Govern · Concepts

Govern concepts

Govern sits between an agent’s output and a host product’s authority. It turns requests, host events, and tool results into bounded replies, proposals, or no-ops without becoming the source of business truth or the executor of business actions.

Host event
  → input
  → turn
  → versioned host tool
  → effect
      ├─ reply
      ├─ proposal → host review and execution
      └─ noop
  → trace and evidence

Input

An input is a normalized request, event, or callback entering the runtime. Its envelope carries runtime context, source lineage, correlation, causation, and an idempotency identity.

The host remains authoritative for the business facts referenced by an input. Receiving an event does not make its payload permanently current.

Turn and effect

A turn is one governed evaluation of an input. The runtime chooses one bounded effect:

Effect	Meaning
reply	Produce a response for a transport adapter
proposal	Persist a reviewable action candidate
noop	Finish without an external side effect and retain the trace
handoff	Reserved; not currently dispatchable

TurnOrchestrator chooses the effect. EffectDispatcher records and dispatches the supported result. A model response is not itself an effect until it passes this runtime boundary.

Host tool

A host tool is a versioned, schema-pinned endpoint that returns fresh host-owned facts or one bounded candidate. Tonetify selects a registered binding and sends correlation, causation, and idempotency metadata with the call.

The host defines the domain semantics inside the tool payload. Tonetify validates the generic envelope and pinned schema; it does not reinterpret eligibility, budgets, targeting, or other business rules.

Action proposal

An ActionProposal records what could happen, why it was proposed, the context used, and its delivery and lifecycle state. It may include review evidence and risk information for an operator surface.

A proposal is not approval, execution, or proof that the action remains valid. Before execution, the host must apply its own policy and current business truth.

Authority and permit

Authority answers whether a particular actor or policy may authorize a mutation. A permit narrows that authority to a specific attempted mutation, audience, scope, and validity window.

Govern has durable authority, permit, credential, receipt, witness, and reversal primitives. These are currently an emerging in-process governance spine, not a public authority service. The reference integration path documented here stops at proposal review and lifecycle reconciliation.

Evidence

Evidence records what the runtime observed: tool results, proposal lineage, delivery attempts, host callbacks, receipts, and witness facts. Evidence supports review and replay, but it does not replace host business truth.

Ownership boundary

Tonetify Govern owns	Host product owns
Runtime normalization and orchestration	Identity and current business state
Versioned tool invocation	Tool payload semantics and eligibility
Generic proposal envelope and lifecycle	Approval policy and operator decisions
Runtime trace and evidence metadata	Mutation execution and durable outcome

Next: describe a host runtime.