so there's no flash<br>of the wrong palette before React hydrates. Mirrors the useTheme hook<br>(storage key "rw-theme"; classes rw-theme-dark|light|ascii). -->

Inside QM: We read Y Combinator’s company-wide agent runtime - RuntimeWire

RuntimeWire

You're browsing RuntimeWire with JavaScript disabled. Articles and<br>navigation work fully. Interactive features — search, comments,<br>and newsletter signup — require JavaScript.

Why it matters

QM turns YC's experience operating more than 50 internal agents into a self-hostable control plane, making permissions, persistent workspaces and fleet administration the core infrastructure problem.

Code reviewed: yc-software/qm at commit 7f2c916, the source revision recorded in npm package @yc-software/qm@0.1.4

Two days after Y Combinator published QM, the project had already drawn 6,600 GitHub stars, 700 forks, 68 pull requests and 14 open issues. That attention makes sense. QM is one of the first open-source attempts by a prominent organization to turn the local coding-agent pattern into shared company infrastructure.

The short description—“a multiplayer agent harness for work”—undersells the amount of machinery involved. QM is a durable, scoped operating layer for agents. A model loop is one replaceable component. Around it sits identity resolution, a permission graph, file and memory boundaries, credential brokering, command policy, human approvals, content screening, background scheduling, app publishing, audit logs and cloud-specific sandbox lifecycle management.

This is our follow-up to RuntimeWire’s launch report. We downloaded the public repository and npm package, pinned both to the same revision, read the runtime and deployment code, generated a fresh deployment directory and ran the package’s CLI test suite. The result is a source-level map of what QM does, where its strongest ideas live and which security promises should still be treated as experiments.

The short version

“Multiplayer” means people and rooms get isolated scopes. A direct message resolves to a personal scope; a channel or group message resolves to shared state. Context from a previous turn is retained only when every member of the current audience is entitled to see it.

The durable computer is the central product idea. Each scope gets files, installed software and long-lived processes inside a sandbox. The model can change while the workspace survives.

QM supports Pi, OpenCode, Codex and Claude Code. They implement one harness interface, though their capabilities differ. Codex, Claude and OpenCode expose native child-agent roles; Pi, the recommended default, runs the scoped turn loop without that native subagent layer.

The npm package is a deployment CLI. It contains no QM runtime. It generates a deployment repository and pins six prebuilt container images by SHA-256 digest.

Memory is plain text with model-assisted maintenance. Durable facts live as bullets in memory/MEMORY.md; recall uses case-insensitive substring matching, capped context and optional model consolidation. There is no vector database in the default path.

Security is a control plane, not a hardened isolation claim. Command rules, approvals, credential grants, audience floors and screening add useful friction. YC’s own threat model says command policy is bypassable, credential material is visible in sandboxes, screening is incomplete and the system is intended for a single trusted organization.

One security warning is already stale. SECURITY.md says published apps can be reached through bearer capability links. The pinned implementation deletes those query tokens, refuses to mint the associated cookie and tests that the link “grants nothing.” Built-in subdomain ingress now requires a portal session plus ACL membership, with a separate short-lived owner link for management.

What we actually inspected

The public repository’s history begins on July 29 with a commit called “Fresh repo history.” The latest package at reporting time was 0.1.4, published July 31 at 18:03 UTC. Its npm metadata points to commit 7f2c916360f1797a8ff2a77ce2ce40c5fabab087. That is the revision used throughout this piece.

Check<br>Result

npm artifact<br>@yc-software/qm@0.1.4, 126 files, 256,580-byte tarball, 1,211,641 bytes unpacked

Tarball SHA-256<br>51593f853eade42ed04f10e96e1c8ddffca876c5be0ee98d753636018ee5e473

Source correspondence<br>125 of 126 package files matched the pinned cli/ checkout byte for byte; the expected exception was manifest.json, which the release job rewrites with production image digests

Package metadata<br>MIT license, no runtime dependencies, npm signature and SLSA provenance record

CLI smoke test<br>qm --version, qm --help and qm init succeeded under Node 24.14.0

Generated project<br>Docker target with OpenAI and SMTP settings; config, secret templates, runbook, deployment skill, image manifest and sample sandbox extension were produced

CLI verification<br>Typecheck passed; 503 CLI unit tests passed, zero failed

Source size<br>74,814...