A BEAM-native control stack for governed AI side effects

A boundary architecture for semantic systems that need to read, reason, request work, and cause external effects while preserving authority, tenancy, replay, and operator control.

94 repositories | @North-Shore-AI | nshkr.com

nshkrdotcom is a public workspace for a layered AI execution platform built on Elixir, OTP, Ash, Postgres, Temporal, and a set of deliberately narrow boundary packages.

The central design constraint is simple: an AI runtime may produce language, plans, code, tool calls, and operator suggestions, but it should not get a direct path to mutate the world. Every consequential action has to cross typed context, authority compilation, durable acceptance, lower-runtime dispatch, and observable proof.

That means the stack is organized around ownership, not around product features:

• product repos own product behavior and operator journeys
• AppKit owns the public application boundary
• Mezzanine owns reusable operational truth above the lower stack
• OuterBrain owns semantic context and normalized AI outcomes
• Citadel owns authority and policy compilation
• Jido Integration owns durable Brain-to-Spine intake and lower facts
• Execution Plane owns raw runtime mechanics
• Stack Lab and AITrace own proof, replay, and operational visibility

The primary artifact is the execution record chain: requester, admitting policy, active installation revision, durable acceptance row, workflow or lower-runtime handoff, returned receipt, review or projection mutation, and replayable proof.

Most AI application stacks collapse three different concerns into one runtime path:

semantic reasoning -> operational decision -> external side effect

That works until the system has to survive real operators, real tenants, long-lived workflows, partial failure, changing permissions, replay, cost attribution, incident export, or post-hoc questions from someone who was not in the room when the model ran.

This workspace separates those concerns:

semantic reasoning       OuterBrain
authority compilation    Citadel
operational truth        Mezzanine
durable lower intake     Jido Integration
raw runtime mechanics    Execution Plane
product boundary         AppKit
proof and replay         Stack Lab + AITrace

Useful autonomy needs inspection points strong enough to replace screenshots, prompt transcripts, and faith with durable records an operator can query after the run.

The repos form a contract stack. Each layer has one primary job and an explicit list of things it must not own.

Products and operator shells
  extravaganza | switchyard | jido_hive | future products
        |
        v
Northbound product boundary
  app_kit
    - stable product-facing DTOs and surfaces
    - installation bootstrap, work control, operator reads, reviews
    - lower-read leases and no-bypass scans
        |
        v
Neutral operational substrate
  mezzanine
    - pack model and compilation
    - source admission, lifecycle, execution, decisions, evidence
    - projection, audit, archival, operator actions
    - Temporal workflow handoff backed by Postgres truth
        |
        +---------------------------+
        |                           |
        v                           v
Semantic and authority chain        Lower durable Spine
  outer_brain -> citadel            jido_integration
    - context and recall              - Brain ingress validation
    - semantic failure carriers       - auth and lease lifecycle
    - policy and authority compile    - connector admission
    - governed mutation envelopes     - review/control-plane/lower facts
        |                           |
        +-------------+-------------+
                      |
                      v
Execution substrate
  execution_plane
    - HTTP, process, JSON-RPC, placement, sandbox lanes
    - local, SSH, guest, terminal, and future cell mechanics
    - raw receipts and facts, not product or business truth

Runtime and provider families
  pristine | prismatic | github_ex | notion_sdk | linear_sdk
  cli_subprocess_core | agent_session_manager | codex_sdk | claude_agent_sdk
  snakepit | snakebridge | slither | DSPex

Foundational substrate
  ground_plane
    - ids, leases, fences, checkpoints, and primitive shared contracts

Proof and operations
  stack_lab | AITrace | ElixirScope
    - fault drills, replay, trace joins, execution cinema, release evidence

The most important dependency rule is that products should not assemble this path by hand. Product code talks to AppKit. AppKit talks to the substrate. The substrate records facts and requests authority. Lower runtimes execute only after the request has been reduced to explicit, typed, governed intent.

A governed execution is expected to carry enough structure to answer these questions without reading a prompt transcript:

The multi-repo shape keeps those responsibilities from collapsing into one convenient agent runtime that quietly accumulates policy, durable workflow state, connector truth, product state, and raw execution mechanics in a single failure domain.

Long-running AI systems need memory, but memory is only useful in production if it is admissible.

The memory design treats recall as an access problem over time, not as a vector search problem with metadata filters. The proposed Platform.AccessGraph.v1 records user-agent, agent-resource, user-scope, scope-resource, user-policy, and review-authority edges as epoch-stamped state. Memory fragments carry immutable provenance: creation epoch, originating actor, contributing agents, accessed resources, scopes, policies, evidence refs, governance refs, tier, and parent fragment.

Memory is physically tiered:

Share-up and promotion create new fragments instead of mutating tier flags. Transform policy, parent links, evidence, and proof tokens make the path auditable.

The hard requirement is retrospective replay: given a past decision, the platform should be able to reconstruct which fragments were admitted, under which policy version, at which graph epoch, with which transforms, and whether those fragments would still be admissible under current policy.

extravaganza is the first product built to prove the shape from above. It is intentionally thin: product defaults, product operator journeys, product packaging, and product-owned pack definitions live there. Workflow machinery, review mechanics, runtime gateway behavior, source publication, durable receipts, and lower-backed reads stay behind AppKit and Mezzanine.

The lower end is intentionally harsher. Modern coding and operator workloads need long-lived sessions, bidirectional JSON-RPC runtimes, host-side tools, approval callbacks, terminal surfaces, and session continuations. Those capabilities are treated as hazmat. They belong behind leases, grants, workflow facts, lower receipts, and operator-visible controls, not behind a direct product import.

• One owner per durable fact. Execution records, decision records, lower receipts, source publications, memory fragments, and operator projections each need a clear writer. Shared reads are normal. Shared write authority turns into ambiguity under failure.
• Semantic richness stops at the boundary. LLMs can propose, summarize, repair, and classify. Durable mutation requires typed intent, authority, idempotency, and an owner that can replay or reject the operation.
• Lower runtimes emit receipts, not meaning. Execution Plane and provider-family packages own transport fidelity, session mechanics, placement, sandbox posture, and raw facts. Product meaning and review state live above them.
• Read paths still need tenant proof. A caller-supplied run id, receipt id, issue id, or workflow id is never enough. Tenant scope has to match at the public surface, substrate authorization layer, and lower-facts boundary.
• Long-lived work is workflow state, not a background job convention. Temporal owns active workflow lifecycle where durable orchestration matters. Postgres owns facts and projections. Local queues are delivery and cleanup tools only where explicitly retained.
• Proof is a product surface. Trace ids, causation, idempotency, source positions, schema hashes, release manifests, projection hashes, audit facts, and proof tokens are part of the contract operators consume.
• Generate boundary scaffolding, keep meaning explicit. DTOs, mappers, manifests, and bridge code can be generated when that reduces drift. Policy interpretation, pack semantics, and owner decisions remain explicit source.

This inventory is generated from live GitHub metadata and grouped by nshkr-* topics so it stays current as the ecosystem grows.

Updated 2026-05-01