# Overview

> How tentaflake turns a NixOS host into a reproducible platform for isolated AI agents.

Canonical page: https://docs.tentaflake.dev/getting-started/overview/

tentaflake is a generic NixOS flake template for running isolated AI agents on one machine. It provides reusable modules, agent builders, an installer, and operational checks for Hermes and ZeroClaw.

## Agent adapters

The [adapter API](https://docs.tentaflake.dev/configuration/agent-adapters/) exposes `mkAgent` alongside the compatible Hermes and ZeroClaw builders. The registered `openclaw` adapter is a stopped refusal scaffold: it creates no OCI container, and an explicit start fails. A reviewed image and actual model, Research, execution, and lifecycle acceptance are still pending.

The same API accepts generic digest-pinned OCI definitions with explicit commands, ownership, workspace, and resources. These workloads remain stopped pending capability admission; generic model and Research hooks are not accepted, and the generic contract requires `balanced`.

Use `tentaflake runtimes --json` to discover presets. [Installed-host onboarding](https://docs.tentaflake.dev/configuration/agents/#add-an-agent-on-an-installed-host) offers `agent template` and `agent validate|plan|import` for stopped additions. Import does not track files in Git, rebuild, activate, or start services; review and track the definitions before an explicit host update.

The [LLM broker](https://docs.tentaflake.dev/configuration/brokered-egress/#streaming-model-responses) offers bounded Chat Completions and Responses streaming when explicitly enabled per agent; streaming remains disabled by default and does not establish vendor compatibility.

## Infrastructure and evidence

The system is designed around three properties:

1. **Isolation:** each agent runs in a hardened container with explicit resources, workspace ownership, and networking.
2. **Controlled access:** a per-agent model broker, the pinned web research relay, and disposable workers narrow the paths from an agent to external services and host tools.
3. **Recovery:** declarative configuration, quotas, backups, and testable NixOS generations make failure modes observable and reversible.

The `dev` security profile preserves compatibility and is not a security boundary for untrusted, continuously running agents. Review [security profiles](https://docs.tentaflake.dev/security/profiles/) and the [threat model](https://docs.tentaflake.dev/security/threat-model/) before production use.

## Next steps

- [Install a dedicated host](https://docs.tentaflake.dev/getting-started/install/)
- [Configure your first agent](https://docs.tentaflake.dev/configuration/agents/)
- [Understand the architecture](https://docs.tentaflake.dev/concepts/architecture/)