powerweave

Dependency-free prose-quality scanners + severity-tiered validators that detect AI-tell vocabulary, stock phrases, weak openers, poor rhythm, invented statistics, and template writing.

A default-safe transactional message dispatcher: test mode is on unless the literal 'false' opts into production, non-allowlisted recipients are redirected before any send, a format gate rejects malformed addresses, and the network send is an injectable transport (dry-run by default).

Host one MCP server for many tenants over streamable-HTTP with bearer tenant-API-key auth — the authenticated tenant overrides any client-supplied tenant id (the isolation invariant).

A dataclass guard: a record physically cannot enter a consequential status without a human verbatim sign-off, with an __setattr__ rollback that closes the in-memory bypass window.

Maker-checker sign-off fields + append-only audit/decision ledger + a domain-neutral sign-off policy for gating high-blast transitions.

An enforcing pre-commit / pre-tool-use gate that blocks ontology + config edits on SHACL non-conformance, missing/substanceless sign-off, and unmet phase prerequisites — advisory / enforce / override modes, injectable seams, degrade-open.

A multi-tenant Postgres data plane where tenant isolation (dual-path RLS), append-only auditability, and migration governance are structural invariants enforced at the DB + a CI coverage gate — composed from five small primitives.

Dependency-free Toulmin argumentation primitives for attaching structured, auditable reasoning to any automated decision.

Four degrade-open OWL governance checks — OWL-RL consistency, SHACL conformance, SPARQL competency questions, and disjointness audit — over any caller-supplied ontology, with no domain baked in.

A default-safe bring-your-own-integration provider pattern: an abstract Provider over a generic Message, a registry whose test-mode gate returns a NullProvider before the registry is ever consulted, and typed auditable suppression instead of silent drops.

A tiny, stable four-dimension provenance tag schema (scope / signal_type / attribution / uncertainty) with caller-supplied vocabularies.

A single dispatch chokepoint that makes every agent/tool call tenant-bound, sign-off-gated, source-secret, provenance-stamped, and append-only audited — by composing five small primitives.

Estimate a band from a direct metric or a proxy metric (with a reasoning chain), driven by caller-supplied band boundaries.

A checksum-tracked, resume-on-failure SQL migration runner: applies *.sql in lexical order, skips applied files, aborts on post-apply drift, resumes after a partial failure — over an injectable DB adapter.

A regex backstop that strips Python source from language-model text output (fenced code, unfenced def/class bodies, base64-exec smuggling).

Map any vendor's native objects onto ontology-typed canonical entities, with deterministic collision resolution, lossless field preservation, a default-safe live-ops gate, and a governed audit event per binding.

Deterministic OWL-extension → typed JSON config generator: extract named subclasses + individuals of caller-bound classes into per-binding config files. Domain-neutral; rdflib is lazy + degrade-open.

An embeddable in-app coaching/nudge engine: event->category routing, a 6-layer suppression model, multi-axis gating, isolated pluggable personas, swappable delivery adapters, and a pluggable repository.

A fail-closed preflight engine for automated outbound actions: seven independent gates (format, legal footer, send-window, do-not-contact, recipient-issue, cadence, idempotency) that default to BLOCK/DEFER when their evidence is missing or their infrastructure fails.

Per-channel outbound compliance gates — LinkedIn cadence, WhatsApp 24h window, SMS TCPA quiet hours, social-DM rate caps — that fail closed before an outbound action is dispatched, with the only network I/O behind an injectable transport seam.