Every module family and module, one surface.

The compliance wedge: fail-closed RLS, WORM, an audit chain, evidence packs, access reviews, the AI risk register, a public trust page, and the framework + signing carves.

The production-rigor layer for AI features: metering, guardrails, prompt versioning, and the CI eval harness.

On-device inference, a privacy egress gate, and local vector search: data stays on device unless you explicitly enable a hosted transport.

The governed-agent kernel: typed agent/skill/rule schema, a guarded lifecycle, and sandboxed execution.

Cryptographic provenance: detached signing, an append-only WORM audit chain, and per-tenant field encryption.

The full catalog: every module family and every standalone module together.

Per-tenant field encryption (HKDF-SHA256): each tenant's ciphertext is sealed under its own derived key, and a cross-tenant read fails to decrypt in the test suite, every run.

Append-only SHA-256 audit chain plus S3 Object-Lock WORM evidence storage. Tamper breaks the link.

Policy-driven data retention on a schedule: expiry and legal-hold, enforced automatically.

Deduped, rate-capped alert delivery with quiet hours and an audit trail: the SOC 2 CC7.2 alerting control your compliance program can point to.

Audit-prep access-review campaigns: import a membership snapshot, record per-reviewee attested approve/revoke decisions into the WORM log, and close with every undecided reviewee flagged, never auto-approved.

Likelihood x impact risk scoring with a computed residual, operator overrides recorded as chained exceptions, crosswalks into your framework packs, and a treatment-plan evidence artifact.

A self-contained trust page built from your evidence pack through allowlist-based redaction: host it anywhere to show prospects your compliance posture.

PG-atomic token metering with per-tenant spend caps and a circuit breaker that trips before a runaway prompt loop reaches your invoice.

Regression-grade evals that run in CI, ahead of production. A model swap that regresses fails the build, catching it before a customer's session does.

A single guardrail boundary between your app and the model: every call passes through the same PII redaction, moderation, and secret-shape gate.

Versioned prompts with rollout history: promote or roll back a prompt by moving an alias pointer, no redeploy required.

Hybrid FTS5 + sqlite-vec search that runs on disk, one file per tenant, with no vector-cloud vendor in the loop.

Typed agent/skill/rule schema plus the guarded lifecycle state machine: a failed VERIFY reopens PLAN, and the only path to SHIP runs back through it.

Sandboxed, governed agent execution: spawn a headless coding agent into an isolated worktree and stream back an auditable transcript, with the child's environment built from scratch rather than inherited.

The governed run record: an append-only, replayable event log of every agent step, tool proposal, approval, and spend, with sensitive bodies referenced by digest, paused runs encrypted at rest, and a deterministic replay for scoring and audit.

The fail-closed compliance substrate: the RLS-force evidence collector, isolation tests, and the SOC 2 / HIPAA evidence-pack generator that maps live controls to named clauses.

The framework control library: SOC 2, HIPAA, and EU AI Act mappings, the clause-to-control catalog the evidence packs render against.

OSCAL v1.2.2 expression for assessment plans, results, POA&Ms, merged catalogs, ISO 27001 statements of applicability, and the vendored NIST 800-53 crosswalk.

Detached Ed25519 + RFC-3161 signing over evidence bundles and audit roots: a verifiable signature a third party can check without your keys.

PG-atomic credit ledger with one integer denomination: grant, debit, and spend-cap credits across codegen and AI features, fail-closed on an empty balance (402).

Two-way offline sync: changesets, tombstones, a logical clock, and a reconcile pass with a convergence test, so the device catches up without a server round-trip.

The InferenceBackend seam over a MiniLM-class ONNX model via transformers.js, SHA-256 hash-verified before use: inference on-device by default, hosted only by opt-in.

A default-deny egress boundary every payload crosses before it can leave the process: no host is reachable unless a typed allowlist names it, and leaving it empty makes egress zero.

The governed tool-execution gate: a default-deny allowlist over Zod-strict argv schemas and execFile arg-arrays, so an agent reaches only the commands you explicitly allowed, never a shell.

WorkOS SSO plus the owner-gated multi-user surface: invite and manage account members, and the admin-write RLS layer that lets an owner mutate scoped tenant data under a dual-logged policy.

The multi-provider billing engine: Paddle, Stripe, LemonSqueezy, and Polar behind one BillingProvider port, with idempotent webhook fulfillment and a domain event stream.

The extended component layer on the open @caisson-sh/ui base: data-dense matrices, credential strips, and the elevation + glow treatments the brand system ships.