Olivares AI v26.8.0 is the first public, tagged release of a self-hosted Go binary that gives the AI agents you already run — Claude Code, Codex, Grok Build and the rest — durable work, scoped access and signed evidence, on your own hardware. I am the author. This post is an inventory of what is real on the tag, with the gaps stated next to the features, because for a product in this category the gaps are part of the specification.
1. The problem, without adjectives
Agents run across machines and vendors. Nothing durable knows who holds a piece of work, what each agent may reach, what it actually reached, or who handed off to whom. The grants live in several IAM systems; the behavior lives in audit logs nobody reads. Every team running agents seriously has rebuilt some fraction of the answer by hand — a spreadsheet here, a naming convention there, a person who remembers. That fraction is what this product replaces.
2. The core: a work plane agents share
Durable work items carry a brief, dependencies, acceptance criteria, decisions, an owner and an event history — one command document shared by REST, the CLI and in-process callers. Leases make ownership a fenced, expiring authority: acquire, renew, release, take over, revoke; a stale holder cannot keep acting, and concurrent acquisition yields exactly one winner. Launch-for-work reserves, takes the lease, then spawns the session, so a retry is safe. Messages between agents carry acknowledgments and handoffs, with replay and stale-epoch rejection. Delegation over A2A reaches an authorized peer through an enforcement gate and returns durable receipts.
All of that is live. And here is the boundary, stated as plainly as the features: messaging is scoped to an orchestration workflow — there is no general message bus for arbitrary agents, deliberately, and a boot test fails if anyone wires one by accident. Shadow mode and final authority are not built. The README carries both halves in the same table.
3. Integrations, with their depth stated
Claude Code is integrated at the PreToolUse/PostToolUse hook, with managed
settings, console launch/attach/stop and per-subject model access. Codex and
Grok Build are first-class command surfaces alongside it. gemini-cli, Cursor,
opencode, goose, cline, OpenHands, OpenClaw and Hermes ship as connectors —
and each one states what it can enforce versus what it can only observe,
because those are different promises. Ollama and other self-hosted endpoints
are inventoried through a local connector that is read-only by design.
4. Governance where the agent acts
A Cedar authorization engine — RBAC, a deny-overlay, positive scoped grants —
and four deny-closed enforcement points: the Claude Code hook, an inline
/v1/messages inference proxy, an MCP tools/call gate, and an A2A
delegation gate. A disallowed action is blocked, sent to a two-person
approval, or rewritten before it runs. “Deny-closed” is measured, not
asserted: a point counts only while a test drives its unconfigured path and
asserts the refusal. Where a point is not provisioned, the capability is
carried as observation, not enforcement — and every connector states which of
the two it is. Two-person approvals, break-glass,
and an estate kill-switch that takes one click to engage and two distinct
humans to re-enable.
5. Evidence you can hand over
An append-only, hash-chained audit ledger with Ed25519-signed checkpoints. Exports in CEF, LEEF, syslog, OTLP and OCSF; at-least-once push to Splunk HEC, Microsoft Sentinel, Datadog, New Relic, or an HMAC webhook. Compliance evidence mapped to 26 framework catalogs — technical control mappings and evidence packages for your counsel or auditor to review, not certifications, and the product’s own catalog says so.
6. Numbers, and the script that produces them
30 modules. 158 integrations. 26 framework catalogs. Four deny-closed
enforcement points. 68 grouped CLI commands. None of these is marketing
arithmetic: scripts/check-public-counts.sh derives the first four from the
tree and fails the build when the README drifts from the code, and the CLI
total is held by a test that refuses to let a command land ungrouped. The
integration count is
honest about its unit — connector directories containing Go code, twelve of
which are shared contract packages rather than capabilities, and the breakdown
is in the repo. The demo estate returns 20 nodes, 13 edges, 8 unexpected
accesses and 2 unused grants — synthetic numbers, asserted by a smoke test
against the
real binary, cited as demo output and never as customer scale.
7. One build at every size
The same binary serves a home server (SQLite, loopback-bound, a reference Compose that runs non-root and read-only in 1 CPU and 1 GiB), a freelancer with a tenant per client and budgets that deny before the invoice does, an engineering team with shared work items and SSO, and a regulated enterprise with Postgres row-level security, air-gapped installs and WORM archival. Several of those capabilities are things you provision, not defaults you get on first boot — and the docs say which, per capability.
8. License and money, plainly
AGPL-3.0 for the core, the modules and the web console; Apache-2.0 for the SDK, connectors and client SDKs; a small set of additive commercial add-ons, built only with a separate build tag and absent from the public binary. The open build is the whole platform — never feature-capped, unlimited user accounts. A commercial license is a legal exception to the AGPL; a subscription is the credential you download signed artifacts with, not a key that activates bytes already sitting on your disk. Commercial terms are on request: enterprise@olivares.ai. Hosted Cloud is not for sale today; self-hosted is the product.
9. Supply chain
Releases are cosign-signed with SLSA provenance, an SBOM and OpenVEX, all
verifiable offline with scripts/verify-release.sh. Artifacts: linux and
darwin binaries (amd64/arm64), .deb/.rpm/.apk packages with a hardened
systemd unit, a multi-arch container image, and an air-gap bundle. Windows is
not built — run the Linux container or build from source.
10. What we refused to claim
No users and no benchmarks — there are none public, and inventing either is
the worst thing a governance product could do. No SLA, no SOC 2, no
certifications. No “nothing ever leaves your network”: closed frontier models
are not self-hostable, so inference against them still reaches the vendor’s
API — what is self-hostable and air-gappable is the plane around them, and
models you genuinely run yourself (vLLM, Ollama) keep the whole path inside.
There is no mandatory telemetry and no control-plane egress by default; the
one vendor call is olivares upgrade, which asks where the new version is,
and --endpoint redirects it. No remote kill switch. No seat cap in the
self-hosted engine.
Try it
# Demo estate — synthetic data through the real engine, loopback-only:
task build && ./bin/olivares serve --seed-demo --insecure \
--listen 127.0.0.1:8901 --grpc-listen 127.0.0.1:8902 --data-dir "$(mktemp -d)"
# Real install — secure by default (TLS on, loopback, one-time setup token):
./bin/olivares quickstart
# Or the container image (registry tags carry no v prefix):
docker pull ghcr.io/olivaresai/olivares:26.8.0Read start/honesty-and-limits before you deploy — it is the contract for
what runs today, what is design-stage, and what the product deliberately does
not do.
Release: https://github.com/olivaresai/olivares/releases/tag/v26.8.0 · Repo: https://github.com/olivaresai/olivares · Docs: https://docs.olivares.ai