Components

These are small tools, not one platform. Each component has one job: witness evidence, gate a proposal, execute a bounded effect, preserve state, expose an operator decision, or audit a refusal class.

Use them independently. The interesting part is the seam between them: what each component accepts, what it refuses, and what receipt survives inspection. NQ does not require Docket; Docket does not require Night Shift. One composition has actually been exercised — the four-office governed vertical of 2026-07-26, featured on the home page. That is one earned relationship between four of the components below. It is not the product, and it is not evidence that any other pairing composes.

Maturity enum: operational / alpha / specimen / reference / building / legacy. Version (when shown) is metadata, not a claim. Nothing on this page is armed for live cage execution — that refusal is by construction. Dated bounded claims and promotion conditions live in the status ledger. See limits.

Planes

Components grouped by what kind of work they do. A plane is analytical: it says what role a component plays, not what it depends on.

witness / testimony	nq · porter · verifier
gate / authority	ag_ng · agent_governor · wicket · standing · linear_accountant
governed execution	docket
operator surface	maude · gov-webui · vscode-governor
memory / read	continuity · spine
proof artifact	lean
proposal / deferred work	nightshift

Exercised composition (not a prerequisite stack): nightshift proposes → docket prepares → ag_ng authorizes → docket executes and settles → nq evaluates → nightshift emits a read-only disposition. Ran once, 2026-07-26, with no code changes in any office. Each component works standalone — absent any neighbour, the seam yields honest absence or cannot-testify, never silent failure.

Witness / testimony plane

Observe and report. These components produce evidence; they do not gate authority. Cannot-testify is a first-class outcome, not an error.

nq witness operational

role: Witness / testimony. Observes substrate facts and packages each finding with its evidence; not authority-bearing.
handles: Observation-to-claim preflight for operational systems. Witnesses disk health, service state, host metrics, and similar substrate facts so each finding is traceable to an observation. When evidence is unavailable, emits cannot-testify rather than a smooth nothing — the refusal is the product surface, not an error to handle.
refuses: Producing a finding it cannot trace to an actual observation; smoothing over evidence loss.
office: Testimony, claims, and reliance in the four-office vertical. Imports Docket attempt dossiers and Continuity rely snapshots; answers consumer-indexed reliance questions. It does not authorize, execute, discharge obligations, or resolve contradictions, and a reliance refusal is never the negation of the underlying claim.
maturity: Operational, pre-1.0 — public GitHub, Apache-2.0, 15+ operator docs. Operator calibration 2026-07-05: “usable today by a normal SRE.” Named limit: consumer identity is configured, not authenticated. The office designation states jurisdiction, not stability — read the compatibility policy before building automation against its surfaces.

nq-witness witness reference

role: Witness / testimony. The supporting observation protocol and profile set that NQ pulls from; a specification surface rather than a runtime service of its own.
handles: Observes local substrates and serves state for collection. Profiles and worked examples are the deliverable.
refuses: Presenting an unobservable substrate as a healthy one.
maturity: Reference — supporting protocol; scope and role are stated in its own status banner.

porter witness alpha v0.1

role: Witness / testimony. Substrate courier: transports work and reports the outcome as evidence, including whether the exit code was actually observed.
handles: Executes work via ssh, serial, or recipe substrates and packages the outcome as a record.v0 with exit-code custody. A record with exit_code_observed: false is refused, not promoted.
refuses: Marking work complete when exit_code_observed is false; emitting outcome vocabulary that belongs to the caller’s domain (porter’s outcomes name transport facts, not admissibility verdicts).
maturity: Alpha — three substrates (ssh, serial, recipe), 19 tests, charter commitments closed. demo/refused-exit.sh produces a live refusal specimen. Serial substrate may slip to a subsequent point release.

verifier witness operational

role: Witness / testimony. Formal constraint sidecar: attests whether a proposal violates a declared invariant set.
handles: Formal constraint checking via a Z3 sidecar. Accepts a declared invariant set and a proposal; refuses proposals that violate the constraints and emits a verdict receipt. The specimen at the front of the README is the stale-standing denial.
refuses: Proposals that fail the declared invariants; constraint-checking without a named clock basis on temporal predicates.
maturity: Operational — lib, CLI, and MCP server; specimen pinned to README.

Gate / authority plane

Gate work. These components decide whether a claim, intent, or permission may become a premise for action, and emit receipts for the decisions they make.

ag_ng gate exercised

role: Gate / authority. The canonical exact-work admissibility and issuance implementation — the authority-bearing decision of the four-office vertical. A Rust hard successor to the classic Python governor, with no compatibility surface between the two.
handles: Decides whether exact prepared work may receive authority, and burns one-use decision authority. Workers propose; the effect daemon alone compiles, ratifies, and executes exact effects. Its pure kernel is crosswalked against a public admissibility calculus through an explicit, non-authorizing adapter.
refuses: A second issuance for the same decision. It is not a universal authority office: mandate custody (the standing jurisdiction) and spendability accounting (the linear_accountant jurisdiction) are separate offices it neither owns nor absorbed, and the current vertical does not exercise them.
maturity: Part of an operationally reusable vertical — its issuance path authorized the three-office vertical (2026-07-25) and the four-office pilot (2026-07-26). Explicitly not production deployable: the issuance surface is a library face exercised by harness, and the decision-burn ledger is in-memory per process.

agent_governor gate legacy v2.8.1

role: Gate / authority, legacy / historical as of 2026-07-26 — maintained, not extended. The classic Python admissibility kernel for AI coding agents: every proposed file write and command requires a typed claim before it runs.
handles: Each proposed action requires a typed claim with pointers; the governor verifies and produces receipts. Language is a proposal, not an authority. Supervised runs, refusal gallery, governed workflow, and specimen corpus are runnable from a fresh clone. It remains the custody home of the frozen conformance corpus, and Night Shift still imports its bounded diagnostic drill helpers — diagnostics only; no authority, policy decision, credential, or capability crosses that wire.
refuses: Prose as authority; tests-passing treated as code-ready-to-land; permissions exercised after their observation horizon; a rehearsal that confers operational effect.
maturity: Legacy — ~14.6k tests; the demo path re-verified 2026-07-29 (exit 0, from an editable install rather than a cold clone). Receives no new authority features. Bootstrap limits: in-process custody forgeability, operator-fiat standing, live cage unarmed by construction.

wicket gate operational SPEC v0.3

role: Gate / authority. Intent preflight kernel — decides whether an actor’s proposed action may become a premise before any effect runs.
handles: Single-call admissibility preflight for intents. Refuses intents from revoked or out-of-scope actors. One call in, one typed verdict out.
refuses: Intents where the actor cannot demonstrate standing or scope; revoked actors.
maturity: Operational — SPEC v0.3, 21 fixtures, wicket-guard absorbed and tombstoned.

standing gate operational

role: Gate / authority. Permission observation with observation-age receipts — a permission valid at check is not automatically usable at spend time.
handles: Produces standing receipts that carry when the permission was seen and when it expires. The gap between check and action is measured on a named clock basis, not wall time.
refuses: Attesting a permission it cannot verify; a spend whose standing observation lapsed past its horizon by exercise time (standing_before_spendability_not_bounded).
maturity: Operational — specimen flow runs; HMAC-only identity substrate (named limit; mTLS/OIDC deferred).

linear_accountant gate reference

role: Gate / authority. Conserved capacity and spend — the reference boundary that ensures no component mints authority from an ALLOW verdict.
handles: An authorized action still refuses without capacity usable at action time. Frozen as a reference seam until a consumer trigger; the transport layer is deliberately deferred.
refuses: Minting capacity from an ALLOW verdict (the component is named consumer, not minter). The no-mint invariant is the load-bearing property; no transport is built until it has a consumer.
maturity: Reference — pushed, frozen by design. “Respect the freeze” is the standing operator ruling.

Governed execution plane

Turn an authorized decision into an exact effect, and settle it with evidence. Preparation authorizes nothing; settlement is a description of what occurred, never a safety claim.

docket governed execution audited baseline gwr-greenfield-v0.1

role: Governed execution and settlement. A local-first governed work runtime for exact AI-mediated repository effects: the trusted runtime establishes mechanical facts only, domain modules own semantic judgments, and labor providers produce candidate artifacts with untrusted provenance.
handles: Prepares exact bytes as an attempt; exports a canonical authorization request; verifies an authenticated issuance against its own stored attempt rather than the record’s echoes; mints local, attempt-bound, single-use standing; executes through a minimal broker; and renders a canonical dossier. Agent-neutral but currently Git-effect-specific.
refuses: Any proposal outside its one admitted effect class — the atomic Git target-ref transition — with a typed refusal before standing is issued, a reservation created, a dispatch identity minted, or a provider runs. Its own reliance bridge refuses safe-to-merge as permanently inadmissible. Journal content that does not hash to the persisted digest is withheld explicitly rather than shown.
maturity: Audited baseline frozen as gwr-greenfield-v0.1 — 125 tests, four gates exiting 0 in both debug and release profiles at the freeze. A working runtime with a full audit record, not a production-hardened product; a source-install path, not a published-package promise. Three trust-model premises are load-bearing assumptions: exclusive broker custody of the governed ref, same-UID trust of the provider and broker binaries, and monotone clock readings. Read trust-model.md before relying on anything.

Operator surface plane

Operator-facing surfaces over the same daemon. Maude is a TUI; gov-webui is a browser path. Both consume the governed shell contract; neither is a hard requirement for the components they expose.

maude operator surface operational v2.4.0

role: Operator surface. TUI for supervised agent sessions over agent_governor — where the human sees, approves, denies, or discards.
handles: Every tool call appears in the decision queue before it runs. When the session ends, the operator reviews the diff and either keeps or discards the changes. Governed-plan runs ingest a plan.md, verify citations, and report as a ReviewPacket.
refuses: Silently promoting session output — promotion is an explicit operator act; the report surface says “not recorded” rather than inferring; used > granted renders OVERRUN, never “authorized.”
maturity: Operational — 301 tests, supervised loop, governed-plan path, M-4 run report, live-daemon smoke verified.

gov-webui operator surface alpha v0.5.0

role: Operator surface. Browser path over the governor daemon — the same decision queue and promotion controls as maude, without a terminal app.
handles: Legacy chat modes plus desk mode v0 in progress: decision queue, sessions board, and promotion keep/discard, consuming the same shell contract as maude so the two surfaces cannot drift on the wire protocol.
refuses: N/A (operator UI surface; the decision-door invariant — resolve only what the daemon's live feed offers — is enforced daemon-side and re-checked at the route).
maturity: Alpha — currency repairs done, DaemonShellClient landed (513 tests); desk routes in progress.

vscode-governor operator surface alpha

role: Operator surface. Editor integration — wraps the governor check CLI for VS Code and surfaces findings inline.
handles: Security and continuity findings from governor check, rendered inline in the editor. CLI-wrapper architecture, not daemon-dependent.
refuses: N/A (editor integration; verdicts come from the CLI).
maturity: Alpha — verified against agent_governor 2.8.1 on 2026-07-05 (CLI contract; 176 extension tests green); structural extension work is post-MVP.

Memory / read plane

Persist state with receipts; index the corpus for navigation. Neither component is authority-bearing; both hold things other components need to find or resume from.

continuity memory operational

role: Memory / read. Governed cross-session state with hash-chained receipts; not authority-bearing.
handles: Observe → commit → rely with hash-chained receipts via MCP. A reliance cannot happen without a prior commit. Used as the persistent memory substrate for agent_governor sessions.
refuses: State mutation without a receipt; relying on state that was never committed.
maturity: Operational — 32 test files, MCP server live. Named limit: reliance-policy semantics are currently permissive (hardening deferred).

spine memory building

role: Memory / read. Navigable index over the declared document corpus — findability is not legitimacy; spine renders an index artifact, never an admissibility verdict.
handles: The charter is fixed; a map page may cite spine’s index as “how to browse the corpus” but does not depend on it.
refuses: N/A (observer only; spine holds no authority seam). Output fields must not imply endorsement or status — the non-authority pin test is the stop condition.
maturity: Building — documentation de-staled and pushed; core index gated on operator decisions.

Proof artifact plane

Not runtime. The theorems prove class boundaries of refusals, not deployment safety.

lean proof artifact reference v7.0.0

role: Proof artifact. Read-only audit surface — not runtime; the theorems prove class boundaries of refusals, not deployment safety.
handles: Formal audit of refusal-class boundaries. Machine-checks that a given refusal kind is required by the custody discipline’s own definitions. Citation tiers: [1.0] stable / [annex] compiled / [scratch] reconnaissance. Annex cannot ratify.
refuses: N/A (proof artifact). The proofs refuse to compile if a stated boundary is falsified; they prove the class, not any deployed instance.
maturity: Reference — sorry-free; Zenodo DOI. See limits for what the theorems do and don’t prove.

Proposal and deferred-work plane

Hold work that arrives outside the authorized window; propose bounded intent when it opens. Proposals bind intent only.

nightshift proposal / deferred work exercised

role: Proposal and read-only orchestration. Schedules and resumes intent, not commands: a cron job says “run this command at this time”; Night Shift says “resume this intention under this policy with this context and produce this kind of artifact.”
handles: Agenda-driven review packets that bind intent only — never file lists, content bytes, or authority. Consumes NQ’s published machine contracts through a supported receiver-side nq disposition CLI and emits a read-only disposition. Deferred governed work with receipts and reconciliation; the stale-witness refusal specimen runs from the README with no live infrastructure.
refuses: Actuation of any kind, at a gate-enforced no-actuation boundary. Completion claims without reconciliation; work completed with a stale witness. It does not authorize, execute, retry, repair, clear findings, resolve contradictions, or emit any execution capability — and it refuses to close the loop until the witnesses needed for closure exist.
maturity: Part of an operationally reusable governed vertical — the first four-office pilot ran 2026-07-26 with this repository as its target. Not operator-ready: file-granular proposals remain a library face, and the deployment files are reference scaffolding rather than a packaged service. No support promise beyond what its own tests and gates demonstrate.

Runnable material

What a stranger can run or inspect today, from a fresh clone of agent_governor. These remain the most self-contained runnable artifacts on the site — note that the repository carries a legacy / historical disposition as of 2026-07-26, so they demonstrate the discipline rather than the current authority implementation.

Quick start: git clone https://github.com/unpingable/agent_governor && cd agent_governor && pip install -e . then ./demo/refused-spend.sh. The demo fails loudly if it passes for the wrong reason.

Field lab — ATProto / Bluesky

A live network where custody, receipt, drift, and moderation claims get stress-tested in public. Not part of the stack above; the place its ideas meet weather. Treat these as a field lab, not as peers of the components.