ClearGlass Inc. · Governed Autonomy
XENOLITH is a multi-domain command substrate. Executive orchestration, intelligence fusion, cyber defense, threat intelligence, telemetry and autonomous agents run as independent subsystems over one shared identity layer, one event bus, one memory fabric and one policy gate. Every consequential action is signed by a named agent, scored for risk, and — above the line — held until a human who is not the requester approves it.
Reference constellation · regenerate with python -m xenolith.cli --write
01 · Architecture
A domain is an authority and memory boundary, not a label. It constrains which partitions an agent may read, which action classes it may attempt, and which events it may publish. Each subsystem runs standalone; they interlock through a shared vocabulary of typed events, risk tiers and provenance.
Translates objectives into policy-constrained missions. Priority is computed from value, deadline pressure, risk drag and the health of whoever would have to execute — work nobody healthy can run sinks rather than queueing into a hole.
Observations in, intelligence packets out. Indicators are extracted from unstructured text, clustered by shared atoms then lexical overlap, corroborated across independent sources, and timelined into a claim with its evidence attached.
Detection, containment, forensic capture and chain-of-custody preservation. Containment is irreversible and scored accordingly — it is one of the actions that can never auto-execute, no matter who asks.
Adversary surveillance: actor profiles, watchlists, exposure tracking and correlation of external threat data against internal telemetry. Feeds red-team, blue-team and executive situational awareness from the same graph.
Structured logs, metrics, traces and model-free anomaly detection — a running band per series, so an unusual rate is caught with no training data and no threshold table to maintain.
Governed workflow execution and recursive delegation. A sub-agent's permissions are intersected with its parent's and its memory partition nests beneath it, so recursive spawning can never become privilege escalation.
02 · The policy gate
There is no method on the lattice that skips the gate. A submission is signed, verified for replay and expiry, checked for capability, scored 0–100, and only then — maybe — executed. An unknown action class is denied rather than waved through, so adding a capability means adding a reviewed rule.
Boundaries match the ClearGlass commerce control plane, so a risk score means the same thing across the estate.
An approval covers one exact action. Change the payload after approval and it is blocked again — approving one containment does not approve the next.
The requester may not be the approver. This is the control that stops every other control from being cosmetic.
Tokens, keys, secret assignments, addresses and hosts are redacted before anything is logged, rendered or forwarded — including into the ledger itself.
Each ledger entry commits to its predecessor's digest. Altering or removing a record breaks the walk, and the lattice reports it.
03 · Live state
Rendered from data/xenolith/lattice.json, regenerated by the CLI. The deployment below is synthetic and offline — fixed feeds, no credentials, no network — so the same input always produces the same governance decisions and the feed can be diffed between runs.
| Codename | Domain | Mission scope | Permissions | Status | Health |
|---|---|---|---|---|---|
| BASTION | cybersecurity | Detect, contain and preserve evidence | cyber.respond, cyber.forensics, intel.read | active | 0.93 |
| CATALYST | autonomy | Run governed workflows and collapse sub-agent results | agent.delegate, intel.read, intel.ingest | active | 0.93 |
| DEEPTRACE | threat-intel | Correlate external threat data with internal telemetry | threat.analyze, intel.read, telemetry.read | active | 0.93 |
| IRONGATE | cybersecurity | Enforce segmentation and access policy | cyber.respond, telemetry.read | active | 0.93 |
| MERIDIAN | intelligence | Turn observations into intelligence packets | intel.read, intel.ingest, intel.analyze, intel.publish, graph.write | active | 0.93 |
| ORACLE | executive | Translate objectives into policy-constrained missions | executive.command, intel.read, telemetry.read, agent.delegate | active | 0.97 |
| PRISM | intelligence | Maintain the knowledge graph and contradiction record | intel.read, graph.write | active | 0.93 |
| PULSE | operations | Metrics, traces and anomaly surfacing | telemetry.read, intel.read | active | 0.93 |
| WATCHTOWER | threat-intel | Track actors, exposures and emerging attack surface | threat.analyze, threat.curate, intel.read | active | 0.93 |
| ID | Action | Risk | Requested by | |
|---|---|---|---|---|
| apr-00001 | threat.watchlist_add | 40 · medium | WATCHTOWER | |
| apr-00002 | cyber.contain | 84 · high | BASTION |
The reference constellation submits a containment request against a compromised edge gateway. It does not run. It sits here, scored 84, until someone who is not BASTION decides.
| Invariant | Result |
|---|---|
| audit_chain_intact | pass |
| high_risk_blocked_until_approved | pass |
| self_approval_refused | pass |
| approval_unlocks_action | pass |
| approval_bound_to_payload | pass |
| unknown_action_denied | pass |
| missing_permission_denied | pass |
| every_submission_audited | pass |
| probe_chain_intact | pass |
Run as a CI gate. A change that opens an ungoverned execution path fails the build rather than shipping quietly.
04 · Operate it
The whole lattice is dependency-free Python, so the governance gate runs unchanged in a minimal CI container. The CLI exits non-zero when an invariant fails.
# governance self-check — exits 1 if any invariant fails python -m xenolith.cli --check # full lattice state as JSON python -m xenolith.cli --json # regenerate the command-surface feed python -m xenolith.cli --write # the test suite python -m pytest tests/test_xenolith_*.py -q
>>> from xenolith import Lattice, Domain >>> lat = Lattice() >>> lat.enlist("BASTION", Domain.CYBERSECURITY, ... role="containment", mission_scope="respond", ... sponsor="ops", permissions=["cyber.respond"]) >>> out = lat.submit("BASTION", "cyber.contain", ... {"asset": "edge-gateway-01"}) >>> out.executed False >>> out.verdict.tier.value, out.verdict.risk_score ('high', 84) # nothing runs until someone who is not BASTION approves >>> lat.approve(out.approval_id, "human-operator") >>> lat.submit("BASTION", "cyber.contain", ... {"asset": "edge-gateway-01"}).executed True