Loops vs Graphs: Why Agent Architecture Needs Both (and a Compiler Between Them)

A developer argues that agent architectures should not be split into loops versus graphs, as both are incomplete, and introduces HURCULES, a compiler that sits between repositories and agent runtimes to produce verified capability packages with provenance, security scans, and license classification. The tool aims to give loops verified nodes and graphs verified edges, addressing supply chain risks in AI agent development.

The False Dichotomy The agent ecosystem is split into two camps: Camp Loops Boris Cherny, OpenAI Agents SDK, LangGraph : "Agents are loops. Plan → act → observe → repeat. The loop is the atomic unit." Camp Graphs Steve Yegge, Gas Town, LangGraph DAGs, CrewAI : "Agents are graphs. Nodes are agents/tools. Edges are handoffs. The graph is the architecture." Both are right. Both are incomplete. What Loops Get Right Loops capture temporal behavior — the iterative, self-correcting nature of agent work: - Replanning on failure AdaPlanner, ReAct - Budget enforcement token caps, step limits, cost ceilings - Verification gates process reward models, extraction floors - Learning loops feedback → lessons → advisory → suppress A loop is a control structure. It says: keep going until condition X. What Graphs Get Right Graphs capture structural composition — how capabilities connect: - Handoffs peer-to-peer control transfer - Parallel execution swarms, polecats, fan-out/fan-in - Supervision trees Erlang/OTP-style restart strategies - Provenance who called whom, with what context A graph is a dependency structure. It says: A feeds B, B feeds C, C can restart A. The Missing Layer: A Compiler Between Repos and Runtime Here's what neither camp addresses: Where do the nodes come from? Today: - You find a repo on GitHub - You hope it implements what it claims - You wire it into your graph/loop - You pray it works There's no verification layer. No SBOM. No attestation. No provenance. HURCULES: The Compiler Between Repos and Runtime HURCULES sits between the repository and the agent runtime: GitHub Repository → HURCULES → Verified Capability Package → Agent Runtime Loop or Graph It doesn't care if your runtime is a loop or a graph. It produces verified capabilities that work in either. What HURCULES Compiles | Input | Output | |-------------------------------|---------------------------------------------------| | Raw repo any language | Deterministic map file tree, deps, entry points | | Map + LLM analyst | Candidate capabilities with file citations | | Candidates + Devil's Advocate | Challenged, evidence-backed capabilities | | Challenged + Human approval | Verified capability package registry entry | The Package Contains - Capability spec name, description, interface - File-level evidence exact files implementing each claim - Provenance source repo, commit hash, timestamp - Approval trail who approved, when, what they saw - License classification permissive/copyleft/proprietary/unknown - Security scan secrets, injection patterns, malicious patterns Loops Need Verified Nodes A loop that runs on unverified capabilities is a liability: - The loop replans, but the capability was never real - The budget enforces cost, but the capability is malicious - The verification gate passes, but the evidence was hallucinated HURCULES gives loops verified nodes. The loop becomes a control structure over attested capabilities. Graphs Need Verified Edges A graph with unverified nodes is a supply chain attack waiting to happen: - Node A hands off to Node B - Node B was never verified - The edge carries malicious context - Supervision restarts Node B, but the capability is still broken HURCULES gives graphs verified nodes with provenance. The graph becomes a composition of attested capabilities. The Architecture: Compiler + Runtime ┌─────────────────────────────────────────────────────────────┐ │ AGENT RUNTIME │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ Loop │ │ Graph │ │ Hybrid │ │ │ │ control │ │ structure │ │ both │ │ │ └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ │ └─────────┼────────────────┼────────────────┼──────────────────┘ │ │ │ └────────────────┼────────────────┘ ▼ ┌─────────────────────────┐ │ VERIFIED CAPABILITY │ │ REGISTRY │ │ HURCULES OUTPUT │ └────────────┬────────────┘ │ ▼ ┌─────────────────────────┐ │ HURCULES │ │ REPO → CAPABILITY │ │ map → analyst → │ │ advocate → consolidate │ │ → compile → approve │ └────────────┬────────────┘ │ ▼ ┌─────────────────────────┐ │ GITHUB REPOSITORIES │ │ raw, untrusted │ └─────────────────────────┘ Why This Changes Everything For Loop Builders - Your loop never runs on hallucinated capabilities - The extraction floor catches empty/unparseable output - The devil's advocate challenges every claim - Cost routing picks the right model tier for the job For Graph Builders - Your nodes have provenance source, commit, approver - Your edges carry verified context not raw LLM output - Your supervision tree can audit the capability, not just the process For Enterprise - SBOM-for-Agents is now real - Compliance teams can audit the supply chain - Security teams can block unapproved capabilities Part 2: Loops vs Graphs: Why Agent Architecture Needs Both and a Compiler Between Them - Legal teams can verify license compliance The Honest Ceiling We don't claim perfection. HURCULES's semantic recall is ~0.10 against human gold labels. We publish this number. Every release. Because the trust layer must be honest about its own limits. A trust layer that lies about its recall is worse than no trust layer. What's Next 1. R1: Extraction quality lift gold-label alignment → recall ~0.20+ 2. R2: Private-repo ingestion + Authentik OIDC Pro tier 3. R3: Hosted dashboards + SBOM export Enterprise tier 4. Registry growth: 26 → 60+ verified capabilities 5. Runtime integrations: Native Hermes, LangChain, CrewAI support The Thesis The agent ecosystem doesn't need another loop framework or another graph framework. It needs a verified capability supply chain. HURCULES is that supply chain. Loops and graphs are the consumers. Try it: pip install hurcules → hurcules ingest --repo <any-repo The ceiling report is at data/ceiling-report.json. The evidence is in every package. Measured, not promised.