Frequently asked, briefly answered.

A free, fair-source agent runtime, published as the @pleach/* scope on npm. Every LLM call your agent makes writes one typed row to a database you own — joinable to billing or compliance in one SQL query. @pleach/core is the reference implementation, in production today; the contract is wire shapes, not a TypeScript surface, so it isn't language-locked.

The runtime is free. @pleach/core, @pleach/tools, @pleach/base-tools, and @pleach/compliance ship under fair source (FSL-1.1-Apache-2.0) — source-available, usable in production, converting to Apache-2.0 two years after each release. You pay LLM providers and your own storage. A hosted gateway and hosted observability are in development; neither gates a runtime feature.

Teams shipping multi-tenant AI products that need per-customer cost and audit; platform teams attributing spend under one Anthropic Workspace or OpenAI Project; regulated surfaces where compliance asks show me every decision; and eval loops replaying production failures. If your app is a single-shot chat with no audit needs, reach for the AI SDK — it'll ship faster.

The AI SDK is the provider layer. @pleach/core wraps it with sessions, the four-stage lattice, family-locked routing, the audit ledger, replay, and checkpoints. A streamText call returns deltas with no shared identity; the Pleach equivalent yields the same stream, but every call beneath it lands as a row you can GROUP BY.

No — it composes underneath. The contract keeps doing its job: SSO/SAML, ZDR, Workspaces or Projects, the Admin or Usage API. Pleach adds the three things it doesn't: per-customer rollup inside one Workspace, a hash-chained AuditableCall row in your own Postgres, and replay across model snapshots. No new vendor — an npm install plus a table.

Different category. Those are complete agent products you launch and use; @pleach/coreis the substrate you embed in your own. If you're the user, install a harness. If you're shipping a customer-facing agent where each tenant needs its own session, audit trail, and invoice, you're past what a harness gives you.

Both, through the same surface. Every AuditableCall row is a typed record — turn, tool, subagent depth, tokens — addressable from code the same way it's addressable in SQL. Agent-friendly first; usable by devs because devs read the same surface.

Not yet; in development. @pleach/gateway is the planned multi-tenant routing SKU. Hosted Observe adds enterprise-scope features on top — SSO/SAML/SCIM, retention SLAs, SOC 2, signed audit retention. Neither gates a runtime feature, and the runtime stays trust-protected: no phone-home, no license check, no account to run it.

Yes for the 1.x line — @pleach/core, @pleach/tools, @pleach/base-tools, and @pleach/compliance ship under FSL-1.1-Apache-2.0 with stable contracts, in production at the consumer that extracted them. @pleach/react and @pleach/langchain are pre-1.0 previews; pin an exact version. The rest stay reserved until their first cut. Each npm page is canonical.

Six reference shapes ship as docs: customer support, research, coding, internal knowledge, multi-tenant SaaS, and regulated domain. Each is a wiring sketch on the same SessionRuntime.

@pleach/* is a fair-source ecosystem; the substrate was extracted from a production agent runtime and is maintained at github.com/pleachhq/core. Contact: getpleach@protonmail.com — same inbox for security disclosures.

Bug reports, feature requests, and PRs go to pleachhq/core issues. Security disclosures go to getpleach@protonmail.com — acknowledged within two business days. No paid bug-bounty program today; reports get a real response, not a payout.