heraldyx - the box tells you

Your agents run on your infrastructure. When one of them is heading somewhere you would want to know about, this is the part that writes to you.

heraldyx watches the NDJSON event log the TAIPANBOX agent-governance stack already writes, decides which of those events a human should hear about tonight rather than tomorrow, and mails them. The mail comes from the operator's own box, and it carries a link into the operator's own console.

It reads a file and sends mail. That is the whole of it, and the narrowness is the design: this is the one component of the box that opens a connection to something outside it, so it is the one component whose blast radius has to be small enough to state in a sentence.

The claim is checked rather than promised: scripts/one-way-out.sh runs in make gates and in CI.

---

The same path on it-rat.com.

---

Where this fits in the stack

flowchart LR
  TF["TokenFuse: money"] --> LOG[("shared event log<br/>NDJSON, one line per event")]
  WX["Wardryx: policy"] --> LOG
  VX["Verdryx: quality"] --> LOG
  MX["Mockryx: drills"] --> LOG
  ENG["Engram: memory"] --> LOG
  GX["Genaryx: the console"] --> LOG
  ID["Idryx: the identity graph"] --> LOG
  QX["Qryx: the hash chains"] --> LOG
  CC["CostCrew: the FinOps console"] --> LOG
  VY["Vouchryx: delegation"] --> LOG
  TY["Typryx: typed answers"] --> LOG
  AC["agent-conform: the chain verifier"] --> LOG
  LOG -->|"reads, never writes"| H["heraldyx"]
  LOG -->|"reads it too"| ID
  LOG -->|"reads it too"| QX
  LOG -.->|"reads verdryx's file, for slo_burn"| WX
  SC["scopyx: web egress"] -->|"its own journal, not this log"| SJ[("scopyx's journal")]
  H -->|"SMTP"| M["your mailbox"]
  M -.->|"one link, a view and never an action"| C["Genaryx console<br/>sign in, then act"]

Twelve planes write this log and heraldyx is the only pure reader. Idryx, Qryx and Wardryx read it as well as write it: Idryx loads it to build an identity graph and Qryx walks it to check the prev_hash chains and the attestation on each passport, and both also emit findings of their own. Wardryx reads one stream of it, the quality plane's, when WARDRYX_SIGNAL_EVENTS names that file (Wardryx 2.5.0), to take the slo_burn signal of an agent. Two more planes, heraldyx and scopyx, write a journal on their own volume rather than this log, which is the same decision twice: a component that can write the shared log can, once compromised, corrupt the trail it was adding to, and those two hold the two dangerous privileges in the box, mail out and web out.

This census has now been wrong twice, in opposite directions, and both are worth keeping. Until 2026-08-05 it was two short, saying four wrote and two read, missing Engram among the writers and Qryx among the readers. Until 2026-08-10 it said Idryx and Qryx "never write", which was false about Qryx the whole time (qryx --events appends agent-event NDJSON, internal/exporter) and became false about Idryx the day it gained an event sink.

The lesson is the one the earlier correction already named and did not apply far enough: a count copied between pictures is a count nobody measured. This one is now taken from agent-passport/SPEC.md §6.2, the registry of who emits what, which is the only place in the estate that is gated on being true (@measured 2026-08-10, ten sources, of which eight write here and two keep their own journal). It registers fifteen sources now, and internal/stream/stream.go lists the same fifteen: twelve write here (the original eight, then CostCrew, Vouchryx, Typryx and agent-conform) and the same two keep their own journal. keyryx, the custody and witness service, was registered on 2026-10-18 as reserved until its first release, and v0.1.0 came the same day. It is the fifteenth: it writes nothing into the shared directory, and its witness's findings file, keyryx.ndjson, is read as an entry of its own (invariant 33 in CLAUDE.md).

Every plane already speaks one envelope (agent-passport SPEC.md 6), so heraldyx needs no integration with any of them. It holds no credential for any plane, has no API of its own, and can take no action on any agent.

What reaches you, by default

Every event meets four checks, in a fixed order, and comes out of exactly one of four doors.

The numbers are from scripts/burst-demo.sh, which runs the real binary over a generated burst. It is a scenario: what a real fleet produces is unmeasured, and VALIDATION.md says so.

The floor is high, so this is roughly what an ordinary day is silent about and what it is not.

You get mail	Examples
immediately	budget_exhausted, run_killed, policy_deny, dlp_block, sustained_loop, taint_block, quality_drift, sim_finding, dependency_failed, slo_burn
in the daily summary	budget_threshold and everything else below the floor, including levels this build has never heard of
never	anything you did not configure a recipient for, and anything about a whole organisation rather than one agent

That last row is a boundary of this plane, and worth stating plainly rather than discovering. The shared envelope requires an agent_id (agent-passport SPEC.md section 6.1), so a fact about a whole organisation has no subject to travel under, and no producer is allowed to invent one to make it fit. spend_spike is the current example: the money plane raises it, the console shows it, and it never arrives here. A mail whose subject line named an agent that had not spiked would be worse than silence.

Org-wide facts live where they have always lived, in the console and in the plane's own API. Changing that is a change to the envelope every product in the stack shares, not something this process can decide.

This is the beginning of the README. Read the rest at the original. Read the full README ↗