No human reviews every line an agent writes; pretending otherwise just moves the bottleneck back to the human. So we move the trust boundary upstream. Intent becomes a requirement, the requirement becomes a typed spec, and the spec becomes law: a hash-verifiable contract that machinery enforces at PR time and at run time.

Agentic output is hostile by default. It earns passage by surviving gates, not by appealing to trust. Humans gate the contracts (specs, approvals, irreversible boundaries); everything between them is enforced, reconciled, and signed by code. The result is delivery you can hand to an auditor: every change bound to the spec that authorised it, every run emitting a certificate anyone can verify offline.

Statecraft is a two-plane system: the control plane is one EnRaHiTu app, and every tenant app it stamps is another, independent one.

flowchart TD
  spine["spec-spine · specs as law"] -. "governs every repo here" .-> sc
  cli["statecraft-cli · CLI for humans, MCP server for agents"] --> sc
  enr["enrahitu · the template chassis"] -- "template.toml" --> sc
  sc["statecraft · the control plane: tenants, factory, fleet, governance"]
  sc -- "stamps and operates" --> cell["governed tenant apps · EnRaHiTu cells on your cluster"]
  cell --> emit["tenant-emit · sign the run"]
  cell --> tail["tenant-tail · verify the run"]

The governed agentic delivery control plane: tenants (per-customer GitHub App installations), factory (stamps apps from the enrahitu template via its versioned template.toml contract), fleet (operates the stamped apps on hetzner-k3s), and the governance UI. It is itself the first production EnRaHiTu app: the platform is governed by the same machinery it offers.

EnRaHiTu: Encore.ts + rauthy + hiqlite + Turso/libSQL. A self-contained, single-container application core with zero managed-infrastructure dependencies: typed APIs, a real OIDC identity provider, and embedded Raft-replicated SQLite in one image. This is the template chassis the Statecraft factory stamps; the Encore toolchain is consumed as a published package and driven directly, no CLI anywhere.

One binary, two faces: Statecraft's governance verbs as CLI subcommands for humans and as an MCP server for agents, so a coding agent can request approvals, check spec-code coupling, and trigger factory stages natively under governance instead of shelling out around it.

The foundation everything else is built on: a typed, hash-verifiable authority ledger over a markdown spec corpus. Each spec declares, in YAML frontmatter, the files, sections, symbols, and crates it owns; a PR-time coupling gate refuses code that drifts from its owning spec. Every artifact is a pure function of (config, file contents): byte-identical output on every platform. Installable from crates.io, npm, or PyPI. It governs itself, its own coupling gate runs against its own spec corpus in CI.

An emit-only CLI a stamped application pins to build a signed governance-certificate.json from a finished run directory: scan every stage, SHA-256 every artifact, lift the frozen spec hash, attach an attributable signer, and write a self-authenticating certificate. Identity-bearing and offline.

The verify-only counterpart: a CLI a stamped application pins to re-check the factory's run-side paperwork (artifact-hash chain, Ed25519 signature, platform countersign, inter-stage manifest chain) with zero trust in the producer. Offline, identity-free, read-only all the way down. Spine to tail to emit: spec-spine compiles the corpus, tenant-tail verifies the run-side paperwork, tenant-emit produces it.

A pure, deterministic decision gate over a pluggable Check registry: evaluate(context, checks) returns Allow, Deny, or Degrade, with a stable config hash so the policy that decided is itself attestable.

A tamper-evident record ledger: append-only, hash-linked, Ed25519-signed, with an independent verifier that does not trust its producer.

A rolling-window trust scorer: weighted samples map to a graduated privilege level, degrade-only or bidirectional, deterministic and snapshot-persistable.

Deterministic canonical JSON: a lexicographic key sort at the serialization boundary, so record hashes agree everywhere.

The shared native packages behind the family: the @statecrafting/* napi-rs addons (hiqlite, kernel, governance, fleet) and the vendored Encore build toolchain that statecraft and enrahitu consume. Licensed per package: the building blocks stamped apps consume are Apache-2.0, the control-plane addons are AGPL-3.0.

The control plane is AGPL-3.0 on purpose: the audit chain is a public good for regulated buyers, and strong copyleft prevents that work from being absorbed into proprietary control planes that strip the traceability while keeping the engine. Everything a stamped customer app consumes (the template, the CLI, the tenant toolkit, the primitives) is Apache-2.0, so the building blocks are free to adopt anywhere.