qm – Multiplayer agent harness for work

The wire report details a multiplayer agent harness designed specifically for startups called QM. Each employee receives their own isolated workspace, enabling independent work without affecting others, while also allowing collaboration through channels, group messages, and projects. The agent operates within a central core, which can utilize various models and harnesses to generate responses, with a Postgres persistence layer storing user data, session history, and other durable state.

The agent's tool surface is small and fixed, with an execute tool enabling commands in the isolated sandbox environment. The web UI, admin panel, and public portal are optional plugins over the core's HTTP API, with Slack being an optional in-process plugin. The core runs on TypeScript directly on Node, using Fastify for HTTP. The Slack plugin utilizes Bolt, and the web UI is built with Vite and rendered with Lit.

Everything specific to an organization, such as org config, custom tools, sandbox image, and infrastructure, resides in a deployment directory validated and deployed via the qm CLI. The core is designed to be generic, with each substrate (harness, session store, sandbox, memory) interacting through an interface. This allows for easy swapping of production implementations via a single wiring file.

The agent acts as the person it's working for, with their credentials and permissions, and all actions are audited. Organizations can choose a security posture, with predeclared command policies applying universally, including approval rules and hard denials for certain actions. Every deployment runs in the operator's own cloud account, with initialization materializing a deployment skill and walking through various infrastructure and setup steps.

The deployment repository does not generate or enable deployment CI and has no production deployment workflow. The report emphasizes the importance of security, vulnerability reporting, and the availability of QM under the MIT License.