Component: Audit Log
What it is: an append-only decision log (PostgreSQL) that records every allow/deny with the
Component: Capability Discovery
What it is: a resolver for declared tools, implementing RFC 9728 (OAuth 2.0 Protected
Component: CI Drift Action
What it is: a GitHub Action + CLI that runs an agent's tests, diffs the observed call graph
Component: DAG Compiler
What it is: a policy compiler that composes every reconciled manifest touching a scope into
Component: Delegation-Chain Query API
What it is: a first-class read API — given a logged action, returns the full delegation
Component: Identity Registry / Verifier
Phase 4, specified but not yet implemented — no /v1/agents//enroll or /revoke route,
Component: Manifest Store
What it is: a versioned, append-only artifact store (PostgreSQL) that persists each
Component: Observability Layer
Four decisions in this layer look wrong at first glance and are not. Each one is written down
Component: PDP
What it is: the Policy Decision Point — a pure function (policy + request + verified token
Component: PEP — Boundary adapters
Phase 5, "Not started" as of this writing. This diagram is the designed flow for the strongest
Component: PEP — Gateway
Phase 5, "Not started" as of this writing (docs/phases/phase-5-gateway-boundary-stepup-coldstart.md).
Component: PEP — Sidecar
What it is: a local egress proxy, one per agent process, that intercepts the agent's
Component: Provenance/Taint Engine
Phase 4, specified in docs/phases/phase-4-transaction-tokens-taint-identity.md and
Component: Reconciler
What it is: a diff engine that compares a declared manifest against what
Component: SDK Client
What it is: a thin orchestrator-side library — consent(), authorize(), hop(), with
Component: Token Exchange Service
What it is: the RFC 8693 issuer. On an allow, exchanges the presented token for a narrower,