Quox Dev Suite · flagship · The governed agentic loop
Witnessed development. The loop that proves itself.
An autonomous loop you cannot watch is a contractor you cannot call. QLoop is the loop that never runs unwatched: it hands a goal to a model's own native loop on infrastructure you govern, and writes every turn to a tamper-evident chain as it happens.
Included in QuoxCOREFree, self-hosted, nothing to buy.BackendsClaude + CodexEvery turnwitnessedToolsdeny-by-defaultSubstrateAEE · WARD · VOLT · AOCL
In plain words
What it is, where it lives, when to reach for it
- What is it
- A long-running task loop: you give an agent a goal and it works turn after turn, watched and recorded.
- Where do I use it
- On a registered dev host or inside the platform itself, started from your terminal or the dashboard.
- When would I use it
- When any goal needs many turns of unattended work and you still want a stop button.
- How do I use it
- Run
quox objective create "<goal>" --execution-mode loop, then approve the start in your inbox.
Why a knot
One strand. Three junctions. Always watched.
The shape we landed on is the trefoil knot: the simplest loop that cannot be pulled straight into a plain circle. A loop you can trivially untie is just a process that happens to repeat. A knot has structure that holds. That is the difference between an agent that merely runs and one that is governed.
Follow the strand and it returns to itself, but three times it crosses over its own path. Each crossing is a junction: the one place where the loop passes above itself and can be seen whole. That is where the watching lives.
In QLoop the watcher at the junction is the Observer, and the code has always called it by its real name: the Knot. It rides every turn, and when the loop starts to wind on itself, the Knot is what pulls the thread and stops it.
In plain words: QLoop runs one long task through Claude or Codex, turn after turn, recording every turn and keeping human stop controls. The goal can be anything you can give an agent: shipping a feature, triaging an inbox, working through a backlog.
Deny-by-default tools. A human halt with real teeth. Autonomy you can audit. The trefoil is that architecture drawn honestly: a single autonomous loop, knotted so it cannot slip its own governance, witnessed at every crossing.
How the loop runs
Six moments, each one governed
A loop is the highest-stakes thing on the platform: unbounded autonomous change. So every moment of it is gated, scoped, witnessed, or remembered.
A goal, handed to a real loop
You create an Objective in loop mode and it always waits for a pre-start human approval. On approval a signed job is delivered to a governed fleet dev server, where a model runs its own native loop, not a pre-decomposed task DAG: just the goal and the tools.
Deny-by-default tools
The loop can only touch the tools you named. Reaching for anything else is interrupted and written down. Proven live: a run that reached outside its scope was stopped with a witnessed out-of-scope finding. Where a backend cannot honour a pattern, the scope fails loud instead of silently widening.
Every turn on a tamper-evident chain
Each turn is hashed into a WARD chain as it happens, carrying the turn sequence and a content hash. Tamper with a stored turn and the chain stops verifying. A 19-turn run landed all 19 turns on an intact chain, each entry recomputed and linked to its predecessor.
Checkpoints while it runs
Live gates fire during the run, not just before it: a budget threshold pauses the loop for a human approve, an interval gate checks in every N turns, and a deny fires the same signed kill as a halt. Budget, interval, approve and deny are proven on the fleet; the risk gate is unit-green.
A human halt with teeth
You can stop a running loop at any moment, with no waiting for a gate to happen to be pending. The halt fires a signed kill that reaches the fleet host and ends the process, the turn sequence freezes, the objective fails, and the reason is witnessed.
The run becomes memory
A finished loop is not discarded. Its outcome is recorded and reflected on through the same QuoxMind path every governed objective uses, and a scoped loop can author a real skill through the same governed chokepoint a human author passes. The loop leaves the platform smarter than it found it.
autopilot, watched
The loop that never runs unwatched.
QLoop hands a goal to a model's own agentic loop on infrastructure you govern, and writes every turn to a tamper-evident chain as it happens.
The proof, in the raw
A real loop, stopped on command
Not a diagram. A loop running on our own dev VM, halted mid-run with no gate pending. The kill lands on the host, the turns freeze, the run fails, and the reason is witnessed.
# loop alive, mid-run, no gate pending >>> ALIVE at seq/count=2 status=running -> POST /api/objectives/…/halt # the governed signed-kill lands on the fleet host >>> HALT RESPONSE: {"status":"halted","interrupted":true,"objective_status":"failed"} seq at halt: 3 · 6s after: 3 · 16s after: 3 # turns FROZE objective final status: failed interrupt envelopes witnessed: 1 error_message: "Loop halted on demand"
Backed by unit and regression tests and a witnessed evidence trail. The deny path shares the same teeth. This is what "autonomy you can audit" means: the stop is real, and so is the record of it.
19 of 19 turns, intact
A 19-turn run produced 19 turn envelopes and 19 chained WARD entries. Every chain hash was recomputed from the formula and every entry links to its predecessor.
A deny that kills
A checkpoint deny fired a signed kill at a loop mid-run. The process ended, the turn sequence froze, the objective failed rather than completed, and the interrupt was witnessed.
The loop authored a skill
A loop scoped to the skill tools drove Claude through the governed chokepoint to publish a real skill, tagged self-authored with its loop session, firewall verdict clean.
Same seam, second backend
The Codex backend authored a skill through the identical chokepoint, keeping its sandbox and its own reviewer, with no bypass flags. One seam, two vendors, same governance.
Every identifier above is a real object on the dev fleet, verified against the database rows and the WARD chain by the reviewing session, not taken from an implementing agent's report.
Self-extension
The loop that writes its own tools, under governance
A QLoop run can author a real skill for the platform, and it does so with no special privileges: the machine author walks through the same door as a human one, and both backends have done it live.
The same chokepoint as a human
A loop-authored skill enters through skill_manage like any human submission: firewall checks before persistence, an LLM safety judge on schedule, and provenance tags naming the loop session that wrote it. There is no side door for machine authors.
Skills start experimental, and stay there until a human says otherwise
An authored skill lands in edition=experimental no matter what the caller asks for, and promotion to stable needs human approval. Voyager and Hermes style skill writers keep whatever the model wrote; QLoop will not promote its own work. Crystallising automatically on measured outcomes (three or more real runs at eighty percent success) is the planned next step and is NOT shipped: nothing today promotes a skill on its track record.
Backend-neutral by construction
The scope is authored once and translated per backend through one vocabulary layer, and the skill format is shared. Swap the model vendor and the governance, the evidence and the skill library all survive the move.
The substrate
Four protocols under every run
QLoop is not a loop with logging bolted on. It sits on the same evidence substrate as everything else in Quox, and a single live run has been proven to speak all four.
Envelopes with causality
Spawn, every turn and interrupt travel as AEE envelopes, so each event names what caused it and what it answers.
The tamper-evident chain
Each envelope is hashed into an append-only chain. Verification is recomputation: change a stored turn and the chain breaks.
A run you can bundle
The loop emits a VOLT run: started on spawn, an event per turn, completed on done or interrupt. The whole run travels as one evidence object.
Classified in the audit stack
Runs are classified at the orchestration layer of the AOCL audit model, so a loop shows up in the same audit view as every other governed action.
And the evidence is not a filing cabinet. Witnessed outcomes already feed an agent trust score that gates autonomy and a live consistency check, with precedent citation next: the write path and the gate logic are proven, the full model-driven loop is waiting on an inference provider in the running stack.
One concept, two shapes
Reviewable plan or adaptive loop. Your call.
The same governed Objective runs either as a task plan you approve up front, or as a native loop governed turn by turn. Tools built around a loop alone cannot offer the first; tools built around plans alone cannot offer the second.
DAG mode: plan first, then run
The classic governed objective: work is decomposed into tasks you can read, approve and audit before anything executes. Right for work you can specify.
Loop mode: the model drives
The same Objective hands the goal to the model’s own loop and governs it turn by turn instead. Right for work that needs judgement mid-flight. Loop-only tools give you only this half.
Why it is different
Everyone else treats the run as exhaust
Run history as exhaust
Native agent loops, OpenHands, Voyager-style skill writers: they run, and the history is a log you hope to keep. In our own read of twelve loop systems, eleven carried zero cryptographic tamper evidence on the artifact their learning writes to.
Run history as evidence
The loop is built on the evidence substrate: AEE envelopes, WARD witnessing, VOLT bundles. Every turn is on an intact chain, and the chain is spent forward, into trust, policy and consistency, not just kept as backward-looking proof.
Witnessing needs the whole stack
A competitor can log turns. Making the log tamper-evident and policy-bearing means rebuilding the evidence layer underneath the loop: envelopes, chain, bundles, audit stack.
A watcher that leaves receipts
Stuck detection exists elsewhere as a private heuristic inside the process. QLoop’s Observer reads turns that are already witnessed evidence, so an interrupt is itself a witnessed act.
Evidence spent forward
Witnessed outcomes feed trust scores that gate autonomy, precedent that future runs must cite, and a live contradiction check. Loop-only tools have nothing to spend.
The "eleven of twelve" figure is a competitive-research finding from our own loop study, not a QLoop runtime measurement. The per-turn witnessing is the runtime fact.
How we know
Driving it is the QA
Every claim on this page was earned by running the real thing on a real fleet host, not by reading green test suites. That discipline found ten defects the suites could not see, from a tool bridge that hung the loop on a closed pipe to a turn counter that killed runs mid-answer, and each one was fixed with a failing test written first.
It also cut the other way. An honesty pass caught our own "every turn witnessed" line as an overclaim: at the time, only the session lifecycle was on the chain. So per-turn witnessing was built, driven, and proven with a 19-turn run before the claim went back up.
The page you are reading is downstream of that process: what is stated is what survived it, and the limits band below is what did not, yet.
Honest limits
What is solid, what is beta, what is planned
Straight from our internal status tracker for this surface. We would rather you trust the green than be sold the grey.
- The native agentic loop runs on a governed, signed-capability fleet host, on both Claude and Codex, through one seam
- Every turn is WARD-witnessed on a tamper-evident hash chain (built after an honesty pass caught the claim as premature, then proven: 19 of 19 turns on an intact chain)
- You can WATCH the evidence, not just trust it: a scrubbable replay of a finished loop reconstructs what it believed at any point in time, with the causal chain of envelopes behind each moment
- Deny-by-default tool scope, the pre-start human approval, and live budget, interval and approve gates
- A signed kill that stops a live loop: deny and on-demand halt both proven on the fleet, the process ends, the turns freeze, the objective fails, the reason is witnessed
- Self-extension: a scoped loop authored a real, firewall-checked skill through the same governed chokepoint a human uses, on both backends
- All four protocols on a live run: AEE envelopes, per-turn WARD, a completed VOLT run, AOCL classification
- Loop outcomes recorded and reflected on through the same QuoxMind path as every governed objective
- Budget enforcement that confesses: a loop killed for exceeding its turn or time budget now writes a system/budget_kill event into its own witnessed stream before dying (built after two silent budget kills spent an evening disguised as crashes, 2026-08-16)
- Core-local loops: a loop can run host-less inside the platform itself, no enrolled dev server required, through the same evidence path with identical witnessing (proven live 21 Aug 2026)
- The Observer’s stuck and oscillation verdicts: the interrupt path is proven, but the verdicts have not yet fired on a genuinely wedged live loop
- Skill lineage from a loop-authored skill: shipped, not yet driven end to end
- The risk checkpoint gate: unit-green, not yet triggered by a live risky call
- Codex scope nuance: Codex’s native tools sit outside per-tool scoping, so patterned scopes are rejected loudly for Codex rather than silently widened
- The dashboard halt button: shipped in the dev.sessions panel, wired to the proven halt route; the click itself has not yet fired on a live running loop
- Precedent as binding policy: the write path and the gate logic are proven against real data, but the full model-driven citation loop is blocked on an inference provider in the running stack
- Fully autonomous, "no human required" self-build: the north star, deliberately not shipped. The pre-start human approval is by design
- 01M02SV9…VQRC013:30 UTC31turns streamed0stderr bytesOBSERVEscopecleanteardown
- 01M02W0B…N4MRN14:10 UTC126turns streamed0stderr bytesOBSERVEscopecleanteardown
- 01M040GG…73AVY78 turnsno result event
- 01M040RT…N4MRN32 turnsno result event
The mission tried a write the session sandbox blocks, and burned its turn budget retrying. The budget backstop then stopped the process, so no terminal result event was emitted. Not a model crash, a budget limit firing mid-work. Fixed the same night.
How you get it
You do not buy the flagship. It comes with the ship.
QLoop is platform core
QLoop ships with the QuoxCORE platform rather than as a separate SKU, and the platform is free during the public beta. Stand it up on hardware you already own, bring your own LLM key, and the loop, its gates and its evidence chain are there.
The rest of the toolbox
The instruments around the loop, the plan, the proof, the verdict, the slots and the rest, ship as the Dev Suite bundle at $169 in the store, against $212 buying its nine members solo. QLoop itself is not one of them: it is core, and it comes with QuoxCORE.
QLoop
Autonomy you can audit
Part of the Quox Dev Suite. Every build, loop turn and deploy leaves a receipt on a chain you can verify.