Waveframe Labs mark
Waveframe Labs
Canonical Architecture · 2026-09

Published authority precedes runtime evaluation.

The current stack separates policy review, authority publication, canonical proposal construction, deterministic evaluation, runtime mediation, and durable evidence.

Architecture diagram

Current public lines: Ledger 0.9.0, Contract Compiler 0.5.0, Proposal Normalizer 0.2.0, CRI-CORE 0.14.0 on PyPI and GitHub, Guard 0.19.0, and Cloud v0.6.0.

Waveframe architecture from policy publication through runtime evaluation and preserved evidence.

Boundary principles

Policy prose is not runtime authority.Ledger publishes reviewed, versioned authority while unsupported meaning remains visible.
Action categories remain independent.Ledger 0.9.0 and Compiler 0.5.0 keep repository create and modify authority separate, including role and target scope.
Evaluation and mediation are separate responsibilities.Guard mediates the application call and CRI-CORE returns the deterministic admissibility result.
Evidence preserves what happened.Local runtime evidence can be retained by Cloud without changing the original decision record.

Four operational flows

Authority Flow

  1. Source policy and intended scope enter Ledger review.
  2. Supported meaning is confirmed and unresolved meaning remains explicit.
  3. Compiler 0.5.0 produces a deterministic contract and hash, including action-specific repository scope where used.
  4. Ledger publishes versioned authority with commitment, receipt, and lineage.
  5. Cloud may distribute the tenant-scoped publication.

Proposal Flow

  1. An application reaches a Guard-mediated capability.
  2. Guard binds the actor, selected authority, action, target, and approved runtime facts.
  3. Proposal Normalizer creates the canonical proposal without inventing contract data.
  4. The proposal and matching authority move to CRI-CORE.

Execution Flow

  1. Guard 0.19.0 receives the mediated call.
  2. The selected authority is resolved and verified.
  3. CRI-CORE returns the admissibility result.
  4. Guard either ends the mediated path or invokes the approved application callback.
  5. Repository create and modify operations use separate action authority.

Evidence Flow

  1. Decision evidence is bound to actor, authority, proposal, target, and mediation context.
  2. Runtime evidence records the observed callback outcome.
  3. Cloud can preserve evidence and return package, receipt, and proof identifiers.
  4. Replay reconstructs logical decisions rather than claiming a new physical mutation.

Release boundary

Open package line

Guard 0.19.0, Ledger 0.9.0, Compiler 0.5.0, and Proposal Normalizer 0.2.0 are the current public package lines. CRI 0.14.0 is published on PyPI and is within Guard 0.19.0’s declared dependency range.

CRI GitHub line

CRI-CORE v0.14.0 is published on GitHub and PyPI with strict-by-default evaluation.

Cloud line

Cloud v0.6.0 is published. Its release handoff keeps production activation separate, so release publication is not presented as a completed hosted rollout.

Commercial boundary

Cloud, Console, Ledger Workspace, Guard Inspector, and multi-tenant operations remain separate from the Apache-2.0 Guard Core SDK.

Read exact package compatibility