Swamp Go Brr

An autonomous, driver-free development loop for coding agents. You hand it an intake and a host-pinned test command; it decomposes the work into a dynamic DAG of tasks, runs each task as a claude --print agent inside a throwaway Firecracker microVM, applies only the returned diff behind an allowlist ACL, and merges a task ONLY when a deterministic, network-less container says the tests pass. Nothing the agent writes ever runs on your host, and the green gate is the container's exit code — never the agent's self-report.

Five models:

• gobrr — a PURE DAG state machine: a Run aggregate over a dynamic Task DAG (implement | verify) with a scheduler (lease TTL/heartbeat/reap, concurrency gate, stall), dynamic follow-up expansion, a state machine, and run caps. It never touches the filesystem.
• source-integration — the host code-ownership / allowlist-ACL actor: build_workorder (read the allowlist file slice into the leaf prompt, no-clone) and apply (parse the @@EDIT envelope, apply each task as a per-task base-isolated jj change behind a realpath-anchored allowlist ACL, return host-observed changedPaths + a secret-scrubbed diff).
• docker-verify — the deterministic green gate: runs the host-pinned verify command to completion in a hardened, network-less, token-less container against the read-only applied tree and returns the raw exit code.
• preflight — codebase-agnostic substrate setup: ensures the local OCI registry, digest-pins the codebase's OWN gate image (pin_image builds a build context or pins a prebuilt ref — the toolkit/deps live in that image, not here), and emits the run config (gate params, fabric_up inputs, the vault CEL for the OAuth token, and the si/dv/fab create commands). Shells to docker only.
• otlp-export — the post-run OTLP egress actor (the loop's ONLY network push; gobrr stays pure): POSTs the derived traceOtlp/metricsOtlp to a configurable OTLP/HTTP collector (https), endpoint + token from a vault CEL, best-effort. gobrr's emit_otlp derives the OTLP span tree + per-leaf token/cost/time metrics; leaves run with outputFormat=json so claude's usage rides back. Each leaf runs claude --print in a Firecracker microVM via the @magistr/firecracker fabric (no-clone). The agent drives the loop inline (next -> build_workorder -> fabric.submit/poll -> apply -> docker-verify -> report); there is no driver script.

Getting started: install the bundled swamp-go-brr skill and let the agent drive the loop — confirm the repo scope, the verify command, and the verify inputs, then it decomposes, runs, gates, and reports. The README has a tutorial, how-to recipes (per-leaf cost/tokens/time, OTLP export, resume/inspect, concurrency), a model reference, and the design rationale.

Release 2026.07.16.2 — align model versions with manifests

Maintenance release across the @magistr extensions. For most packages this carries no functional change: the only edit is the model's version: field, brought back in line with its manifest version so the published model type version and the package version no longer drift.

Functional changes in this release are limited to:

• anime-cron: normalizeTitle now strips a ": subtitle" suffix and a trailing parenthesized year before comparison, fixing dedup false-misses where the torrent title carries a subtitle or year that the AniList romaji does not.

• arckit: first publish. Standalone ArcKit port — a 12-phase architecture governance state machine with 65 bundled templates, driven by a bundled skill.

Also tracks three extensions (kaiten, observability-agent, music-library) that previously existed only as untracked working-tree directories, recovered from stashes.