A file-based governance runtime for LLM agents. Declarative JSON state, bash hooks as admission controllers, namespace-scoped ownership, periodic compaction. No external dependencies.
AI agents have moved from demos into production. They write code, send email, move money. The agents have become more capable. The systems around them have not.
Today, when something goes wrong: retrain the model, rewrite the prompt, add a human reviewer. These depend on trust between developer and model. This is relational oversight. It breaks under load.
AI agent safety is a governance problem, not an alignment problem.
Alignment is necessary. It is not sufficient. What is missing is the layer between the agent's decision to act and the system's commitment to that action.
Covenant sits between an agent and the systems it acts on. Every action passes through it. Five functions, in order.
Every actor has a verifiable identity. Agents cannot impersonate other agents.
Each identity has defined capabilities. Deny by default.
Policies express what is forbidden across sequences of actions, not just single calls.
Graduated responses. Warning, then throttle, then suspend. Each tier narrows what the agent can do.
Every decision logged. A graph of causes and effects that can be queried and audited.
Each agent follows the same rules but has a different job. Hover any role to see what it does.
Hover or tap any agent above.
A single message triggers twenty-three safety checks before any code is written.
Your message is validated. The Interpreter reads system state.
Semantic memory, abandoned-goal checks, historical review.
Nothing executes until you approve.
Overlap detection, complexity threshold, memory retrieval.
Seven orientation steps before the first tool call.
Three hooks on every tool call. Files tracked. Tokens logged.
Exit report. Skills updated. Consolidation threshold checked.
The closest architectural analog is Kubernetes, not other agent frameworks.
| Kubernetes | → | Covenant | What it does |
|---|---|---|---|
| etcd | → | JSON registry files | 36 flat-file state stores. No database. |
| Admission controllers | → | Bash hooks | Fire on four lifecycle events. WARN, BLOCK, or INFO. |
| Namespaces | → | Domains | Horizontal grouping. Shared memory. Write boundaries. |
| Pod specs | → | Agent definitions | Declarative role templates in Markdown. |
| ConfigMaps | → | orientation.json | Shared broadcast state. Current mandate, what to protect. |
| Init containers | → | Genesis Phase | Seven-step bootstrap before first tool call. |
| Liveness probes | → | Health score | Performance tracked against baselines. |
| GC / compaction | → | Consolidation | Stop-the-world pause. Distill, trim, archive. |
/covenantFormal project commitment/consolidationConsolidate, reflect, distill/trialAdversarial stress-test/floodFull reset with lessons/bindingGraceful abort/lamentAcknowledge failure first/rememberSemantic memory retrieval/memoStructured memo to a peer/councilMediate sibling disagreement/ezraRe-orient after time away/retrospectivePost-mandate retrospective/welcomeEvaluate external tool trust/preflightReview past failures first/rebuildPost-reset reconstruction/patternsDetect recurring failures/territoryView explored domains/assessQuality assessment/amendPropose an amendment... and eighteen more in the repository.
10 pages. The problem, architecture, a walkthrough, honest limitations.