Map
Everything we've built, laid out by what it is. Verbs act — they are the only places an agent can touch the world. Nouns hold — the data those actions run on. Each entry below is generated from the package's own declared labels, so this page can't drift from the code; when it looks wrong, the code is wrong.
The system itself is the three repos on the front page — guest-room, claude-box, prx. Everything else here is the workspace around them: the packages those three are built from, and the tooling that keeps the org honest.
- door Door
- — one bounded capability an agent acts through. Hold the socket, never the keys behind it.
- room Room
- — infrastructure a stay runs on: storage, runtimes, policy engines.
- guest Guest
- — agent-side tooling: what the agent itself uses to do its job.
Coverage is honest, not complete: these are the published packages that declare their own labels. The rest of the org's repos appear here as their descriptors land.
Verbs — the things that act
Every one of these is a sanctioned access point: the single place a kind of effect is allowed to happen.
Service-credential resolver (GitHub, Notion) through a single sanctioned access point
uses → env
Typed interface to the beads CLI with policy enforcement and short-ID guards
uses → env, policy, proc
In-box door-client SDK for claude-box's capability doors, over the guest-room protocol
The one sanctioned reader of process.env, routing ambient config through capability imports
Filesystem capability seam; the one allowed filesystem-access point with an injectable FileSystem
GitHub CLI wrapper with policy enforcement, rate-limit gating, and budget audit logging
uses → env, github-budget, policy, proc
Git CLI wrapper with policy enforcement and stale-lock recovery
uses → env, fs, policy, proc
Rate-limit-aware gh wrapper with bucket classification, pre-call gating, and audit trail
uses → audit-context, env, proc
The one sanctioned reader of host/OS ambient state (home dir, temp dir, hostname), routing ambient authority through capability imports
uses → env
The one allowed subprocess spawn point, routing external-tool invocations through a capability
uses → env, policy
Repo-root resolution capability: lazy git-based runtime root plus the eager .git-marker walk for build/codegen, the one sanctioned root-resolution point
uses → proc
Content-addressed surface reads (file/grep/files) with anchored-chain provenance
uses → anchored-chain, anchored-chain-sqlite, cas
Policy-gated, provenance-tracked Slack read surface: bounded read ops behind a swappable transport port, with keymaker-minted scoped credentials
uses → anchored-chain, anchored-chain-sqlite, cas, policy
Guest-agnostic room+door capability runtime — the core library claude-box is built on
Tool-policy engine enforcing subcommand allowlists by tool, state, and role
Type ontology for work-unit change-detection across GH/branch/worktree/tmux/beads
uses → disposition
Pure classifier mapping work-unit surface state to a disposition (ok/prune/repair/review)
Project zod schemas to explicit, fast-types-clean TypeScript (zod → JSON Schema → .d.ts)
Spec-driven CLI core: author a verb once as a typed VerbSpec, project it to CLI, MCP, OpenAPI, and Anthropic tool surfaces
Nouns — the things that hold
The data the verbs run on: storage, schemas, chains, context.
Derivation chain with contract validation, signing, lineage tracking, and invalidation
uses → cas
SQLite/Drizzle-backed implementation of the anchored-chain stores
uses → anchored-chain, cas
Ambient runtime context for gh-call audit attribution (verb, actor, truth reason)
Content-addressable storage substrate: bytes addressed by their SHA-256 digest, with a storage-agnostic blob-store port
Brands, handoff envelope, and state/phase/invariant primitives for work-unit machines
Capability-use provenance: a schema + SLSA mapping binding each privileged effect to a signed owner + auditable chain
TUI configuration schema parser/emitter for L1 Claude and L2 Warp tools
The capability seams
One narrow seam per kind of ambient system power — the single sanctioned access point in prx today, each one a door on the guest-room runtime tomorrow — so effects stay attributable and policy stays enforceable.
Contract state between repos lives on /contracts; how honestly the claims hold up, on /ledger. The full source is at github.com/bounded-systems.