What you can build with Jikji
Each pattern maps to checked-in configuration, commands, or evidence in the repository. Deterministic mechanisms are separated from provider-dependent live runs, so you can see exactly what was exercised and what still depends on your environment.
Start from a worked path, not an empty framework
This curated catalog separates supported integration paths, worked mechanisms, operator references, and research evidence. Each link opens the relevant public mechanism or operational evidence on this site.
| Example | What the evidence covers | Evidence · support tier |
|---|---|---|
| agent-cli-backbone ↗ | HTTP MCP from a coding CLI into a five-vendor trinity.ensemble, Oracle, and durable child runs. | Documented live qualification · integration path |
| trinity-council ↗ | Candidate fan-out, synthesis, verifier voting, and the accepted answer preserved for inspection. | Runnable example · mechanism |
| taskgraph-orchestration ↗ | Dependency-aware durable sub-agents, concurrent waves, and file-conflict serialization. | Runnable + worked artifact · mechanism |
| dispatch-queue-worker ↗ | Durable queue claims, leases, completion, and worker restart behavior. | Worked artifact · mechanism |
| production-hardening ↗ | Fail-closed auth, TLS, policy, audit, redaction, recovery, and telemetry controls to qualify in your environment. | Checklist + config · operator reference |
| ha-multi-node ↗ | Shared PostgreSQL, leader election, readiness, draining, and a multi-node topology. | Config + procedure · deployment reference |
| coding-debugging ↗ | Hash-checked anchor edits, a compiler-grade code.check gate, symbol rename, and shell tests — a coding agent held to a measurable acceptance KPI, not vibes. | Runnable + worked artifact · mechanism |
| observability-tracing ↗ | OTLP traces over gRPC or HTTP with W3C trace-context propagation and head sampling, correlation IDs through the request path, and structured access logs. | Checklist + config · operator reference |
| approval-gates ↗ | A dedicated authorization plane evaluates tenant, principal, action, and tool context into allow, deny, or ask, each carrying a recorded reason. Tool executions land in a structured audit trail; full decision auditing — denials and asks, or every decision — is a configurable mode, and the trail can be HMAC hash-chained so tampering is detectable. | Deterministic mechanism · operator pattern |
| backup-restore ↗ | SQLite VACUUM INTO, integrity verification, content-hash evidence, and a restore drill that proves the recovered database contents. | Runnable procedure · operator reference |
| audit-tamper-evidence ↗ | A keyed hash chain detects modified, deleted, or reordered audit records and reports the first broken link. | Runnable verification · security mechanism |
| relay-secure-cluster ↗ | Ed25519-signed join, one-time scoped bootstrap credentials, renewable leases, and stable-key reconnect for remote tool nodes. | Example config + full-source qualification · operator pattern |
From a chat call to a goal-driven run
Start where you are — a drop-in OpenAI-compatible endpoint — then grow into goal-driven runs and multi-model reasoning without changing stacks.
OpenAI-compatible chat
Point an existing OpenAI client at Jikji: POST /v1/chat/completions, non-streaming or SSE stream. Swap the base URL and keep your code.
Goal-driven agent runs
Turn a goal into a checkpointed, replayable run with jikjictl run and POST /v1/runs, streamed step by step — the deterministic forme loop, not an opaque chain.
Multi-model reasoning
Run a swarm debate, a compare-with-judge, or an agent loop across several models at once — pick the strongest answer, or have a panel verify it.
Discover & call tools
List the agent's tool catalog and invoke any of them directly with POST /v1/tools/call — the same tools the loop uses, available over the API.
Custom Lua & Python tools
Register your own tool as a Lua script or a Python run(input) function and it joins the catalog — no rebuild, gated like any built-in.
Read, query, and compute — under governed execution
Give an agent real capability without giving up explicit boundaries: file, query, and command tools pass through policy gates, while OS-level sandbox strength depends on the selected runner and host platform.
Workspace file tools
Scope an agent to a set of roots and let it read, search, write, and list files — path-guarded so it never escapes the workspace you grant.
Governed SQL access
Expose a SELECT-only SQL tool with a layered, per-tenant access policy — the agent queries data it is allowed to, and nothing else.
Palantir-style data pipeline
Combine an ontology, a SELECT-only SQL query, an intermediate cache, and extension.python (numpy/pandas) analysis into one KPI-gated pipeline — data, cache, and analysis in a single loop.
Type-aware coding & debugging
Hash-checked anchor edits, a compiler-grade code.check gate, symbol rename, and shell tests — a coding agent held to a measurable acceptance KPI, not vibes.
Long-horizon work that survives a crash
Structure ambitious work as measurable goals and durable queues, then stack primitives on one recoverable harness.
Goal hierarchy with real KPIs
Build a nested goal tree with measurable KPIs (the "paperclip" pattern): mechanical acceptance, evidence, and an observedGeneration staleness gate so a tightened target can't be falsely satisfied.
Composable mechanisms
Stack the primitives: goals + a dispatch queue + trinity.ensemble (verifier-gated multi-model) + trinity.oracle (drift check), all on one durable harness.
Queue-driven autonomous work
Enqueue work items and run a worker loop that drains and exits — or waits forever with --keep-waiting. Durable, claim-safe, restartable.
Scheduled autonomous jobs
Cron and interval jobs that emit orchestrator commands, tools, queued work, or notifications — at-most-once and crash-safe across restarts.
Many execution surfaces, one gate
Route tools across named surfaces — local shell, python, browser, remote tool-nodes with docker or ssh sandboxes — all under one gate chain, from laptop to cluster.
Ride out a usage limit
Hit a provider or ChatGPT-subscription usage limit (429/529)? Jikji reads the real reset window — including codex's 5-hour and weekly windows — and resumes instead of failing. An interactive run waits it out with --wait-on-rate-limit (bounded by --max-wait, 6h default); dispatched agent and plan runs resume unattended from their last checkpoint when the window resets (rate_limit_resume: park) — no client needs to stay connected.
Grounded, cited, adversarially verified
Make an agent cite captured pages and derive violations from evidence — answers you can check, not confident guesses.
Grounded web research
Search, open, read, and save sources, then tie every claim to a captured page with research.source — cited to real pages, not training data.
Mechanical invariant review
Assert predicates, supply measured observations, and derive violations fail-closed — materializing a contradiction graph instead of asking a model to "check."
Adversarially verified writing
Write an engineering paper where every claim is a KPI: an ambiguity gate, goal claims, web sources, system.review, and a trinity ensemble/oracle pass before it stands.
Native ontology & knowledge graph
Build and serve ontologies natively — TTL, SPARQL via lexicon.query, and semantic ontology.search — a knowledge layer the loop reasons over directly.
Interoperate over MCP, ACP, and A2A
Expose Jikji as a server other systems already know how to call — MCP, ACP, A2A — and connect the channels your users live in.
MCP server
Expose Jikji's tools as a Model Context Protocol server over stdio or HTTP — any MCP client drives them directly.
ACP over stdio and HTTP
Use stdio JSON-RPC for local ACP clients, plus an HTTP manifest and invoke surface for remote integrations.
Agent-to-agent registry
Discover and watch agents in the A2A registry over gRPC — the substrate for agents that find and call each other.
Telegram bot → agent runs
Run a Telegram bot that turns every message into an agent run — streamed replies, slash commands, right where your users already are.
Codex Responses through device OAuth
Use a configured Codex Responses model through ChatGPT device OAuth. Requests consume the user's subscription quota and remain subject to the provider's terms, model availability, and rolling usage windows.
Intelligence backbone for your app
Run Jikji as a dedicated reasoning backbone for a separate application: your app owns its data and read-only tools, POSTs a deterministic scenario to /v1/runs, and Jikji calls back into those tools over an MCP subprocess declared under sorts.mcp_servers — every call gated and audited. Your app never imports Jikji or embeds an agent framework; it stays a plain HTTP client.
A cross-vendor council your coding CLI can't run
A coding CLI (Claude Code, Codex) has its own sub-agents — but they are all one vendor. For a high-stakes call — a security audit, an architecture choice — it attaches a running Jikji over /v1/mcp and puts the question to a cross-vendor, policy-gated, audited, verifier-voted council (trinity.ensemble): distinct-vendor models answer, a panel votes ACCEPT/REVISE, a synthesizer fuses the survivors. Also trinity.oracle (drift check) and agent.spawn. Worth the MCP hop for consequential decisions, not routine coding.
Run it as a service, for many users
Serve isolated tenants from one deployment: per-key scopes, deny-by-default tool boundaries, and a marketplace to distribute what you build.
Per-tenant keys & scopes
Issue per-tenant API keys, scopes, and role bindings with jikjictl rbac — one deployment, many isolated users, each with their own reach.
Tool-boundary RBAC
Require scopes per tool, deny by default, and roll authorization out safely with a staged observe → warn → enforce path plus preflight — tighten without breaking traffic.
Publish & install packages
Package a registered tool or agent, publish it to the marketplace, and install it on another tenant — signed, versioned, one command to adopt.
Each example is one movable piece. The real leverage is stacking them — a goal hierarchy that drives a dispatch queue, worked by a verifier-gated council, citing web sources and gated by a mechanical review. Pull the ones you need, set them precisely, and press.