Systems research for autonomous computing
Verifiable boundaries for autonomous agents.
Open protocols, execution gateways and evidence engines that make agentic software deterministic and auditable.
One agent action passing POLICY.md, MAP, OVARA and DASH. A conceptual picture of how the layers relate; the projects are not yet integrated at runtime.
Demo · Illustrative
Follow one action through the stack.
Each layer answers a different question: is it written down, is it authorized, who is acting, and what is the evidence.
Pick an agent action
An illustrative simulation in your browser, using the products' documented example rules. The projects are not yet integrated at runtime.
agent → file.write src/app.ts
4 layers
- 01POLICY.mdRefactoring files inside src/ is allowedallow
- 02MAPNo rule requires approval for file.writeallow · receipt signed
- 03OVARAIdentity and lease valid in devallow
- 04DASHReceipt stored with its sourceevidence recorded
Allowed
Allowed. Refactoring inside src/ is permitted while tests pass.
agent → file.write .env
4 layers
- 01POLICY.mdNever write .env or files containing secretsdeny
- 02MAPDenial recordeddeny · receipt signed
- 03OVARANot reachednot executed
- 04DASHDenial stored with its ruleevidence recorded
Denied
Denied at the manifest. The action never runs.
agent → package.install left-pad
4 layers
- 01POLICY.mdAdding dependencies requires approvalrequire_approval
- 02MAPApproval webhook sentwaiting · approval_reference
- 03OVARAPaused until approvednot executed yet
- 04DASHRequest stored with its contextevidence recorded
Needs approval
Held for a person. New dependencies need approval.
agent → payment.execute $5,000
4 layers
- 01POLICY.mdNo rule for paymentsallow
- 02MAPpayment.* where amount > $1,000require approval
- 03OVARAPaused until approvednot executed yet
- 04DASHRequest stored with its contextevidence recorded
Needs approval
Held for a person. Payments over $1,000 need approval.
agent → shell git push origin main
4 layers
- 01POLICY.mdNo rule for git pushallow
- 02MAPNo rule for shellallow · receipt signed
- 03OVARAShell in production requires approvalescalate · policy_escalate
- 04DASHEscalation stored with its contextevidence recorded
Needs approval
Escalated by the gateway. Production pushes go to a person.
How can autonomous AI systems be given externally verifiable boundaries around capability, authority, execution, identity and evidence?
The four products are layers of one systems investigation. Sidian, our editor, is where the ideas are tried in everyday development. We do not claim to solve AI safety.
Write the boundaries down.
A portable, Markdown-native negative-capability manifest for AI agents.
- 1.1Markdown body with machine-enforceable YAML frontmatter
- 1.2allow, deny and require_approval, with 12 condition operators
- 1.3Scopes for project, skill, agent or department
Authorize every action. Sign every decision.
An open protocol for governing registered agent actions through policies, approvals, and signed receipts.
- 2.1Policy as JSON, hot-swapped at runtime
- 2.2Human approval through webhooks for high-risk actions
- 2.3Receipts signed as HS256/RS256 JWS, typ MAPSIG
Check identity and authority at the moment of action.
Runtime trust and control infrastructure for autonomous systems and agents.
- 3.1Single-binary Go gateway: allow, deny or escalate
- 3.2ed25519 machine identity and capability leases
- 3.3Shell and Git interceptors wired; GitHub and CI planned
Retrieve claims with the evidence for and against them.
Evidence-first data infrastructure for provenance-aware retrieval.
- 4.1Claim, Evidence and Edge as the data model
- 4.2Contradictions and temporal validity windows
- 4.3OpenAI-compatible /v1/embeddings endpoint
Evidence
What we can show today.
| Product | Claim | Detail | Reproduce | Status |
|---|---|---|---|---|
| MAP | Released on npm | @sidianlabs/map v0.1.0 | npm view @sidianlabs/map | Verified |
| OVARA | 2 interceptors wired | shell and Git; 14 action types recognized | repository inspection | Verified |
| DASH | 416 tests pass | Rust, with WAL and hash-chained audit log | cargo test --workspace | Verified |
| POLICY.md | 21 tests pass | 12 condition operators; allow, deny, require_approval | npm test | Verified |
Status labels are never softened. Benchmarks list the command and environment behind every number, and each project publishes what it does not guarantee.
- MAPREADME status aligned with released v0.1.0
- MAPAdded NON-GUARANTEES.md and BENCHMARKS.md
- OVARAAdded NON-GUARANTEES.md and BENCHMARKS.md
- DASHAdded NON-GUARANTEES.md
- POLICY.mdAdded NON-GUARANTEES.md