Agent loop

The agent loop lives in Bolt. Each loop invocation is admitted into one one-shot worker. await infer yields while the host runs the model, then resumes that same invocation in the same worker. Interactive start persists the user turn, then admits the loop (agents.start plus agents.turn). The loop is still Bolt’s, and it is bounded by the permissions the workspace declared.

The loop

Every run starts from the workspace prompt — src/+agents.md, plus an envoy’s task — then alternates model turns and tool calls. Model and tool facility waits happen within the admitted invocation: its worker and slot stay assigned, active CPU metering pauses, and the same invocation resumes when the host replies. A later loop iteration is a new invocation and worker.

  persist user turn ─► HOST ADMIT ─► BOLT FUNCTION (agents.ts — the loop)
                                              │
                         ┌────────────────────┼────────────────────┐
                         ▼                    ▼                    ▼
                      return             await infer            not done
                         │                    │                    │
                         ▼                    ▼                    ▼
                       reply             host I/O; same       later loop
                                         invocation resumes   invocation
                         │
           ┌─────────────┼──────────────┐
           ▼             ▼              ▼
    platform tools   workspace tools   host tools
    (describe/read/ (defineAgentTool) (policy-named,
     write/skills)                     sandbox)

Two doors into the loop

The same loop serves two entry points. Web chat and envoy inbound each persist the user turn, then the host admits the loop function:

web chat — a signed-in user, acting on their own account
envoys — the envoy principal under its declared policies

Permission bounds

The rule is permission bounds the agent, not its tool list : data operations run unelevated under the acting principal’s policy, whatever tools the loop can name.

Budget

Colony’s host policy is a 2,000 ms uninterrupted CPU span per invocation, not a 2-second wall timeout. Model and database waits retain the slot and worker but do not consume the CPU span or compute meter. There is no token budget to declare in source: the invocation budget stops a step, as do provider refusals, errors, and metering.

Subagents

For narrow subtasks the loop can spawn an in-session subagent with a focused prompt (sandbox tools: spawn_subagent and its siblings). Subagents run inside the same permission bounds.

Transcripts

The whole run — turns, tool calls, results — is written to chat session collections, so agent activity is inspectable and auditable like any other data.

The platform surface is Agent platform ; the authoring surface is Agents .