A durable execution platform for AI agents.
Helm · Harness · Forge · Witness · Distillery · Guild · Commons
🚧 This repository is under construction. What you're reading is the public face of a project that currently exists as a complete, adversarially-reviewed specification corpus (~450 KB of normative text, 52 constitutional articles, 15 companion specifications) entering its first build phase. The specs and code will be opened progressively as the walking skeleton comes alive. Watch the repo.
Praxis is an execution platform where AI agents operate real-world software — sending messages, charging customers, managing records — with the reliability of industrial machinery, not the fragility of a chatbot with tools.
The prevailing agent frameworks make the model the driver: it holds state, sequences actions, calls tools, and the system waits on its judgment. Praxis inverts this. Deterministic machinery drives everything — memory, sequencing, verification, retrieval, safety — and invokes a language model only at the last possible moment, with everything pre-assembled, for the two narrow things models are actually good at: choosing from a small menu and writing short prose.
The model acts like a competent clerk handed a brief, a fact sheet, and a form. Which means small, cheap, even local models can do the daily work.
The end state: a principal states an intent in plain language. A frontier model plans it once. Thereafter the task recurs forever at near-zero cognitive cost, executed by machinery and small models, with every side effect validated, authorized, identified, confirmed, and recorded — and with the platform's integrations maintaining themselves.
AI agents fail at real-world operation for reasons that are structural, not intelligence-limited:
| # | Failure | What it looks like |
|---|---|---|
| 1 | Integration burden | Capability grows at the speed of engineering headcount |
| 2 | Fragility | Hallucinated IDs, unsafe retries, double-charges, acting on stale facts |
| 3 | Integration rot | APIs drift; every company with >10 integrations pays a standing team to keep them alive |
| 4 | Cost | Frontier tokens burned on every step of every task, forever — recurring work never gets cheaper |
| 5 | Context chaos | Too little context (agents guess) or everything (agents drown, auditors ask questions) |
All five have one cure: move the intelligence into structure.
The command path, top to bottom. Agents live above the waterline; the plumbing of the world lives below it, and no agent ever sees it.
┌────────────────────────────────┐
│ PRINCIPAL │
│ intents & open-ended goals, │
│ plain language │
└───────────────┬────────────────┘
│ intake ladder
"do this" ┌────────┴─────────┐ "work on this"
▼ ▼
┌──────────────────────┐ ┌──────────────────────────┐
│ ORCHESTRATOR │◄──┤ THE HELM │
│ frontier model — │ │ the deliberative organ │
│ invoked once per │ │ missions · the Agenda │
│ novel plan, then │ │ waves of gated plans │
│ never again │ │ budgets it cannot exceed│
└──────────┬───────────┘ └──────────────────────────┘
│ typed, type-checked Plan Graph
▼
┌──────────────────────┐
│ SPECIALISTS │ per-technology namespaces
│ libraries, not │ verbs · relations graph
│ minds │ retrieval · routine library
└──────────┬───────────┘
│ press-level mini-plans
│ (small "clerk" model — or a cached routine
│ at zero cognition)
▼
┌────────────────────────────────────────────────────────────────────────┐
│ THE HARNESS (built on Temporal) │
│ the deterministic engine — owns all state, all sequencing. │
│ every press runs THE GAUNTLET: ten gates, no exceptions ↓ │
└───────────────────────────────────┬────────────────────────────────────┘
▼
┌──────────────────────┐
│ VERBS │ manufactured capabilities:
│ │ named · form-based · validated
│ │ danger-classed · confirmable
└──────────┬───────────┘
│
═════════════ THE WATERLINE — nothing below is visible to any agent ═════════════
│
┌────────────┐ ┌────────────┐ ┌────────────┐ ┌──────────────┐
│ ADAPTERS │ │ MAILBOXES │ │ TRIGGERS │ │ AUTH VAULT │
│ catch │ │ keep │ │ wake │ │ credential │
│ sessions │ │ durable │ │ declarative│ │ lifecycle — │
│ & events │ │ event logs │ │ no LLM │ │ agents never │
│ │ │ │ │ │ │ see a secret │
└─────┬──────┘ └─────┬──────┘ └─────┬──────┘ └──────┬───────┘
│ │ │ │
└────────────────┴───────┬────────┴─────────────────┘
▼
┌──────────────────────────────┐
│ THE OUTSIDE WORLD │
│ APIs · sockets · webhooks │
│ humans │
└──────────────────────────────┘
Adapters catch. Mailboxes keep. Triggers wake. Verbs act. The world's changes are events we hear, not surprises we trip over.
Available at every layer, none on the hot path of another:
| Organ | One line |
|---|---|
| 👁 The Witness | The mechanical world-model: a per-tenant, entity-indexed store of Claims — facts that carry their own timestamp, verification recipe, volatility, and epistemic grade. It attests; it never acts, never reasons. |
| 📜 The Intent Journal | Write-ahead log of every write attempt. Identity minted before firing, status tracked through confirmation. The Witness is "what the world is"; the Journal is "what we did." |
| 🔥 The Forge | The integration manufactory and lifelong custodian — human-driven today, supervised then autonomous only as measured agreement earns each stage. Manufactures verbs from API documentation, proves them behaviorally with a closed probe taxonomy, and owns them for life. Today's weird response is next month's breaking change — anomalies flow home. |
| ⚗️ The Distillery | The subconscious, mechanized. Mines execution traces (engrams) into routines, binding rules, and gate tunings — learning that can tighten policy but never loosen it. Always off the hot path. |
| 🏛 The Guild | Compiles procedural mastery — skill documents, SOPs, runbooks — into Crafts: read once by a master model, executed forever by machinery and small models. |
| ⚖️ The Charter | Who may cause what, made mechanical. Capability grants stored as witnessed claims, enforced inside the policy gate. Can make the system stricter for anyone and looser for no one. |
| 🛟 AITL | Agent-in-the-Loop: tiered resilience for genuine semantic failure. System-fixable failures (token refresh, reconnects, backoff) are invisible — the agent's context stays clean. |
| 🌾 The Harvest → The Commons | The factory identity: run frontier models through the whole system, judge every demonstrated success by outcome, compile the exemplars into open curricula and open-weight clerks. Frontier capability in; permanent, public structure out. |
Every side effect in the system passes through the same invariant sequence of gates. Every possible failure lands in exactly one gate with exactly one owner — agent, system, policy, or human. A failure with no owner is a bug in the Gauntlet, not an edge case.
intent
│
▼
┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
│ 1 SELECT │─►│ 2 FORM │─►│3 VALIDATE│─►│ 4 PROVE- │─►│ 5 POLICY │
│ verb │ │ fields │ │ schema + │ │ NANCE │ │ danger × │
│ chosen │ │ filled by│ │ type- │ │ taint │ │ tenant → │
│ by menu │ │ declared │ │ eligible │ │ checked, │ │ auto/log/│
│ or wiring│ │ source │ │ refs only│ │ escalated│ │ human │
└──────────┘ └──────────┘ └──────────┘ └──────────┘ └────┬─────┘
│
┌─────────────────────────────────────────────────────────┘
▼
┌──────────┐ ┌─────────────────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
│ 6 READI- │─►│ 7 EXECUTION │─►│ 8 DOUBT │─►│ 9 INTER- │─►│10 RECORD │
│ NESS │ │ 7a INTENT: identity │ │ confirm │ │ PRETATION│ │ durable │
│ sessions,│ │ journaled BEFORE │ │ PRESENT/ │ │ is the │ │ history, │
│ locks, │ │ any bytes move │ │ ABSENT/ │ │ answer │ │ facts → │
│ guards, │ │ 7b FIRE: idempotent │ │ UNKNOWN— │ │ sane? │ │ Witness, │
│ freshness│ │ by construction │ │ never │ │ anomalies│ │ auditable│
│ re-verify│ │ │ │ guessed │ │ → Forge │ │ forever │
└──────────┘ └─────────────────────┘ └──────────┘ └──────────┘ └──────────┘
+ THE RE-ENTRY PROTOCOL — applied at every wake from suspended time:
approvals re-validated, guards re-evaluated, readiness re-run.
Waking is not resuming trust; it is re-earning it.
A few consequences worth savoring:
- No side effect exists before validation and policy have passed. Ever.
- No fire without prior identity — every write durably records its own identity before any bytes move, so every retry path in existence is safe regardless of the caller's manners.
- "Not seen yet" is never "didn't happen." Confirmation is three-valued;
IN_DOUBTis a first-class durable state; doubt is patient. - Authorization binds to exact content and decays with time. Any mutation — even a correct fix — voids the approval and re-routes through the gate.
Praxis is designed around three compounding flywheels, all feeding on the same substrate: every press, deliberation, and mission deposits a structured, minable trace — an engram.
┌───────────────────────────────────────┐
│ EVERY EXECUTION │
│ deposits a typed engram │
└───────────────────┬───────────────────┘
│
┌─────────────────────────────┼─────────────────────────────┐
▼ ▼ ▼
╔═══════════════════╗ ╔═══════════════════╗ ╔═══════════════════╗
║ FLYWHEEL 1 ║ ║ FLYWHEEL 2 ║ ║ FLYWHEEL 3 ║
║ RECURRENCE ║ ║ SPECIALIZATION ║ ║ THE FACTORY ║
╟───────────────────╢ ╟───────────────────╢ ╟───────────────────╢
║ Distillery mines ║ ║ execution data ║ ║ Mastery Mode runs ║
║ plan shapes into ║ ║ becomes clerk ║ ║ frontier masters; ║
║ Routines; missions║ ║ curriculum; small ║ ║ the Judge ranks ║
║ collapse; the ║ ║ models specialize ║ ║ by outcome; the ║
║ deliberating ║ ║ on exactly the ║ ║ Commons publishes ║
║ itself compiles ║ ║ shrunken task ║ ║ verbs, curricula, ║
║ away ║ ║ ║ ║ open weights ║
╚═════════╤═════════╝ ╚═════════╤═════════╝ ╚═════════╤═════════╝
│ │ │
▼ ▼ ▼
recurring tasks run at daily work runs on capability, not genius,
ZERO cognition small / local models democratized — forever
The industry distills what frontier models say. Praxis distills what they do — judged by execution, replayable against history — into an open commons. What is farmed is practice, not prose.
The invariant core is a constitution of 52 articles — and every one of them was earned before any code existed, by writing out a production disaster on paper and watching the design fail, or by surviving an adversarial review round. Superseded ideas are never deleted; they retire to a ledger with the reason for their death.
A taste:
Art. 1 — No side effect may exist before validation and policy have passed.
Art. 4 — Nothing in doubt is ever retried without reconciliation.
IN_DOUBTis a first-class durable state, not an exception message.Art. 8 — No fire without prior identity.
Art. 13 — Suspension is a seam, not a pause. Nothing held across sleep is trusted on resumption.
Art. 14 — Facts cross boundaries only as Claims — self-identifying, timestamped, carrying their own re-verification recipe.
Art. 20 — Every value carries its origin; derivation inherits it. Over-tainting is safe; under-tainting is not.
The Harness enforces these on every press, forever. Any future design change is tested against them. Governance has teeth: no maintainer, steward, or employer has a private path around a gate — the only way past a constitutional mechanism is a constitutional amendment, with independent safety reviewers holding veto standing.
| ✅ It is | ❌ It is not |
|---|---|
| An automation and execution engine: background tasks, scheduled work, long-running processes, enterprise operations | A chatbot — chat is merely one input method |
| Runtime capability selection across manufactured, verified verbs | Zapier — end-to-end paths are selected and compiled at runtime, not manually pre-wired (compiled Routines are cached results of that selection, re-checked and re-gated on every run) |
| Machinery that consults a model at narrow, pre-assembled decision points | CrewAI / LangGraph — the LLM never orchestrates anything here |
| Full replacement for routine operational work; honest augmentation for judgment work | A claim that judgment is automatable — the farmable/irreducible boundary is measured, not asserted |
Pieces of this exist elsewhere — tool catalogs, durable execution, agent graphs. Nobody has the custodian (integrations that maintain themselves), the Witness (a mechanical truth layer), a gated subconscious (learning that can only tighten), compiled skills instead of rented frontier cognition, or a budgeted, auditable, self-abolishing deliberation loop. Those are ours.
The project is specification-first. The full corpus exists and governs the build; it opens progressively.
| Document | Role | Public |
|---|---|---|
| Project Memorandum v5.1 | The complete, self-contained vision — a reader with amnesia can reconstruct everything | 🔜 |
| Verb Specification v1.5 | The four faces of a capability: Card, Contract, Warrant, Chronicle | 🔜 |
| Harness Specification v1.4 | The engine and the Gauntlet, normatively | 🔜 |
| Helm Specification v1.2 | Missions, deliberation, the Agenda, the collapse rule | 🔜 |
| Forge Specification v1.1 · Forge Workbench v1.0 | Manufacture, probes, custody, the touch taxonomy | 🔜 |
| Distillery & Guild Specification v1.3 | The learning organs | 🔜 |
| Harvest & Commons Specification v1.1 | The factory and the open treasury | 🔜 |
| System Interfaces Spec v1.4 · Identity & Access v1.0 · Economic Model v1.0 | The seams | 🔜 |
| Lexicon v1.0 | Every term of art, exactly one definition | 🔜 |
| Conformance Matrix v1.0 | Every constitutional MUST → owning module → test | 🔜 |
| Roadmap v1.4 · Technology Dossier v1.3 · GOVERNANCE.md | How it gets built, on what, under whose law | 🔜 |
Risk-ordered, exited only by passing disaster tests in CI — a phase without a passing fault-injection test is not finished.
Phase 0 THE WORKSHOP ◄── we are here
the repo becomes the amnesia-proof brain the project runs on
Phase 1 THE WALKING SKELETON
one press survives every death you can inflict on it
(kill -9 mid-refund → exactly one refund, provably, every run)
Phase 2 THE FULL GAUNTLET
all ten gates, the Witness, the Charter, human approval cards
Phase 3 THE AUTHORING SURFACES
anyone who writes English authors a workflow that is
checked, previewed, linted, and gated — adequacy stays
with the author
Phase 3H THE HELM
an open-ended goal survives budgets, crashes, and the world's silence
Phase 4+ Forge automation · Distillery · Guild · Harvest & Commons
gated on measured traction, not optimism
Every phase publishes its kill-numbers — tokens per task, human touches per 100 presses, intent-to-completion latency — and each number names the thesis it can falsify. A phase that stops measuring has already failed its exit.
Open from day zero: Apache-2.0 with DCO and trademark protection. Tenant substance never enters the Commons; consent law is in force before the first external trace can exist. Stewards are powerful in curation and powerless in exemption.
Praxis (πρᾶξις) — Aristotle's word for intelligent action as distinct from thought.
The founding inversion, in one word.
⭐ Star and watch — the specs and skeleton are coming.