Charter

Why it's ranked here

The engineering is careful where money and authority are at stake. Spend caps are enforced twice: once per call inside the worker and once as a running total carried across every pause, so a task stopped four times for approval cannot spend its budget five times. Token usage is read from the harness's own saved state rather than counted in memory, so subagent spend is not missed. Undeclared tools are refused, so a tool server shipping a new tool cannot quietly widen an agent's reach. Against that: it declares itself pre-alpha, is Apache 2.0 licensed, and does nothing without the BoundFlow server.

What's good

The design notes explain why each choice was made, including the traps: the underlying SDK names its tool failure metric a rate while summing a raw count, and Charter uses the accurate name. A rollback restores an older agent version while today's spending limits stay in force, because policy is deliberately left unversioned. One broken tool server quarantines only its own agent, not the whole process, with a retry after 60 seconds. Notifications are HMAC-SHA256 signed webhooks with Slack and Telegram body shapes, so there is no vendor integration to maintain. End-to-end tests run against a real control plane with only the model faked.

Tradeoffs

Everything depends on BoundFlow: without that server running, locally in Docker or through a hosted service still in early access, nothing executes. The package warns that the config format and command line can change between releases. Resumed work is at-least-once, so a tool call whose side effect landed just before a worker crash can run again. When one turn proposes several gated actions, only the first goes to a person and the rest wait for later rounds. A provider-billed call lost in a crash before its result is saved goes uncounted, which the authors bound to one call.

How to use it well

It fits a team already on LangChain that needs agents to touch real systems, such as issuing refunds or closing tickets, with a named person approving the risky calls and a hard dollar cap per task. Start with the local Docker setup and the bundled support-desk examples, then add one gated tool and a spending ceiling before anything else. Keep every version a lifecycle rule might roll back to in the worker's served list, and make gated tools idempotent. It is not an evaluation suite or a prompt-testing tool, and a team outside Python will fight the required dependencies.

Observed

License

Apache-2.0

Language

Python, requires 3.10 or later

Install surface

pip package boundflow-charter, with extras ui, otel, openai, google, bedrock, ollama, groq

Interfaces

charter CLI plus a browser console served by charter ui; config as YAML with JSON Schema export

Required dependencies

BoundFlow SDK and control plane, deepagents, LangGraph with Postgres checkpointing, MCP client

Model providers

Any provider LangChain's init_chat_model can build, including local Ollama; Anthropic installed by default

Notifications

Webhook, Slack and Telegram channels, optionally HMAC-SHA256 signed

Trace sinks

none, logging, jsonl, OpenTelemetry (otel)

Tests

pytest suite with a 180-second per-test timeout; end-to-end tests excluded by default and require a running control plane

Execution semantics

Resumable operations are at-least-once: a tool call can run again after a worker dies