Independent Python prototype | v0.1.0 alpha
An AI that Waits.
RSS sits in front of the model path and decides what governed context an AI workflow may receive before a model is asked to answer. Scope gets declared. Consent gets checked. Audit evidence gets written. If the boundary is missing, the system stops.
Why the boundary matters
A model receives broad context, generates an answer, and only then do filters or monitors try to catch what went wrong. That posture is fragile when the workflow touches customer records, account signals, approvals, legal documents, or regulated data.
Govern the request before model exposure. RSS narrows context through SCOPE, classifies meaning through RUNE, checks consent through OATH, bounds cadence through CYCLE, and builds a Prepared Advisory View instead of handing the model the full environment.
Architecture — governed by The Pact
RSS is governed by an open-source constitution, The Pact. It defines eight seats, each holding one authority type that no other seat may assume. Subsystems serve the seats but hold no authority of their own, and the model is the least privileged component in the system: it informs, it does not rule.
Operational seats active in every governed request
Routes governed tasks and halts on integrity failure.
Declares bounded data access for a task.
Classifies meaning against governed vocabulary.
Checks recorded consent for action classes.
Bounds cadence and reports per-domain load.
Writes tamper-evident evidence; supports cold verification.
Constitutional seats active only when The Pact itself changes
Drafts and stages constitutional revisions. Cannot seal.
Ratifies reviewed amendments through ceremony, under T-0.
Subsystems serve the seats; hold no authority. Lowercase by design — they are not seats.
Execution state machine.
Prepared Advisory View builder.
Hub topology and walls.
Tenant container isolation.
Persistence and round-trip.
External model adapter.
Current proof surface
The current implementation includes scoped data access, PAV construction, consent gates, Safe-Stop recovery, hash-chained TRACE records with cold verification, TECTON container isolation, and a governed offline demo mode.
Reproduce the baseline with python tests/test_all.py. Claim mapping lives in
docs/claim_matrix.md.
Governed claims
RSS holds its own claims to the standard the kernel holds AI workflows to: no claim outruns its proof.
Direction - not yet built
The direction is TECTON: isolated AI workspaces where each client, project, or operational domain has its own governed context, hub topology, and audit surface. RSS remains the shared law underneath those worlds. The future product is the layer agents plug into before they touch consequential work.
Manifesto
RSS is not another engine. It is a runtime boundary for governing what powerful systems can touch, what evidence they leave, and where human authority remains intact.
In 1977, Renault rolled out the RS01 with a turbocharged 1.5-liter V6. The car was mocked as the Yellow Teapot because it kept returning to the pits steaming. Within a few years, the grid was chasing turbocharging.
By 1986, qualifying engines were producing staggering power for single-lap bursts. The era ended because the output had outrun the chassis, circuit safety, economics, and regulation around it. Structural containment became mandatory.
You do not put brakes on a race car so it can drive slow. You put brakes on a race car so it can drive fast.
AI is entering its own turbo era: stronger models, faster agents, more tool access, and more autonomy. RSS treats that as a structural problem. It explores what happens when scoped context, consent checks, audit traces, and fail-closed behavior are built into the workflow before the model is asked to answer.
RSS did not invent the security kernel, the reference monitor, zero trust, or capability security. The honest claim is narrower: RSS independently converged on those principles and applies them to the LLM and agent runtime boundary.
The older lineage has durable requirements: complete mediation, tamper resistance, and verifiability. RSS maps those instincts onto the AI boundary through an always-invoked request path, Section 0 integrity checks, a bounded tier model, cold verification, and a claim matrix that ties documented assertions back to tests.
The model is not the product's authority. Governance is the product: the runtime mediator, the policy gate, the audit surface, and the recovery path. Alignment by disposition asks the model to behave. Alignment by construction changes what the model is allowed to touch.
Open source kernel work
Building in public. If you're working near AI governance as a builder, an operator, or a potential partner, reach out.