Nothing here is bespoke. A component is a typed value producer — config → input → output — and a network of components is itself a component. The pipeline, the runtime, and the transport are all components; the topology is defined separately from any of them.

A run moves through a closed, ordered set of stages. The controller runs them in order and refuses a missing stage or a skipped gate.

• The model appears only at the front, to turn natural language into a formal proposal.
• Transformers formalize that proposal into strict-schema artifacts.
• The gateway admits tools; the applier is the only writer; the verifier runs a closed catalog.
• Acceptance joins the evidence and decides.

Everything the model touches is clamped. Everything past it is reproducible.

Authority is a spine, not a folder. One document owns each fact; every other citation resolves to it. Nothing is silently restated, and nothing drifts unannounced.

The human is not "in the loop" by default. The human is the clamp — placed by a decidable function: deterministic, verifiable, robust, secure, idempotent. If that cannot be decided, the system refuses, and the human owns the boundary. A machine that meticulously labels what it has not proven is the opposite of one that guesses.

Agent Elmer assumes nothing about its environment and grants nothing by default. Every capability is explicit, scoped, and recorded — and the parts that touch your work cannot be bypassed.

• Default-deny capabilities. No ambient access to the network, filesystem, secrets, or clock. Each access is a declared, recorded grant.
• The runtime is not an authority. A running component cannot make the decisions that belong to the controller, gateway, applier, or verifier. An attempted effect is refused and logged.
• Secrets stay out. They never enter arguments, environments, logs, or evidence — only capability references travel.
• Provenance is recomputable. Identity is a content address, so what ran, what it produced, and who made it are facts you can re-check.
• Sovereignty. Your data is yours. The components you create carry your rights.

Safety here is not a policy bolted on top. It is the shape of the system.

• Rogue agents are structurally impossible. Each AI is a small, bounded domain expert with no ambient authority. It cannot act outside the capability it was granted, so it has no reach for mischief — and small, fine-grained agents are easy to watch, regulate, and reason about.
• Every parent governs its children. A composite component holds immediate, recorded authority over the components it contains. Governance is recursive, so control scales with the topology.
• Bubble-wrapped, at every scale. Each fractal structure carries its own security and governance boundary. A fault is contained exactly where it happens.
• Mission-critical, live. A component can be repaired or replaced without downtime — not a second, not a millisecond, not a microsecond. Identity stays stable; the running instance is swapped underneath it.

Every artifact the factory produces is content-addressed. Two runs, two machines, one address. There is no "it worked on my machine."

• Deterministic — the same pinned inputs yield the same outcome, every time.
• Verifiable — an external check decides pass or fail; the model never has the last word.
• Idempotent — a re-run is a no-op; state converges.

And when a check cannot pass, it refuses. No partial success. No silent pass. The floor is green, or the build does not ship.

Every claim below is backed by an external check that runs on the floor. A guarantee that cannot be verified is not offered.