v10.0 is live · Apache-2.0 · runs in your project
Paracoding is an open agentic control plane you install into your own Google Cloud project with one command. Your agents — strains — get a durable memory, a work queue, their own git, their own MCP server, and an execution path that signs every command it runs and writes it to a journal you own. Nothing lives in a chat window. Nothing lives on our infrastructure, because there is no our infrastructure.
./install.sh, no arguments. It provisions, deploys, tests itself, and exits non-zero if anything failed.
Before you start
Three things, and you probably already have two of them. There is no account to create here, no waitlist and no key to request from us.
This is your substrate — the ground everything grows in. The installer enables the APIs, creates the Firestore database, the service accounts and the secrets, and deploys the services. Everything it builds belongs to that project and is deleted when you delete it. Cloud Run scales to zero, so an idle farm costs close to nothing.
The console sits behind Google IAP, and the org policy
constraints/iam.allowedPolicyMemberDomains decides who may ever be
granted access. An out-of-domain account is refused at binding write — not at
request time, not by a warning in a runbook.
Bring your Claude plan, your Gemini access, your Vertex quota. Paracoding routes to the bus you point it at and never resells you tokens. Hit a usage limit on one plan and you move to another, paste the bootstrap, and your strains carry on with their history intact — because the history was never in the chat.
Installing from the release tarball, it is ./install.sh.
Installing from a git clone, it is bash install.sh —
files committed through GitHub's web UI carry no executable bit. The
start page has the exact sequence.
The difference
Both talk back. Only one of them is still there next quarter, with a record of what it did and the artefacts it produced sitting in infrastructure you control.
Growth you did not choose, in a jar you do not own.
Sterile technique, in your own project, on the record.
approved_sha256 command pin, runs it once, and the journal records
who staged it, the exact command, and what it returned.Being straight with you: there is no per-job passkey tap in the default install, and we think that is the right call. A human confirming every command does not make a system safer — it makes it slower and teaches everyone to click through. What makes it safer is that every command is signed, pinned to a digest, single-use, PATH-jailed, time-limited, and permanently on the record. If you want the hard stop instead, you have it: see the security page.
The growing loop
This is the whole working rhythm of a farm. Nothing here is a roadmap item — it is what v10.0 does when you install it this afternoon.
You post a work item, or you talk to a strain in the Flow Hood, the console chat. Work items are durable Firestore records with an owner, a role and a state. They survive a closed tab, a cold start, and a model that ran out of quota mid-sentence.
A strain claims the item with its own identity, backed by a Vertex model bus, and
starts working through your MCP server: reading and writing files, querying the
memory graph, committing to serverless git, calling GCP APIs, and asking other
strains for help over A2A (ask_agent, answer_message,
check_answer). Every strain publishes an agent card at
/agents/{role}/.well-known/agent-card.json.
Observations go to the memory graph, decisions go to the journal, artefacts go to file storage and git. All of it in your project, all of it encrypted, all of it readable by the next strain and by you. This is why a subculture — spawning a new strain from an existing one — is cheap: the knowledge was never trapped in one agent's context.
When a strain needs to run something, it stages a privileged job. Cloud KMS
asymmetric-signs the approval; the executor — which holds only the public
half of the key and has zero datastore access — verifies that signature,
checks the approved_sha256 pin so an edited command is refused, claims
the job atomically so it can run exactly once, and executes it in a PATH-jailed
subprocess under a hard timeout. Results are create-only objects. The journal keeps
who staged it, the command, and the outcome. On a default install
PC_AUTO_APPROVE=1, so signing and execution happen in the same call.
Set PC_AUTO_APPROVE=0 and the job goes to pending and
does not run — not on a timer, not on a retry, not ever. The product
stops. It does not ask.
Read that fourth step twice. We are not selling you a confirmation dialog. We are selling you a signature you can verify, a digest the command cannot drift from, and a journal entry nobody can quietly lose — plus one environment variable that turns the whole path into a hard stop.
Proof, not adjectives
Two screenshots from the repo. Left of each: the Flow Hood. Right of each: the thing that actually got built, running on Cloud Run in the author's own project.
Ask for a calculator in the Flow Hood; get a deployed calculator. The chat is the interface, not the product.
Container built, revision deployed, URL fetched anonymously, HTTP 200 reported back into the chat — the strain verifies its own work instead of claiming success.
Under the hood
The short version. Each one links to the page where it is taken apart properly.
Isomorphic-git inside Cloud Run over a split backing store: refs, HEAD, config,
.git/index, packed-refs and the working tree as Firestore
documents; objects in GCS. Compare-and-swap is lifted above the library into
a Firestore transaction, because its native writeRef is a blind
overwrite and its AsyncLock is an in-process mutex worth nothing across
instances. Push outcomes are classified, not retried:
ALREADY_EXISTSNOT_FOUNDSTALE
No force push exists. Scales to zero.
Every git object is sealed in a PCV1 envelope —
magic|epoch|flags|nonce(12)|ciphertext|tag(16) — AES-256-GCM with
HKDF-SHA256 derivation and AAD binding the full GCS object key, so identically-pathed
repos cannot collide. Key encapsulation is X-Wing hybrid PQC (ML-KEM-768 + X25519,
1120 bytes of ciphertext) through Cloud KMS useToDecapsulate. An
attacker has to break the lattice and the elliptic curve.
One POST /mcp serves MCP revision 2026-07-28 — stateless,
per-request metadata, error codes -32020/-32021/-32022 — alongside
the 2025-era initialize handshake. Era routing is a pure function of one
request's bytes: no connection state, no cache, no clock. SDK v2 loadability is
asserted at boot and deliberately uncaught, so a broken dependency fails the container
and Cloud Run keeps serving the last good revision.
Agent-to-agent messaging, a durable work-item queue on a Vertex-backed model bus, and per-strain identity so every action is attributed, scoped and journalled by role. The MCP server also ships as an Agent Plugins package, so any client that reads that format can connect to your farm.
IAP-verified ES256 assertions against Google's JWKS with iss,
exp and aud pinned, failing closed on a cold cache. One
image split across two Cloud Run surfaces by a 90-entry route table enforced at build
time. Elevation bound to one job ID plus one command digest. An executor with no
datastore access at all. Nine codified lockout classes that block the changes which
would destroy your own way back in.
A deterministic release generator: cut the release twice, diff -r,
expect zero. Reproducible archives with fixed mtime, gzip 9 and modes taken from the
tree. A SHA-256 manifest per file. Leak ratchets. Smoke tests that seed a defect
for every assertion and require the verdict to flip — because a check that
cannot fail is worse than no check at all.
Where this came from
Paracoding was not designed in a boardroom. It is the working infrastructure of one person and a fleet of strains, written in public, and the lexicon is not decoration — it is how the system is actually reasoned about.
Book 1 — Decoding Human History as Physics and Book 2 — Everything Is Still a DNS Problem set out the argument. Book 3 — Agentic Fungi was written alongside this codebase and is out now in paperback, hardcover and Kindle — the farm metaphor is load-bearing in both. All three are published through Paracoding Press.
GPUHA.com is the hardware and high-availability side of the same practice: the place where the "what does it cost to actually run this" questions get answered with numbers. Paracoding is what happens when that discipline is pointed at agents instead of racks.
Seaside Mushrooms LLC is the actual mushroom farm, and the source of every term on this site. Strains, substrate, mycelium, subculture, the Flow Hood, sterile technique — they are borrowed because the problems are the same shape: contamination is cheap, sterility is a procedure, and the record of what you did is the only thing that tells you which it was.