Infrastructure for autonomous systems that have to be governed, not just prompted.

An agent that can run commands is easy. An agent whose actions can be authorized before they happen, bounded while they happen, and proven after they happen is a different engineering problem. Neuruh builds that second thing.

The rule everything here is designed around:

Model output is evidence, never command authority.

One command, no API key, no model required. It runs a governed agent end to end and writes artifacts you can verify with tools that know nothing about it:

git clone https://github.com/NeuruhAI/neuruh-sovereign-agent-starter.git
cd neuruh-sovereign-agent-starter
python -m venv .venv && source .venv/bin/activate
pip install .
neuruh-sovereign-agent examples/starter.synthetic.json --out-dir run-output

RUN COMPLETED: run-87f295783d3e46fb96ab6a7c7e3ce0c0
MANIFEST: run-output/manifest.json
RECEIPTS: run-output/receipts.jsonl

Now verify the run independently:

neuruh-agent-run-manifest validate run-output/manifest.json
neuruh-agent-receipt verify run-output/receipts.jsonl

VALID run-87f2... sha256:070b5f29089ca9d6...
PASS: 3 receipts

The manifest is content-bound and records the exact released version of every component that actually ran. The receipts are hash-chained: edit one byte of the ledger and verify fails.

Requires Python 3.11+. Every dependency resolves to an immutable public tag — nothing points at a branch or a local path.

Neuruh models an autonomous system as one loop, and each stage of that loop is a separate, independently testable artifact rather than a feature of a monolith.

observation
  -> evidence          what was actually seen, with provenance
  -> decision          ALLOW / DENY / ESCALATE, deterministically
  -> authority         who permitted this, bounded and single-use
  -> governed execution  exactly one declared command, contained
  -> receipt           tamper-evident proof of what ran
  -> outcome           what actually happened afterwards
  -> calibration       what the system is allowed to learn from it

A stage that cannot prove its inputs fails closed. Nothing in this repository set treats "the model said so" as authorization.

Seven repositories. Each one installs, tests, and versions on its own.

Beyond the core, 26 further packages implement the governed promotion lifecycle: evidence provenance, human approval checkpoints, delegated authority, outcome calibration, reversibility, canary evaluation, rollback, deployment authorization, drift detection, and canonical-state reconciliation.

Neuruh Public Commons is the index: what each package does, where it sits, how mature it is, and what it deliberately excludes.

The public repositories are the rails. The routing intelligence is not public.

No production authority topology, policies, thresholds, or scoring. No production connectors, prompts, or routing. No customer data — every fixture in every public repository is synthetic. The complete rule is written down in PUBLIC_PRIVATE_BOUNDARY.md, and nothing is published until it passes the review in CHARTER.md.

These are alpha releases. They are small, dependency-free, and tested, but the interfaces are still moving. Pin the tag.

Published under the same boundary rules, but not part of the Commons protocol:

• nimdp-validator — scores a specification for launch readiness and can fail a CI job on the result.
• notion-auto-exporter — exports selected Notion pages to markdown organised for RAG ingestion.

Apache-2.0 across the Commons. Founded by Jeramie Hicks. Security reports: SECURITY.md.