Components — unpingable

The custody stack is a set of small tools, not one platform. Each component has one job: witness evidence, gate a proposal, preserve state, expose an operator decision, or audit a refusal class.

Use them independently. The interesting part is the seam between them: what each component accepts, what it refuses, and what receipt survives inspection. NQ does not require agent_governor; agent_governor does not require NQ. The monitoring lane that wires them together — NQ witnesses a disk state, Nightshift defers and reconciles the governed work, agent_governor refuses the action if the evidence is stale — is one natural composition. It is not the product.

Maturity enum: operational / alpha / specimen / reference / building. Version (when shown) is metadata, not a claim. Nothing on this page is armed for live cage execution — that refusal is by construction. See limits.

Planes

Components grouped by what kind of work they do. A plane is analytical: it says what role a component plays, not what it depends on.

witness / testimony	nq · porter · verifier
gate / authority	agent_governor · wicket · standing · linear_accountant
operator surface	maude · gov-webui · vscode-governor
memory / read	continuity · spine
proof artifact	lean
deferred work	nightshift

Illustrated composition (not a prerequisite stack): nq (witness) → nightshift (defer + reconcile) → agent_governor (gate). Each component in that lane works standalone — absent any neighbor, the seam yields honest absence or cannot-testify, never silent failure.

Witness / testimony plane

Observe and report. These components produce evidence; they do not gate authority. Cannot-testify is a first-class outcome, not an error.

nq witness operational

role: Witness / testimony. Observes substrate facts and packages each finding with its evidence; not authority-bearing.
handles: Observation-to-claim preflight for operational systems. Witnesses disk health, service state, host metrics, and similar substrate facts so each finding is traceable to an observation. When evidence is unavailable, emits cannot-testify rather than a smooth nothing — the refusal is the product surface, not an error to handle.
refuses: Producing a finding it cannot trace to an actual observation; smoothing over evidence loss.
maturity: Operational — public GitHub, Apache-2.0, 1203 tests, 15+ operator docs. Operator calibration 2026-07-05: “usable today by a normal SRE.”

porter witness alpha v0.1

role: Witness / testimony. Substrate courier: transports work and reports the outcome as evidence, including whether the exit code was actually observed.
handles: Executes work via ssh, serial, or recipe substrates and packages the outcome as a record.v0 with exit-code custody. A record with exit_code_observed: false is refused, not promoted.
refuses: Marking work complete when exit_code_observed is false; emitting outcome vocabulary that belongs to the caller’s domain (porter’s outcomes name transport facts, not admissibility verdicts).
maturity: Alpha — three substrates (ssh, serial, recipe), 19 tests, charter commitments closed. demo/refused-exit.sh produces a live refusal specimen. Serial substrate may slip to a subsequent point release.

verifier witness operational

role: Witness / testimony. Formal constraint sidecar: attests whether a proposal violates a declared invariant set.
handles: Formal constraint checking via a Z3 sidecar. Accepts a declared invariant set and a proposal; refuses proposals that violate the constraints and emits a verdict receipt. The specimen at the front of the README is the stale-standing denial.
refuses: Proposals that fail the declared invariants; constraint-checking without a named clock basis on temporal predicates.
maturity: Operational — lib, CLI, and MCP server; specimen pinned to README.

Gate / authority plane

Gate work. These components decide whether a claim, intent, or permission may become a premise for action, and emit receipts for the decisions they make.

agent_governor gate alpha v2.8.1

role: Gate / authority. Admissibility kernel for AI coding agents — every proposed file write and command requires a typed claim before it runs.
handles: Each proposed action requires a typed claim with pointers; the governor verifies and produces receipts. Language is a proposal, not an authority — an agent saying “done” is not the operator approving it. Supervised runs, refusal gallery, governed workflow, and specimen corpus are runnable from a fresh clone.
refuses: Prose as authority; tests-passing treated as code-ready-to-land; permissions exercised after their observation horizon; a rehearsal that confers operational effect.
maturity: Alpha — ~14.6k tests, demo path fresh-clone verified. Bootstrap limits: in-process custody forgeability, operator-fiat standing, live cage unarmed by construction.

wicket gate operational SPEC v0.3

role: Gate / authority. Intent preflight kernel — decides whether an actor’s proposed action may become a premise before any effect runs.
handles: Single-call admissibility preflight for intents. Refuses intents from revoked or out-of-scope actors. One call in, one typed verdict out.
refuses: Intents where the actor cannot demonstrate standing or scope; revoked actors.
maturity: Operational — SPEC v0.3, 21 fixtures, wicket-guard absorbed and tombstoned.

standing gate operational

role: Gate / authority. Permission observation with observation-age receipts — a permission valid at check is not automatically usable at spend time.
handles: Produces standing receipts that carry when the permission was seen and when it expires. The gap between check and action is measured on a named clock basis, not wall time.
refuses: Attesting a permission it cannot verify; a spend whose standing observation lapsed past its horizon by exercise time (standing_before_spendability_not_bounded).
maturity: Operational — specimen flow runs; HMAC-only identity substrate (named limit; mTLS/OIDC deferred).

linear_accountant gate reference

role: Gate / authority. Conserved capacity and spend — the reference boundary that ensures no component mints authority from an ALLOW verdict.
handles: An authorized action still refuses without capacity usable at action time. Frozen as a reference seam until a consumer trigger; the transport layer is deliberately deferred.
refuses: Minting capacity from an ALLOW verdict (the component is named consumer, not minter). The no-mint invariant is the load-bearing property; no transport is built until it has a consumer.
maturity: Reference — pushed, frozen by design. “Respect the freeze” is the standing operator ruling.

Operator surface plane

Operator-facing surfaces over the same daemon. Maude is a TUI; gov-webui is a browser path. Both consume the governed shell contract; neither is a hard requirement for the components they expose.

maude operator surface operational v2.4.0

role: Operator surface. TUI for supervised agent sessions over agent_governor — where the human sees, approves, denies, or discards.
handles: Every tool call appears in the decision queue before it runs. When the session ends, the operator reviews the diff and either keeps or discards the changes. Governed-plan runs ingest a plan.md, verify citations, and report as a ReviewPacket.
refuses: Silently promoting session output — promotion is an explicit operator act; the report surface says “not recorded” rather than inferring; used > granted renders OVERRUN, never “authorized.”
maturity: Operational — 301 tests, supervised loop, governed-plan path, M-4 run report, live-daemon smoke verified.

gov-webui operator surface alpha v0.5.0

role: Operator surface. Browser path over the governor daemon — the same decision queue and promotion controls as maude, without a terminal app.
handles: Legacy chat modes plus desk mode v0 in progress: decision queue, sessions board, and promotion keep/discard, consuming the same shell contract as maude so the two surfaces cannot drift on the wire protocol.
refuses: N/A (operator UI surface; the decision-door invariant — resolve only what the daemon's live feed offers — is enforced daemon-side and re-checked at the route).
maturity: Alpha — currency repairs done, DaemonShellClient landed (513 tests); desk routes in progress.

vscode-governor operator surface alpha

role: Operator surface. Editor integration — wraps the governor check CLI for VS Code and surfaces findings inline.
handles: Security and continuity findings from governor check, rendered inline in the editor. CLI-wrapper architecture, not daemon-dependent.
refuses: N/A (editor integration; verdicts come from the CLI).
maturity: Alpha — verified against agent_governor 2.8.1 on 2026-07-05 (CLI contract; 176 extension tests green); structural extension work is post-MVP.

Memory / read plane

Persist state with receipts; index the corpus for navigation. Neither component is authority-bearing; both hold things other components need to find or resume from.

continuity memory operational

role: Memory / read. Governed cross-session state with hash-chained receipts; not authority-bearing.
handles: Observe → commit → rely with hash-chained receipts via MCP. A reliance cannot happen without a prior commit. Used as the persistent memory substrate for agent_governor sessions.
refuses: State mutation without a receipt; relying on state that was never committed.
maturity: Operational — 32 test files, MCP server live. Named limit: reliance-policy semantics are currently permissive (hardening deferred).

spine memory building

role: Memory / read. Navigable index over the declared document corpus — findability is not legitimacy; spine renders an index artifact, never an admissibility verdict.
handles: The charter is fixed; a map page may cite spine’s index as “how to browse the corpus” but does not depend on it.
refuses: N/A (observer only; spine holds no authority seam). Output fields must not imply endorsement or status — the non-authority pin test is the stop condition.
maturity: Building — documentation de-staled and pushed; core index gated on operator decisions.

Proof artifact plane

Not runtime. The theorems prove class boundaries of refusals, not deployment safety.

lean proof artifact reference v7.0.0

role: Proof artifact. Read-only audit surface — not runtime; the theorems prove class boundaries of refusals, not deployment safety.
handles: Formal audit of refusal-class boundaries. Machine-checks that a given refusal kind is required by the custody discipline’s own definitions. Citation tiers: [1.0] stable / [annex] compiled / [scratch] reconnaissance. Annex cannot ratify.
refuses: N/A (proof artifact). The proofs refuse to compile if a stated boundary is falsified; they prove the class, not any deployed instance.
maturity: Reference — sorry-free; Zenodo DOI. See limits for what the theorems do and don’t prove.

Deferred work plane

Deferred governed work. Earlier-stage than nq; presented here as a specimen, not a maturity peer.

nightshift deferred work specimen

role: Deferred work. Holds work that arrives outside the authorized window and reconciles it when the window opens; presented here as a specimen, not a maturity peer of nq.
handles: Deferred governed work with receipts and reconciliation. Refuses completion claims without a reconciliation receipt. The stale-witness refusal specimen runs from the README with no live infrastructure.
refuses: Completion claims without reconciliation; work completed with a stale witness.
maturity: Specimen — runnable as a demonstration of the stale-witness refusal; earlier-stage than nq as a product. The monitoring lane (nq → nightshift → agent_governor) presents nightshift as the deferred-work layer, not as a maturity peer of nq.

Runnable material

Quick start: git clone https://github.com/unpingable/agent_governor && cd agent_governor && pip install -e . then ./demo/refused-spend.sh. The demo fails loudly if it passes for the wrong reason.