Application · Control plane · v0.7.2

AbstractGateway

AbstractGateway runs your durable AI workflows and is the control plane of an AbstractFramework installation. It starts runs, keeps their append-only ledger (the record of every step) so any client can replay or stream them, and serves the web console, the browser apps and the Automations API from one address. You manage users, providers, local engines, models, apps and network access from the web or terminal console, the command line or the tray icon (the menu bar on macOS). The installer sets it up for you (Install).

Get started GitHub PyPI Docs llms.txt llms-full.txt

pip install abstractgateway
abstractgateway serve
# prints http://127.0.0.1:8080/console#claim=…

abstractgateway claim --open     # a fresh link
abstractgateway service install  # start at login

Overview

One gateway, many clients

AbstractGateway hosts AbstractRuntime runs and exposes them over HTTP. Every client talks to it the same way, so none of them depends on another: AbstractFlow, AbstractCode, AbstractObserver, AbstractContinuum, AbstractEntity, AbstractAssistant and your own scripts.

Replay-first ledger

Every run writes an append-only ledger. A client that connects at any time replays it over HTTP, then follows new records over server-sent events, so it sees the whole run even when it arrives mid-way.

Durable commands

Clients act by submitting commands (pause, resume, cancel, conclude, emit an event, inject guidance, compact memory). Commands go to a durable inbox that the runner applies, so they survive restarts.

A control plane you can see

AbstractGateway comes with two consoles. Its web console at /console covers users, runtimes, workflows, providers, multimodal defaults, models, engines, apps and network access; its terminal console, abstractgateway-console (built on AbstractTUI), has the same screens. See the gateway consoles.

First run

Start it, open the link

No environment variables and no token to copy. On a first run with nothing configured, a plain abstractgateway serve:

Listens on this computer only

It binds 127.0.0.1:8080 (use --port to pick another port) and keeps its data in your operating system's per-user data folder.

Turns on user accounts

It creates the admin user default/admin and keeps its first token in <data dir>/auth/bootstrap-admin-token (file mode 0600).

Prints a one-time link

http://127.0.0.1:8080/console#claim=… signs you in as the admin and opens a short setup guide. The link works once, for 10 minutes, from this machine only.

The setup guide installs a local engine, downloads a model that fits your machine and lists the apps. It is described on the gateway consoles page, together with the gateway’s terminal console, abstractgateway-console, which runs the same guide on a server without a browser.

Upgrade. Re-run the same install line: it upgrades or repairs the install in place. The console’s Gateway card (Check now), the terminal console (F3, then u) and the tray icon (Check for Updates) also offer the update; on an installer install it runs the installer. See Upgrade. A pip install abstractgateway upgrades with pip install -U.

Users and sign-in

1 user = 1 runtime

With user accounts on, the gateway routes each user to their own runtime and data. Admins manage users from the console or /api/gateway/admin/users. Tokens are shown once and stored only as hashes.

Browser sessions

Browser apps exchange a user token for an opaque session (an HTTP-only cookie plus a CSRF token) and do not keep the token. Each user can also install workflows in a registry of their own.

How the claim link is protected

Only someone who can write the data folder can mint one, it is stored as a SHA-256 digest, and the gateway redeems it only from a loopback connection without proxy headers.

ABSTRACTGATEWAY_AUTH_TOKEN is an optional shared server bearer token. It is not a browser sign-in token, and a normal install does not need it.

Network & security

Loopback first, open on purpose

One setting decides who can reach the gateway. The console's Network tab, the terminal console, the tray icon and abstractgateway network all edit it, and it applies at the next start (or at once with abstractgateway network restart).

Mode	Listens on	Requires
`localhost` (default)	`127.0.0.1`	Nothing: only this machine can connect. User accounts stay on, because every local process can still connect.
`lan`	`0.0.0.0` (IPv4)	User accounts. Plain HTTP, so use it on networks you trust, or put TLS or a VPN in front.
`internet`	`0.0.0.0` (IPv4)	User accounts and an explicit acknowledgement (`--acknowledge-internet`). The gateway does not terminate TLS: put a TLS reverse proxy or a tunnel in front.

abstractgateway network set lan                   # let your local network reach the gateway
abstractgateway network restart                   # apply it now
abstractgateway network status                    # configured vs running, addresses, warnings
abstractgateway network set --allowed-origins https://ui.example.com   # allow another browser origin

The security baseline

Refuses unsafe starts

An explicit non-loopback --host with neither user accounts nor a token refuses to start. lan and internet are refused unless user accounts will be on.

Origin checks

Browser origins are limited to localhost and 127.0.0.1 (plus the gateway's own LAN addresses in a network mode). A foreign origin, including a DNS-rebinding name that resolves to your LAN address, is refused with 403.

App proxy checks

Requests to /apps/<id>/ that carry another origin are refused, and a Host header the proxy cannot forward is refused with 400 invalid_host.

Credential folders denied

Every run gets a built-in deny list: ~/.ssh, ~/.aws, ~/.gnupg, ~/.config/gcloud, ~/.kube, ~/Library/Keychains, the framework's settings folders and the gateway's data folder. Keep shell tools behind approval on machines that hold secrets.

Lockout and limits

Failed sign-ins are locked out per client address with a growing wait. Request sizes, concurrency and server-sent event streams have limits, and write requests go to an audit log.

Start at login

abstractgateway service install registers a LaunchAgent, systemd user unit, desktop autostart entry or Windows Run entry; status, enable, disable and uninstall manage it. The same Start at login switch is in the web console's Gateway card, on the setup guide's last step and in the terminal console (F3).

Apps

Every app on one address

The gateway installs the browser apps from npm (and Node.js when needed), runs them on 127.0.0.1 and serves them at /apps/<id>/ on its own port, over HTTP, server-sent events and WebSocket, with cookies isolated per app. One address, and one SSH tunnel, reaches the console, the API and every app.

Observer/apps/observer/

Watch, launch and automate runs.

Flow Editor/apps/flow/

Author workflows visually and publish them.

Code/apps/code/

The coding assistant in the browser.

Continuum/apps/continuum/

Board, backlog, inbox and services.

Entity/apps/entity/

Entities, their memory graph and diaries.

Assistantdesktop app

Opens on the gateway's computer, signed in.

abstractgateway apps install observer --launch   # Flow, Code, Observer, Continuum, Entity, Assistant
abstractgateway apps open observer               # a one-time signed-in link

The local gateway pointer. Once bound, serve writes ~/.abstractframework/gateway.json (its URL, port and data folder). The terminal consoles, the Node apps and the Assistant read it to find this computer's gateway, and follow it when the gateway moves to another port. abstractgateway network status shows it.

Models & engines

Local models that fit this machine

The console's Models and Engines tabs, and the matching commands, install a local engine and download a model that fits. They are AbstractCore's model browser and engine installer, shown inside the gateway.

abstractgateway engines status --probe           # Ollama, LM Studio, MLX, llama.cpp, ...
abstractgateway engines install ollama --dry-run # the exact command, nothing runs
abstractgateway models catalog --fits            # models that fit this machine
abstractgateway models download ollama qwen3:8b
abstractgateway models list                      # installed models with sizes
abstractgateway models loaded                    # what is in memory (also: load, unload)

Each build gets a fit verdict for this computer: Fits, Tight, Partial offload, Too large or Unknown. On a Mac, Needs GPU limit shows the exact command that raises the GPU memory limit (sudo sysctl iogpu.wired_limit_mb=<MB>). The commands talk to the running gateway, so admin rules and the audit log apply; add --local to run them in-process.

Shipped workflows

Ready to run on a fresh install

The gateway loads the .flow workflow bundles packaged with it (a bundle packs one or more workflows and their metadata), so these workflows work without installing anything. flow_id selects an entrypoint; leave it out to run the bundle's default.

Bundle	Entrypoints	What it does
`basic-agent`	default	The framework's default chat agent: one Agent node with tools, memory and status updates.
`coding-agent`	`coder`, `coding-agent`	Verify-gated coding: a builder writes code and an independent verifier runs build, execute and match gates each round until they pass.
`deep-research`	`deep-research`	Research with adversarial review, a verified source ledger and Markdown, PDF or DOCX export.
`co-scientist`	`co-scientist`	A multi-agent hypothesis engine: literature grounding, then generation, reflection, Elo-ranked debate and evolution into a reviewed research overview.
`docs-qa`	default	Documentation Q&A grounded on the asking app's `llms.txt` corpus.
`react-agent`, `codeact-agent`, `memact-agent`	`react`, `codeact`, `memact`	The native ReAct, CodeAct and MemAct agent loops from AbstractAgent.
`abstractassistant-orchestrator`	default	The orchestrator behind the AbstractAssistant tray app.

The console's Workflows tab imports, exports and deletes bundles. Set ABSTRACTGATEWAY_FLOWS_DIR to serve your own bundle directory instead. The editable sources of these workflows are in the AbstractFlow repository (shipped workflow sources); you author your own in the Flow Editor.

Automations

Run a workflow again and again

An automation runs a workflow on a trigger (a fixed UTC interval such as every 2 minutes, or only when asked). Every run reads as a chat turn, and you are notified only when a run asks for you or fails. Automations are durable runs: they survive a restart, and a restart never starts a run twice.

Create from any workflow of the gateway, or from the gateway's default agent
Independent context (each run starts fresh) or growing context (each run continues one conversation)
Pause, resume, run now, stop the current run, revise or archive
Read each run (an occurrence) with its prompt, answer, files and pending questions
Discuss one run in a separate conversation
Tool approval: automatic by default, or ask for every tool batch

You create and manage automations in AbstractObserver, AbstractAssistant and AbstractCode (terminal and web). See Automations.

GET   /api/gateway/trigger-sources
POST  /api/gateway/automations
GET   /api/gateway/automations
GET   /api/gateway/automations/{id}
PATCH /api/gateway/automations/{id}
POST  /api/gateway/automations/{id}/commands
GET   /api/gateway/automations/{id}/occurrences
GET   /api/gateway/automations/{id}/attention
POST  /api/gateway/automations/{id}/seen
POST  /api/gateway/automations/{id}/discuss

API

The client contract

Clients start runs, act with durable commands and render by replaying or streaming the ledger. The live OpenAPI spec is at /openapi.json and Swagger UI at /docs.

# <token>: <data dir>/auth/bootstrap-admin-token, or the console's one-time link (abstractgateway docs/configuration.md:120, v0.7.2)

# Start a run of a shipped workflow (flow_id omitted: the bundle's default entrypoint)
RUN_ID=$(curl -sS -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"bundle_id":"basic-agent","input_data":{"prompt":"How long should I steep green tea?"}}' \
  "http://127.0.0.1:8080/api/gateway/runs/start" | python3 -c 'import json,sys; print(json.load(sys.stdin)["run_id"])')

# Replay the ledger, then follow new records live (SSE; --max-time ends the sample)
curl -sS -H "Authorization: Bearer <token>" "http://127.0.0.1:8080/api/gateway/runs/$RUN_ID/ledger?after=0"
curl -sS -N --max-time 5 -H "Authorization: Bearer <token>" "http://127.0.0.1:8080/api/gateway/runs/$RUN_ID/ledger/stream"

# The run and its ledger survive a gateway restart
curl -sS -H "Authorization: Bearer <token>" "http://127.0.0.1:8080/api/gateway/runs/$RUN_ID"

# Resume a paused run with a durable command
curl -sS -H "Authorization: Bearer <admin token>" -H "Content-Type: application/json" \
  -d '{"command_id":"<uuid>","run_id":"<run_id>","type":"resume","payload":{}}' \
  "http://127.0.0.1:8080/api/gateway/commands"

Media routes

Run-scoped routes for text-to-speech, transcription, music, image generation, editing and upscaling, and video (from text or an image). Each creates a durable child run and returns artifacts, with the backend chosen in the console's Multimodal tab.

Discovery

GET /api/gateway/discovery/capabilities is a versioned contract of packages, endpoints and feature gates. Voice, speech, music and vision catalogs, artifact search, knowledge-graph queries and prompt-cache controls sit beside it.

Telegram and email

Optional bridges turn incoming messages into durable runs: ABSTRACT_TELEGRAM_BRIDGE=1 (Bot API or TDLib, with an allowlist of users) and ABSTRACT_EMAIL_BRIDGE=1 (IMAP). The Telegram bridge runs the shipped basic-agent unless you name another workflow.

Deploy

Python, Docker or split processes

Python 3.10 or newer. The base install is the light server; extras add local engines.

Light server

pip install abstractgateway

HTTP/SSE server, Runtime, Agent, hosted and OpenAI-compatible providers, remote media and LanceDB memory, without PyTorch or CUDA.

Apple Silicon

pip install "abstractgateway[apple]"

The full native macOS profile with Apple-local engines and every non-NVIDIA capability.

GPU workstation

pip install "abstractgateway[gpu]"

vLLM, Hugging Face, local voice, music, Diffusers images and memory. Add [tray] to any profile for a tray icon (the menu bar on macOS, the system tray elsewhere).

Docker

docker pull ghcr.io/lpalbou/abstractgateway:0.7.2
# experimental full GPU image for NVIDIA hosts (best effort)
docker pull ghcr.io/lpalbou/abstractgateway:gpu-latest

docker run --rm --name abstractgateway \
  -p 8080:8080 \
  -e ABSTRACTGATEWAY_DATA_DIR=/data \
  -e ABSTRACTGATEWAY_USER_AUTH=1 \
  -e LMSTUDIO_BASE_URL="http://host.docker.internal:1234/v1" \
  -v "$PWD/runtime:/data" \
  ghcr.io/lpalbou/abstractgateway:0.7.2

On first start the container creates default/admin and writes its token to runtime/auth/bootstrap-admin-token; use it to sign in to /console, then rotate it or create named users. On Apple Silicon, keep MLX inference native on macOS and point the container at it.

Split API and runner, SQLite

# Process 1: the runner loop
abstractgateway runner
# Process 2: the HTTP API only, on the same data directory
abstractgateway serve --no-runner --host 127.0.0.1 --port 8080

# Indexed tables instead of files, and a one-time migration
export ABSTRACTGATEWAY_STORE_BACKEND=sqlite
abstractgateway migrate --from=file --to=sqlite \
  --data-dir runtime/gateway --db-path runtime/gateway/gateway.sqlite3

Where to next

Keep going

InstallOne line on macOS, Linux and Windows, or the Mac package. The gateway consolesThe setup guide, models, engines, network and apps, in a browser or a terminal. AutomationsScheduled workflows you can pause, edit and discuss. Start as an architectNetwork modes, headless servers, security and data. AbstractRuntimeThe durable run model behind every gateway run.