Implementation walkthrough

The earlier lessons take the pieces one at a time. This one follows a single case to show how they fit together: answering from documents, teaching the model a fixed output shape, letting it act only with a person's approval, and tracking the work of building it. It points at code more than any other lesson; the links open each repository on its principal branch.

A caveat: Adapta is an unaudited working prototype, docket is beta software for a single operator, and Tack's execution fleet is not in a tagged release (see each README: Adapta, docket, Tack). None is hardened for production. We use them because you can read every line of their code.

Scenario and architecture

Adapta supplies the knowledge (and behavior, if needed), docket governs the actions, and Tack tracks the building work. In the diagram, your app gets a cited answer from Adapta, and if the model wants to open a ticket, docket holds it until a person approves.

No product here ships the "support app"; that code, user sign-in and the interface are yours.

1. Knowledge: answering from the manuals with Adapta

Answering from the manuals means finding the passages that matter for each question and handing them to the model. That is RAGRAG Retrieval-augmented generation: finding relevant passages in your documents and adding them to the prompt before the model answers. (Embeddings and RAG), and Adapta packages it as a service. make up (README.md) starts its API, a background worker and its databases (docker-compose.yml). RAG alone needs only an ordinary CPU.

Using it takes four API calls: create a project of type rag, upload the manuals, create an endpoint, and issue an access key. The commands are in Adapta's guide Knowledge and behavior. Here is what happens inside:

1. Upload. upload_file checks the file type, saves it and replies at once, leaving indexing to run in the background.
2. Indexing. _index_file extracts the text, cuts it into chunks (chunk_text) and stores them with their embeddingsEmbedding A list of numbers that captures the meaning of a text, so texts with similar meanings get numbers that sit close together. (index_chunks). Re-indexing replaces a file's chunks instead of duplicating them.
3. Endpoint. create_endpoint refuses to create one for a RAG project with nothing indexed.
4. Question. _resolve_endpoint checks the key. retrieve finds the best passages, _build_system adds them, numbered, to the model's instructions, and _fit_context drops the least relevant ones if they don't fit.

The app calls the endpoint with any OpenAI-compatible client and gets citations with the answer.

2. Behavior: when an adapter is worth training

RAG supplies facts. It does not reliably make the model answer in a fixed shape, such as one label from a closed list or the same JSON structure every time. When instructions alone can't hold that shape, you train an adapterAdapter A small set of extra weights trained and attached to a model that otherwise stays unchanged, so its behavior changes without retraining the whole model., a small add-on that adjusts the model's behavior (Fine-tuning, LoRA and QLoRA). Here, the ticket classifier is the natural candidate. The risk is serving an adapter that learned nothing, and Adapta blocks that with an eval gateEval gate An automatic check that blocks a model or change from going live unless it passes an evaluation.: a test the adapter must pass before it can be served.

The score measures how well the adapter predicts held-out answers, not label accuracy, so you still need your own checks (Evaluating models).

3. Acting safely: a governed tool with docket

Opening a ticket, unlike answering, changes another system. As Governance and human-in-the-loop argues, code should decide whether an action runs, not the model. In docket, every tool call passes one checkpoint that applies rules, asks a person when needed and records the outcome.

Your own application uses docket as a library, docket-runtime, built from source and not published to any package index (DOCKET Architecture). In the repository's example (examples/runtime_embed.py), the application registers each tool, marking whether it writes, and sends every call through the runtime instead of calling the function directly.

The rules are JSON files in ~/.docket/policies/, matched against each call as a line of text that starts with the tool's name. This illustrative policy, in the format of the real template high-risk-deploy.json, requires approval for every open_ticket call:

{
  "id": "approve-open-ticket",
  "applies_to": ["*"],
  "hook": "pre_tool_call",
  "match": {"type": "regex", "pattern": "^open_ticket\\b"},
  "action": "require_approval",
  "message": "Opening a ticket needs a support lead."
}

Inside dispatch_tool, a call goes through these steps:

1. An unknown tool, or missing or unreadable arguments: denied.
2. The rules are checked (evaluate_tool_call), and the most restrictive verdict wins.
3. If approval is required, docket stores a request with sensitive values hidden (approval_create) and waits (wait_for_approval) for a person to answer, from the command line or over HTTP, MCPMCP The Model Context Protocol: an open standard that lets AI applications connect to tools, data and prompts through one common interface. or Telegram. No answer before the deadline means denied.
4. Every decision goes into an audit logAudit log A record of who decided what, when and under which rule; linking each entry to the previous one with a cryptographic fingerprint (hash) makes later edits detectable. where each entry is chained to the previous one by a hash, so later edits show (audit_log, verify_chain).

docket policies test tries a rule without executing anything (docs/commands.md), and run_agent_turn lets docket run the whole agent loopAgent loop The repeating cycle behind an agent: ask the model, run the tools it asked for, feed the results back and repeat, until it is done or hits a set limit. through the same checkpoint.

4. Tracking the work: items and runners in Tack

Building the assistant is itself a project. Tack is a project manager that can also hand a work item to a coding agentCoding agent An agent that works inside a code repository, reading files, editing code and running commands toward a task. (such as Claude Code or Codex) and record the run in the item's history. Its documentation describes two parts: a board that decides and records, and runnersRunner A worker program that picks up work, runs it close to the code and credentials it needs, and reports back. that do the work.

You add an item, then create an execution that assigns it to a runner, the machine that runs the agentAgent A system in which a model, in a loop, chooses the next action until it decides it is done or hits a stop condition. (agent-runners.md). A scheduler picks a runner with the right capabilities (select_runner). The runner writes down what it is about to do before touching any files (run_claimed), then launches the agent. Every run moves through a fixed set of states (validate_transition); how it survives crashes is covered in Durable agent execution.

5. A deployed chat: the yielab.com widget

For contrast, this site's pre-sales chat widget is actually deployed. Its repository is private, so only the architecture is described.

• Runtime and model. Next.js on Cloudflare Workers via OpenNext. The browser resends the conversation each turn, and the server treats it as untrusted. One call per turn, with no retries, goes to an Anthropic model through Vercel AI Gateway, which holds the key and caps spending.
• Checks, cheapest first. Size and origin, a bot check with Turnstile, a signed ticket for later turns, a turn cap, a per-address rate limit and a daily counter. Every check fails closed, blocking the request when in doubt, and the model call comes last.
• Grounding. No RAG: the service catalog fits in the instructions, built from an allowlist of fields so prices never reach the model.
• Output. Every reply is scanned for mentions of money, a hidden marker that would reveal leaked instructions, and excess length; a failure shows a fixed message instead. The lead email is built from validated data, never from the model's free text.
• Monitoring and evalsEval A measurement of how well the whole system behaves on realistic cases, including the steps it took along the way, scored with imperfect checks and read with statistics.. Conversations are traced in Langfuse (EU region) via OpenTelemetry. An offline test suite runs on every build; a paid model comparison is still pending.

6. Before real production

Putting it into practice

• Decide what you buy, adopt and write. The application, sign-in and helpdesk integration are always yours.
• Ask each component for evidence of its real state: known limits, roadmap, tests.
• BudgetBudget A hard limit on tokens, calls, time or money, enforced before the resource is spent. a security review before a prototype touches sensitive data.

Sources

• OpenNext for Cloudflare
• Vercel AI Gateway
• Cloudflare Turnstile
• Rate limiting in Cloudflare Workers
• Langfuse and OpenTelemetry

Go deeper

Each product's own documentation goes further into the architecture this lesson walks through:

• Architecture maps Adapta's containers and follows a question and a training job through them, step by step.
• DOCKET Architecture explains how docket's code is layered, what state it keeps (the chained audit log included) and how an application embeds its runtime.
• Introduction presents Tack's split into a board and runners, and why they are kept apart.
• Agent Runners & Fleet Execution covers enrolling runners, where credentials live, and which parts of the pipeline are proven end to end today.

Key takeaways

• Components solve parts of the problem; the application, identity and glue code stay yours. Tack tracks the building work, not the running assistant.
• Adapta serves an adapter only after it passes an eval gate on examples it never trained on.
• In docket, every action passes one checkpoint: rules, then a human approval that denies on silence, then a tamper-evidentTamper-evident A record whose modification is detectable, which is not the same as impossible to modify or delete. audit entry.
• In production, run cheap checks before the model and review the whole output before anyone sees it.

Check yourself