Libero runs one shared session per channel — not one per user. It holds no credentials, calls only the tools that channel’s team sheet allows, and stops for a human click before anything destructive. Self-hosted, MIT, model-agnostic.
Not deployable yet. Phase 0 is the skeleton — see the roadmap for what lands when.
Two processes. The gateway and agent talk to Slack and run the model loop. The tool proxy holds every credential and decides what each channel may do. They speak over mutual TLS on a private network, and the only thing that crosses is a tool call and its result.
That split is the whole design. Enforcement is a deterministic lookup against a file in your git repo — not a paragraph in a system prompt asking the model to behave.
Credentials are encrypted at rest in the proxy and referenced by name in team sheets, logs, and errors. The proxy injects them into the outbound call and scrubs known secret values out of the result before it crosses back. Compromise the agent — prompt injection, a bad skill, a misbehaving model — and you get zero credentials.
Every call resolves against the channel’s team sheet in the proxy: is this server allowed here, is this tool listed, is the destination on the egress allowlist. A refusal is a structured result the agent relays. The model’s cooperation is never part of the enforcement path.
Tools marked approval = "required" are held in the proxy while an Approve / Request changes card renders in the thread. Approvals are per-call, recorded with the approver’s Slack user id, and expire in 15 minutes. Destructive verbs — delete, drop, transfer, deploy — default to required.
Tokens and tool calls, per channel per day. The agent loop caps itself too, but the proxy’s meter is the authoritative one. A soft limit warns in-thread; a hard limit stops the loop until an admin resets it or the day rolls over.
Timestamp, channel, requesting user, task id, tool, server, argument hash, result status, tokens, and the approver if there was one. Append-only SQLite with no UPDATE or DELETE grant for the service role. Query and export it with libero audit.
Channel state — history, curated memory, skills — is a SQLite file scoped to that channel. The file-per-channel layout is the isolation boundary, so there is no schema or query that can join across channels by accident.
We call it the channel’s team sheet — the sheet a manager submits before a match declaring who is allowed on the pitch, what position they play, and what needs the gaffer’s sign-off.
Nothing in it is a secret: credentials are names, resolved only inside the proxy’s vault. Changes are picked up on file change and validated against the schema; an invalid sheet is rejected loudly and the previous valid one stays active.
There is no web admin UI, and that is deliberate. The files in git are the admin UI — reviewable, diffable, revertable.
# Nothing here is a secret. Credentials are names,
# resolved only inside the proxy's vault.
[budget]
daily_tokens = 2_000_000
daily_tool_calls = 400
[[mcp_server]]
name = "github"
credential = "github_service_account"
# Tools not listed here do not exist
# as far as this channel is concerned.
[[mcp_server.tool]]
name = "list_prs"
[[mcp_server.tool]]
name = "trigger_workflow"
approval = "required"
[egress]
allow = ["api.github.com"]
[ambient]
enabled = false # off by default, alwaysColour means one thing here, and it is always status. Every row below is also a line in the audit log.
Requested by @alice in #engineering. The team sheet marks this tool approval = "required", so the call is held in the proxy until someone approves it. Whoever clicks is recorded in the audit log.
The phases are gated on purpose. Nothing that depends on the proxy ships before the proxy can be attacked and hold.
A prompt-injected agent in a test channel cannot exfiltrate a secret, call an unlisted tool, exceed budget, or act destructively without a human click — demonstrated by e2e tests that try.
Monorepo, schema package, design system, site, CI with the license gate and boundary checks, CLI placeholder on npm.
Slack gateway, vault, team-sheet enforcement, approval cards, budget meter, audit log — and the e2e suite that attacks all of them.
Curation inner loop, MEMORY.md tooling, semantic recall, Slack-deletion mirroring.
Author turn, retrieval-based loading, lifecycle job, curator-as-diff.
Heartbeat evaluation and scheduled tasks, disabled by default, behind the budget meter.
Discord adapter, durable orchestration, proxy hardening, audit hash-chaining.
It is the design of record, it is ahead of the code, and it says which parts do not exist yet.