fak — the Fused Agent Kernel

fak turns a tool-using agent into a managed agent.

The agent keeps its interface and model, while a fak kernel manages its model traffic, context lifetime, cache reuse, capabilities, and recovery.

Try the kernel without a key, model, or GPU

Audience: first-time evaluators checking whether fak can manage a tool-using agent.

For the shortest public proof, install the one binary and run one deterministic end-to-end check:

go install github.com/anthony-chaudhary/fak/cmd/fak@latest
fak agent --offline
# -> task completed (booked) YES / YES · poisoned result blocked YES · destructive op prevented YES

Those three verdict rows are the proof: the managed agent still finishes its task while a poisoned tool result and a destructive operation are both stopped at the kernel boundary. Offline mode uses a deterministic mock planner, so it verifies the managed-agent path and the policy boundary without claiming live-model quality or latency.

Next action: run it and check those three rows. For the expanded policy, routing, and benchmark sequence, use the reproduction packet.

One managed agent, two ways to run the kernel

A managed agent pairs Claude Code, Codex, opencode, or your own client—and its chosen model—with fak. The client keeps the task loop and user experience; fak owns the operational boundary around it: what context is retained, what work is reused, which tools may run, what results may return, and how the session recovers.

The roles stay separate: the agent or client owns the task loop and user experience; the fak kernel is the management plane; the model provider or server generates tokens. Change any one without replacing the others.

Default: start with fak guard for one existing agent; choose fak serve when the kernel must be a shared or durable endpoint.

Both commands run the same kernel. guard runs it beside one agent session, as that session's launcher and supervisor; serve runs it as a standalone service. The model remains a replaceable backend—cloud API, local model server, or in-kernel GGUF.

flowchart LR
    A[Agent or client] --> G{How is it managed?}
    G -->|one local session| Guard[fak guard]
    G -->|shared or durable endpoint| Serve[fak serve]
    Guard --> K[the same fak kernel]
    Serve --> K
    K --> M[context + cache + recovery]
    K --> P[capabilities + result admission]
    K --> B[cloud API, model server, or GGUF]

For architecture, current evidence, and development workflow, start at START-HERE.md.

What the managed agent gains

• Less repeated work, safely. fak's core job is to coordinate several caching layers that would otherwise fight each other into one system—on by default, and without changing the model's output: it keeps shared prompt prefixes byte-stable so the provider's cache never busts, sheds stale history before it is sent again, and reuses KV directly when it owns inference. ~4.1× less work than a tuned warm-cache stack (up to 6.95× on larger models).
• Long runs keep moving. Sessions compact their own history (up to ~107K tokens per trim) and can resume after a crash instead of dying at the context limit.
• Policy is on the execution path. Every proposed tool call receives ALLOW, DENY, TRANSFORM, or REQUIRE_WITNESS against a reviewable capability floor—362 ns in process, with no policy model or network hop. Tool results carry provenance too, so poisoned content read from an untrusted source is stopped before the model acts on it.
• Big local models are first-class. The kernel loads GGUF weights itself and serves OpenAI, Anthropic, and MCP clients directly. For mixture-of-experts models (where each token uses only a few of the model's expert blocks), it pages just the needed expert weights in from SSD and stripes weight reads across sources by measured bandwidth—so the whole model does not have to sit in RAM. Quantized (e.g. Q4) inference and grammar-constrained structured output are built in.

Evidence: tuned benchmark baselines · tagged claims ledger.

Manage one local agent: fak guard

Start with the agent you already run—no rewrite, config file, API key, or second terminal:

fak guard -- claude                                  # keep a Claude Pro/Max subscription — no API key
fak guard --provider openai -- codex                 # provider is normally auto-detected
fak guard --policy examples/dev-agent-policy.json -- opencode

Your model wire and credentials pass through unchanged. API billing is opt-in with --api-key-env; a local model with --gguf or --local. On exit, fak reports savings and decisions.

Read: Claude Code walkthrough · Codex · Cursor · all supported hosts · policy guide

Run the managed-agent endpoint: fak serve

Use fak as a shared OpenAI, Anthropic, or MCP endpoint, with reuse, compaction, routing, observability, authentication, and policy in one place.

Front an existing local or remote model server:

fak serve --addr 127.0.0.1:8080 \
  --base-url http://localhost:11434/v1 \
  --model qwen2.5:1.5b \
  --policy examples/dev-agent-policy.json

Or stand alone with GGUF weights—no separate model server:

fak serve --addr 127.0.0.1:8080 \
  --gguf /path/to/model.gguf \
  --model my-local-model

Point OpenAI clients at http://127.0.0.1:8080/v1 and Anthropic clients at the bare host. Use --stdio for MCP or fak node install for an always-on service. Your inference backend stays in place; fak owns cross-request reuse and the agent/tool boundary.

Read: server quickstart · serving architecture and engines · configuration · API reference · deployment

Install

go install github.com/anthony-chaudhary/fak/cmd/fak@latest

Go 1.26+; no external Go dependencies. Source builds, archives, and containers: INSTALL.md.

Going deeper

• Use it: tutorial · integration guides · examples
• Operate it: serving · observability · deployment
• Understand it: performance outcomes and proofs · managed cache · external system architecture · concepts and story
• Verify it: benchmark route · current benchmark authority · claims ledger · reproduction packet
• Build it: contributing · security · documentation home by audience · front-page overflow

Apache-2.0. Please report vulnerabilities privately as described in SECURITY.md.