Aether
The fabric for enterprise-class AI agents.
Aether is the open-source control plane that bundles messaging, JIT orchestration, identity, audit, agent state, and durable tasks into one protocol — so your proof of concept is enterprise-ready on day one.
go install github.com/scitrera/aether/server/cmd/aetherlite@latestThe demo works. Shipping it doesn’t.
Anyone can prototype an agent in an afternoon. Making it auditable, multi-tenant, durable, observable, and access-controlled is months of integration across messaging, orchestration, identity, audit, state, and task management. That’s the gap between a demo and an enterprise deployment — and where most agent projects stall.
One protocol replaces the six you’d otherwise integrate.
Aether collapses the agent infrastructure stack into one gRPC control plane. Identity, audit, JIT orchestration, durable tasks, and agent state are already wired together — so the system you prototype this week is the system you deploy next week.
For most agent backends, adopting Aether means less infrastructure to maintain — not another piece bolted on. It solves a layer above general-purpose messaging and workflow engines, so the boxes you would have stood up separately don’t need to be there at all.
Six jobs, one fabric.
Aether collapses the agent infrastructure stack into a single, opinionated control plane.
One stream. No side channels.
A single bidirectional gRPC stream carries messages, state ops, configuration snapshots, task assignments, and signals — multiplexed per principal. Nothing for you to wire up.
Agents that spin up on demand.
Senders don’t need to know if a target is online. Aether persists the message and asks your orchestrator to launch the agent — idle out, scale to zero, version-pin, sandbox, all without coordination in your code.
Execution that survives the worker.
Atomic claim, checkpoint, complete, retry. Tasks outlive process crashes and network partitions; stragglers are reaped automatically when their lease expires.
Identity at the protocol layer.
Eight typed principal types with routing permissions enforced before your code runs. Casbin-backed ACL with scoped authority grants, fallback policies, and decisions that can pivot on who originally triggered the request.
Every event, accounted for.
Connections, messages, KV writes, ACL decisions — captured by default, retained how long you choose, queryable from the admin API. Compliance is not a separate project.
Stateless gateways, no coordination.
All shared state lives in Redis and RabbitMQ Streams. Add gateways behind a load balancer; clients reconnect to any instance and resume from the persisted offset.
From customer support to cross-region orchestration — one fabric.
Aether is the substrate. Whether you ship a single chatbot or wire legacy services into a swarm of agents across regions, the protocol is the same.
Customer-facing agents
Support, sales, and concierge agents that hold a session per user, escalate to humans, and leave an audit trail your compliance team will sign off on.
Internal copilots & RAG
Workspace-scoped retrieval agents that respect SSO identity, share config via push-on-connect, and never leak data across tenants.
Multi-agent collaboration
Specialist agents — planner, researcher, executor — coordinate over typed topics with enforced routing. No prompt-engineering the orchestration layer.
Human-in-the-loop ops
Users connect alongside agents with window-scoped sessions. Approvals, escalations, and overrides flow over the same protocol with the same audit trail.
Durable task pipelines
Long-running work that survives worker crashes. Atomic claim, checkpoint, complete, retry — and a reaper that fails stragglers when their lease expires.
Cross-datacenter agent fabric
Securely route agents and tasks across regions, clouds, and air-gapped sites. Workspace-scoped identity, mTLS between gateways, audit at every hop.
Wrap REST & WebSocket APIs
A proxy sidecar turns existing HTTP and WebSocket services into Aether-native participants. Bring legacy systems into your agent fleet without rewrites.
Multi-tenant SaaS agents
Workspace is part of identity. One deployment, many tenants isolated by default — and when sharing is intentional, ACLs scope the path and audit it.
Edge & embedded agents
AetherLite runs as a single binary on a Raspberry Pi or an air-gapped VM. Same SDKs as the clustered gateway; upgrade when you outgrow it.
Three layers. One protocol.
Your agents speak gRPC to Aether. Aether speaks to standard infrastructure. The same wire format runs on a laptop and in a multi-region cluster.
Connection = Lock = Heartbeat. The active gRPC stream is the exclusive lock for an identity, and its liveness is the heartbeat. When the stream closes, the lock releases and the principal becomes available — no separate heartbeat API to maintain.
Connect in Minutes
Official SDKs for Go, Python, and TypeScript.
package main
import (
"context"
"fmt"
"log"
"github.com/scitrera/aether/sdk/go/aether"
)
func main() {
client, err := aether.NewAgentClient(aether.AgentOptions{
ClientOptions: aether.ClientOptions{ServerAddr: "localhost:50051"},
Workspace: "default",
Implementation: "my-agent",
Specifier: "worker-1",
})
if err != nil {
log.Fatal(err)
}
client.OnMessage(func(ctx context.Context, msg *aether.Message) error {
fmt.Printf("Received from %s: %s\n", msg.SourceTopic, msg.Payload)
return nil
})
ctx := context.Background()
if err := client.Connect(ctx); err != nil {
log.Fatal(err)
}
defer client.Close()
client.SendToAgent("default", "other-agent", "main", []byte("Hello from my-agent!"))
client.Run(ctx)
}Typed principals
Agent, Task, User, Orchestrator, WorkflowEngine, MetricsBridge, Service — each with routing permissions enforced at the protocol, not in your app code.
Trigger-aware ACL
Casbin-backed rules with scoped authority grants and on-behalf-of auth. Decisions can pivot on the original trigger, not just the immediate caller — and every grant is audited.
Audit by default
Every connection, message, KV write, and ACL decision can be captured. Batched async writes, configurable retention, queryable from the admin API.
Workspace isolation
Workspace is part of identity. Cross-workspace routing is default-deny — tenants stay isolated unless an explicit ACL grants the path, and every cross-tenant send is audited.
Cross-region & cross-network
mTLS between gateways and proxy sidecars that turn REST or WebSocket services into Aether-native participants. Federate agents across datacenters, clouds, and air-gapped sites.
mTLS + OAuth
Mutual TLS for service-to-service, OAuth/JWT for user sessions, short-lived task tokens for orchestrator-launched compute.
OpenTelemetry built in
Spans on routing, ACL decisions, and orchestration; Prometheus exposition on the admin port. Plug into the observability stack you already run.
Quotas & rate limits
Per-workspace connection and message quotas, enforced in Redis. Stateless gateways, predictable failure modes, no leader election.
// Audit event
{
"timestamp": "2026-05-10T12:00:00Z",
"principal": "agent::researcher-1",
"workspace": "acme",
"operation": "KV_WRITE",
"resource": "/state/agent/snapshots/run-42",
"decision": "ALLOW",
"trigger": "user::ops/alice",
"session_id": "8f2b3c..."
}# ACL policy (trigger-aware)
p, agent::*, kv, /public/*, read, allow
p, agent::*, kv, /state/agent/{sub}/*, rw, allow
p, agent::*, kv, /tenant/{trigger.workspace}/*, read, allowDeploy Your Way
AetherLite
Single Go binary with embedded SQLite and Badger. No Redis, no RabbitMQ, no PostgreSQL. Perfect for development, testing, and edge deployments.
Docker Compose
Multi-instance deployment with nginx load balancer, Redis cluster, RabbitMQ with Streams, and PostgreSQL. Ready in minutes.
Kubernetes
Helm charts, cert-manager integration, horizontal pod autoscaling, and session-affinity ingress. Battle-tested for production workloads.
Apache 2.0. Full source. No lock-in.
Aether is an open-source control plane, not a freemium funnel. Every capability on this page is in the repo you can clone today.
Apache 2.0
Permissive license. Use it commercially, fork it, vendor it, ship it. No source-available bait-and-switch.
Self-host anywhere
Your laptop, your cluster, your air-gapped data center. No managed-only features held back to push you to a SaaS tier.
Built to be inspected
Full source on GitHub. Architecture docs derived from the running code. Security and audit are not optional add-ons.
One command to a backend that's enterprise-ready on day one.
AetherLite is a single Go binary with embedded storage. Audit, ACL, durable tasks, JIT orchestration — same protocol, same SDKs, same guarantees as a clustered deployment. No Redis, RabbitMQ, or Postgres needed to start.
go install github.com/scitrera/aether/server/cmd/aetherlite@latest