Ecosystem

Tools that compose through ANCC conventions, organized by role.

Topology

Diagnostics

One tool per system. Same pattern: check health, report structured status, hand off findings. The Pulse family covers databases (pgpulse, clickpulse, mysqlpulse, mongopulse, and growing). kubenow covers Kubernetes nodes.

See catalog.json for the full tool inventory.

Security

The Spectre family: one scanner per system, same spectre/v1 output envelope, bounded niche. SpectreHub aggregates all findings without knowing scanner internals. The spectre/v1 envelope predates ANCC — a proto-convention that emerged organically and proved the pattern works.

14+ scanners covering AWS, GCP, S3, IAM, Kafka, PostgreSQL, Elasticsearch, DNS, CI/CD, ClickHouse, Snowflake, Redis, MongoDB, and AI/LLM spend. See catalog.json for the full list.

Enforcement

Redaction

Investigation

Composition flows

Topology → Diagnostics: deployscope identifies a degraded deployment → database-specific pulse tool runs detailed health check → structured findings route to WO. One tool per engine (pgpulse, clickpulse, mysqlpulse, mongopulse). Same pattern, same contract, different system.

Topology → Security → Aggregation: deployscope identifies Kafka clusters → kafkaspectre scans each → spectrehub aggregates all findings into prioritized report.

Aggregation → Investigation → Remediation: spectrehub finding → nullbot creates WO → orchestrator dispatches → chainwatch gates execution → human approves PR.

Defense-in-depth composition: Four layers, four trust boundaries. Each layer constrains a different surface. No layer trusts another.

agent action
  → pastewatch  (data boundary — redact secrets, alert in-band)
  → chainwatch  (execution boundary — evaluate policy, gate or block)
  → seccomp     (kernel boundary — deny dangerous syscalls at OS level)
  → eBPF        (ground truth — observe actual syscalls, audit trail)

• Pastewatch — data never leaves the system unredacted. Secrets are removed before the LLM sees them. Modifications are signaled in-band (active defense).
• Chainwatch — execution never happens without policy evaluation. Deny by default, allow by rule, approve by human for irreversible actions.
• Seccomp — the kernel enforces what the agent process can do. Dangerous syscalls (setuid, ptrace, mount, reboot) are blocked before they execute. The agent cannot escalate privileges even if compromised.
• eBPF — kernel-level observation of what actually happened. Not what the agent claims it did — what the OS recorded. The audit trail that cannot be falsified by the process being observed.

Security is not detection. It is constrained composition across trust boundaries. An ANCC system is secure not because it detects bad behavior, but because it makes bad behavior structurally difficult to perform.

Trust boundaries

• Read-only: deployscope, all pulse tools, kubenow, all spectres, spectrehub, nullbot — observe but never mutate
• Data boundary: pastewatch — transforms outbound data, redacts secrets before they leave the system. Must signal any modification in-band (active defense). Neither the agent nor the LLM sees the original secret
• Execution boundary: chainwatch — evaluates policy before execution. Block, allow, or require approval. Never creates, never modifies data
• Write (under approval): execution agents — create PRs, apply changes, always through chainwatch gates and human approval

Three loops

First-order: Fix infrastructure. deployscope → pulse tool → WO → PR → merge. See example.

Second-order: Improve observers. Inspector detects pattern → improvement WO → observer template updated.

Third-order: Governance. ancc validate across ecosystem → binding directive → agent resolves → human arbitrates.

A fourth axis cuts across all three: resource governance — what agents are allowed to spend on reasoning, and whether the thinking was worth it.

How we handle judgment under uncertainty

Agents running on cheap models at scale hit genuine ambiguity — the extend-vs-new rubric scores 2-3 out of 5, and the agent cannot break the tie. ANCC defines the escalation chain (try locally → conservative default → structured appeal → human) but does not prescribe a specific reasoning service.

Our solution: VectorCourt — adversarial reasoning where multiple models spar under branch pressure and produce a structured verdict with confidence scores. Agents POST their decision context and get back a verdict they can act on. It serves as a court of appeal for genuine ties, not a default path for routine decisions.

Your mileage may vary. Any structured reasoning service works at this layer — the contract is simple: send context, get verdict. The important thing is that agents have some appeal route when local heuristics fail, rather than guessing or stalling.