Barycenters governs any agent, on any stack. The boundary that governs it is written in your operating language — and it is born a dead object, authority_effect = 0, until your steward signs it. We never force anything. It simply falls out.
Lumen is the natural-language compiler. It proposes; it can never permit. A steward must sign what it emits to make it law — which is the entire reason it is safe to point a language model at production: a bad compile is a bad proposal, never a bad permission.
Support can issue a refund up to $100 with an order match and a customer identity match using stripe_refunds
binding_id "acme.support.issue_a_refund" consequence_class "money_movement" // inferred from "refund" limits { max_amount_without_escalation: 100 } required_evidence [ "an_order_match", "a_customer_identity_match" ] adapter "stripe_refunds" authority_effect 0 // grants NOTHING until a human signs
residue: none — everything you said was expressed. Compilable.
This is what Lumen actually compiles — every field above is pinned by its test suite (test_lumen.py), not hand-drawn.
A natural-language compiler's dangerous failure is not a wrong packet. It's a plausible one that quietly drops a clause it couldn't express — because every restriction dropped is an authority granted, and it looks perfectly correct. So Lumen tracks its residue: every span it did not consume. If anything meaningful is left over, it refuses to produce a signable packet at all.
Support can issue a refund up to $100 only during business hours
compilable false residue [ "only during business hours" ] // cannot express packet null // there is nothing to sign
This is the system working. A refusal costs a human thirty seconds. A silently widened boundary — an unconditional $100 refund — costs them the thing the boundary was protecting.
Lumen also won't guess a consequence_class: filing a money movement under the wrong law is residue, never a coin-flip. Unknown verb → refuse, unless a human states the class.
Your words (Lumen) or a call (mint()) — one dead object, two doors. It carries no authority.
authority_effect = 0sign_binding — the one authority event. Not an agent, not a quorum of agents. A person, once.
the one human pointA $50 refund with the evidence admits. A $500 refund is refused — the number you said actually binds.
$50 ✓ $500 ✗Admit or refuse, a signed receipt falls out. A number that can't be traced to work is not a measurement.
verifiableBefore a signature, put the packet straight to a boundary and it is refused: "not a live boundary". A compile is a proposal — which is exactly what makes it safe to let a model write one.
// live on npm: npm install barycenters (v1.0.3, AGPL-3.0). Go and Rust builds also in sdk/. import { Barycenters } from "barycenters"; // mode defaults to "shadow": it NEVER blocks. It only records what /admit WOULD have refused. // No apiKey needed in shadow — /admit is open; a key is only for enforce. const bary = new Barycenters({ endpoint: "https://barycenters-admit.fly.dev", namespace: "acme/eng" }); const d = await bary.admit({ action: "deploy_prod", metadata: { env: "production" } }); doTheDeploy(); // shadow: d never throws await bary.receipt(d.token, { outputHash: "sha256:..." }); // after a day — the one line that sells it to your team: console.log(bary.shadowReport().summary); // → "2 of 17 action(s) would have been blocked by /admit"
Zero dependencies · Node 18+ · also shipped for Go and Rust in sdk/. Live on npm as barycenters (v1.0.3), AGPL-3.0 — open forever, the Cloud give-back. Point it at the endpoint above and every admit() returns a signed, offline-verifiable decision.
# put a deploy to the boundary — the raw admission endpoint the SDK calls for you curl -s https://barycenters-admit.fly.dev/v1/admit \ -H "content-type: application/json" \ -d '{"domain":"infrastructure.compute_deploy","environment":"production","service":"checkout-api","image_digest":"sha256:abababababababababababababababababababababababababababababababab","requested_by":"you"}' # → a signed ACCEPT / REFUSE receipt you can verify offline (Ed25519)
The service is a deterministic Layer 0 runtime — same proposal in, same decision out, every time.
// Live now over streamable-HTTP — point any MCP client at the hosted endpoint. // one plug for every agent that speaks MCP — /admit is the outlet; the server does the rest. { "mcpServers": { "barycenters": { "type": "http", "url": "https://barycenters-admit.fly.dev/mcp/" } } } // (a zero-config `npx barycenters-mcp` wrapper is coming once published; the HTTP endpoint works today.)
Adapters are "Barycenters for X" — the main Cloud give-back, open forever. MCP is the universal one; the same inert-proposal contract underneath.
Endpoint https://barycenters-admit.fly.dev live
Readiness GET /readyz → durable issuer, single-use receipts, fail-closed if the store is unreachable.
Verify key your steward provisions the Ed25519 public key via ADMISSION_STEWARD_KEYS and pins it — receipts verify with the public key alone. We serve no secret; there is nothing here for us to leak.
Wire the Barycenters admission wedge into this codebase in SHADOW MODE. Shadow never blocks anything — it only records what /admit would have refused. Steps:
1. Install the SDK: `npm install barycenters` (v1.0.3, AGPL-3.0 — live on npm; Go/Rust builds also in sdk/).
2. Instantiate once, near startup:
const bary = new Barycenters({ endpoint: "https://barycenters-admit.fly.dev", namespace: "acme/eng" });
// mode defaults to "shadow". No apiKey needed in shadow — /admit is open; a key is only for enforce.
// (or omit endpoint and set ADMIT_ENDPOINT=https://barycenters-admit.fly.dev in the environment.)
3. Before every consequential action — deploys, refunds, DB writes, external sends — call:
const d = await bary.admit({ action: "deploy_prod", metadata: { ...context } });
In shadow, d never throws. Proceed exactly as before.
4. After the action, record the outcome:
await bary.receipt(d.token, { outputHash });
5. After the app has run for a day, print bary.shadowReport().summary and paste it back to me.
Default-deny: until you author a permission an action reads as "would block" — that IS the report of
what your policy would have stopped. To allow one (shadow, binds nothing):
POST /v1/namespaces/acme/eng/agent-permissions {"action":"deploy_prod"}
Do NOT change any control flow. Shadow is read-only by design; flipping to enforce is a human decision made later, once.
This is the whole pitch: you learn exactly which agent actions your policy would have stopped — before a single one is blocked. No risk, no downtime, no config to trust.
You wire in the wedge; you do not bind authority. Dropping the SDK in, minting a boundary, running it in shadow — none of it grants a single permission. Authority enters at exactly one point, and it is a human's: your steward signs a boundary, and later — once your own shadow report has earned it — decides to flip enforce. Once. That one human point is what makes the autonomy underneath it bankable.