---
title: Introduction
description: Subako is the runtime your product's AI agents run on — long-running sessions, secure code execution, credentials, and skills, reachable from one API.
sidebar:
  order: 1
---

A model on its own answers a question and stops. Everything that turns that answer into work — keeping a run alive past a single HTTP request, holding the conversation so a dropped connection can pick it back up, executing code the model wrote, reaching a real system with a real credential — is runtime. It is also the part every team ends up building for itself, once per product.

Subako is that runtime, run as a service. Your product creates a **session**, streams its events, and answers the tool calls only it can answer. Subako holds everything else.

## The pieces

**[Agents](/concepts/agents)**

A model, a prompt, and the grants that go with them — published as immutable
versions a session binds to.

**[Sessions](/concepts/sessions)**

One unit of work, as an append-only event log you can read, tail, and
resume.

**[Skills](/concepts/skills)**

Bundles of knowledge and procedure, versioned in a workspace and granted to
an agent version.

**[Vaults](/concepts/vaults)**

Where a session's tool credentials live. The broker uses them; the model
never sees them.

## How a session runs

1. **You create a session**

    A session names an agent and, optionally, the vaults it may draw
    credentials from. It binds the agent's current version and never
    re-binds — a version published later does not change a session already
    running.

2. **You append input**

    A user message is appended to the session's log. That starts a **run**:
    the engine is claimed, handed the committed log, and pointed at the model
    proxy and the tool broker for that run alone.

3. **The run produces events**

    Assistant messages, tool calls, tool results, approvals — every one is
    appended to the log with a sequence number, then streamed. Nothing about
    a run lives only in a connection.

4. **Your client answers what it can**

    A client registers the tools it offers and answers the calls routed to
    it. Tools that reach an external service go through the broker instead,
    which attaches the credential.

5. **The run finishes — or you reconnect**

    Runs end in `run_completed`, `run_failed`, or `run_cancelled`. If your
    connection dropped somewhere in the middle, you reconnect with the last
    sequence number you saw and the log replays from there.

## What ships on day one

The CLI and the API. There is no web console: everything an operator does is a `subako` command, and everything your product does at runtime is an HTTP call against the Core API.

That is a deliberate ordering, not a gap to work around. Workspaces, agent versions, skills, vaults, and API keys are all configuration, and configuration that lives in a terminal is configuration you can put in a script, a Makefile, or CI.

:::note
Every operator task in these docs is shown as a `subako` command, and every runtime task as an HTTP request. Both reach the same Core API.
:::

## Where to go next

**[Quickstart](/quickstart)**

Organization to first running session, in one sitting.

**[Streaming events](/guides/streaming-events)**

Tail a session's log over SSE and resume after a drop.

**[Client tools](/guides/client-tools)**

Let the agent call functions that only your app can run.

**[CLI reference](/cli)**

Every command, grouped by what it acts on.