Agentic AI and Infrastructure
ChaseOS Core
A standalone, MIT-licensed governance framework for agent systems: approval-gated writes, fail-closed authority, and decision routing that picks a human, deterministic code, an ML model or a generative agent before it picks a provider.
Outcome
Installable from PyPI as chaseos-core and usable inside any Python project. ChaseOS is the framework's own proving ground — the same package is the substrate the wider system runs on, so the governance model is demonstrated in production rather than described in a README.
Media
The authority pipeline. A request is routed by modality, gated, bounded and evidenced — and with no authority provider bound it denies rather than proceeds. Canonical knowledge is reached only through an explicit promotion gate, never by direct agent writeback. 
Runtime topology. Core is not an agent — it is the layer above them. Runtimes declare a profile and propose by default; authority is granted by Core, never by one runtime asserting it to another. 
MIT licensed, approval-gated, fail-closed — the three properties the framework is built to guarantee.
Case study
The problem
Agent frameworks compete on capability: more tools, more autonomy, more things the model is allowed to do. That leaves the harder question unanswered — not whether a system can perform an action, but whether it was permitted to, who is accountable for it, and what evidence survives afterwards. Once agents can write to durable memory, the failure mode is rarely dramatic. It is quiet corruption: a plausible inference gets written down, read back later as fact, and within weeks the knowledge base holds confident claims nobody verified and nobody can trace.
Authority as the engineered property
Core treats capability as assumed and authority as the thing being designed. Every gated operation resolves through a single port, and the resolution order ends in a deny-by-default fallback — so an installation with no authority provider registered refuses gated work instead of silently permitting it. A misconfiguration produces a denial, not an accident. The cost is real and stated plainly in the docs: a fresh install cannot perform gated operations until you supply a policy.
Deciding who acts, before deciding which model
The decision router asks which kind of actor should own a step — a human, deterministic code, an ML model, or a generative agent — before any provider is chosen. Action classes such as money movement, access control, identity and canonical transitions cannot be delegated to a generative model: the router blocks routes that try. Generative steps must declare a cost ceiling and explicitly opt into bounded nondeterminism; ML steps must declare model version, evaluation reference and drift status. Inspection derives the full approval plan without dispatching anything, so a route can be checked in CI or a pull request without touching production authority.
Truth is promoted, never written
Captured material lands in quarantine and becomes canonical only by passing an explicit promotion gate with provenance and a review decision. Agents produce candidates; candidates become knowledge through a gate. Provenance is enforced rather than assumed — content without a traceable source cannot be promoted — which closes the obvious hole of an agent that is allowed to write, writing something unattributable.
Open framework, private instance
The split is enforced rather than encouraged. Core is the public MIT layer: contracts, governance, fail-closed adapters, a lean CLI. Credentials, live runtime state and personal content live in a separate private instance and never enter the public tree — a publication standard backed by a repo-safe secret audit that reports credential-shaped strings without ever emitting their values. The proprietary enforcement engine is a registered implementation behind the port, which is why the open half can be inspected, forked and extended without the closed half.
Governing agent runtimes, not being one
Core is not an agent. It is the layer above them: the runtimes that do the work — an agent harness, a coding assistant, an MCP server, a bot acting as an operator control plane — are workers, and Core is where their authority is defined, checked and recorded. Each declares a profile rather than describing itself in prose, and the default posture is proposer rather than actor: credential values, private memory mutation, host mutation and external publication are refused unless explicitly granted. The rule that makes a fleet survivable is that a target runtime does not gain authority because another runtime mentions it. Authority comes from the workflow manifest, the role card and the approval gate — never from the request — so if one runtime instructs another, that instruction is data, not permission. Work crosses as a task packet carrying its own authority, and a handoff is explicitly not an approval: credentials never transfer, and stale context is revalidated before anything acts on it. What Core ships here is the contracts and the Gate port, not working adapters for specific third-party runtimes; Chaser Agent is the reference consumer built to these principles.
Proven on ChaseOS itself
ChaseOS is the framework's first and most demanding consumer: the same published package is the substrate the wider control plane runs on. That is the practical case study — the governance model is not a proposal, it is the thing already carrying real multi-agent work. Because Core is a standalone dependency rather than an extract, anyone building their own agent system can adopt the same boundaries without adopting ChaseOS.
Built to be verified, not trusted
Continuous integration runs the test suite across Python 3.11 and 3.12, a lint gate scoped to defect-class rules rather than style, and a job that installs the built wheel outside the source tree and asserts the packaged policy data actually loads — a guard added after a real defect where the published package installed cleanly but shipped none of its manifests. Five runnable examples double as executable documentation: they assert the framework's own guarantees, including that no provider enables a write capability by default, so a claim in the docs cannot quietly stop being true.
Where it is now
Published on PyPI and installable with pip. Alpha and pre-1.0: Core ships no workflow manifests, so workflow execution escalates rather than running, and gated operations deny until an authority provider is registered. Both are deliberate, and both are stated in the README rather than discovered later. Architecture decision records document why the seams sit where they do.
Technology
- Python 3.11+
- MIT licence
- PyPI
- Ports and adapters
- YAML policy manifests
What's shipped inside it
Gate port ↗
LiveThe single seam every authority question resolves through, so a runtime's permissions are checked in one auditable place. Registering your own provider replaces the policy without touching call sites.
How a runtime declares what it is and what it may do. Anything outside the declaration is forbidden, and credential values, memory mutation, host mutation and external publication are refused by default.
The unit of work that crosses between runtimes, carrying its own authority rather than assuming it. Handoffs are data, not approval: credentials never transfer and stale context is revalidated before acting.
Inspection-only routing that picks a human, deterministic code, an ML model or a generative agent per step and derives the approval plan without dispatching anything.
Connections registry ↗
In DevelopmentProvider manifests describing each capability's action type and safety level as data. Read-only by default — no write or external-egress capability is enabled out of the box.
Third-party runtime adapters
PlannedCore ships adapter specifications as worked examples of the contract, not working integrations. Chaser Agent is the reference consumer built to these principles; other runtimes referenced in the docs are interoperability targets and not ChaseOS projects.
Scope and boundaries
Alpha and pre-1.0. Core ships no workflow manifests, so workflow execution escalates rather than running, and it deliberately denies gated operations until an authority provider is registered. It is not a production autonomy runtime, a hosted service, or a model.