Carpenter

How Carpenter Works

Mon, 01 Jan 0001 00:00:00 +0000

The Core Loop
#

Carpenter agents follow a simple cycle: observe → generate code → review → execute → persist.

Arcs: The Work Tree

Mon, 01 Jan 0001 00:00:00 +0000

What Is an Arc?
#

An arc is a unit of work with a lifecycle. It is the only work abstraction in Carpenter — tasks, projects, cron jobs, and sub-steps are all arcs at different depths in a recursive tree.

Security Model

Mon, 01 Jan 0001 00:00:00 +0000

Threat Model
#

Carpenter’s threat model is prompt injection, not adversarial users. The danger is untrusted data — web content, webhooks, API responses — manipulating the AI into generating harmful code.

Research Foundations

Mon, 01 Jan 0001 00:00:00 +0000

Carpenter’s security model draws on several lines of research in agentic AI security. This page summarizes the key ideas and how they informed the design.

The Dual LLM Pattern
#

Simon Willison, 2023 — The Dual LLM pattern for building AI assistants that can resist prompt injection

Trust & Taint

Mon, 01 Jan 0001 00:00:00 +0000

The Problem
#

An autonomous agent that fetches web content, processes webhooks, or calls external APIs will inevitably encounter attacker-controlled data. The question isn’t whether — it’s how that data flows through the system without contaminating trusted operations.

Skills & Memory

Mon, 01 Jan 0001 00:00:00 +0000

Skills
#

Skills are knowledge-only markdown packages. They implement three-stage progressive disclosure to minimize context window consumption:

Stage	What the agent sees	Token cost
1. Advertise	Compact index in system prompt: name + description	~100 tokens per skill
2. Load	Full `SKILL.md` via `load_skill`	Varies
3. Read	Specific resource files via `load_skill_resource`	On demand

Skills live at skills_dir/{name}/SKILL.md with optional resources/ directories. Metadata is synced to a skills table in the database.

Platform Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Core vs Platform
#

Carpenter separates platform-agnostic logic from platform-specific implementations:

Core (carpenter-ai) — Arc management, review pipeline, trust system, agent loop, model selection, skills, memory
Platform packages (carpenter-linux, carpenter-android, etc.) — Executors, sandbox backends, network egress enforcement, platform-specific tools

Platform packages are thin. They register their implementations at startup, then hand off to the core:

Carpenter

How Carpenter Works

The Core Loop #

Arcs: The Work Tree

What Is an Arc? #

Security Model

Threat Model #

Research Foundations

The Dual LLM Pattern #

Trust & Taint

The Problem #

Skills & Memory

Skills #

Platform Architecture

Core vs Platform #

The Core Loop
#

What Is an Arc?
#

Threat Model
#

The Dual LLM Pattern
#

The Problem
#

Skills
#

Core vs Platform
#