A connected system with a job at each layer.

Where the proof already exists

Runestack

Contracts that survive delegation, signed receipts per consequential action, evidence anchored where the author can't edit it after the fact. It proves the chain is real: Freyr, Vór, and Forseti are the components that acted in the anchored batch — not a diagram of what we intend to build. Receipt: the Base Sepolia transaction, block 44531898.

Heimdall

Operational visibility and investigation — the system that watches what agents and services actually do, independent of what they report doing. It runs in production today; what it proves isn't yet inspectable by anyone outside the estate. not generalized — single-estate implementation

Mimir

The memory system other Ravenhelm services read from — production recall, not a demo cache. It's live and load-bearing; there's no public instance yet to check that independently. public receipt: closing

Supporting the bets

Víðarr

Agent and service operations.

Thor

Constrained execution.

Gullveig

Transformation and adaptive systems.

Agentropy

A published conservation law: an accounted cost is a necessary condition for life-like dynamics, not an incidental one. Proofs and a runnable reference implementation — public repo.

Bifröst

Governed execution boundary.

THE RUNTIME / CONSTRAINT BEFORE THE ACT

Runestack

Accountable agent issuance. Durable name. Short-lived proof. Attenuated grant. Policy check. Witness. Expiry. Then, and only then, a projection into whatever consumer asked.

Delegation chains

Authority flows from humans to agents through explicit, verifiable delegation. Scoped permissions, time-bounded access, revocable credentials.

Signed receipts

Every consequential action produces a cryptographic receipt. External verification means you don't trust the system; you verify it.

Mutation containment

Agents operate within declared boundaries. State changes are tracked, constrained, and reversible. No silent side effects, no undeclared writes.

The stack

Not “an AI gateway.” IAM as the umbrella, then the whole alphabet: IDM · IdP · SSO · federation · SCIM · CIAM · IGA · MFA · passwordless · AuthN · AuthZ · FGA · ReBAC · ABAC · PBAC · policy-as-code · PDP · PEP · PIP · PAP · PAM · JIT · least privilege · capability security · UCAN · ZCAP · PKI · CA · CLM · HSM · KMS · secrets management · mTLS · workload identity · SPIFFE · WIMSE · RATS · attestation · DID · VC · SSI · ZTNA · API gateway · MDM · RADIUS · NAC · SCM / checkout occupancy · SIEM · UEBA · audit trail · CT / transparency log · tamper-evident ledger · Merkle anchor · SLSA / in-toto · GRC / prove-it

Status

Building in the open. Core primitives under active development. Manifesto →

THE LAW / CONSERVED RESPONSIBILITY

The grant may attenuate.
The human does not.

Agents cannot yet be held accountable. Accountability does not divide. Delegated authority must not be diluted. Authority without accountability is just permission, and permission without proof is a liability with good marketing.

The physics

Every interaction an agent has is priced; nothing is consumed without account; the math is the audit. Agentropy, DOI 10.5281/zenodo.20818597 →

Risk

An unaccountable delegate is an audit finding waiting to happen. A signed, anchored chain is the incident you can prove you contained.

Cost

The accountable version does not cost more to build. It costs less to defend later.