Genaryx

The control room over the TAIPANBOX agent-governance stack: one window over TokenFuse, Wardryx, Engram, Idryx, Qryx, Verdryx and Mockryx, running on your own infrastructure and opened in a browser.

Apache-2.0, like every other repository in the stack. See LICENSE.

This repository was closed until 2026-07-27 and opened under Apache-2.0 with its history intact. A repository that changes licence owes the reader an honest note rather than a badge, so here are the three things worth knowing before you read further.

• Parts of docs/ are older than the licence. Several design documents were written under the earlier model and still argue from it. They are left as they were written rather than quietly edited, because they record how the thing was built and when each decision was made. Read them as history; the code is the present tense.
• The history is here, minus some media files. Everything up to the flip is preserved. Screenshots carrying a pairing QR (a torn-down address and two one-time codes that expired in 274 seconds on 2026-07-20) and screen recordings from the same session were removed before publication. Nothing else was rewritten, and no credential, key or certificate has ever been committed here; that was verified across every commit before publication.
• The licence gate is gone, the ML-DSA verifier is not. A module that always granted and printed a TODO guarded a product nobody sells; it was deleted on 2026-07-27. The post-quantum verifier in crates/signing stayed: Genaryx never signs with ML-DSA, Qryx does, and this crate verifies what Qryx signed, which is a capability rather than a licence check.

What it is

A real-time surface for whoever answers for a fleet of agents: burn and kill switch (TokenFuse), policy decisions and approvals (Wardryx), identity graph (Idryx), crypto posture and evidence (Qryx), quality and cost-per-outcome (Verdryx), fire-drills (Mockryx), and memory (Engram). No new backend: the console is a privileged consumer of the per-service NDJSON event bus plus a client of the existing HTTP APIs.

The product is a web console served from the customer's own box (genaryx-web): the runtime and the console both run inside the customer's perimeter, reached over the operator's own WireGuard tunnel (D11). Nothing about their runs, spend or identities travels anywhere to be displayed, and it-rat.com has no route to the console at all.

The console as its room on it-rat.com draws it: the control plane never faces the internet, and Felyx holds no signing key.

---

Where this fits in the stack

Genaryx is the console plane of the TAIPANBOX agent-governance stack, and it is the operator's way IN: the counterpart to heraldyx, which is the stack's way out to a mailbox and is explicitly a view that never acts. This one acts, which is why every write it makes is a command, signed or bearer-keyed, rather than a store edit.

flowchart TB
  Agent["AI agent (any framework)"] -->|"LLM call (base-URL swap)"| TF["TokenFuse proxy: spend + enforcement"]
  TF -->|"POST /v1/decide (PEP)"| WX["Wardryx: policy PDP"]
  WX -.->|"allow / deny / hold"| TF
  TF -->|"cheapest model, budget OK"| LLM[("LLM provider")]
  TF -->|"CallRecords"| CL["TokenFuse Cloud: control plane, incidents, replay, evidence, kill-switch"]
  VCX["Vouchryx: delegation proved, and endable"] -->|"short-lived token: act + cnf"| TF
  TF -.->|"polls /v1/revocations"| VCX
  VCX ==>|"delegation_issued / denied / revoked"| BUS
  TF ==>|"agent-event NDJSON"| BUS{{"agent-event bus + Agent Passport"}}
  WX ==> BUS
  Agent -->|"web fetch"| SCX["Scopyx: governed web egress"]
  SCX -->|"POST /v1/decide"| WX
  SCX ==>|"web_fetch / web_blocked"| BUS
  ENG["Engram: memory"] -->|"reflect via base_url"| TF
  ENG ==> BUS
  BUS ==> IDX["Idryx: identity graph, detectors, Agent-BOM"]
  IDX ==>|"identity_finding"| BUS
  BUS ==> QX["Qryx: crypto / PQC, passport + hash-chain scan"]
  QX ==>|"crypto events"| BUS
  BUS ==> VX["Verdryx: quality / drift"]
  VX ==>|"quality events"| BUS
  TF -->|"outcome-tagged traces"| VX
  MX["Mockryx: pre-prod safety rehearsal"] -->|"hostile scenarios"| TF
  MX ==>|"sim events"| BUS
  BILL[("cloud, SaaS and model bills")] --> CC["CostCrew: the bill, worked by a crew of agents"]
  CC ==>|"spend_spike / budget_threshold / crew moves"| BUS
  BUS ==> TRX["Trailryx: the record plane, sealed and packed"]
  BUS ==> HX["reads the log, mails you (heraldyx)"]
  HX -->|"one mail, a view and never an action"| OPS["your mailbox"]
  HX ==>|"alert_sent"| HJ[("heraldyx's own hash-chained journal, not this bus")]
  YOU(["you, in a browser over your own tunnel"]) --> GX[["Genaryx: the console over all of it"]]
  GX -->|"commands: the kill, an approval, a policy"| CL
  GX -->|"signed commands"| WX
  GX ==>|"console_command"| BUS
  GX -.->|"reads it"| IDX
  GX -.->|"reads it"| QX
  GX -.->|"reads it"| VX
  GX -.->|"reads it"| MX
  GX -.->|"reads it"| ENG
  GX -.->|"reads it"| SCX
  GX -.->|"reads it"| CC
  TFP["terraform-provider-taipan"] -->|"budgets + passports as code"| CL
  ASG[["agent-stack-go: shared Go contract"]] -.->|imported by| IDX
  ASG -.->|imported by| WX
  ASG -.->|imported by| MX
  ASG -.->|imported by| TFP
  ASG -.->|imported by| HX
  ASG -.->|imported by| QX
  SPEC[["agent-passport: the spec"]] -.->|governs| BUS

• Consumes: each plane the way that plane actually exposes itself, which is deliberately not one mechanism. Wardryx and Idryx over their HTTP APIs (:8090, :8081); Qryx and Mockryx by running their JSON-emitting CLIs; Engram over MCP on stdio, typed against five tools; Verdryx by opening its SQLite store SQLITE_OPEN_READ_ONLY, because Verdryx prints human text on every subcommand and its store is the only machine-readable surface it has; and TokenFuse Cloud over REST and a live SSE stream.
• Produces: console_command, and nothing else. The console is itself an agent of the stack, so a privileged action of the operator's own lands on the same bus the Bus Explorer displays instead of being a UI-only side effect: one fixed-shape event, source: "console" on schema v0.2, registered in the agent-passport spec (SPEC 6.2) and appended to the console's own hash-chained NDJSON. What journals is what changes governance state: a kill, a budget change, an incident acknowledgement, an approval decision, a lifecycle block on an agent, a unit or a user, an evidence build, and a WireGuard peer issued or revoked. Actions whose effect lands outside that (a drill firing crafted traffic, an admission baseline) and the read-only planes (Identity, Quality, Memory) write nothing, each saying so in its own module. About the planes it reads it emits nothing at all: it is a surface, not a plane that emits. What it writes outward are signed commands (the kill, an approval decision) and, through the lifecycle block and unblock, a policy put or delete at Wardryx, sent with a bearer key rather than a signature.
• Talks to: everything above, and the rule that shapes all of it is that the console never writes another service's store. It mutates planes only through signed commands to Cloud and Wardryx, never by touching a database another service owns. That is why the diagram shows one solid edge to each of those two and dotted reads to the rest.

The full stack is TokenFuse (spend), Wardryx (policy), Vouchryx (delegation), Engram (memory), Idryx (access), Qryx (crypto), Verdryx (quality), Mockryx (pre-prod), scopyx (governed web egress), CostCrew (the bill), Trailryx (the record) and heraldyx (the mail out), on the shared Agent Passport + agent-event contract (agent-stack-go / agent-passport), configured via terraform-provider-taipan and driven from Genaryx, the console over all of it.

Run the whole open stack locally with one command via stack-up; the stack's home on the web is it-rat.com.

How the console is put together, next to the four tabs below.

What it looks like

Four of the twenty tabs, from the demo build (npm run build:demo) on simulated data, which is what anybody can click at it-rat.com/demo. The frozen e01 campaign further down is the run against a live plane on a real box; these frames are not it, and say so here rather than in a footnote.

What is built (all live-verified unless marked)

• Phases 0-4: the console itself. One shared Rust core (genaryx-core: ingest, store, reducers, commands, signing ceremonies, alerts, evidence, ToolRunner, MCP), environment connectors (FS, SSH, Cloud SSE, cloud inventory), and every tab redesigned (shared dash kit + FreshBadge). Phase-4 live exit gate passed 2026-07-18: the console raised its own WireGuard tunnel from the Remote panel to a Hetzner box whose control plane was closed to the internet (ufw), and sent a hardware-signed ES256 kill through it. The set_addr netmask bug on the WG data path was found and fixed live.
• Felyx (D13). The in-console AI copilot (genaryx-copilot): read + propose, never act. C0 read-only triage, C1 explanation, C2 propose-and-confirm (every action still goes through the signed ceremony). Provider-agnostic, local/BYO model, residency-gated; validated against a real cloud model with bounded tool output, and, measured 2026-09-27 on a three-node cluster, against a governed stack's own TokenFuse gateway with its policy hook in enforce mode (console v1.1.14, Anthropic Haiku 4.5): Felyx answered money, incident, identity-alert and approval-inbox questions with figures equal to the control plane's own, proposed a kill on a stalled run with a stated confidence and reason, and had that kill refused without a passkey; lowering its run budget then had the next question refused before it reached the provider. The residency gate accepts a literal loopback or private address outright, and, since 2026-09-27 (invariant 14), a HOSTNAME too when the operator names it in GENARYX_COPILOT_LOCAL_HOSTNAMES and it resolves to nothing but local addresses, checked again on every connection rather than only once at startup, so a Kubernetes Service name or a Compose service name (tokenfuse-gateway, not its ClusterIP) can satisfy the gate without opening it to every destination the way GENARYX_COPILOT_ALLOW_REMOTE does. Both launchers now set GENARYX_COPILOT_LOCAL_HOSTNAMES to tokenfuse-gateway (stack-single since v1.1.12, stack-k8s since v1.1.18) and neither sets GENARYX_COPILOT_ALLOW_REMOTE; the run measured above predates that and patched one console by hand, pointing it at the gateway's ClusterIP. Since 2026-10-05 (invariant 16) Felyx reads budgets from a budgets tool, the control plane's own run budgets joined with each run's spend plus unit budgets with month-to-date spend, instead of inferring them from alerts, which lists a run only once it is near or over its limit. A draft answer that states a run's budget no tool returned, or calls a budgeted run unbudgeted, is sent back once for revision, and a statement that survives reaches the operator with a note naming it. The check also covers over claims: a run called over budget that the tools returned under its budget, or an agent named as over budget when none of its runs is at or over, is sent back the same way, and the revision request asks for a fresh answer rather than an apology. Since 2026-10-13 (invariant 24) Felyx can present a gateway client key of its own: ( or , like the provider key's reference) names it, Felyx sends it as , and a TokenFuse gateway with client keys on admits its questions instead of answering 401. Left empty, nothing is sent; the key appears in no log, error message or debug line, and a gateway that echoes it back has it replaced by a marker before the operator sees the refusal.

Being written to, not just watched

Email alerts are built, in heraldyx, a separate process beside this console on the same box: it reads the shared event log, decides which events are worth a human's evening, and mails them.

This console's half is the other end of the one link that mail carries. It is a coordinate, never a control: following it opens the panel that shows the event, and the action still happens here, behind a sign-in and, for anything destructive, a passkey. A link that ACTS would be an unauthenticated capability held by whoever forwards the message, and mail gateways prefetch links.

What is NOT here yet is a notifications panel: what has been sent, and to whom. heraldyx writes that down (a hash-chained journal on its own volume), and the console will show it once that record reaches the record plane. A panel that could only echo an address back is the kind this console does not build.

Not built yet (decided, on the roadmap)

• Onboard wizard follow-up: the "provisioned, awaiting first traffic" check against the Cloud's per-unit aggregation, together with Identity-tab unit grouping.
• Live e2e against a real gateway /v1/keys (I15 "key lifecycle health", review-stage check): crates/connectors/src/gateway.rs's DTOs are proven against fixtures only; a round trip against an actual running TokenFuse gateway is verified at review, not by a unit test.

Two further limits found running Felyx against a real governed stack (2026-09-27), neither yet closed: Felyx's policies tool reads only policies stored through wardryx's HTTP API, not wardryx's file-loaded base set, so a box running only the starter policies shows "no governance rules in place" while two are actually in force; and Felyx's default agent id (agent://local/genaryx/felyx, unset GENARYX_ORG_DOMAIN) sits outside a stack's own trust domain, so wiring Felyx through a gateway should also set GENARYX_ORG_DOMAIN or GENARYX_COPILOT_AGENT_ID to match it.

Layout

crates/
  core/         genaryx-core - all console logic (ingest, store, conform,
                commands, signing, evidence, ToolRunner, MCP).
  api/          genaryx-api - the command layer the web shell calls.
  web/          genaryx-web - the console served over HTTP from the box.
  connectors/   environment/service connectors (FS, SSH, Cloud SSE, cloud inventory).
  copilot/      Felyx (D13): read + propose, never act.
  signing/      canonical-string ceremonies (ES256 sign/verify, ML-DSA verify).
apps/
  web/          genaryx-web-ui, the browser frontend (React + Vite + TS +
                Tailwind), served by crates/web.
provisioning/   box-side WireGuard provisioner; issues device configs.
live-campaign/  the live-validation campaign: runbooks, records, shots, open work.
docs/           PHASE0-6 scopes and exit-gate results, WEB-SHELL.md.

Golden truth for the event contract is vendored under crates/core/src/schemas/ (byte-exact copies of the open agent-passport schemas) and crates/core/tests/fixtures/ (real campaign NDJSON).

Build

cargo build            # workspace (core + api + connectors + signing + copilot + web)
cargo test             # unit + golden conformance tests
cargo fmt --all        # formatting (pinned toolchain, see rust-toolchain.toml)
cargo clippy --all-targets --all-features

Web console (browser UI bundle, then the server):

cd apps/web && pnpm build     # -> apps/web/dist
cd ../..    && cargo build -p genaryx-web --release

Architecture source of truth

The plan lives in ~/Development/itrat-console, a private repository: decisions 00 through 18. This pointed at "00-09 and 13" until 2026-08-04, which left out the file describing the work three sections of this README are about: 15 (registration, identity and units, D15/B2 and B3). Per-phase scopes and exit-gate results are under docs/; the web shell's operational truth is docs/WEB-SHELL.md. Read those before architectural changes.

Process

Architect (Fable 5 / Opus) writes specs and reviews every diff; implementation by Sonnet 5 subagents against self-contained specs. A feature exists only when it lands in the core and in the console within the same phase.

Do not push without explicit sign-off. No publicity until the owner's explicit call.