TensorLine documentation.

TensorLine is a Go server backed by PostgreSQL that holds agent plans, tasks, documents, findings, reviews, agent runs, and worktrees as live rows — the system of record for agent-driven engineering. It is reached two ways: agents connect over MCP at /mcp, and operators run two local CLIs (tensorline-admin and tensorline-worktree).

There is no HTTP API or web UI yet — that is M11. The OpenAPI contract exists and is frozen, but it is not served; do not expect a REST surface or a frontend in this release. TensorLine is in Closed beta, and it is not a GitHub replacement — source control and pull requests stay where they are. This page documents the pinned version 992010d2. Milestones M0 through M7 and M9 are complete; interfaces can still change before general availability.

• Organization — the tenant. Every credential is bound to one organization; a request for another tenant's id and a request for an id that does not exist return the identical 404, so existence never leaks across tenants.
• Principals — humans, agents, and services. Human principals carry a role of owner, admin, or member; an agent's or service's authority is derived, not requested.
• Scoped bearer tokens — an agent authenticates with a token that names its tenant and principal. Tokens are stored hashed; the secret is shown once at issue time.
• Work items, documents, findings, reviews, agent runs, and worktrees — the domain. Every mutation of a tenant table writes an event row by a database trigger, so the audit trail is a property of the schema rather than of convention.

TensorLine needs Go 1.26 and PostgreSQL 16 or 17 binaries (no Docker). make build compiles all four binaries into ./dist/:

The four binaries are tensorline-server (the MCP and worktree listener), tensorline-migrate (forward-only migrations plus first-owner bootstrap), tensorline-admin (the privileged control plane), and tensorline-worktree (the on-host worktree CLI). tensorline-server takes only -version.

Four make targets stand up a throwaway PostgreSQL cluster over a UNIX socket under .dev-cluster/ — no Docker, no TCP port:

make dev-db writes .dev-cluster/env, which exports the platform TP_* variables plus TensorLine's TL_BOOTSTRAP_*, admin, and artifact-store variables.

The owner DSN and the application DSN are separate on purpose. Migrations run as the schema OWNER through TP_MIGRATE_DATABASE_DSN; the server runs as the de-privileged tensorline_app through TP_DATABASE_DSN. tensorline_app holds no DDL privilege, so it cannot alter the tables whose row-level-security policies constrain it — one shared DSN would hand the request path the power to drop its own policies.

make dev-db also sets the PostgreSQL logging settings the server requires. The two that matter are log_parameter_max_length and log_parameter_max_length_on_error: their PostgreSQL default of -1 logs bind parameters in full, so the server refuses to start unless both are set to 0. A cluster missing them looks like a broken binary, not a hardening suggestion.

Configuration is entirely environment variables. Every *_REF names a reference to a secret in your backend, never an inline password; a DSN carrying an inline password for the admin credential is refused. The server listens on loopback (127.0.0.1:8080) by default and has no built-in TLS — put your own TLS terminator in front of it.

The three GitHub App credentials — TL_GITHUB_APP_ID, TL_GITHUB_APP_PRIVATE_KEY_REF, and TL_GITHUB_WEBHOOK_SECRET_REF — are all-or-nothing: set all three to enable the GitHub App integration, or none; setting one or two is refused at startup. So is setting TL_GITHUB_API_BASE_URL on its own — it counts as a partial forge configuration. The remaining forge variables are optional and take their defaults (TL_GITHUB_API_BASE_URL https://api.github.com, TL_FORGE_BUDGET_PER_SWEEP 250 and at least 64, TL_FORGE_RECONCILE_INTERVAL 5m, TL_FORGE_REPROCESS_INTERVAL 2m) once it is enabled. When enabled, the webhook mounts at /v1/webhooks/github. The admin and reclaim credentials are deliberately separate logins from the server's, so "this deployment can run the privileged CLI" is a visible fact about a unit file rather than an inference.

tensorline-server fails closed. It prints tensorline-server: <err> and exits 1 when any of these hold:

• The database role is not de-privileged — the pool is opened as something other than tensorline_app. Fix TP_DATABASE_APP_ROLE and TP_DATABASE_DSN.
• The operator role topology is wrong — the operator role grants are not as the schema expects. Provision tensorline_operator correctly.
• PUBLIC holds EXECUTE on a privileged procedure — an omitted REVOKE. Revoke EXECUTE from PUBLIC on the control-plane procedures.
• log_parameter_max_length or log_parameter_max_length_on_error is not 0 — set both to 0.
• The schema is behind — the startup privilege sweep resolves every procedure signature, so a binary whose migrations have not been applied refuses rather than serving against a stale schema. Run tensorline-migrate first.

The server shuts down gracefully on SIGINT or SIGTERM with a 5-second drain timeout. A per-IP rate limit runs before authentication.

tensorline-migrate requires TP_MIGRATE_DATABASE_DSN naming the schema OWNER (distinct from TP_DATABASE_DSN). Migrations are forward-only — there are no down migrations. It prints applied N migration(s); … and then bootstraps the first owner from four variables — all four or none, and a no-op once an owner exists:

• TL_BOOTSTRAP_ORG_ID — the externally issued organization id.
• TL_BOOTSTRAP_ORG_NAME — the organization name.
• TL_BOOTSTRAP_OPERATOR_ROLE — the first operator's database login.
• TL_BOOTSTRAP_HUMAN_USER_ID — the first human user's id.

Principal lifecycle, token issuance, integration credentials, and gate policy are not reachable from the request path. They live behind tensorline-admin, which connects through TL_ADMIN_DATABASE_DSN and TL_ADMIN_DATABASE_PASSWORD_REF. Every subcommand takes -org <uuid>:

There is no --as flag. The acting operator is derived server-side from the database login you connect as, through the operator_login mapping. Provisioning an operator is two steps: create the database role (CREATE ROLE and GRANT tensorline_operator TO …, a cluster-global operation the schema owner must not be able to do), then bind it with map-operator-login, which refuses any role that is not correctly provisioned.

Create a principal and issue an agent token (placeholders only):

issue-agent-token prints the secret once to stdout and stores only its argon2id hash — capture it there.

Agents connect over Streamable HTTP on the single endpoint /mcp, presenting a scoped bearer token. The token format is tlagt.<org>.<prefix>.<secret> — it names the tenant before there is a row to read. Point a generic MCP client at your host with the token as a bearer credential (placeholders only — supply your own host and token, do not treat any one vendor's config schema as authoritative):

There are 20 tools. Every result is bounded — listings page with keyset cursors and documents come back in a byte window with an explicit truncated flag — so a response can never outgrow its declaration.

Reclamation is not on the MCP surface: a bot may scan and propose dispositions, but it can never authorise reclamation, and the call is not offered here at all.

tensorline-worktree runs on the machine that holds the worktree, because the server cannot see a filesystem. It authenticates with a scoped bearer token and holds no database credential. Set TL_SERVER_URL and a token via TL_TOKEN_FILE (preferred) or TL_TOKEN:

The lifecycle is scan → state → reclaim (dry-run) → reclaim → restore. Nothing is ever deleted: reclamation archives the whole directory, hashes the bytes, re-walks to confirm, then performs exactly one rename(2) into quarantine — reversible while quarantine exists.

-dry-run archives, verifies, and re-walks, then stops before authorising — so "would this be allowed, and what is unmet" costs nothing. The real reclaim is refused unless the credential belongs to an admin or an owner; a bot or member may scan and propose only. If quarantine is on another filesystem the whole thing is refused — there is no copy-then-delete fallback.

The OpenAPI document openapi/tensorline.yaml is frozen at 1.0.0-m11a — 57 paths, bearer-authenticated under https://{host}/api/v1. It is a frozen contract, not a served surface: there is no HTTP API yet (M11), so treat it as the shape the API will take, not something to call today.

The contract's events stream is documented as at-least-once: an event may be redelivered, and clients deduplicate on the envelope's event_id, never on the SSE transport id.

Apply tensorline-migrate before deploying any server or admin binary of that release. This is enforced, not remembered: a binary whose schema has not been applied refuses to start, and a previous release's binary cannot mint a credential against a newer schema.

Migration 0003_session.sql changes the bearer-token wire format from tlagt.<prefix>.<secret> to tlagt.<org>.<prefix>.<secret> and revokes every old token in the same transaction, recording one agent_token.revoked event per credential with reason = 'token_format_changed'. There is no compatibility window. Recovery is one runbook:

reissue-agent-tokens is idempotent and resumable, and each token is written to stdout before it is stored — so capture stdout. What this upgrade does not provide: no schema rollback (the migrator is forward-only), legacy credentials cannot be restored (their wire format is no longer parseable), and authentication is interrupted between the migration and the reissue — run it in a window where that is acceptable.

• TP_MIGRATE_DATABASE_DSN is required — set it to the schema OWNER DSN, distinct from TP_DATABASE_DSN.
• Server refuses with a role error — TP_DATABASE_APP_ROLE is not tensorline_app (the sibling tensorplane_app is refused).
• Server refuses over logging — set log_parameter_max_length and log_parameter_max_length_on_error to 0 on the cluster.
• no credential: set TL_TOKEN_FILE or TL_TOKEN — the worktree CLI has no token; set one of them.
• TL_SERVER_URL is not set — the worktree CLI cannot reach the server; export it.
• Reclamation refused because quarantine is on another filesystem — move -quarantine onto the worktree root's filesystem; there is no copy fallback.
• Reclamation refused for a bot or member credential — reclaim needs an admin or owner; bots may scan and propose only.
• Log warning stream-boundary reclamation is NOT configured — set TL_RECLAIM_DATABASE_DSN (and its password ref) to enable the sweep.

• A usable HTTP API or web UI — the contract is frozen but not served (M11).
• A GitHub replacement — source control and pull requests stay where they are.
• A hosted, multi-tenant SaaS sign-up.
• Forge integrations beyond github.com — no GitHub Enterprise Server, GitLab, or other third-party git hosts.
• External security-compliance certifications, customer-supplied model keys, or any availability or high-availability service-level guarantee.
• TLS built into the server, Docker images, or install packages beyond make build.
• Schema rollback or restoration of legacy-format credentials.

TensorLine is invite-only in the Closed beta. Request early access, or contact us; Closed beta participants receive access to the TensorLine repository.

TensorLine is part of the single platform plan — €35 per contributing developer, billed on unique non-bot git authors whose work the platform touched, trailing 90 days. There is no separate TensorLine price. See billing for the full model.

Get early access to the platform.

Every product is included in one platform subscription. Request early access and we'll onboard your team hands-on — free while we build toward launch.