GraphARC

Python 3.12+ · MIT · built on LangGraph · pip install grapharc

The admission gate for agent graphs.

A planner proposes a subgraph. A deterministic checker admits it — or refuses with reasons. Only then does anything execute. GraphARC is a governed agent runtime on LangGraph: every transition permitted, every loop bounded, and afterwards you can prove what happened and why it stopped.

Get started View on GitHub

One governed GraphARC run A planner proposes a subgraph containing a deploy node. The admission gate rejects it with the reason edge_denied and nothing runs. A second proposal with a patch node instead is admitted; its nodes execute one by one, each stamping its spend on a budget meter, until the run stops with goal met. The rejected round stays on the record. planner admission REJECTED · edge_denied triage$0.0031 pull logs$0.0058 pull metrics$0.0044 correlate$0.0072 patch$0.0049 verify$0.0056 stop: goal_met $0.031 / $0.05

Enforced by the library, not left to convention.

Each of these is a mechanism with a test you can run — not a policy document.

Admission before execution

Every proposed subgraph passes five deterministic checks — registry membership, edge policy, worst-case budget fit, depth, acyclicity — before a single node is built. Work discovered mid-run re-enters the same gate; there is no already-approved path. A rejection is data: codes and remedies handed back to the planner. grapharc run --check-only is the gate as a linter — it executes nothing.

Budgets that bind before the bill

Cost ceilings are checked against a worst-case, execution-frequency-aware estimate before anything runs. Actual per-node spend is stamped on the trace even on error or cancellation — an overspent run still says what it spent. recorded_cost_usd is never an estimate.

One trace file, every answer

Replay, diff, metrics, viz, cost attribution and OpenTelemetry spans all read the same append-only JSONL file. Runs are replayable and comparable, and the dashboard cannot disagree with the audit trail — they are the same record.

Different tools, different jobs.

None of these is a competitor to be beaten. This is where GraphARC sits.

Claude Code

An interactive single-agent coding loop. Permissions are decided live, by you, per action. Superb at its job; not a multi-node runtime. GraphARC's default backend drives the Claude CLI.

OpenClaw

A personal AI assistant gateway. Safety comes from how you configure it. GraphARC borrowed its policy-before-schema tool gating — and put it behind enforcement.

Raw LangGraph

The mechanism GraphARC is built on. It gives you graphs; conventions like write discipline, budgets and admission are yours to uphold. GraphARC upholds them for you and raises when you don't.

GraphARC

The governance layer for multi-node agent graphs: propose → admit → execute → replan, with the refusals on the record.

Zero keys to try it.

The demo planner is scripted, so this run is free, deterministic, and identical on your machine.

$ pip install grapharc
$ grapharc demo stage0          # deterministic DAG, costs nothing, needs no key
$ grapharc plan "investigate the checkout outage"
   round 1: rejected  nodes=2 executed=False  rejected: edge_denied
   round 2: admitted  nodes=3 executed=True

Round 1 wanted to deploy and never executed. Round 2 went through the same checker and ran. Then watch any run redraw live in the browser:

$ grapharc serve --live-root .grapharc   # the live view, self-contained, no CDN
One question in, a governed graph out: a local model proposes the topology, the admission gate and a human approval decide, and the live view shows every node run — amber while executing, green when done.

Measured claims only.

Every claim GraphARC makes is enforced by a test you can run, and its edges are documented rather than denied. The README keeps a Limits section that is re-derived by running each item, not by reading the commit log. A sample of what it says: admission authorises a node's kind, not its arguments; the in-process sandbox is defense in depth, not a kernel boundary — ContainerExecutor is the boundary where one is needed; the HTTP API does not yet use the durable session layer. If a sentence on this page over-promises, the README wins.

Read the full list →