Status: Available
elan1 Run Contracts
Ten fusion.*/v1 contracts, each with two licence-clean implementations.
Contracts in detailInfrastructure Intelligence Platform
elan1 Run: the contract layer for the open-source AI stack
elan1 Run is the infrastructure intelligence platform for the open-source AI stack. It puts ten versioned fusion.*/v1 contracts between your applications and components such as model servers and vector stores, proves them with an offline conformance suite, swaps components through human-gated substitution and runs Day-2 operation, priced by node and GPU, never by token.
Status: Available
- Contracts
- Ten, fusion.*/v1
- Conformance
- K1–K7, blocking-green
- Priced by
- Node-year, never tokens
01What it does
Infrastructure gets swapped. Your integration should not have to be rebuilt.
elan1 Run Runtime Controls, with elan1 Govern built in.
The named profile for regulated teams.
elan1 Run puts each part of the open-source AI stack behind a versioned contract. Each contract has two licence-clean implementations and a conformance suite. A nine-step substitution process changes components, and Day-2 operation keeps the stack running.
Who it’s for
Teams who run the stack for others.
- GPU operators offering a managed AI stack under their own brand.
- Systems integrators delivering AI stacks.
- Regulated platform teams who must know what runs, what it cost and whether it is licence-clean.
02How it works
One contract per job, two implementations behind each.
Your applications call the contract. The component behind it can change, under conformance and with people at the switch.
Your applicationsCall one versioned surface, whichever component serves it.
- C1fusion.chat/v1Chat UI and conversationsTwo implementations
- C2fusion.gateway/v1One model gatewaye.g. LiteLLM
- C3fusion.inference/v1Model servinge.g. vLLM
- C4fusion.retrieval/v1Search over your documentsTwo implementations
- C5fusion.vectors/v1Vector storagee.g. pgvector
- C6fusion.trace/v1Spans for every calle.g. Langfuse
- C7fusion.tools/v1Tool calls, authorisedTwo implementations
- C8fusion.run/v1Durable workflowse.g. Temporal
- C9fusion.memory/v1Agent memoryTwo implementations
- C10fusion.guard/v1PII, provenance, injectionTwo implementations
Open-source componentsTwo licence-clean implementations per contract, each pinned at its exact SHA.
- Your applicationCalls a contractOne versioned fusion.*/v1 surface, the same whichever component serves it.
- ContractBinds a pinned implementationTwo licence-clean implementations stand behind each contract, each pinned at its exact SHA.
- ConformanceRuns K1–K7Blocking-green and offline, including on your auditor's machine.
- OperateCounts every callTokens in and out, GPU-seconds, bytes, pages and tool calls: counted and shown, never priced.
- Named peopleHold the substitutionA swap runs nine steps with human gates H1 and H2. It is never autonomous.
03Key capabilities
Contract, conform, substitute, operate.
Each module carries its status. Nothing here is shipped.
- 01
Contracts
Ten fusion.*/v1 contracts: chat, gateway, inference, retrieval, vectors, trace, tools, run, memory and guard. Examples behind them include LiteLLM, vLLM, pgvector, Langfuse and Temporal.
Available - 02
Conformance
Suite K1–K7, blocking-green, runs offline, including on your auditor's machine.
Available - 03
Substitution
Nine steps, with human gates H1 and H2. It is never autonomous.
Available - 04
Runtime Controls
A budget hard-stop before the first token, plus attribution by tenant, team and use case. A guard covers PII, provenance and injection. Tool authorisation has an autonomy ceiling. A licence register pins each component at its exact SHA, and an isolation attack runs nightly.
Available - 05
Operate (Day-2)
Six runtime units are counted: tokens in, tokens out, GPU-seconds, bytes, pages and tool calls.
Available - 06
Deployment
Direct, through a systems integrator, or as Operator OEM, where the operator's brand is the only brand shown. elan1 Run Cloud (up to 25 tenants), customer VPC and on-prem. Air-gapped is on What's next.
Available
04Modules
Five modules. One node-year.
Every module is included in every subscription. Tokens and the six runtime units are counted and shown, never priced.
- Status: Available
elan1 Run Conformance
Suite K1–K7, blocking-green, runs offline, including on your auditor's machine.
Conformance in detail - Status: Available
elan1 Run Substitution
Nine steps, with human gates H1 and H2. It is never autonomous.
Substitution in detail - Status: Available
elan1 Run Operate
Day-2 operation. Six runtime units are counted: tokens in, tokens out, GPU-seconds, bytes, pages and tool calls.
Operate in detail - Status: Available
elan1 Run Runtime Controls
elan1 Run Runtime Controls, with elan1 Govern built in. A budget hard-stop before the first token, attribution, a guard and tool authorisation.
Runtime Controls in detail
elan1 Run governs the call. elan1 Govern governs the write.
Run pricing by module05Two kinds of governance
elan1 Run governs the call. elan1 Govern governs the write.
Every control in Run’s contract layer is a promise about a call: who made it, what it cost, which component served it and what data it touched. None of them decides whether a business write may happen. That belongs to elan1 Govern alone. Run asks Govern for a gate check at substitution step 7.3, and honours the answer. A regulated team can buy one thing and still keep the two jobs apart.
Named profile
elan1 Run Runtime Controls, with elan1 Govern built in.
elan1 Run can prove a call happened. Only elan1 Govern can prove it was allowed.
A guard verdict is an input, never the allow.
The call: fusion.guard/v1Returns a verdict on PII, provenance and injection for the call.The write: Right Path inputelan1 Govern reads the verdict as one input. The allow stays with Govern.The approval wait is held on the run contract, and expiry means refusal.
The call: fusion.run/v1Holds the workflow durably while a write waits for a person.The write: Named approverA named person decides in elan1 Govern. If the approval expires, the write is refused.Trace spans bind to the proof record.
The call: fusion.trace/v1Records a span for every call: who made it, what it cost, which component served it.The write: Proof recordEach span binds to the proof record of the write it served.Substitution step 7.3 calls a Govern gate check.
The call: Substitution, step 7.3A component swap reaches step 7.3 of nine, after human gates H1 and H2 are set.The write: Gate checkelan1 Govern answers the gate check, and elan1 Run honours the answer.Erasure is itself a governed write.
The call: Erasure requestA request arrives to erase data the runtime holds.The write: Governed writeThe erasure takes the Right Path like any other write and leaves its own record.Restore drills are verified with elan1-verify.
The call: Restore drillA runtime store is brought back from backup on a schedule.The write: elan1-verifyThe restored chain is re-walked and reported continuous or broken at a sequence number.
Choose a seam number to pin both ends of it.
A runtime outage stops writes. An elan1 outage stops allows. Stopping allows is the safe direction.
06Inside the product
The Run console, screen by screen.
Contracts and their ranked bindings, the nightly conformance matrix, a substitution at its human gates, a trace, the attribution explorer and the licence register. Choose a screen; each lists what to look for.
01 / 14 · Home
Tenant home
- Blocking classes K1, K2, K3, K5 and K7 are shown per class, with the green streak in nights.
- Spend carries a reconciliation badge and its variance, not just a total.
- Each item that needs attention has one action, oldest first.
- The substitution in flight shows its shadow clock and how much of the minimum has run.
02 / 14 · Contracts
Contract board
- Every contract lists rank 0, substitute A and substitute B, each with a licence verdict.
- Last night's blocking classes and the reported K4 and K6 figures sit on the same row.
- Clocks by tier show how long a forced substitution may take on Standard and Sovereign.
03 / 14 · Contracts
Ranked bindings
- Rank 0 serves live traffic; A and B have passed the same nightly classes.
- Licence verdicts are specific: a conditional obligation is named, an acquisition is flagged.
- Only one substitution per contract can run at a time, and the screen says why the button is disabled.
04 / 14 · Conformance
Nightly conformance matrix
- Five classes block; K4 and K6 report a figure against a tolerance and never decide anything.
- The harness version and vector-set hash are shown, so a result can be reproduced.
- One substitute is blocking red, and the screen says which one and for how many nights.
05 / 14 · Conformance
Live class board
- No verdict is shown until every class has finished; a run is never partial.
- Time remaining is labelled modelled, not measured.
- The run record lists the run, implementation, spec hash and vector set it used.
06 / 14 · Substitutions
Substitution record
- The stepper marks human decision points with a half disc; Gate 1 is decided by the suite, not a person.
- Shadow, latency, scheduled and rollback clocks are each shown with what they measure.
- Evidence is listed step by step, with who supplied it and when.
07 / 14 · Substitutions
Gate 1: blocking red
- A red blocking class closes the plan. It is not turned into a warning.
- The failing vector is shown as the property it tests, with its input and both outputs.
- The run id is still recorded, so a failed proof is kept as evidence.
08 / 14 · Substitutions
Gate 2: decide
- Two different people sign, each after stepping up, in the Console only.
- Proving run, shadow, cost and rollback evidence sit side by side before anyone signs.
- If elan1 Govern cannot be reached, the proposal is held. It never goes ahead on a timeout.
09 / 14 · Traces
Trace detail
- Edge, contract call, guard and elan1 Govern spans are drawn on one timeline.
- A 409 refusal is labelled as a refusal, not an error.
- Budget reservation and meter rows are written in the same transaction as the call.
10 / 14 · Traces
Refusal ledger
- The declared reason is the policy's own text, never a model's paraphrase.
- Refusals by elan1 Govern are kept apart, link to their proof records and are metered by Govern at 40% of a governed action.
- Malformed requests and outages are counted separately; they are not refusals.
11 / 14 · Meter
Attribution explorer
- Rows are stamped once at the edge with tenant, team and use case.
- The period shows when it was last reconciled and the current meter lag.
- Guard verdicts are counted but never billed, and the table says so.
12 / 14 · Trust
Licence register
- The register is audited every Monday, and an open diff is raised as a P1.
- Counsel status is tracked per component, including re-reads after a change.
- A blocked component cannot be entered here, and there is no override.
13 / 14 · Trust
Residency and data map
- Eighteen stores, all in ap-south-1, drawn across three availability zones.
- Cross-border transfers and refused egress are counted, not assumed.
- Regions that are not open yet are shown as not opened, with their earliest date.
14 / 14 · Operations
SLOs and reviews
- A breach is shown against its objective and linked to the incident that caused it.
- Contract call latency excludes the component's own time, so the overhead is visible.
- The same figures are read aloud at the first-Monday review and exported as a pack.
Illustrative specimen. Not customer data. Screens come from the elan1 Run console running on fictional sandbox data.
07Deployment
Direct, through an integrator, or under the operator's brand.
Three ways to buy, three places to run it. On an OEM console, the operator's brand is the only brand shown.
Direct
Your platform team runs the stack with us: a paid 90-day pilot, then a subscription by node-year.
Through a systems integrator
An SI delivers and operates the stack for its clients, licensed for ten deployments a year.
Operator OEM
A GPU operator offers the managed AI stack under its own brand. The operator’s brand is the only brand shown.
| Where it runs | What it means | Status |
|---|---|---|
| elan1 Run Cloud | Hosted by elan1, for up to 25 tenants. | Available |
| Customer VPC | In your own cloud account. | Available |
| On-prem | In your own data centre, on your own GPUs. | Available |
| Air-gapped | No outside network at all. | What’s next |
The operator’s view
elan1 Run · Illustrative specimen/run/acme-in/trust/residencyFull size: the elan1 Run Residency and data map screen (opens in a new tab)
elan1 Run · Illustrative specimen/run/operator/operations/slosFull size: the elan1 Run SLOs and reviews screen (opens in a new tab)
Illustrative specimen. Not customer data. Fictional sandbox data from the console.
08Assurance level and mode
Run attests calls, never business actions.
L1 · Guarded
Available now.
Run attests calls, components, licences and conformance. It never attests business actions. Its own tooling writes to Govern in Mode B: evaluated and recorded, failing closed if elan1 is unreachable.
Mode B · Attested advisory
Run's own tooling and elan1 Govern
When Run's tooling makes a write, it goes to elan1 Govern in Mode B. If elan1 is unreachable, it fails closed.
- We sayCalls, components, licences and conformance, attested.
- We never sayThat a business action was allowed.
Business actions belong to elan1 Govern. See elan1 Govern
09Meter and pricing
Priced by capacity, never by tokens.
The unit
One node-year
Per node and per GPU. Runtime units are counted and shown, never priced.
Priced by capacity, never by tokens. The six runtime units are counted and shown, never priced. A call refused at the edge returns a 409 before the first token. It costs 40% of one governed action: ₹0.64 at the L1 rate.
- Every bill has three capacity lines: a yearly subscription, every CPU node under management and every GPU under management. Calls refused at the edge, if any, appear on a line of their own.Excl. GST
- Every subscription includes all five modules, Runtime Controls among them. The governance profile, with elan1 Govern built in, adds three nodes under management at ₹5,40,000 per year.Excl. GST
- Operator OEM and systems-integrator terms are on the pricing page.Excl. GST
Subscriptions
Every subscription includes all five modules: Contracts, Conformance, Substitution, Operate and Runtime Controls. The Runtime Controls governance profile, with elan1 Govern built in, adds three nodes under management (below).
| What | Price · excl. GST | Includes |
|---|---|---|
| Starter | ₹1,80,000 per year | 2 CPU nodes included |
| Standard | ₹6,00,000 per year | Plus nodes and GPUs under management |
| Sovereign | ₹24,00,000 per year | Plus nodes and GPUs under management |
Capacity under management
| What | Price · excl. GST | Includes |
|---|---|---|
| CPU node under management | ₹1,80,000 per node per year | |
| GPU under management | ₹1,80,000 per GPU per year | |
| Tokens and runtime units | ₹0 — counted, never priced | Tokens in and out, GPU-seconds, bytes, pages, tool calls |
| A call refused at the edge | 40% of one governed action (₹0.64 at the L1 rate) | Returns a 409 before the first token, so no token is sent |
Support and add-ons
| What | Price · excl. GST | Includes |
|---|---|---|
| Priority support | 25% of the subscription | |
| 24×7 named-engineer support | 40% of the subscription | |
| elan1 Run Runtime Controls, with elan1 Govern built in | ₹5,40,000 per year | The Runtime Controls module is included in every subscription; the governance profile adds three nodes under management (contracts C2, C6, C7, C8, C10) |
| Paid 90-day pilot | ₹4,50,000 | |
| Onboarding — Standard | ₹2,10,000 per new account | |
| Onboarding — Sovereign | ₹8,00,000 per new account |
All prices are exclusive of GST. Prices are current list prices; GST is added at the applicable rate on the invoice.
10Where it is weak
What elan1 Run does not do.
Plain limits, so you can plan around them.
- It never attests business actions.Run shows that a call happened, what it cost and whether it conformed. Whether a write may happen is elan1 Govern's answer.
- Substitution speed is a target, not a measurement.Our target is inside 72 hours, with no change to consumer code.
- Substitution is never autonomous.Human gates H1 and H2 make a swap deliberate, and slower than an automatic rollout.
- No air-gapped deployment today.Customer VPC and on-prem are available; air-gapped is on What's next.
- A runtime outage stops writes.Run fails closed when elan1 is unreachable. That is safe, and it is not free.
- elan1 Run Cloud has a ceiling.Up to 25 tenants. Larger estates run in a customer VPC or on-prem.
11Status
Available now. All five modules.
Every elan1 Run subscription includes all five modules.
- ModulesContracts, Conformance, Substitution, Runtime Controls and OperateAvailable
- ContractsTen fusion.*/v1 contracts; fusion.memory/v1 in limited availabilityAvailable
- Deploymentelan1 Run Cloud, customer VPC and on-prem; direct, through a systems integrator or as Operator OEMAvailable
Available now. Future improvements are listed, in order and without dates, on What’s next.
Announced 10 Oct 2026: elan1 Govern, Work, Decide and Run are available.
12FAQ
Seven direct answers.
The components that serve AI applications: model gateways and inference servers, retrieval and vector stores, tracing, tool calling, workflow runs, memory and guards. Examples behind the ten fusion.*/v1 contracts include LiteLLM, vLLM, pgvector, Langfuse and Temporal. elan1 Run operates them under contracts rather than replacing them.
Yes. Your application calls a fusion.*/v1 contract, not the component behind it, so elan1 Run Substitution can swap a model or vector store through nine steps with two human gates, H1 and H2. Our target is inside 72 hours with no change to consumer code; it is a target, not a published measurement.
Per node-year, never per token. Starter is ₹1,80,000 a year with two CPU nodes included; Standard is ₹6,00,000 and Sovereign ₹24,00,000 a year, plus ₹1,80,000 a year per CPU node and per GPU under management. Tokens are counted and shown, never priced, and all prices exclude GST.
Yes. elan1 Run deploys as elan1 Run Cloud, in your own VPC or on-premises, and the Sovereign subscription is ₹24,00,000 a year plus capacity under management. Air-gapped deployment is not available today; it is on What's next.
It governs the runtime: calls, cost, components, licences and substitution. Approving business actions is elan1 Govern's job, and Govern comes built in with Runtime Controls.
No. On an OEM console, the operator's brand is the only brand shown.
No. Run never reads tenant records.
Next steps
Related reading
MCP server security and governanceRead, stage and act tools, credentials, approvals and an audit trail per call.Swap an LLM without breaking productionNine steps, two human gates, never autonomous.fusion.*/v1 contracts referenceWhat each of the ten contracts covers, and its two implementations.For buildersCIO, platform and integration teams.elan1 GovernBuilt in with Runtime Controls; governs the write.Reference architectureWhere Run sits below the fusion.*/v1 seam.SecurityIsolation, residency and the licence register.
One write path, four layers
Proposeselan1 WorkProposes what should changeProposeselan1 DecideProposes the answerControl planeelan1 GovernAllows, refuses, recordsRuntimeelan1 RunCarries every call under contract
Work and Decide propose. Govern and Run assure. Only Govern allows.
// elan1 RUN
Swap a component without rebuilding the integration.
Start with a paid 90-day pilot: your stack behind the contracts, conformance running nightly, every call counted.