MCP governance · Contracts and integrations
Two legal crossings. Six calls in, ten contracts down.
Agents reach elan1 through two crossings only. Above, they call KernelPort directly, through the MCP server or over HTTP; MCP tools are grouped into read, stage and act classes, and every act becomes a governed write. Below, elan1 Run reaches the stack through ten fusion.*/v1 contracts. There is no third door.
01KernelPort v1
Six calls. One write function behind them.
KernelPort is the only door into the kernel. It has six calls: define, assert, seal, verify, scope and refuse. A model may produce a write intent. It may never produce an allow.
| Call | What it does | Who may call it |
|---|---|---|
| define | Registers a write type at an explicit declaration version and returns a content-addressed digest. Registering is itself a governed write under dual control. | Control-plane token |
| assert | The central call. Runs the whole Right Path in order and returns committed, refused or escalated, with the proof sequence and digest, synchronously. | Tenant token, act scope |
| seal | The chain writer. At L1 it returns a hash-chain receipt. From L2 the same call also signs. | The kernel only |
| verify | Recomputes the preimage and digest octet for octet and walks the chain. At L1, verification needs elan1. | Read-only token |
| scope | Resolves blast radius and autonomy for rendering. Advisory only, because assert resolves both again. | Read-only token |
| refuse | Emits a typed refusal from a closed register. A refusal still writes a proof record and is metered at 0.4 of a governed action. | Tenant token, act scope |
One governed write, three ways to read it
An agent posts a month-end accrual through assert. Read it in plain English, as the write intent and response, or as the record it left.
An agent asks to post a month-end accrual of ₹18,400 against journal entry je_specimen_5531. It calls assert with a typed write intent.
Govern climbs the Right Path. The gates pass and the rules allow the change, but the agent holds autonomy A2, so a person must approve. assert answers at once: escalated at rung 6, with an obligation for a named approver and a proof record for the escalation.
The approver, who is not the asker, says yes. The single writer posts the entry with a 10-minute single-use credential, Govern seals record 1042, and one governed action is metered.
Checked and recorded by elan1 Govern.
POST /v1/assert
X-Tenant: tnt_specimen_01
Idempotency-Key: wr_specimen_7c2
{
"write_id": "wr_specimen_7c2",
"write_type": "journal_entry.post",
"declaration": { "id": "decl_month_end_close", "version": 7 },
"actor": { "id": "agt_specimen_gl02", "kind": "agent" },
"record": { "id": "je_specimen_5531", "expected_version": 1 },
"payload": {
"date": "2027-07-14",
"lines": [
{ "account": "5100 Freight inward", "debit": "18400.00" },
{ "account": "2100 Accrued expenses", "credit": "18400.00" }
]
}
}HTTP/1.1 200 OK
{
"outcome": "escalated",
"rung": 6,
"reason": "Above the autonomy ceiling. A named person, not the asker, decides.",
"obligation": "OB-specimen-0412",
"proof": { "seq": 1039, "digest": "sha256:3b9a51c2…7e04d1f8" },
"meter": { "governed_actions": 0 }
}F01 tenant_id tnt_specimen_01
F02 seq 1042
F03 prev_digest sha256:8e37839e…0ffdeac0
F04 write_id wr_specimen_7c2
F05 write_type journal_entry.post
F06 declaration_id decl_month_end_close
F07 declaration_version 7
F08 policy_version 2027.06.1
F09 actor_id usr_specimen_approver
F10 actor_kind human
F11 autonomy_level A2
F12 record_id je_specimen_5531
F13 record_version 2
F14 payload_hash sha256:e1eb0d8f…1a32ab6a
F15 lexicon_hash sha256:fd8e4d0b…666b2633
F16 recorded_at 2027-07-14T10:42:07+05:30Every outcome is one of three: committed, refused, or waiting on a person. A platform failure is ours, not a rule, and is never billed. Frozen identifiers: kernelport/v1, elan1.proof.seal.v6, action-receipt/1.
02MCP server and HTTP API · Mode B
For the agents you already run.
Agents built elsewhere call elan1 Govern over MCP or HTTP. Every write intent is evaluated against your rules and recorded. Your system still holds the credential, so this is attested advisory, never blocked.
34 tools in all. Each tool description is pinned by hash in the declaration, so a changed description shows as a version change, never a silent update.
HTTP API · /v1
Three families of endpoint
- act: send write intents and read their outcomes.
- ro: read-only access to declarations, obligations and records.
- ctl: control-plane operations. A ctl token cannot read any record.
Webhooks are HMAC-authenticated and carry seq, so a gap in delivery is detectable. Writes take an Idempotency-Key; replaying one returns the original outcome.
SDK · Mode A
In-process, where we hold the credential
Where elan1 Govern can hold the write credential, as with hosted ERPNext in elan1 Work, the SDK runs in-process and writes are enforced. This is the only place we say “enforced”.
A Mode B integration can move to Mode A where the credential can move: after 30 days of recorded traffic and a review.
03fusion.*/v1 · into elan1 Run
Ten contracts. Two licence-clean implementations each.
Each part of the open-source AI stack sits behind a versioned contract. Callers name the contract, never the vendor, so a component can be replaced without rebuilding the integration. Run never depends on Govern.
| Contract | What it carries | Two licence-clean implementations | State | Status |
|---|---|---|---|---|
| fusion.chat/v1 | Chat interface, conversations, single sign-on and per-user quota. | LibreChat · AnythingLLM | Stateless | Available |
| fusion.gateway/v1 | Model gateway: aliases, routing, failover, budgets that stop before the first token. | LiteLLM (core) · Bifrost | Stateless | Available |
| fusion.inference/v1 | Serving open-weight models in your region. | vLLM · SGLang | Stateless | Available |
| fusion.retrieval/v1 | Document ingestion and permission-aware retrieval, with per-document provenance. | RAGFlow · Onyx (community edition) | Indexed | Available |
| fusion.vectors/v1 | Vector storage and search. | pgvector · Qdrant | Indexed | Available |
| fusion.trace/v1 | Traces of every call: who made it, what it cost, which component served it. | Langfuse (core) · Opik | Indexed | Available |
| fusion.tools/v1 | Tool and MCP server registry, pinned by hash, with scopes and autonomy ceilings. | ContextForge · agentgateway | Registered | Available |
| fusion.run/v1 | Durable workflows: long runs, retries and approval waits that survive a restart. | Temporal · Prefect | In-flight | Available |
| fusion.memory/v1 | Agent memory across sessions. | Mem0 · Cognee | Indexed | Limited availability |
| fusion.guard/v1 | Guard for personal data, provenance and prompt injection. A guard verdict is an input, never the allow. | Presidio · NeMo Guardrails | Stateless | Available |
POST /c2/chat/completions
X-Fusion-Contract: fusion.gateway/v1; impl=litellm
Idempotency-Key: 4bf92f35-77b3-4da6-a3ce-929d0e0e4736
200 served under contract
409 refused at the edge (budget, guard) · 40% of one governed action
4xx your request did not meet the contract
5xx our failure, never billedHow a component is replaced
Substitution takes nine steps with two human gates, H1 and H2, and is never autonomous. At step 7.3, elan1 Run asks elan1 Govern for a gate check and honours the answer. If elan1 is unreachable, the plan is held, undecided.
elan1 Run is the runtime for all ten contracts. Nine are available; fusion.memory/v1 is in limited availability.
04Conformance
The suite is the claim.
Two published suites stand between a component or an agent and any claim about it. Suite K1–K7 runs offline, including on your auditor's machine. Tests C1–C14 decide whether a third-party agent may say it runs on elan1 Govern.
About elan1 Run ConformanceK1–K7 · components behind a contract
Five classes are blocking-green: a run is green or red, with no override. Two are reported.
Surface Blocking
Every endpoint, field and outcome in the contract descriptor behaves as written, on both implementations.
Isolation Blocking
No tenant can see another tenant's data or counts. An isolation attack runs nightly.
Accounting Blocking
The runtime meter agrees with the component's own counters within 0.5%.
Semantic Reported
Answers stay within tolerance on a fixed corpus when a component changes. Reported, not blocking.
Failure Blocking
Each declared failure produces the declared outcome, including a 409 at the edge, metered at 40% of one governed action.
Performance Reported
Latency and throughput are measured and published as measured. Reported, not blocking.
Licence Blocking
Each component is pinned at its exact SHA, with its licence stored verbatim and checked for change.
C1–C14 · agents on elan1 Govern
No claim to run on Govern until all fourteen pass. C14 fails any L1 copy that claims what only L2 delivers.
Import graph
No module reachable from rungs 3–8 imports a model client; nothing above P3 imports a kernel type.
Bypass attempt
Every write path other than the single writer fails against the real target.
Rung completeness
For 100 intents, every rung runs in order and every gate records a row.
Determinism replay
The same intent, versions and as-of time give the same decision on replay.
Fail-closed matrix
Every dependency outage produces a platform refusal, never an allow.
Missing grant → A0
Actors without a grant resolve to A0 Observe.
Idempotency
Replaying an intent returns the original outcome, sequence and digest, and no second meter event.
Refusal shape
A refusal returns a register code, the rung, a zeroed record_id, record_version 0 and a meter quantity of 0.4.
Chain integrity
A flipped octet, a reordered pair, a duplicate and a gap are each found.
Meter reconciliation
Meter event, proof record and target reconcile both ways.
Approval separation
No approval where the approver is the requester, and none by an agent token.
Rollback drill
The reversal plan runs by both paths: native undo and the compensating entry.
Version pinning
“latest” is rejected for production keys; every decision records its versions.
Claim boundary
A string check over rendered L1 copy for claims that belong to L2.
05Coverage
Every layer uses the contracts. None has a private door.
Govern's work runs on five contracts: gateway, trace, tools, run and guard. Work and Decide use the contracts their jobs need. Run runs all ten.
| Layer | fusion.*/v1 contracts | Note |
|---|---|---|
| elan1 Work | chat · gateway · inference · retrieval · vectors · trace · tools · run · guard | Nine contracts. Memory is not bound: it is in limited availability. |
| elan1 Decide | gateway · inference · retrieval · vectors · trace · guard | Six contracts. Bounded reasoning on escalations goes through the gateway. |
| elan1 Govern | gateway · trace · tools · run · guard | Fixed by design: the five contracts Govern's work runs on. |
| elan1 Run | chat · gateway · inference · retrieval · vectors · trace · tools · run · memory · guard | Runs all ten. |
06Modes per consumer
Enforced where we hold the credential. Evaluated and recorded everywhere else.
The integration you choose decides which sentence you may use. We keep to it, and so does every partner.
| Consumer | Mode | How | What we may say |
|---|---|---|---|
| elan1 Work hosted (ERPNext) | Mode A · Enforced | SDK in-process | “No write reaches the system of record without a gate decision and a proof record.” |
| elan1 Work Attach (your ERPNext) | Mode B · Attested advisory | MCP/HTTP | “Evaluated against your rules and recorded.” |
| elan1 Decide | Mode B · Attested advisory | MCP/HTTP | “Writes go to Govern as intents.” |
| elan1 Run tooling | Mode B · Attested advisory | MCP/HTTP | “If elan1 is unreachable, the gate check fails closed.” |
| Third-party agents | Mode B · Attested advisory | MCP/HTTP (A by agreement) | “No claim to run on Govern until conformance tests C1–C14 pass.” |
07FAQ
MCP governance and integrations, in four answers.
Yes, in Mode B. Agents built elsewhere send their write intents to elan1 Govern's MCP server or HTTP API, and each one is evaluated against your rules and recorded in a proof record. Your system still holds the credential, so this is attested advisory: recorded, not blocked.
Only act tools can lead to one. The 18 read-only tools change nothing and the 10 staging tools prepare a write without committing it; the 6 act tools send a write intent up the Right Path, and where your rules ask for a person, the approval request comes back through MCP as a request for input.
Only in Mode A, where the in-process SDK runs, as with hosted ERPNext in elan1 Work; that is the only place we say enforced. Over MCP or HTTP, your system holds the credential. A Mode B integration can move to Mode A after 30 days of recorded traffic and a review.
elan1 writes directly in Mode A, wherever the in-process SDK holds the write credential, as with ERPNext hosted for elan1 Work. Elsewhere, your system makes the write over MCP or HTTP and elan1 Govern evaluates and records it. Every write, in either mode, leaves a proof record.
// BUILD
Put your agents on one write path.
Start with one process. We map its writes to a declaration, connect your agents over MCP or the SDK, and show you the records.