AgentField: The Control Plane That Turns AI Coding Agents Into Production Infrastructure

Most agent frameworks solve the wrong problem. They make it easy to get an LLM to call a function, chain a few steps together, and produce a result that looks impressive in a demonstration. What they do not solve is what happens when that agent needs to run reliably at scale inside a real backend, where it makes consequential decisions, coordinates with other agents and services, handles failures gracefully, operates for hours or days without a timeout, and produces an audit trail that a regulator or an engineer can actually verify.

The gap between a working prototype and a production agent system is not primarily a model quality problem. The models are capable. The gap is infrastructure. Routing, async execution, memory that persists across sessions, identity that is cryptographically verifiable, human approval gates that survive crashes, canary deployments that let teams roll out new agent versions safely, and observability that shows exactly what every agent did and why. These are backend engineering problems, and most agent frameworks treat them as someone else’s concern.

AgentField approaches the problem differently. It is an open-source control plane that treats AI agents as production backend services from the start, giving every agent the same infrastructure primitives that any serious API service receives: a REST endpoint, a cryptographic identity, async execution with no timeout limits, verifiable audit trails, and a mesh of addressable peers that can discover and call each other at runtime.

Harness Orchestration: A New Primitive for Coding Agent Workflows

The most novel concept in **AgentField** is what the project calls harness orchestration, a pattern for composing multi-turn coding agents as verifiable pipeline stages rather than as isolated tools.

The idea is that agents like Claude Code, Codex, Gemini CLI, and OpenCode are not just assistants. They are composable infrastructure components. A harness workflow might chain one coding agent to write an implementation, a second to review it against coding standards, a third to write and run tests, and a fourth to refactor based on the test results. Each agent verifies the output of the previous one. The entire pipeline is traceable through the control plane, and the output of each stage is recorded in a tamper-proof audit trail.

This is fundamentally different from calling a coding assistant and hoping the output is correct. It is a pipeline architecture where verification is structural rather than aspirational. The reviewer agent cannot skip its review because it appears after the writer in the execution graph. The test agent cannot pass without running actual tests because its output is a verified artifact that the next stage receives as input.

Triggering a harness task from within an agent:

from agentfield import Agent, AIConfig
app = Agent(
    node_id="engineering-pipeline",
    version="1.0.0",
    ai_config=AIConfig(model="anthropic/claude-sonnet-4-20250514"),
)
@app.reasoner(tags=["engineering", "backend"])
async def implement_feature(spec: dict) -> dict:
    # Dispatch a multi-turn coding task to Claude Code
    # The harness manages the full conversation until the task is complete
    result = await app.harness(
        f"Implement the following feature according to the spec: {spec['description']}. "
        f"Follow the existing patterns in the codebase. Write tests. "
        f"Return a summary of what was changed and why."
    )
    return {"implementation": result, "spec_id": spec["id"]}
app.run()

The harness call dispatches the task to a configured coding agent, manages the multi-turn conversation until the task is complete, and returns the result as a typed artifact that subsequent pipeline stages can receive and verify.

Every Function Becomes a REST Endpoint

One of the most immediately practical aspects of AgentField is its approach to deployment. Writing agent logic and exposing it as a callable API are the same operation. A Python function decorated with @app.reasoner() or @app.skill() is automatically exposed as a REST endpoint when app.run() is called. No separate web framework configuration is required. No manual route registration. No API contract to maintain separately from the implementation.

A complete agent that processes insurance claims, makes AI-powered decisions, pauses for human approval when confidence is low, and notifies a downstream agent:

from agentfield import Agent, AIConfig
from pydantic import BaseModel
app = Agent(
    node_id="claims-processor",
    version="2.1.0",
    ai_config=AIConfig(model="anthropic/claude-sonnet-4-20250514"),
)
class Decision(BaseModel):
    action: str  # "approve", "deny", "escalate"
    confidence: float
    reasoning: str
@app.reasoner(tags=["insurance", "critical"])
async def evaluate_claim(claim: dict) -> dict:
    decision = await app.ai(
        system="Insurance claims adjuster. Evaluate and decide.",
        user=f"Claim #{claim['id']}: {claim['description']}",
        schema=Decision,
    )
    if decision.confidence < 0.85:
        await app.pause(
            approval_request_id=f"claim-{claim['id']}",
            approval_request_url=f"https://internal.acme.com/approvals/claim-{claim['id']}",
            expires_in_hours=48,
        )
    await app.call("notifier.send_decision", input={
        "claim_id": claim["id"],
        "decision": decision.model_dump(),
    })
    return decision.model_dump()
app.run()

This single file, when run, exposes POST /api/v1/execute/claims-processor.evaluate_claim as a production endpoint. The agent auto-registers with the control plane, receives a cryptographic identity, and every execution produces a verifiable audit trail.

The distinction between @app.reasoner() and @app.skill() reflects a meaningful architectural division. Reasoners are functions that involve AI judgment, where the output depends on model inference and may vary between calls. Skills are deterministic functions where the output depends only on the input. Both become REST endpoints, but the control plane treats them differently for observability and auditing purposes, since non-deterministic AI calls require richer tracing than deterministic computations.

Getting Started

Installing AgentField and setting up the first agent requires minimal ceremony:

curl -fsSL https://agentfield.ai/install.sh | bash

Scaffolding a new agent:

af init my-agent --defaults
cd my-agent && pip install -r requirements.txt

Starting the local control plane and the agent:

# Terminal 1: Start the control plane and dashboard
af server
# Terminal 2: Start the agent
python main.py

The control plane dashboard is available at http://localhost:8080. The agent auto-registers on startup, and the REST endpoint is immediately callable:

curl -X POST http://localhost:8080/api/v1/execute/my-agent.demo_echo \
  -H "Content-Type: application/json" \
  -d '{"input": {"message": "Hello!"}}'

For teams that prefer to describe the system they want and receive a working implementation rather than writing it from scratch, the prompt-to-production workflow generates a complete Docker Compose stack from a natural language description. In Claude Code:

/agentfield a claims processor with risk scoring and human approval

Or directly:

Build a research agent that spawns parallel investigators and recurses
into deeper sub-questions until the answer has citation-grade provenance.

The generated output includes the agent code, the control plane configuration, and a ready-to-run Docker Compose file with a local test command.

Structured AI Output: Typed Results From Any LLM

The app.ai() interface takes a Pydantic model as a schema parameter and returns typed, validated output rather than raw text. This eliminates an entire category of production reliability problems: the output parsing failures, the schema validation errors caught late, and the silent type mismatches that corrupt downstream processing.

A research agent that extracts structured information from a document:

from agentfield import Agent, AIConfig
from pydantic import BaseModel
from typing import List
app = Agent(
    node_id="document-analyst",
    version="1.0.0",
    ai_config=AIConfig(model="anthropic/claude-sonnet-4-20250514"),
)
class RiskFinding(BaseModel):
    finding: str
    severity: str  # "low", "medium", "high", "critical"
    evidence: str
    recommendation: str
class AnalysisReport(BaseModel):
    document_id: str
    summary: str
    findings: List[RiskFinding]
    overall_risk_score: float
    requires_escalation: bool
@app.reasoner(tags=["compliance", "analysis"])
async def analyze_document(document: dict) -> dict:
    report = await app.ai(
        system="""You are a compliance analyst. Analyze documents for risk.
        Be specific about evidence. Assign severity based on regulatory impact.""",
        user=f"Analyze this document for compliance risks:\n\n{document['content']}",
        schema=AnalysisReport,
    )
    if report.requires_escalation:
        await app.call("escalation-handler.notify_compliance_team", input={
            "document_id": document["id"],
            "risk_score": report.overall_risk_score,
            "critical_findings": [
                f.model_dump() for f in report.findings
                if f.severity == "critical"
            ]
        })
    await app.memory.set(
        f"analysis:{document['id']}",
        report.model_dump(),
        scope="global"
    )
    return report.model_dump()
app.run()

The schema=AnalysisReport parameter ensures that the LLM output is not just a string that looks like a report. It is a validated Python object with guaranteed field types, required fields enforced, and an immediately usable structure that subsequent code can rely on without defensive parsing.

Human-in-the-Loop Execution That Survives Crashes

Most implementations of human approval gates in agent systems have a fundamental reliability problem: the agent holds the execution state in memory. If the process crashes, restarts, or times out while waiting for a human decision, the execution is lost and must be restarted from the beginning. For long-running workflows or workflows that involve consequential decisions, this is not acceptable.

AgentField’s app.pause() suspends execution in a crash-safe, durable state. The execution is checkpointed to persistent storage before the pause. If the process crashes while waiting for approval, the execution resumes from the checkpoint when the process restarts. If the human approver takes 47 hours to respond on a 48-hour approval window, the workflow picks up exactly where it left off.

@app.reasoner(tags=["finance", "high-value"])
async def process_large_transaction(transaction: dict) -> dict:
    risk_assessment = await app.ai(
        system="Financial risk analyst. Assess transaction risk precisely.",
        user=f"Transaction: {transaction}",
        schema=RiskAssessment,
    )
# Pause for human approval on high-risk or high-value transactions
    if risk_assessment.risk_level == "high" or transaction["amount"] > 50000:
        await app.pause(
            approval_request_id=f"txn-{transaction['id']}",
            approval_request_url=f"https://finance.company.com/approvals/{transaction['id']}",
            expires_in_hours=24,
        )
        # Execution resumes here after approval, even across restarts
    return await execute_transaction(transaction, risk_assessment)

The pause is not a polling loop or a sleep call. It is a genuine suspension that releases execution resources while waiting, allows the process to handle other work, and resumes with full context when the approval arrives via webhook.

Cryptographic Identity and Verifiable Audit Trails

Traditional API authentication relies on shared secrets: API keys that any process holding the key can use to impersonate the legitimate service. AgentField replaces this model with cryptographic identity at the agent level. Every agent registered with the control plane receives a W3C DID (Decentralized Identifier), a cryptographic identity standard that allows agents to authenticate to each other with cryptographic signatures rather than shared secrets.

This matters for multi-agent systems where agents call other agents. When the claims-processor agent calls the notifier agent, the notifier agent can verify cryptographically that the call genuinely came from the claims-processor and not from an attacker who obtained a shared API key. The authentication is unforgeable and traceable to a specific agent identity rather than to a shared credential.

Every execution produces a verifiable credential: a tamper-proof receipt that records what the agent did, what inputs it received, what outputs it produced, and which other agents it called. These credentials can be verified offline:

af vc verify audit.json

For regulated industries where demonstrating exactly what an AI system decided and why is a compliance requirement, this level of auditability is not a nice feature. It is a prerequisite for deployment.

Policy enforcement through infrastructure rather than prompts addresses one of the most common security weaknesses in multi-agent systems. In most frameworks, access control between agents is implemented through prompt instructions: the agent is told not to call certain other agents. This is a fragile boundary that a sufficiently adversarial prompt can bypass.

AgentField enforces tag-based policies at the control plane level, where infrastructure intercepts calls that violate policy before they reach the target agent. An agent tagged for the finance domain cannot call an agent tagged for customer-data access unless an explicit policy grants that permission, and this enforcement happens in Go code rather than in an LLM context window.

The Agent Mesh: Discovery and Runtime Routing

In a system with many agents, hardcoding which agent calls which other agent creates brittle dependencies that make the system difficult to evolve. AgentField’s agent mesh allows agents to discover capabilities at runtime based on tags and health status rather than fixed addresses.

An agent that needs research capability does not need to know the specific node ID of the research agent. It discovers a healthy agent with the right capabilities:

@app.reasoner(tags=["orchestrator"])
async def run_research_pipeline(query: dict) -> dict:
    # Discover available research agents at runtime
    researchers = await app.discover(tags=["research", "web-search"])
# Spawn parallel investigations across discovered agents
    investigations = []
    for researcher in researchers:
        investigation = await app.call(
            f"{researcher.node_id}.investigate",
            input={"query": query["question"], "depth": "thorough"}
        )
        investigations.append(investigation)
    # Synthesize results using an available synthesis agent
    synthesizer = await app.discover(tags=["synthesis"], limit=1)
    synthesis = await app.call(
        f"{synthesizer[0].node_id}.synthesize",
        input={"investigations": investigations, "original_query": query["question"]}
    )
    return synthesis

The mesh also supports tools="discover" for LLM-driven discovery, where the model itself can invoke the discovery mechanism to find agents with capabilities relevant to the task it is solving. This enables emergent coordination patterns where agents find their own collaborators rather than following a hardcoded orchestration script.

Distributed Memory Across Four Scopes

Most agent frameworks treat memory as a conversation-level concept: what happened in this session. AgentField provides vector-backed memory across four scopes that reflect the actual structure of multi-agent systems.

Global scope memory is accessible to all agents in the system. Research results, domain knowledge, and shared reference data live here. Agent scope memory is specific to a particular agent instance and persists across sessions for that agent. Session scope memory captures the state of a specific interaction. Workflow scope memory tracks the state of a specific multi-agent workflow execution.

@app.reasoner(tags=["research"])
async def research_topic(query: dict) -> dict:
    # Check if this topic has been researched recently
    cached = await app.memory.search(
        query["topic"],
        scope="global",
        limit=3
    )
if cached and cached[0].similarity > 0.92:
        return {"result": cached[0].content, "source": "cache"}
    # Perform fresh research
    result = await app.ai(
        system="Research analyst. Provide comprehensive, cited analysis.",
        user=f"Research: {query['topic']}",
        schema=ResearchResult,
    )
    # Store for future use across all agents
    await app.memory.set(
        f"research:{query['topic']}",
        result.model_dump(),
        scope="global"
    )
    # Store in agent scope for personal research history
    await app.memory.set(
        f"history:{query['topic']}",
        {"researched_at": "now", "quality_score": result.quality_score},
        scope="agent"
    )
    return result.model_dump()

The vector search capability means that memory retrieval is semantic rather than exact-match. Searching for “payment processing failure” in global memory returns relevant results about transaction errors, gateway timeouts, and refund processing even if none of those exact phrases were used as keys.

Canary Deployments and Version Management

Shipping a new version of an agent that makes consequential decisions into production at 100 percent traffic immediately is risky. A subtle regression in the model’s reasoning, a schema change that breaks downstream consumers, or a behavior change that increases escalation rates can affect every user before the problem is detected.

AgentField’s version management allows traffic to be split between agent versions during rollout:

# Deploy version 2.2.0 to 5% of traffic
af deploy claims-processor --version 2.2.0 --traffic-weight 5
# Monitor for 24 hours, then increase to 50%
af deploy claims-processor --version 2.2.0 --traffic-weight 50
# Roll out fully or roll back instantly
af deploy claims-processor --version 2.2.0 --traffic-weight 100
# or
af rollback claims-processor --to-version 2.1.0

The control plane tracks per-version health metrics, error rates, and latency. If the new version shows elevated error rates or degraded performance, the rollback is a single command that takes effect in seconds rather than requiring a redeployment.

Production Examples: What the Architecture Enables

The capabilities described above compose into systems whose scale would be impractical to build with traditional agent frameworks.

The recursive research engine example spawns parallel investigator agents for sub-questions, evaluates the quality of each investigation, generates deeper investigator agents for questions that require more exploration, and recurses until the answer reaches a specified quality threshold. A single research query may spawn more than 10,000 agents across its recursive execution tree. Each agent is tracked by the control plane, each result is stored in memory for deduplication, and the final synthesis cites only results that passed quality verification.

The autonomous engineering team example spins up a product manager agent to interpret requirements, an architect agent to design the system, multiple coder agents to implement different components in parallel, a QA agent to write and run tests, and reviewer agents to verify each coder’s output. The entire pipeline runs from a single API call and produces a deployable artifact with a complete audit trail of every decision made along the way.

These are not toy examples. They represent the class of systems that production AI infrastructure needs to support, and they require routing, memory, identity, async execution, and observability that no chatbot framework was designed to provide.

What AgentField Is Not For

The project is explicit about its intended scope. For teams still exploring what their agent system should do, still iterating on prompt structure, still validating that an AI approach is viable for their use case, lighter-weight frameworks like LangChain or CrewAI are more appropriate. The overhead of production infrastructure is a cost that makes sense when the system is headed toward real deployment, not when the fundamental viability of the approach is still being tested.

AgentField becomes relevant when the questions shift from “will this work?” to “how do we run this reliably at scale, audit what it decides, roll out changes safely, and enforce access control between agents?” Those are backend engineering questions, and they require backend engineering infrastructure.

Conclusion

**AgentField** addresses the most significant gap in the current AI agent ecosystem: the absence of genuine production infrastructure for agents that make real decisions inside real systems. By treating every agent function as a REST endpoint, giving every agent a cryptographic identity, providing crash-safe human approval gates, enabling semantic memory across four scopes, supporting canary deployments and instant rollbacks, and producing verifiable audit trails for every execution, it provides the control plane that production agent systems require but that most frameworks leave teams to build themselves.

The harness orchestration pattern specifically, which chains coding agents as verifiable pipeline stages where each stage checks the work of the previous one, represents a genuinely new architectural primitive for AI-powered engineering workflows.

For teams that have moved beyond prototype agents and are building systems where reliability, auditability, and security are non-negotiable requirements, this is the infrastructure layer that makes production deployment tractable.