SHACKLE is the runtime governance layer that catches autonomous agents in silent infinite loops and halts the run before the next call — capping the bleed instead of letting it run unbounded. It is also SP/1.0: the authored, verifiable conformance standard for agent mediation — live today, and its reference implementation provably passes its own conformance suite. Works with CrewAI, LangGraph, AutoGen (sync & async) — zero refactoring.
Agent hits an error. Retries same tool with same input. Burns tokens quadratically. You wake up to a $400 bill â or worse, a $106,000 AWS disaster â with no idea what happened.
CrewAI, AutoGen, and LangGraph have zero built-in cost guardrails. Your agent runs until it runs out of your money. Framework developers admit this is unsolved.
API hangs. Agent waits forever. No timeout. No alert. Just a frozen process burning compute budget. Across 20+ agents in production, this compounds exponentially.
Production stacks run CrewAI + AutoGen + LangGraph simultaneously. Each framework has different failure modes. None has a unified circuit breaker. Until now.
An AutoGen agent managing 10,000+ AWS accounts destroyed the management account in a recursive cleanup loop. No circuit breaker. No budget guard. No kill switch.
Source: microsoft/autogen#7770 â @tzb1-ai, enterprise infrastructure operator
SHACKLE's repeat-call + error-cascade breaker is built to trip on exactly this recursive-loop patternâbefore it compounds.
SHACKLE hooks litellm.completion and BaseTool.run
at the interpreter level. No framework source changes. No refactoring. Works across CrewAI,
LangGraph, and AutoGen simultaneously.
Detects identical sequential tool calls and error cascades. Trips circuit breaker before quadratic token burn.
Real-time token tracking against client-side pricing table. Hard freeze when budget is exhausted.
Kills hung threads on dead APIs. No more frozen processes burning compute.
Interactive terminal with Resume / Skip / Abort. Human stays in the loop when it matters.
No telemetry. No phone-home. No hidden SaaS. Your agent data stays on your machine.
CrewAI â LangGraph â AutoGen â Smolagents 𧪠â one decorator, all frameworks.
Every AI agent framework offers some safety mechanism â but none provide a dedicated pre-execution circuit breaker with mathematically verified decision logic. Here's the landscape:
| Capability | Prompt Guards | Framework Limits | LangSmith / Monitoring | SHACKLE |
|---|---|---|---|---|
| Pre-execution interception | â In-band | â Post-hoc | â Observability only | â Process-level |
| Budget enforcement | â | â³ Token count only | â | â Per-session USD tracking |
| Loop-of-death detection | â | â³ Recursion limit | â³ After-the-fact | â 3-call repeat + error amplification |
| HITL (human-in-the-loop) | â | â³ Manual only | â | â CLI + WebSocket remote |
| Error signal detection | â | â | â | â 401/403/500/timeout cascade |
| Mathematical verification | â | â | â | â 9 invariants (Hypothesis-tested) |
| Cryptographic audit trail | â | â | â | â Ed25519-signed, immutable |
| Framework-agnostic | â | â Framework-locked | â³ LangChain only | â Works with ANY agent |
| Zero-refactor integration | â³ System prompt | â Requires config | â Requires SDK | â One decorator: @Guard |
| Open source | â³ Varies | â | â Proprietary SaaS | â AGPLv3 + commercial |
The gap: Every framework has prompt guards, rate limits, and monitoring. Nobody has a pre-execution circuit breaker with mathematically verified decision logic. That's what SHACKLE is. One import. Zero refactoring. Works today.
SHACKLE sits between your agent and the runtime â not as middleware, but as a runtime shim.
SHACKLE started as a runtime circuit breaker. It is now the SP/1.0 conformance standard for runtime mediation of agent tool calls — an authored, verifiable contract that any runtime can be tested against.
ALLOW / DENY / HITL — a small, closed verdict set with typed reasons,
not free-text guesses.
Valid(τ) ⇔ Required(τ) ⊆ Supported(τ). A transition is valid iff every required
capability is supported.
9 decision-core + 5 HITL transition cases (approve / reject / modify / defer-escalate / duplicate-resume), each a hash-verifiable vector.
A stdlib-only decide() produces every verdict. Run pytest tests/test_conformance.py
to prove conformance.
The core invariant: history-visible ≠ runtime-executable. A record that an action happened is not proof the transition was supported. A runtime is SHACKLE-conformant iff it passes the published fixtures — provable by reproduction, not assertion.
Honest scope: the conformance layer (spec + 14 fixtures + reference decide()) is the
verified standard. The @Guard runtime is the reference integration — it uses the same canonical-hashing
discipline and is tested on Python 3.10–3.12, with a literal runtime→decide() wiring on the roadmap.
A certification is only worth what it can withstand. SHACKLE Certification proves — not promises — that a runtime correctly enforces the SP/1.0 mediation contract, measured against 14 public, hash-verifiable conformance fixtures. The same vectors that certify you are the ones anyone can re-run to check the claim. No trust required.
What SP/1.0 actually governs: every moment an autonomous agent is about to act — call a tool, spend budget, invoke another agent, execute a transaction. SP/1.0 defines, verifiably, whether that action is ALLOW, DENY, or HITL (halt for a human), on a simple contract: a transition is valid only if everything it requires is within what the system provably supports. Its core invariant — history-visible ≠ runtime-executable — means a rejected or deferred action can never "resume" its way past the guardrail. For a buyer, that answers the one question every acquirer and regulator asks about autonomy: can you prove it does only what it's allowed to do? A SHACKLE-certified runtime can — in minutes, from a clean clone.
Core Conformance. All mediation fixtures pass — ALLOW / DENY / HITL verdicts and deny reasons match the spec.
Transition-Complete. Core, plus every human-in-the-loop transition: approve, reject, modify, defer-escalate, duplicate-resume.
Enterprise Runtime. HITL, plus daemon atomic-state, ledger tamper-evidence, and audit export (V2 runtime).
pytest v2/tests/test_conformance.py.SP/1.0 is neutral and public. Any agent runtime — including competing frameworks and competing safety products — is invited to test against it and be listed. The fixtures are public, the verdicts are deterministic, the registry is open. We hold our own reference implementation to exactly the bar we ask of everyone else. A standard is only worth what it can withstand: if a runtime conforms, the registry proves it; if it doesn't, the fixtures show exactly where. The measure is public, and the same for everyone.
"SHACKLE's litellm hook is brilliant for teams running polyglot stacks (CrewAI + AutoGen + LangGraph). You get one unified guardrail across your whole topology."
â Creator of TokenCircuit, competing LangGraph solution
"The error-amplification logic (catching 401/500s on the 2nd attempt) is incredibly sharp."
â Developer on LangGraph issue tracker
SHACKLE now ships first-class governance for the two biggest chokepoints in the agent ecosystem — LiteLLM (the universal adapter under CrewAI, AutoGen, LangGraph and thousands of custom agents) and Microsoft AutoGen. One integration governs the whole supply chain, and every decision traces to the hash-pinned SP/1.0 conformance fixtures.
ShackleGuardrail enforces the pure SP/1.0 reference decide();
ShackleEngineGuardrail drives the full stateful circuit breaker
(budget / repeat / timeout). Sync check()/record() for the SDK, plus
async pre/post hooks for the LiteLLM proxy. litellm is optional.
@wrap_tool governs any AutoGen tool through the same engine, with
canonical input dedup so dict key ordering can’t evade loop detection.
create_shackle_agent() spins up a governed AssistantAgent.
Every path enforces Valid(τ) ⇔ Required(τ) ⊆ Supported(τ)
and the ALLOW / DENY / HITL decision surface. See
INTEGRATIONS.md
for proxy config and usage.
Dante Bullock â 52-year-old self-taught systems architect, Oakland, California. Founder of Sovereign Logic. No venture capital. No corporate incubator. Just code that works.
"I don't wait for VC validation. I scrape issue trackers, find the bleeding, and build the tourniquet."