Architecture
A stable foundation that doesn't depend on which model or harness you deploy.
The Philosophy
Most agent systems make the agent the center of the architecture. steadfaste reverses that relationship.
Control flows in one direction:
Steward → Constitution → Judgment → AgentWorkers cannot bypass the Constitution. There are only two doors into the system:
- Workers enter through the Wire
- Surfaces enter through the Core Interface
Both remain behind the same governance boundary. The Judgment layer evaluates candidate actions before they execute — escalation is a first-class outcome, never a failure.
Layer One: The Constitution
The small, stable core. It owns everything that must remain dependable:
- Durable state and the tamper-evident Ledger
- Event bus for internal coordination
- Configuration validation — one file, no silent env vars
- Worker supervision and lifecycle control
- Permissions and enforcement (Gate)
- Verification and graded trust (Verifier)
- The Wire protocol (additive-only)
- A versioned moral constitution (28 principles, tiered conflict resolution)
The Constitution is the system's single writer, single verifier, and single lifecycle authority. No agent can modify its own permissions or approval records.
Layer Two: Judgment
A constitution-governed System-1 decision engine that scores candidate actions against policy and situation.
- Fast: one encoder pass → probability distribution over options
- Honest: calibration + out-of-distribution detection + margin thresholds route uncertainty to human escalation
- Equivariant: score order does not depend on option labels
- Hardware-efficient: runs on standard compute, including Apple Silicon
The model lives in a separate repo and is versioned independently of the core. It applies the same constitutional principles the core enforces structurally.
Layer Three: The Wire
The boundary between steadfaste and its workers. A deliberately small, versioned JSON-over-stdio protocol.
The One Rule
Existing workers should keep working.
The protocol is additive-only. New capabilities are introduced without silently breaking old workers. Any agent that speaks the Wire can become a governed steadfaste worker.
Layer Four: The Core Interface
Human-facing applications use a separate stable interface behind the Constitution:
- Web UI
- TUI (terminal interface)
- Messaging gateway (Telegram today, others additively)
- Operator dashboard
- Future clients
The Core Interface exposes governed state, evidence, subscriptions, and lifecycle operations — without giving any surface a path around the Constitution.
System Diagram
Constitution
Judgment
The Wire
Additive-only JSON-over-stdio protocol
Governed workers
Core Interface (human-facing surfaces)
How a request travels through steadfaste
Agent requests action
Agent sends a task through the Wire — deploy code, access secrets, modify infrastructure.
Gate checks permissions
Is the caller allowed? Is the resource in scope? Is there an active veto or taint?
Judgment scores the action
Policy + situation → probability distribution. Escalation is a valid, first-class outcome.
Human approval (when required)
High-risk or escalated cases route to the Steward for explicit approve, deny, or hold.
Execution + recording
Action runs. Result is captured. Evidence is sealed. The Ledger holds a tamper-evident record.
Without and with steadfaste
Status quo
Agent acts directly. Governance is downstream, after the fact. No independent record of who authorized what.
With steadfaste
One governed decision point sits between agent and enforcement. Every action is scored, recorded, and attributed before it runs.
Incremental adoption
steadfaste does not replace your existing enforcement. It adds one governed decision point in front of it.
The Covenant
Every action runs under a human Steward who remains accountable for what the system does.
Trust is not requested. It is demonstrated. Actions are recorded. Results are verified. Trust is graded. Failures have consequences.
Ready to evaluate?
Read the docs or request walkthrough access.