The ecosystem, in layers.
10 public repositories, one governed stack. Each owns a specific surface: the toolchain everything is checked against, the substrate an app is born from, the control plane, the interface people and agents drive, and the small primitives that make the record checkable. All open source, all spec-governed.
Architecture layers
Governance toolchain
The spec spine everything else is built and checked against. Markdown is the source of truth; drift is refused at pull-request time.
Substrate
The runnable chassis a stamped app is born from: Encore.ts, rauthy, hiqlite, and Turso in a single container with zero managed dependencies.
Control plane
The governed loop itself: specify, stamp, operate, verify. This is the layer the status ladder tracks as it lands.
Interface
How people and agents drive the plane: a CLI and an MCP server exposing the same governed verbs, so an agent passes through the controls a person does.
Verification primitives
Small, single-purpose libraries that make the record checkable by someone who trusts none of it: certificates, a signed ledger, canonical hashing, a decision gate, and a trust score.
The governed delivery flow
Each chip is rolled up from the spec that governs it. The status ladder on the home page tracks the same truth.
The repositories.
Statecraft
the governed delivery control plane
The governed delivery control plane: the loop that turns intent into an operated, verifiable application.
enrahitu
the EnRaHiTu template chassis (Encore.ts + rauthy + hiqlite + Turso)
The EnRaHiTu template chassis a stamped app is born from, runnable on its own today.
statecraft-cli
the CLI and MCP server
The command line and MCP server: the same governed verbs for people and for coding agents.
spec-spine
the spec-governance toolchain everything above is governed by
The spec-governance toolchain the whole family, including this website, is built and checked against.
tenant-emit
the tenant certificate emitter: signs a produced app's governance certificate
The tenant certificate emitter: signs a produced app's governance certificate from a finished run.
tenant-tail
the tenant certificate verifier: re-checks the factory's paperwork, no trust in the producer
The tenant certificate verifier: re-checks the factory's paperwork with no trust in the producer.
action-gate
a pure, deterministic decision gate: evaluate(context, checks) returns Allow, Deny, or Degrade
A pure, deterministic decision gate at the heart of every governed action.
attest-ledger
a tamper-evident record ledger: append-only, hash-linked, Ed25519-signed, with an independent verifier
A tamper-evident record ledger: what the plane did, in a form a stranger can re-check.
canonical-keysort-json
deterministic canonical JSON: a lexicographic key sort at the serialization boundary, so record hashes agree
Deterministic canonical JSON so record hashes agree across independent parties.
trust-window
a rolling-window trust scorer: weighted samples map to a graduated privilege level
A rolling-window trust scorer: privilege is earned and decays rather than granted once.