tictac's Lightweight Agent Middleware

SUBMISSION PANIC ATTACK

Inspiration

AI Agents can already write code, run commands, and work with data. The harder problem is coordinating multiple Agents while keeping permissions, project boundaries, and execution history under control.

The starter kit showed that individual Agents could run, but it needed a middleware layer to manage how people, projects, Agents, workspaces, and protected resources interact. That became the focus of tictac's middleware.

What we built

tictac's middleware connects users, shared projects, Codex-powered Agents, persistent workspaces, and protected data.

Users can create Agents, give them instructions, chat with them across multiple turns, and let them work in isolated project workspaces. Projects act as the collaboration boundary: users can invite collaborators, assign specific Agents, and submit tasks to a project orchestrator.

The orchestrator can delegate work to participating Agents, including bounded parallel tasks. Each delegation is validated by the server and recorded as a parent-child run with status updates, progress events, results, errors, and cancellation support.

Protected resources are accessed through explicit, time-limited capabilities and fixed allowlisted projections. Agents cannot select arbitrary users, projects, credentials, or SQL queries to gain access to data.

How we built it

The frontend uses React, TypeScript, and Vite. The backend is a Fastify control plane backed by SQLite for authentication, permissions, projects, Agents, orchestration runs, messages, and audit events.

Codex CLI executes Agent work in persistent workspaces. Local runs can use disposable Docker, Colima, or Podman containers, while the same application can be deployed to Volcengine ECS. The project also includes automated unit, integration, and end-to-end tests.

What we learned

We learned that multi-Agent systems need a clear trust boundary. The browser should submit a task, but the middleware must decide which user, project, Agent, workspace, and resource are actually involved.

We also learned that orchestration is mostly a state-management problem. Delegated work needs durable parent-child relationships, waiting and resume states, cancellation, recovery, depth limits, and a readable timeline.

Challenges

The biggest challenge was allowing Agents owned by different users to collaborate safely. We had to enforce project membership, Agent ownership, explicit project assignment, credential validation, capability expiration, and least-privilege access.

Another challenge was making protected data useful without making it unrestricted. We solved this with fixed, sanitized projections for approved resources instead of exposing arbitrary database access.

Finally, we had to keep the system reproducible for local demos while supporting deployment to Volcengine ECS. Container-based runtimes allowed us to keep those environments consistent.