Preloop 0.16.0: flows for software factories, Alibaba Cloud Model Studio and AWS Bedrock
Preloop 0.16.0 shipped on 21 September 2026. It is the largest release so far, and most of it serves one idea.
We run Preloop's own repository as a software factory. An issue comes in and an agent triages it. A second agent implements it in a worktree and opens a pull request. A third agent, from a different vendor, reviews it, and the two go back and forth until the PR is ready. A person merges. Every release then goes through a security stage that produces evidence a person signs off. Until now each of those steps was a flow on its own: a job with a trigger, a budget and a result. 0.16.0 is the release where flows become the parts of a factory: they start each other, share capacity, take instructions mid-run from a person or from the agent that started them, stop themselves when they are going nowhere, and leave a record you can search.
Flows that start flows
A flow execution can now start another flow of the same account as a child of itself, through the run_flow builtin tool. It is off until a flow opts in and names the flows it may call. Depth and fan-out are bounded, a cost ceiling covers the whole subtree so it cannot be dodged by delegating one level deeper, and every refusal comes back as a task record with a reason.
A parent that waits on its children parks on a new WAITING_FOR_CHILDREN status: the container, the runner and the runtime token are released and the timeout budget pauses, exactly as a park on a human decision does. When every child is terminal the parent resumes as a continuation of the same agent session, with one completion record per child. The execution page shows the tree, one row per child with state, duration and cost, and a rollup for the subtree. Stopping a parked parent stops its children at any depth.
This is what lets one flow be the factory's dispatcher. Our portfolio review is the first example shipped: it discovers the independently built projects in a repository, asks a human which to review, then starts one child per project per lens and parks while they run. Implement-then-review, triage-then-implement, and audit-then-fix are the same shape.
Runners that keep up
A factory has more than one job in flight. Private runners now hold several executions at once (default 2, ceiling editable in the console from 1 to 32); a connected process can lower the ceiling but never raise it.
For CI there is a one-shot mode. preloop runner fg --once --ephemeral registers a runner that belongs to a single process, runs exactly one execution, prints its console URL and unregisters on every exit path. It never touches the persistent runner's identity on the same host, and its exit status is the job's verdict. The run-flow GitHub Action wraps this: it installs a pinned CLI, triggers a flow with the payload on stdin and fails the job on the execution's verdict. With mode: runner it starts the ephemeral runner on the job's own VM and pins the execution to it, so the agent runs on the machine GitHub already gave you and nothing persistent needs maintaining.
Notes: agents steering agents, and humans steering both
Until now, once an agent was running you could watch it, approve or deny its tool calls, or stop it. You could not tell it anything. That is a problem for people, and a bigger one for agents. When a parent agent in Claude Code decides a subagent is heading the wrong way, its only tool is to kill it and start over, losing the context the subagent had built. Factories that delegate a lot pay that cost constantly.
0.16.0 adds notes: a short instruction delivered to a running agent at its next turn boundary. The gateway appends it to the next model request as a trailing user message, after policy enforcement and before anything reaches the provider, so no harness polls and a turn with no note costs nothing. Hook-path agents (Claude Code, Codex CLI, Cursor CLI) receive it through their hooks.
Agents send them through the send_note builtin tool. Off by default; when on, the scope is descent: a run may note the runs it started, at any depth, and nothing else, keyed on lineage the platform recorded rather than an id the caller passed. A sibling or a parent is refused and the refusal is audited. Wider scope is an explicit policy grant. The server stamps the author, so every console surface shows who wrote a note and with what kind of credential. A dispatcher flow that spots a child drifting can now say "the fixture changed, use the new one" instead of stopping the run and paying for the checkout twice.
Humans send the same notes from the console (agent page or live execution), or from preloop notes send in a terminal. Each note shows its state (pending, delivered, acknowledged, cancelled, expired), and an undelivered one can be withdrawn.
The other half is knowing when to give up. A no-progress guard reminds a flow run whose checkout is still clean after a set time, then stops it after a grace period if it still has nothing to show. The result is classified agent_no_progress rather than "unknown", and retry_on_no_progress allows exactly one retry, optionally on a stronger model. Unattended runs that spin are the quiet cost of a factory; this makes them a bounded, labelled event.
The record: session search, retention, legal holds
A factory produces transcripts nobody reads until something breaks. Every governed session is now searchable: keyword out of the box, semantic over embeddings as an account opt-in, and a hybrid mode that fuses both and says which half found each result. When the semantic half cannot run (no opt-in, daily cap reached, provider down) you get keyword results with a named reason rather than an error. Saved searches keep a query, mode and filters under a name.
The index sits under the same rules as the sessions. This release also brings record retention settings per class of record, with a 183 day floor and a 365 day default, and legal holds that freeze one execution, approval or evidence pack past its retention date. The audit log itself is now a per-account hash chain with signed checkpoints, and a period export ships as a signed bundle that preloop evidence verify checks offline against a key you keep. Every search is itself audited.
Alibaba Cloud Model Studio (Qwen) and AWS Bedrock
A factory picks a model per stage, and two more catalogs are now on the menu, both with live discovery.
Alibaba Cloud Model Studio is a named provider in the add-model dialog. Fetch Models lists the live catalog for the region the API URL names (Beijing, Singapore International, a Singapore workspace host, US), and the chat adapter covers streaming, tool calls, provider usage, thinking controls and cache markers, so Qwen 3.8 Max works as a full coding-agent model behind the gateway, with budgets, policies and audit. Costs are estimates seeded from the Singapore International list prices, with live prices overlaid per host and region; CNY sites stay unpriced rather than guessed.
AWS Bedrock takes an access key, secret and region, and lists foundation models from the Bedrock control plane, filtered to active text-output chat models. One related guard: preloop agents onboard for Claude Code now warns when CLAUDE_CODE_USE_BEDROCK is set in the shell, because that routes traffic past the gateway's budgets, policies and accounting.
Repo review presets and OTLP export
The security audit presets from 0.15.0 gain siblings that read a whole repository and write a report, never code: architecture strategy review (declared intent versus observed structure), code health review, a standards compliance walk that refuses to run without a named standard, and a docs currency review that checks five kinds of claims in your documentation against the code. Every report opens with the same one-page verdict cover. The portfolio review above fans these out across projects.
OTLP export, off by default, emits GenAI spans for governed model calls and MCP tool calls, with the same token and cost attributes the console shows, to any collector. The guide covers a generic collector, Langfuse and Datadog.
Also in 0.16.0: an "unpriced is expected" marker for models whose requests carry no price; persistent flow execution that delivers a flow's prompt to a long-lived agent such as Claude Code as one audited message; Pi and DeepSeek Harness agents; an Activity feed, an Inventory box, editable model prices and user avatars in the console; a Cost page that loads totals first; Hermes and OpenClaw plugin fixes; and context-window hints for Codex and OpenCode so they stop compacting early.
The full changelog is in the 0.16.0 release notes.