Governed AI execution
as a typed platform stack.

app_kit is the workspace product code is allowed to touch for governed platform behavior. It carries chat, typed domain, operator, work-control, runtime gateway, review, installation, semantic assist, trace lookup, and leased lower-read surfaces. It is also the enforcement point: product and hazmat scanner profiles reject direct imports into Mezzanine runtime services, Citadel internals, Jido Integration, and Execution Plane unless the product is authoring a pure Mezzanine.Pack model contract.

mezzanine is the neutral high-level monorepo behind AppKit. It owns pack registration, compiled installation config, source admission, subject and object lifecycle, execution ledgers, decision and review state, evidence, projections, audit, archival restore posture, operator actions, runtime scheduling, and Temporal workflow handoff. Oban remains a local delivery and garbage-collection tool where explicitly retained; Temporal owns active workflow lifecycle, while Postgres stores substrate truth and projection facts.

outer_brain owns semantic session work: context assembly, clarification, memory-shaped recall, normalized semantic outcomes, semantic failure journaling, and AITrace-linked provenance. citadel owns authority and policy compilation before mutation: action requests, capability posture, governance packets, topology, and the authorization shape that lower layers must receive. The split is deliberate: cognition can be rich, but durable mutation still needs deterministic authority.

jido_integration is the Spine. It accepts Brain-origin work, validates ingress shape, owns auth and lease lifecycle, records review and control-plane truth, admits connectors, publishes connector effects, and exposes lower facts through tenant-scoped substrate reads. It is not just a connector workspace; it is the durable middle layer between Brain governance and raw execution mechanics.

execution_plane owns low-level effect mechanics: HTTP, process, JSON-RPC, placement, sandbox and operator-terminal lanes, plus future cell-style execution. Provider and runtime-family kits such as Pristine, Prismatic, CLI Subprocess Core, and Agent Session Manager normalize transport and session behavior. They emit receipts and raw facts; they do not own product truth, semantic meaning, or review state.

The memory architecture extends the same contract discipline into recall. Platform.AccessGraph.v1 makes user, agent, resource, scope, policy, and review-authority relations epoch-stamped. Private, shared, and governed memory live in separate stores with different writers and constraints. Share-up and promotion create new fragments, preserve parent links, apply transform policy, and emit proof tokens so a future audit can answer which memories influenced a decision, under which policy, and whether those fragments would still be admissible now.