Evidence-gated change control for agent instructions.
An agent's skills are instructions it will follow. Ingot is a local-first library that treats them as what they are: versioned state that needs a review process. Every skill folder is content-addressed, every proposed change is quarantined until a human reads the evidence and approves it, and promotion is atomic, snapshots what it replaced, and is recorded. An MCP server then serves the approved revision of the right skill for each task, which is what lets a cheap or local model reuse methods that would otherwise need a frontier model.
What the system guarantees:
- A revision names an exact skill. Every file in a skill folder is hashed, so the revision on a trace, in a piece of evidence, and on disk are comparable.
- Changes are quarantined. Generated rewrites land in
runs/pending/and cannot route traffic until a human approves them. - Approval needs evidence. A rewrite carries held-out champion-vs-challenger scores, per-case deltas, token cost, and a gate verdict; promotion re-checks the evidence still matches disk.
- Promotion is atomic and reversible. The displaced revision is snapshotted and the directory swapped by rename; restore any snapshot from the UI or CLI.
- Decisions are audited. Approvals and rollbacks append metadata-only records (action, skill, revision, actor, timestamp), never skill text or credentials.
Built for individual users first, ready to share:
- Lite.
docker compose upstarts just the router and the change-control UI; the tracing stack is an optional upgrade (--profile langfuse), not a requirement. - Local. Point it at Ollama or vLLM and it runs with no API key; nothing leaves your machine.
- Secure. Hosted calls default to OpenRouter with zero-data-retention routing enforced on every request, everything binds localhost, and the shared UI has an optional password gate.
- Easy. A skill is a folder with a
SKILL.md. Drop one in and it is live on the next request.
Changes come mostly from you. Ingot also ships an optional candidate generator that mines real traces for failing skills, drafts rewrites, and measures them on held-out tasks; it produces proposals, never activations.
Quickstart · Tutorial · How it works · Configuration · Architecture · Contributing · Security · MIT license
git clone https://github.com/SlanchaAI/ingot.git && cd ingot
cp .env.example .env # add an OpenRouter key, or point BASE_URL at Ollama (no key)
scripts/fetch_skills.sh all # fetch ~70 real skills into ./skills (see docs/skill-sources.md)
docker compose up # lite by default: skill router (:8000) + change-control UI (:8080)
# + one demo agent run
docker compose run --rm agent "How do I merge several PDFs into one and add page numbers?"The change-control UI at localhost:8080 asks for a login; the compose default is admin /
ingot. Change AUTH_PASSWORD in .env before sharing it on your LAN (or set it empty to run
open), see Privacy & security.
Everything runs in lite mode against a local JSONL trace store, so no external stack is required;
docker compose --profile langfuse up adds the self-hosted Langfuse (traces + experiment UI) if you
want it. Trace-store, model, and gate settings live in Configuration.
Then walk the full loop, a stale Tailwind skill mined, rewritten, gated, and promoted, in the Tutorial.
Ingot does three things around your skill library:
- Serve. An MCP server routes each task to the approved revision of the right skill (embedding routing on CPU, no GPU) so a weak or local model can reuse a strong method.
- Govern. Every change is quarantined, carries held-out evidence, and needs a human approval; promotion is atomic, snapshotted, reversible, and audited.
- Improve. An optional loop mines real traces for failing skills, rewrites them with the SkillOpt reflective optimizer, and A/Bs the result on held-out tasks, leaving a reviewable proposal.
The component map is in docs/how-it-works.md; deeper design in ARCHITECTURE.md.
| Doc | Contents |
|---|---|
| Tutorial | The full loop end to end: route, mine, generate, review, promote, roll back |
| How it works | Component map (MCP server, agent, optimizer, UI) |
| Configuration | Env reference, candidate generation, cross-model compatibility, eval task sets, Langfuse |
| The evidence gate | The anti reward-hacking checks a reviewer relies on |
| Privacy & security | Zero-data-retention, network exposure, threat model |
| Sign in with Google (SSO) | Domain-restricted login and roles for a shared deployment |
| Bring your own agent | Use the MCP server from your own harness; tracing |
| Skill sources | Where scripts/fetch_skills.sh gets skills, and their licenses |
MIT, see LICENSE.