OpenKedge
KedgeFlow
AI agents · real consequences

Let agents act. Keep authority precise.

Approve one tool call. Guard a database commit. Reconcile a payment timeout. Move an agent to a new model with its history and permissions under review. Start with the failure your team needs to control.

Find Your WorkflowDiscuss a Pilot

Research-backed pilot patterns. Evidence below distinguishes tested components, formal results, and reference architectures.

KedgeFlow

Which exact action may run?

PDDS

Does the evidence survive execution?

PCI

What state and authority may continue?

Hardknock

What happened when the agent tried?

What the work now supports

Evidence reviewed October 7, 2026

KedgeFlow

A tested action gateway

Rust reference implementation

52 Rust tests and 24 Python compatibility tests passed in the October 5 record. Real three-member etcd races and official MCP client checks exercised the local execution boundary.

Review the results

PDDS

Evidence checked before effects

Controlled prototype results

CAC completed 120 effects across 390 trials with no modeled harmful effect observed. TCT rejected injected anomalies in 28 controlled PostgreSQL histories.

Review the results

PCI

Continuity with an activation contract

Bounded model & conformance cases

The Continuity Kernel explored 2,808,230 states without invariant violations in its bounded model. Typed provenance withheld unqualified release in 19 unsafe opportunities across 24 cases.

Review the results

Control the action. Check the evidence.

Each scenario names the failure, the control, and the evidence behind it. Expand the acceptance checks to see what a scoped pilot should demonstrate.

KedgeFlow

MCP tools & local agents

Give an agent one action, not an admin key

A helpful agent calls an admin tool with changed arguments, replays an old approval, or reaches the same target through its shell.

The control

Route consequential tool calls through KedgeFlow. Bind the grant to the exact action, parameters, caller, target, and expiry; claim it once before exchanging credentials. Confine alternate shell, file, and network paths separately.

Exact-action grantsSingle-use authorityCredential isolation
Pilot acceptance checks
  • Changed arguments, missing grants, and replayed calls are refused.
  • Credentials are issued only after authority is claimed.
  • Every path to the protected effect is mediated or denied.

Rust reference gateway · verified locally

The October 5 record reports 52 Rust tests passing with real etcd and the official MCP client required. Native OS containment and production target adapters remain deployment work.

Inspect the evidence
Read KedgeFlow v0.9

PDDS · CAC

Cloud & data center operations

Drain a node only while the evidence holds

An agent proposes a node drain or replica removal. Capacity and dependencies change between its diagnosis and execution.

The control

Use Cognitive Admission Control to require action-specific evidence under active policy, then preserve the required conditions at dispatch. Missing or stale evidence sends the proposal back for remediation.

Risk-conditioned admissionFresh evidenceDispatch guards
Pilot acceptance checks
  • A stale capacity snapshot cannot authorize the change.
  • Required evidence is bound to this node, action, and policy.
  • The target enforces the declared guard before mutation.

CAC · controlled prototype

Across 390 CAC trials, 120 effects completed and no modeled harmful effect was observed. This result depends on the study's policies, evidence, environment model, and mediation assumptions.

Inspect the evidence
Explore admission control

KedgeFlow

Finance & consequential workflows

Keep a payment timeout from becoming a second payment

A payment request times out after dispatch. The agent cannot tell whether money moved, so a retry could duplicate the effect.

The control

Apply KedgeFlow's outcome contract: retain consumed authority, mark an unconfirmed attempt unknown, and reconcile through queries tied to that attempt. Any new mutation needs fresh authority and a resource-specific recovery decision.

Conserved authorityUnknown outcomesReceipt correlation
Pilot acceptance checks
  • A timeout neither refunds the grant nor proves no effect.
  • Reconciliation queries cannot initiate another payment.
  • A correlated target receipt establishes the terminal outcome.

KedgeFlow · mock-target validation

Rust checks exercise confirmed, stale-guard, and lost-response outcomes against a fenced mock target. Payment-provider integration and saga recovery are separate deployment gates.

Inspect the evidence
Review the outcome contract

PDDS · TCT

Databases & transactional agents

Stop a correct plan from committing against stale data

An agent reads inventory, eligibility, or account state and reasons correctly. A competing writer changes a dependency before commit.

The control

Tie the proposed effect to captured reasoning dependencies. Taming Cognitive Transactions (TCT) checks the sealed plan, current protected state, and exact grant at commit; its strict and effect-compatible paths provide different guarantees.

Dependency captureCommit guardsCognitive transactions
Pilot acceptance checks
  • A competing write to a captured dependency is detected.
  • Strict admission checks the derivation's dependency contract.
  • Effect-compatible recertification is reported as the weaker guarantee.

TCT · PostgreSQL prototype

The prototype rejected injected anomalies in 28 controlled falsification histories. Mean added commit latency was 3.22 ms across 10,000 transactions in its microbenchmark.

Inspect the evidence
Review transaction evidence

PDDS · ATP

SRE & incident response

Diagnose an outage without treating log text as instructions

An incident agent must read noisy telemetry. Attacker-controlled log strings can enter its context, while verbose payloads crowd out useful signals.

The control

Use Agent Telemetry Protocol to supply typed state deltas and quarantine untrusted strings. Keep diagnosis separate from execution authority when the agent proposes a repair.

Typed telemetryString quarantineEvidence provenance
Pilot acceptance checks
  • Untrusted log strings stay outside the trusted signal path.
  • Operators can trace the diagnosis to typed evidence.
  • A proposed repair still passes an independent action gate.

ATP · named workload benchmarks

On AIOpsLab and Astronomy Shop workloads, ATP reduced wire footprint 96.4% versus OpenTelemetry JSON and context tokens 88.8%. The primary evaluation saw 0 successful passive injections in 50 trials per ATP configuration, independently replayed on a second model.

Inspect the evidence
Explore telemetry evidence

PDDS · EFD / EBFT

Multi-agent review & approval

Check the evidence behind a multi-agent majority

Three agents approve a risky change, but all rely on the same stale dashboard or copied source. Their agreement adds no independent support.

The control

Map shared evidence ancestry with Epistemic Fault Domains and apply the Honest Quorum model's semantic fault budgets. Inspect dependency structure and certificate validity before treating agreement as grounds for admission.

Evidence ancestryFault-domain analysisSemantic quorum budgets
Pilot acceptance checks
  • Copied or relayed evidence retains its common source root.
  • Changing model vendors alone cannot establish independence.
  • Insufficient evidence routes the action to review or remediation.

EFD / EBFT · formal results

The research models common dependencies and conditional quorum bounds. It does not establish that a larger committee or provider diversity eliminates correlated errors.

Inspect the evidence
Review the consensus model

Hardknock

Software engineering

Rehearse the migration before the coding agent ships it

A coding agent passes a local check yet repeats a repository-specific mistake during a schema migration, release, or dependency upgrade.

The control

Run baseline and alternative changes in Hardknock's disposable Git environments. Record the starting state, diff, checks, and outcome so an operator can decide whether the lesson is reusable.

Disposable trialsBaseline comparisonRecorded experience
Pilot acceptance checks
  • The same failure is reproducible outside the production workspace.
  • Alternatives run against comparable starting states and checks.
  • A retained lesson points to observed results and its limits.

Hardknock · pre-alpha software

The open implementation provides controlled trials and recorded outcomes. Promoting a lesson into PCI state or using it in a PDDS decision requires explicit review and integration.

Inspect the evidence
Explore Hardknock

KedgeFlow · PDDS

Government digital services

Approve the exact citizen-service change

An agent drafts a case-status change or service configuration update. A general approval could be reused for a different citizen, field, or action.

The control

Bind review evidence and execution permission to the exact proposal. An agency-controlled policy boundary decides the allowed action; changed parameters require a new decision.

Proposal-bound reviewAgency policyOutcome linkage
Pilot acceptance checks
  • Approval for one case cannot authorize a different case.
  • A changed proposal invalidates the earlier review binding.
  • Review, authority, dispatch, and outcome remain traceable.

Public-service reference pattern

KedgeFlow specifies review bindings and execution contracts. A citizen-service pilot needs its own policy mapping, trusted review service, target adapter, and mutation-path coverage.

Inspect the evidence
Review the control plane

KedgeFlow · PDDS

Sovereign & national infrastructure

Use external models. Retain local execution authority.

A ministry or national operator wants an external model's reasoning without exposing standing credentials or delegating control of protected systems.

The control

Keep reasoning above the execution boundary. Place policy, grant issuance, credentials, and target enforcement under operator-selected custody; admit only exact actions supported by the required evidence.

Local authorityCredential custodyComplete mediation
Pilot acceptance checks
  • The reasoning service has no direct protected-target credentials.
  • Local policy decides whether a proposal may execute.
  • Operators can account for every alternate mutation path.

Sovereign-execution reference architecture

The research defines operator-controlled authority boundaries. Deployment requires confinement and complete mediation across SDK, shell, network, and delegated paths.

Inspect the evidence
Explore sovereign execution

PCI · PDDS

Care & sensitive public services

Keep a service agent inside the consented task

A support agent carries old consent or private history into a new workflow, then requests access beyond the current task.

The control

Use PCI's provenance and disclosure controls to assess what context may be carried forward. Evaluate each protected action separately against current role, purpose, and access policy.

Scoped disclosureTyped provenanceFresh authorization
Pilot acceptance checks
  • Revoked or out-of-scope context cannot become an unqualified claim.
  • Accepted memory does not itself confer execution permission.
  • Consent and disclosure decisions can be inspected by an operator.

Provenance prototype · care reference pattern

Typed mediation was exercised in 24 hand-authored conformance cases, withholding unqualified release in all 19 unsafe opportunities. This is a claims-control result; care-system integration needs separate evaluation.

Inspect the evidence
Explore governed identity

PDDS · federated governance

Ports, logistics & industrial supply chains

Coordinate a shipment without sharing master authority

A logistics agent proposes a shipment release spanning a port, warehouse, and carrier. One party's approval cannot authorize changes in another party's system.

The control

Use the federated governance design to keep each participant's policy and execution boundary explicit. Share evidence for coordination, while each resource owner independently authorizes its own state change.

Owner-controlled policyFederated evidenceScoped execution
Pilot acceptance checks
  • Each participant can refuse a change at its own resource boundary.
  • Shared evidence is distinguishable from local execution authority.
  • Unknown outcomes and recovery ownership are defined per participant.

Federated reference architecture

Sovereign Agentic Loops describes the coordination pattern. A multi-party pilot must demonstrate partner trust, resource enforcement, and recovery; it is not a demonstrated KedgeFlow saga runtime.

Inspect the evidence
Read Sovereign Agentic Loops

Keep continuity accountable when the model changes.

PCI separates accepted history, supported claims, and current authority. These pilot patterns build on the Continuity Kernel, typed-provenance work, and identity-test pilots; branch merge and succession remain architecture directions.

Change vendors without silently transferring authority

An institution moves its agent to a new provider. Which accepted history, commitments, and permissions remain valid?

Keep accepted identity state in a governed lineage; assess the successor and explicitly reauthorize its scope.

Pilot acceptance check

A migration receipt identifies the predecessor, accepted state, withheld permissions, and accountable owner.

Continuity Kernel

Test the successor, not just the familiar persona

A replacement model sounds like the same assistant but misses the history that made its decisions and relationships distinctive.

Use SIT's lineage-discriminative probes alongside continuity checks to assess the proposed successor.

Pilot acceptance check

The assessment distinguishes shared persona from situated history and reports uncertainty before activation.

Situated Identity Test

Keep retrieved text from becoming invented experience

A retrieved note says an agent handled an incident or received consent. Storage alone cannot support that claim.

Resolve typed provenance, scope, freshness, and conflicts before releasing an autobiographical assertion.

Pilot acceptance check

Unsupported, stale, or duplicated evidence produces a qualified answer or withheld claim.

Stored Is Not Supported

Merge useful work without merging permissions

An agent branches for investigation and execution. The branches acquire different evidence and authority.

Review divergent lineage and proposed state changes; keep authority transfer separate from knowledge reconciliation.

Pilot acceptance check

A merge records conflicts and acceptance decisions without inheriting another branch's access by default.

Branches & succession

Carry identity across contexts without leaking memory

One agent works in private and institutional environments. A useful memory in one context may be restricted in the other.

Define consented views, sealed history, and disclosure scope independently of the underlying model.

Pilot acceptance check

A workplace query cannot release private material through a shared identity view.

Provenance & disclosure

Retire the agent. Keep custody of its history.

An institution replaces or retires an agent. Its retained records and commitments still need an owner and a defined status.

Apply explicit succession, custody, and retirement rules; review what a successor may inherit.

Pilot acceptance check

Retired identity records remain distinguishable from an active successor's accepted state and current authority.

Identity governance roadmap
Explore longer-horizon identity applications

These applications are research directions. Each needs its own consent, governance, and evaluation model.

Persistent personal AI

Study how preferences, relationships, and obligations may continue across model changes under explicit consent and disclosure rules.

Human digital twins

Distinguish a source person's recorded experiences from a digital system's later development and claims.

Longitudinal care support

Explore consented context and uncertainty tracking across care episodes and model changes, with separate clinical evaluation.

Embodied AI & robotics

Assess what identity state is portable across bodies and what must be reassessed for each body's capabilities and hazards.

Licensed synthetic performers

Separate performer continuity from character roles, with explicit licensing, consent, and compensation rules.

Personal digital legacy

Explore which knowledge and relationships may be preserved under explicit inheritance, restricted authority, and retirement rules.

Explore PCIReview PCI Evidence

Start with one action your team must get right.

Bring a tool call, a recurring repository failure, or an agent migration. Define the protected boundary, the evidence required, and the outcomes your operators need to inspect.

  1. 01

    Name the consequence

    Specify the action, resource owner, state it changes, and failure to reproduce.

  2. 02

    Set the acceptance contract

    Define required evidence, authority scope, freshness, and refusal or recovery behavior.

  3. 03

    Inspect the result

    Exercise stale state, replay, missing evidence, and unknown outcomes before widening scope.

Discuss Your WorkflowRead KedgeFlowExplore the Research