← All work

TOMA

Tool Orchestration Meta-Agent — governed tool use for the ecosystem

Last devlog: June 25, 2026

INVOCATION HOT PATH — DETERMINISTIC LULL PATH — PROBABILISTIC ← LLM NEVER CROSSES THIS LINE → HTTP GatewayReceives invocationsdeterministicOrchestratorValidate · dispatch · logdeterministicTool RegistryVersioned tool definitionsdeterministicExecutor LayerSandbox · proxy · file · LLMdeterministic (except LLM chat)Evidence LedgerEvery invocation loggeddurable · signedExternal ServiceHTTP target or sandboxexecutor-definedLocal LLMDiscovery & chat only — never invokesrequestresolvedispatchlogproxy / execsemantic embeddings (lull only)

Key boundary: The LLM never runs inside the invocation hot path. It provides semantic discovery between invocations; the invocation itself is pure deterministic Rust. An LLM in the invocation loop is a latency bomb and a determinism solvent — the boundary is what makes the gateway trustworthy as infrastructure.

Notable decision: Security policy travels with the tool definition, not the caller's input. The tool author controls where data goes, not the calling agent.

A meta-agent that governs how every other agent in the ecosystem calls tools. Any agent — Scarlett, the Diametric entities, future systems — can invoke a tool through TOMA's HTTP gateway, and the invocation passes through a deterministic pipeline: schema validation, dependency resolution, circuit breakers, execution, and a signed evidence ledger. The local LLM is confined to semantic discovery (which tool to call) between invocations; the invocation itself is pure deterministic Rust.

The architectural commitment that makes TOMA trustworthy as infrastructure: the LLM never runs inside the invocation hot path. It can help you find a tool; it cannot help execute one. The boundary is what makes sub-millisecond dispatch and full auditability possible — and what makes the system safe to expose to every agent in the ecosystem as shared infrastructure.

The security posture travels with the tool definition, not the caller's input. The Python executor runs inside a bubblewrap sandbox with no network and a writable working-directory jail. The file-read executor canonicalizes paths and rejects anything outside an allowlisted root. The HTTP proxy executor forwards to a target URL defined in the tool definition — so the tool author controls where data goes, not the calling agent. This means a compromised or hallucinating agent cannot redirect tool invocations to attacker-controlled endpoints.

Devlog posts about TOMA

The circuit breaker that could never recover

A circuit breaker that opens on failure but never transitions back to closed — because the recovery call was never wired in. A safety mechanism that becomes a permanent outage. Plus the circular health metrics that hid it.

The safety net that paid for itself on the first run

65 HTTP route tests caught two production bugs on their very first run — a deadlock and a runtime panic that 233 unit tests couldn't see. Then the same session imported a vLLM structured output finding from another project, added an HTTP proxy executor for a consumer project, and closed three security attack surfaces. Each piece of discipline paid for itself immediately.