governed agentic delivery control plane
Statecraft
Statecraft is built around one governed loop: intent becomes a governed spec, a factory stamps a complete application from an open template, a fleet operates the result, and your code stays in your GitHub org the whole time.
That is the design. What runs today is the status section below, rolled up live from the specs, not a roadmap you have to take on faith. The substrate already ships: EnRaHiTu is Encore.ts, rauthy, hiqlite, and Turso in a single container, with zero managed dependencies.
the loop
One governed loop, and where each turn stands
Each block describes a turn of the loop and carries the state of the spec that governs it. Present tense is the design; the chip is the truth.
Markdown is the source of truth
spec-spine compiles specs into typed registries and gates drift in CI. Every repo in this family is governed by it today, including this site.
the governed registryA contract stamps a whole app
A versioned template contract stamps a complete application from an open template, with a born-with certificate that binds an explicit agentic posture.
the template contractUpdate and backup are verbs
One container and one volume per app. Governed verbs carry an audit trail, instead of a runbook you hope someone followed.
the fleet specThe record is checkable
A tamper-evident attestation ledger records what the plane did, and an independent verifier can check it without trusting the plane.
the governance spineproduct family
10 repos, one stack
Everything is open source and governed the same way. Apps the factory stamps are not on this list: they belong to their owners, in their own orgs, under their own licenses.
- statecraftthe governed delivery control planeAGPL-3.0
- enrahituthe EnRaHiTu template chassis (Encore.ts + rauthy + hiqlite + Turso)Apache-2.0
- statecraft-clithe CLI and MCP serverApache-2.0
- spec-spinethe spec-governance toolchain everything above is governed byApache-2.0
- tenant-emitthe tenant certificate emitter: signs a produced app's governance certificateApache-2.0
- tenant-tailthe tenant certificate verifier: re-checks the factory's paperwork, no trust in the producerApache-2.0
- action-gatea pure, deterministic decision gate: evaluate(context, checks) returns Allow, Deny, or DegradeApache-2.0
- attest-ledgera tamper-evident record ledger: append-only, hash-linked, Ed25519-signed, with an independent verifierApache-2.0
- canonical-keysort-jsondeterministic canonical JSON: a lexicographic key sort at the serialization boundary, so record hashes agreeApache-2.0
- trust-windowa rolling-window trust scorer: weighted samples map to a graduated privilege levelApache-2.0
for agents
shippedAgents run through the same controls as people
The model is deliberate: same verbs, same guards, an explicit posture, no side doors. The MCP face will expose the governed verbs to coding agents directly, so an agent driving the plane passes through the exact controls a person does.
the MCP server specread the source
Every claim here is a spec you can open
The registry bakes the family's spec corpora at build time, 43 specs across 4 repos, each page stamped with the commit it was baked from. Nothing on this page asks you to take it on faith.
Open the registrystatus
Where it actually is
Each rung rolls up the implementation state of the specs that make it up, read from the baked registry. When the specs move, this moves.
- M1Substrate8/8 completeshipped
The chassis boots
EnRaHiTu: an Encore.ts app with in-process hiqlite, a CoreLedger data layer over libSQL/Turso, auth on rauthy behind a same-origin proxy, and a webapp, packaged as one container with a vendored toolchain.
- M2Stamp1/2 completein progress
The template contract
A versioned template.toml that says what a stamped app is, plus a born-with certificate that binds an explicit agentic posture at stamp time.
- M3Factory3/4 completein progress
The control plane stamps apps
Statecraft itself: the thesis, the EnRaHiTu app shell, tenant onboarding via a per-org GitHub App, and the factory that stamps complete apps into the customer's own org.
- M4Fleet1/1 completeshipped
The fleet operates the result
Placing and running stamped EnRaHiTu apps: one container and one volume each, with update and backup as governed verbs rather than runbooks.
- M5Verify3/4 completein progress
The governance spine and the CLI face
A tamper-evident attestation ledger with an action gate and trust window, and the statecraft binary that drives the same governed verbs from the terminal and over MCP.
rolled up from the registry baked 2026-07-17