{ "schema_version": 1, "canonical_url": "https://quox.ai/facts.json", "generated_from": "2026-09-04", "platform": { "agents": { "value": 49, "text": "49 specialist agents", "definition": "Agent personas in the audited manifest (src/data/agentsManifest.json). Owner decision 2026-08-25: 49 is the number; all recently audited. Known defect: 2 personas (quoxflow, scout) lack agentRegistry entries, filed for dashboard-side registration so the count is fully backed.", "status": "OWNER-APPROVED", "as_of": "2026-08-25" }, "integrations": { "value": 417, "text": "417 integration types", "definition": "Named provider integrations with a stored credential field schema the vault can hold and test (src/config/integrationTypes.js). An integration TYPE, not a certified end-to-end connector, and not the same population as the vendor names appearing inside imported workflow templates. The workflow library's old '200+ integrations covered' figure counted the latter and is banned.", "status": "OWNER-APPROVED", "as_of": "2026-08-25" }, "tools": { "value": 168, "text": "168 governed tools", "definition": "Distinct tool definitions an agent can be granted, each subject to policy, scoping and evidence emission when invoked. Counts tool definitions, not tool invocations or integrations.", "status": "DRAFT-PENDING-OWNER", "as_of": "2026-08-25" } }, "protocols": { "aee": { "name": "AEE", "long_name": "Agent Envelope Exchange", "draft_name": "draft-cowles-aee", "revision": "01", "datatracker_url": "https://datatracker.ietf.org/doc/draft-cowles-aee/", "filed_date": "2026-02-28", "expires_date": "2027-03-04", "status": "AEE is a live IETF Internet-Draft (individual submission), not a standard: draft-cowles-aee-01, current through 2027-03-04." }, "aocl": { "name": "AOCL", "long_name": "Agent Orchestration Control Layers", "draft_name": "draft-cowles-aocl", "revision": "01", "datatracker_url": "https://datatracker.ietf.org/doc/draft-cowles-aocl/", "filed_date": "2026-02-28", "expires_date": "2027-03-04", "status": "AOCL is a live IETF Internet-Draft (individual submission), not a standard: draft-cowles-aocl-01, current through 2027-03-04." }, "volt": { "name": "VOLT", "long_name": "Verifiable Operations Ledger and Trace", "draft_name": "draft-cowles-volt", "revision": "01", "datatracker_url": "https://datatracker.ietf.org/doc/draft-cowles-volt/", "filed_date": "2026-02-28", "expires_date": "2027-03-04", "status": "VOLT is a live IETF Internet-Draft (individual submission), not a standard: draft-cowles-volt-01, current through 2027-03-04." }, "ward": { "name": "WARD", "long_name": "Write-once Append-only Receipt Digests", "draft_name": "draft-cowles-ward", "revision": "00", "datatracker_url": "https://datatracker.ietf.org/doc/draft-cowles-ward/", "filed_date": "2026-08-31", "expires_date": "2027-03-04", "status": "WARD is a live IETF Internet-Draft (individual submission), not a standard: draft-cowles-ward-00, current through 2027-03-04." } }, "offline_verification": { "aocl": "AOCL gates are enforced and fail closed: an approval hold blocks execution until a named human decides, a policy deny hard-stops the node, and an unresolved hold expires to expired status rather than proceeding. Detail in the enforcement section of this file.", "volt": "VOLT evidence bundles verify offline.", "ward": "WARD publishes signed hash-chain tips to external witnesses." }, "pages": { "/docs/aee": { "protocols": [ "aee" ] }, "/docs/aocl": { "protocols": [ "aocl" ], "offline_verification": [ "aocl" ] }, "/docs/volt": { "protocols": [ "volt" ], "offline_verification": [ "volt" ] }, "/docs/ward": { "protocols": [ "ward" ], "offline_verification": [ "ward" ] }, "/docs/aarm": { "protocols": [ "volt", "ward" ], "offline_verification": [ "volt", "ward" ] }, "/solutions/verifiable-ai-operations": { "definition": "Verifiable AI operations means every consequential AI action produces evidence a third party can check without trusting the operator: hash-chained records, identity binding, portable bundles that verify offline." } }, "enforcement": { "approval_hold": { "text": "A HITL approval hold blocks execution until a named human decides, and the per-node approval gate fails closed: an action it cannot evaluate is held, it does not proceed by default.", "definition": "quoxflow src/executors/approval-gate.executor.ts (gate returns paused) and src/pipeline/control-pipeline.ts (policy-injected approvals pause identically; store errors pause rather than proceed). Verified from source 2026-09-02.", "status": "OWNER-APPROVED", "as_of": "2026-09-02" }, "approval_timeout": { "text": "A pending approval never silently proceeds: the held action stays held. Approvals past their expiry window are swept to expired status by a scheduler registered at server boot; an expired approval does not auto-approve, auto-deny or auto-escalate, the workflow remains paused until someone acts on it.", "definition": "quoxflow src/approval/approval-expiry-scheduler.ts, registered in src/server.ts at boot; expiry semantics in src/approval/approval-engine.ts processExpired(). Verified from source at repo HEAD 2026-09-02.", "status": "OWNER-APPROVED", "as_of": "2026-09-02" }, "policy_deny": { "text": "A policy DENY hard-stops the node: the pipeline emits a POLICY_DENIED envelope and returns failure without walking further edges.", "definition": "quoxflow src/pipeline/control-pipeline.ts denied branch. Verified from source at repo HEAD 2026-09-02 (fix landed 2026-09-02 in commit 33edb1cd with tests).", "status": "OWNER-APPROVED", "as_of": "2026-09-02" }, "collector_default_deny": { "text": "Collector API routes are deny-by-default: in production the auth gate enforces 401/403 even when the enforcement flag is unset, unless an explicit time-boxed break-glass record exists. Outside production the gate can run in shadow, log-only mode.", "definition": "quox-dashboard services/collector/utils/collectorAuthGate.js and enforcementPosture.js (production_no_break_glass path). Verified from source 2026-09-02.", "status": "OWNER-APPROVED", "as_of": "2026-09-02" }, "credential_custody": { "text": "An agent working through Quox does not hold the stored credentials it works with. When a tool call needs a vault credential, the platform resolves it server-side and makes the call; the model receives the result, never the secret value. The one agent-facing vault tool is a health test-connect that never reveals or echoes the credential value.", "definition": "quox-dashboard services/collector/lib/agentTools.js: credentialedIntegration tools resolve through the agent_credential_assignments -> org-default -> instance -> env lookup server-side (remote_ssh via vault ssh_key with TOFU host-key verification, db_query via vault database credential, tls_cert_info via vault tls_cert); the vault_test_connect tool description states it never reveals or echoes the credential value. Scope: covers credentials placed in Quox custody; a secret reaching an agent through another channel (prompt, file, environment variable) is outside the boundary and outside the record. Verified from source 2026-09-04.", "status": "OWNER-APPROVED", "as_of": "2026-09-04" }, "chain_scope": { "text": "A WARD receipt is tamper-evident proof that Quox recorded the governed request, decision and result, in sequence, unmodified since. It does not independently prove an external system’s final state; pair it with that system’s own records when the question is whether the world changed accordingly.", "definition": "The published chain construction (quox.ai/docs/ward, chain_hash = SHA-256 over prev_chain_hash | chain_id | seq | ward_entry_id | witnessed_at | source_kind | source_id | payload_hash) proves record integrity and ordering only; nothing in the construction attests external side effects. Stated on /docs/ward#enforcement-boundary. Owner approved 2026-09-04 (ward enforcement-boundary v3, codex-hardened).", "status": "OWNER-APPROVED", "as_of": "2026-09-04" } }, "containment": { "budgets": { "text": "Agent budgets for tokens, tool calls, wall-clock duration and optionally USD cost are enforced as a pre-execution gate: a breached budget blocks the next scheduled run or loop iteration before it starts. This is not after-the-fact accounting. Status Beta; known gap: per-request token-in usage is not populated on the hot path.", "definition": "quox-dashboard services/tasks/lib/budget.js, gated in agentScheduler.js before dispatch and dagUtils.js before loop continuation; Beta rating and the token-in gap from docs/STATUS_AND_LIMITS_AUTOMATION.md. Verified from source 2026-09-02.", "status": "OWNER-APPROVED", "as_of": "2026-09-02" }, "loop_containment": { "text": "The loop-stuck detector fires after three identical action results or errors in sequence (also on oscillation and monologue patterns) and requests termination of the live session; Beta, the interrupt path has fired live. Per-resource circuit breakers (ssh, llm, collector) are wired at the primary execution chokepoints and fail fast with a typed error when open, with real half-open recovery; Beta, first wiring 2026-09-02, uncovered paths named in the status doc.", "definition": "quox-dashboard services/tasks/lib/loopStuckDetector.js (default threshold 3) wired in loopDispatch.js; resourceBreaker.js wired at goalEvaluator/coordinatorStep/decomposer (llm), fleetLoopSpawner (ssh), loopDispatch continuity recall (collector) in quox#504 (PR #505). Beta ratings and uncovered paths from docs/STATUS_AND_LIMITS_AUTOMATION.md. Verified from source and full-suite tests 2026-09-02.", "status": "OWNER-APPROVED", "as_of": "2026-09-02" }, "kill_switch": { "text": "The kill switch is enforced server-side: a per-agent E-STOP or instance DEFCON RED blocks new dispatch at the scheduler, at every collector invocation chokepoint, and at the shared objective-dispatch chokepoint that covers team schedules, human plan approvals and calendar-triggered work (each refused with a typed AGENT_HALTED error; a refused plan is held for later re-approval, not destroyed). Live loop sessions are killed at the turn boundary, and every path fails closed if the halt store is unreachable. Only a human administrator can set or release it; an agent or service key cannot, and every trigger and release lands in the audit trail.", "definition": "quox-dashboard services/collector/lib/killSwitchStore.js + routes/safetyGate.js (human-admin gated), services/tasks/lib/agentScheduler.js + loopDispatch.js chokepoints (quox#503, PR #505), and the shared dispatchObjective() chokepoint gating teamScheduler, approve-plan and calendarEvents (quox#506, main a3b0bc72). Driven live on the dev instance twice: 2026-09-02 (activation flipped the gate, dispatch refused HTTP 423 AGENT_HALTED, audit row, release restored dispatch) and 2026-09-03 (a human-approved plan for an E-STOPped agent refused HTTP 423 at approve-plan with the plan surviving as re-approvable).", "status": "OWNER-APPROVED", "as_of": "2026-09-03" }, "autonomy_defcon": { "text": "Agents configured at DEFCON ORANGE or RED cannot act autonomously: the autonomy decision engine forces escalation to a human before acting. Retry limits and consecutive schedule failures likewise force deferral or escalation instead of another autonomous attempt.", "definition": "quox-dashboard services/tasks/lib/autonomyDecision.js (DEFCON check forces ESCALATE; retry and schedule-failure checks force DEFER/ESCALATE). Verified from source 2026-09-02.", "status": "OWNER-APPROVED", "as_of": "2026-09-02" }, "memory_governance": { "text": "Memory writes accept only the fact role (other roles are rejected with a typed error) and are scoped server-side to the authenticated org and user; client-supplied org or user identifiers are discarded. Not yet implemented: retention or expiry policy, content redaction, and human review before a memory becomes readable.", "definition": "quox-dashboard services/memory/lib/memoryStore.js (ALLOWED_WRITE_ROLES) and services/memory/server.js (JWT-derived scoping on every route); Stable rating from docs/STATUS_AND_LIMITS_MEMORY.md. Verified from source 2026-09-02.", "status": "OWNER-APPROVED", "as_of": "2026-09-02" } }, "acceptance": { "acceptance_verdict": { "text": "A terminal run can carry a witnessed acceptance verdict: a pass or fail attestation of whether the action achieved its intent, recorded separately from run status. The verdict pins the run's evidence-chain head hash and is itself witnessed through the same VOLT bundle and WARD receipt pipeline as the run; the run's sealed bundle is never touched retroactively.", "definition": "collector services/collector/lib/acceptanceStore.js recordAcceptanceVerdict(): terminal-status check, target head_hash pinned, verdict minted as its own VOLT run (corr accept:) completed through the standard auto-bundle + WARD hook; REST at /volt/runs/:runId/acceptance, CLI quox volt accept. Verified from source and driven live 2026-09-03: worked-example v3 records verdict pass on a run that failed with APPROVAL_DENIED, because proving the deny path WAS the intent.", "status": "OWNER-APPROVED", "as_of": "2026-09-03" }, "acceptance_actor": { "text": "Who attested is derived from the credential class (human, agent or service), never self-asserted: an agent that marks its own work as passing is recorded as an agent, in the verdict row, in its audit envelope and in its witnessed evidence run.", "definition": "collector utils/httpAuth.js deriveActorType() (agent markers win over human, fail-closed) consumed by routes/runAcceptance.js; test/runAcceptance.test.js asserts an agent-scoped token is recorded as actor_type agent, never human. Verified from source 2026-09-03.", "status": "OWNER-APPROVED", "as_of": "2026-09-03" }, "acceptance_scope": { "text": "An acceptance verdict is an attestation, not automated evaluation: the platform records who said it worked and binds that statement to the evidence; it does not yet evaluate declared acceptance criteria itself. Verdict history is append-only; a later verdict supersedes but never edits the record.", "definition": "collector services/collector/lib/acceptanceStore.js: closed pass/fail vocabulary (ACCEPTANCE_VERDICTS), append-only run_acceptance_verdicts table with latest-first reads; declared-criteria evaluation deliberately deferred (owner ruling 2026-09-03).", "status": "OWNER-APPROVED", "as_of": "2026-09-03" } }, "track_record": { "ops_canary": { "text": "Two operations canaries publish one signed, RFC-3161 TSA-countersigned checkpoint per day each, on append-only public chains whose signing key was publicly pinned before either began: one observing the development instance, and one observing the production instance that runs Quox Ltd's own operations (observation-only in its first phase; the governed self-workload arrives in later published phases, so the buildout itself is visible in the history). Failures are included: production day 0 already records a failing container healthcheck, a missing recurring-backup schedule and its own corrected day-0 parser slip. Day zero for both is 2026-09-03; accumulated day counts are independently recomputable and cannot be backdated.", "definition": "github.com/quoxai/quox-facts-witness: ops-canary/ (development) and ops-canary-prod/ (production, remote-observed over SSH from the key-holding box; key never resides on the observed instance). Chains ward:quox.ai/ops-canary and ward:quox.ai/ops-canary-prod, public generator scripts beside the data, daily systemd timers with Persistent=true. Started 2026-09-03 in response to benchmark round-5 web-enabled assessors (3/3 NO) unanimously naming pre-committed longitudinal operational evidence as the missing layer; buildout tracked as stream PROD-CORE.", "status": "OWNER-APPROVED", "as_of": "2026-09-03" } }, "witness": { "receipt_url": "https://quox.ai/facts.receipt.json", "how_to_verify": "Fetch this file and the receipt. The receipt’s facts_sha256 must equal sha256 of this file’s exact bytes. The receipt is a WARD entry: an Ed25519-signed hash-chain tip verifiable offline with the embedded public key against the WARD spec at https://quox.ai/docs/ward. No Quox system needs to be trusted or contacted for the check.", "external_witnesses": "The receipt’s witnesses array carries corroboration from outside Quox’s control: an RFC-3161 timestamp token from a public TSA (freetsa.org) over the canonical chain-tip statement, verifiable with openssl against the TSA’s independently fetched CA, and an append-only public git history of every witnessed tip at https://github.com/quoxai/quox-facts-witness. Quox’s own signature proves non-tampering since Quox signed; these sinks prove a third party saw the same tip.", "worked_example": "https://github.com/quoxai/quox-facts-witness/tree/main/worked-example: a real run held at its approval gate, denied, and then attested (v3): the exact evidence-bundle export, the acceptance verdict bound to the run’s chain head, a WARD receipt carrying its covering Ed25519-signed and TSA-countersigned chain tip, and the platform’s own verifier script, limits stated in its README.", "worked_example_adversarial": "https://github.com/quoxai/quox-facts-witness/tree/main/worked-example-adversarial: the acceptance layer tested against a FALSE pass, published deliberately: a run that completed with provably wrong output, a calling system falsely attesting pass, a human refuting it. The README states plainly that the platform did not and cannot catch the false pass today; what the record proves is that the lie is attributable, bound to the exact evidence, and refutable on an append-only history.", "chain_id": "ward:quox.ai/facts", "note": "If this file changes, a new chain entry is minted, the receipt is republished, and the new tip is externally witnessed; a receipt hash mismatch means you are reading an unwitnessed edit." } }