Creasura Blog · Behind the scenes

Behind the scenes: the Creasura Agentic OS Protocol, walked through with a real estate deal.

Our earlier posts showed what an agentic operating system does for a brokerage. This one opens the hood on the protocol underneath: CAOP v0.1, the specification behind Creasura One OSS.

By Creasura · November 1, 2026 · 8 min read · For technical readers

Read the full CAOP v0.1 specification ›

What an agentic OS is

CAOP defines an Agentic Operating System as a persistent, event-driven system that coordinates intelligent agents, tools, knowledge, and human decisions to achieve goals over time, while maintaining durable state, enforcing policies, verifying outcomes, and recovering from failures.

It doesn’t need its own LLM, browser, or coding agent. Those are execution capabilities. The OS decides how they’re invoked, coordinated, supervised, and remembered. For a real estate firm, ChatGPT or Claude does the reasoning and drafting; the OS keeps the deal on track.

The five abstractions

Provenance is the critical requirement for state. Here is a fact about our deal. It knows where it came from and when it was true:

// Fact (CAOP v0.1, illustrative values)
{
  "subject": "property/14-oak-lane",
  "predicate": "appraised_value",
  "object": 641000,
  "source": "evidence/appraisal-report-2026-11-24",
  "observedAt": "2026-11-24T15:10:00Z",
  "confidence": 1.0
}

The lifecycle, as API operations

Each of the eight stages maps to an operation. In a brokerage:

Observation is idempotent. If the email arrives twice, or a webhook replays, the same idempotency_key returns the existing observation instead of starting the deal twice:

POST /v1/observations
{
  "source": { "provider": "gmail", "resource_id": "msg_offer_accepted" },
  "type": "message.received",
  "idempotency_key": "gmail-msg_offer_accepted"
}
// → { "observation_id": "obs_901", "status": "accepted", "duplicate": false }

Try the execution state machine

The lifecycle stages are not execution states. Work moves through its own state machine, and the API rejects invalid transitions. Try it on the appraisal work item: press complete early, or verify before the appraisal is on record.

Every accepted transition is persisted with an actor, timestamp, reason, and correlation ID. Rejections use the standard error shape:

{
  "error": {
    "code": "INVALID_TRANSITION",
    "message": "CREATED → COMPLETED is not allowed for this work type",
    "retryable": false
  },
  "trace_id": "trace_14oak_0042"
}

Policies: advisory or enforced

CAOP’s most important line: a policy written in an assistant’s instructions is advisory. A policy enforced by a runtime before executing an action is an actual control. In a brokerage:

// Policy (CAOP v0.1)
{
  "id": "policy_client_email_approval",
  "scope": "capability:email.send",
  "condition": "recipient.type == 'client'",
  "effect": "require_approval",
  "version": "3"
}

Capabilities declare their sideEffectLevel, which tells the runtime how careful to be:

{ "id": "mls.search",        "sideEffectLevel": "none" }
{ "id": "deal.update_notes", "sideEffectLevel": "reversible" }
{ "id": "esign.send",        "sideEffectLevel": "irreversible", "authorizationRequired": true }

Approvals are scoped and expiring

When the buyer’s agent approves sending the offer, the approval covers that document, at that price, until a set time. A counter-offer needs a new approval, and an attempt after expiry returns POLICY_APPROVAL_REQUIRED with a fresh approval_request_id.

Verdicts name their checks

A commitment cannot be completed because an agent claims it is complete. Verification may combine deterministic checks, model evaluation, and human sign-off, and the verdict must say which ran:

POST /v1/verifications
{ "execution_id": "exec_closing", "criteria": ["funds_confirmed", "appraisal_on_record", "no_policy_violations"] }
// → { "verdict": "passed", "evidence_refs": ["artifact_title_wire", "artifact_appraisal"],
//      checks: deterministic ×2, model ×1, human ×1 }

Writes that can’t collide

POST /v1/records/commit
{ "execution_id": "exec_closing", "verification_id": "verify_closing",
  "expected_state_version": 42, "changes": [{ "entity_id": "com_14oak", "operation": "set_status", "value": "completed" }] }
// → { "state_version": 43, "status": "committed" }  or a version conflict if someone wrote first

Exactly-once execution can’t be guaranteed across outside services like e-signature or email. CAOP uses idempotency keys, a transactional outbox, and reconciliation of external side effects instead.

Events keep it moving

The OS is event-driven, not prompt-driven. Each event carries a correlation_id (the goal it belongs to) and a causation_id (what triggered it):

{
  "event_type": "commitment.deadline_approaching",
  "subject_id": "com_14oak",
  "correlation_id": "goal_q4_buyer_deals",
  "causation_id": "evt_appraisal_ordered",
  "payload": { "hours_remaining": 72 }
}

For a single firm’s deployment, an SQLite-backed event table and a scheduled processor are enough. No distributed broker required.

What the assistant actually sees

ChatGPT or Claude doesn’t get all eight stages as tools. It gets ten outcome-oriented operations, and the OS maps them to the full lifecycle internally:

Three levels

• L1Agentic workspace: organized context, tools, and reusable workflows in your assistant. Policies are advisory.
• L2Stateful Agentic OS: adds a minimal MCP state service, so goals, commitments, execution state, and recovery are durable and enforced.
• L3Autonomous Agentic OS: adds an event processor and execution runtime with policy enforcement and supervision.

The principle throughout: keep the protocol independent of both the model and the execution framework. The OS defines what valid work is, which transitions are allowed, what evidence is required, and who can authorize an action. The assistant stays free to reason, research, and draft inside those boundaries. Conformance is tested against the protocol with the model mocked.

CAOP v0.1 is Creasura’s specification for Creasura One OSS, not an OpenAI or Anthropic API. Values in the examples are illustrative.