An interactive, visual walkthrough of the TENIR governance system — from business rule to machine execution, from raw signal to verdict, from budget reservation to evidence record. Explore the 5-level resolution model, the double-kernel adjudication, the consensus and budget coordination layer, and three live use-case simulators.
Nothing can skip a level. A business intention must be translated into a substantive rule, resolved into a profile, decomposed into invariants, and only then executed by the runtime. Each level has a distinct owner and produces a distinct artifact.
Signals are the raw facts the engine reads. Each family has a distinct origin and a distinct level of trust. A signal from S1 is declarative (may be false). S2 is observed. S3 is attested by a third party. S4 is historical. Confusing these provenances is a category error.
From raw observation to post-hoc evaluation. Each step is distinct, testable, and produces a traceable artifact. Click "Animate" to walk through the pipeline step by step.
unmeasured and becomes a gate reason.The Double-Kernel is NOT structural vs. substantive. It separates the continuous (Scoring Kernel: S = K/(P·V+ε)) from the discrete (Transition Membrane: invariants). The composition of both produces the verdict. The score and the invariants are independent in the composition.
S > τ_pass → PASS · τ_block < S ≤ τ_pass → FLAG · S ≤ τ_block → HARD_VETO
A high score (S = 0.9) does not guarantee PASS — an invariant can produce HARD_VETO alone. Conversely, a low score (S = 0.4) does not force HARD_VETO if invariants pass — the verdict will be FLAG, not HARD_VETO. The score and the invariants are independent in the composition.
Control · Aim · Veto · Epistemics. The canonical diagnostic framework for agentive situations. Click any cell to see the detailed interrogation.
The REG+ consensus contract defines four properties any conforming backend must satisfy. The ConsensusBackend interface is implementation-neutral — a file-lock backend, a Raft cluster, or a PostgreSQL transaction can all conform, provided they satisfy these properties for their declared fault model.
Cross-process via fcntl.flock. Durable state. I8 enforced atomically under file lock.
Cross-host via pysyncobj Raft. I8 enforced on leader before replication. Leader failover with state preservation.
Every operation passes through a defined lifecycle. Click any state to see its meaning. The critical transitions: RESERVED → DISPATCHING → CONFIRMED|FAILED, with uncertainty states (UNKNOWN, HOLD, ESCALATED) for when the provider cannot confirm the outcome.
The EvidenceRecord is the artifact that makes governance verifiable. It contains not just the verdict, but the exact inputs, the result of each invariant, and the commit trace — all cryptographically chained.
Each simulator lets you play the role of an autonomous agent operating under TENIR governance. Reserve budget, execute operations, and watch the I8 invariant hold — or break. Try to trigger a budget violation.
Three AI agents propose trades against a shared $100M mandate. Each agent operates independently but all draw from the same ceiling. Watch how the aggregate budget invariant prevents over-commitment.
A DevOps team deploys 12 autonomous agents consuming from a shared $50K monthly cloud budget. Each agent must reserve before making API calls. The CFO needs a guarantee that total committed spend never exceeds budget. This simulator includes reconciliation for uncertain operations (timeouts).
Multiple departments issue purchase orders against a shared $2M quarterly procurement envelope. Three Raft nodes across data centers ensure I8 holds even under leader failover. Simulate a node crash to see the cluster maintain quorum.
The ecosystem enforces a strict separation: the standard defines what, the runtime implements how, and the harness verifies that.
An honest accounting of the bugs and gaps identified by the external audit. No production claims until these are resolved.