observe
Inspect and record. Never mutate or block the call.
Designed to catch what changed, repair only what drifted, and show the evidence behind each decision.
Local Rust engine and Node/Python SDKs. Both SDKs are unpublished. Detection is off until you configure it.
No production traffic. HTTP distributions are not deployed. Local tests establish local behavior, not production guarantees.
Read the full status table ↗A renamed field can stop a workflow. A changed unit can quietly write the wrong value. Valid JSON is only part of the contract.
Synthetic example · field rename
// Agent sends
const request = {
source: "card_42",
amount: 2000,
};# Agent sends
request = {
"source": "card_42",
"amount": 2000,
}// Vendor now expects
const expectedRequest = {
payment_method: "card_42",
amount: 2000,
};# Vendor now expects
expected_request = {
"payment_method": "card_42",
"amount": 2000,
}A selective repair changes only the drifted field, when evidence and policy allow. The amount stays untouched.
byte_identical: falseA repair changes the payload. Its audit artifact must say so.
Synthetic example · unit change
// Previously: total in cents
const previousResponse = { total: 2000 };
// Now: total in dollars
const response = { total: 20 };# Previously: total in cents
previous_response = {"total": 2000}
# Now: total in dollars
response = {"total": 20}The shape still fits. The meaning changed. Explicit statistical windows and invariants can supply evidence; a single response cannot establish a unit change.
Reads fail open. In repair mode, detected semantic write drift without a verified repair fails closed.
Illustrations only. These disclosures do not call an API, run detection or execute a repair.
Start with visibility. Enable repairs deliberately. Tighten policy as evidence earns your trust.
Inspect and record. Never mutate or block the call.
Apply only a verified, selective patch. Semantic writes without a safe repair are blocked.
Refuse unrepairable write drift. Reads still fail open.
Original stays original. The no-repair path preserves the payload; repairs explicitly record changed bytes.
Engine faults pass through. Internal failures bypass inspection. Policy refusals are a separate decision.
Investigation stays outside the call. No synchronous database, LLM or other-cell dependency in the guard.
Embedded Rust/WASM, local adapters and explicit guard configuration. SDK packages remain unpublished.
Node SDK ↗Python SDK ↗Loopback or Unix socket guard endpoint with explicit fail-open clients. Not deployed or production qualified.
Sidecar boundary ↗A local Worker build exists. Hosted delivery and production qualification remain future work.
Build & limits ↗Explore the local SDKs and the decisions behind the runtime.
Open the project ↗Dashboard preview: hosted login unavailable. Sign in ↗