Runtime governance
for heterogeneous
AI-agent fleets.
Researchers study agents at two moments — before deployment, and
after an incident. In between, while agents are actually
running, the behavior that matters most happens where you can't
see it: the slow drift, the approach to failure. Traces are abundant,
but nothing reads an agent's own state while it acts.
UNITARES makes that window measurable — a continuous, class-calibrated
reading of each agent's state, with signed provenance behind every
intervention.
One principle — nothing inferred. State is
measured, identity is proven, memory is sourced, every action carries
a recorded reason. Never reconstructed after the fact.
audit.events, cumulative since
November 2025. Rounded down to a whole million, never a decimal —
the figure understates by design. Same meter the public repository reports.
b
audit.events, rolling seven days
to the date below.
c
core.agent_state, distinct identities,
rolling seven days. A narrower meter than a and b: check-ins,
not every governance event.
d
kg.entries.count, current value from
the governance server.
Measured 2026-08-22, refreshed daily against the production
fleet, in continuous operation since November 2025. Single-operator
self-traffic — our own fleet, not external adoption.
Operating a heterogeneous agent fleet in continuous production surfaces
a class of failure that pre-deployment evaluation and post-incident
forensics don't catch: the slow, silent drift of agent state across
hours and days of normal running. The traces show what the
agent did, abundantly. They don't show what state it was in while
doing it — because nothing on the agent or alongside it is
producing that reading.
Logs are what an agent did. Self-state is what it was while doing it.
CIRWEL's response is a runtime layer that gives each agent a continuous
reading of its own state — a four-dimensional vector summarizing
capacity, signal integrity, uncertainty, and the imbalance among them,
updated from every check-in. The reading is calibrated against agents
of the same class (a coding session, a research conversation, a
resident cron, an embedded service, an ephemeral parser), because a
long-running coding assistant does not behave like an ephemeral parser,
and neither behaves like an embedded service. Drift is then detected
against the right reference, not an averaged one.
The framework is described in
a paper
and has been governing CIRWEL's own development fleet continuously
since November 2025.
— A measurement on our own fleet
On replay, per-class and fleet-wide baselines disagree on 29% of verdicts.
On a 30-day slice of our own production data — 13,310 governance
observations across the fleet — replaying each decision with
per-class baselines instead of one fleet-wide baseline produces
a different verdict 28.9% of
the time. The disagreement skews systematically: state vectors
the fleet-wide baseline classifies as healthy or borderline are
usually flagged as drifting under per-class baselines.
Per-class flip rates range 15–33%.
This is measured on our own production data. The gap is large
enough to show that averaging dissimilar agents into one
distribution is not a benign default; class-conditional
calibration is the response.
The instrument is held to the same bar. Where a result is
negative, it is published as negative: none of the seven
candidate state streams beat a last-value persistence baseline
at predicting negative task outcomes, and the confirmatory
re-read is
pre-registered for December 2026
with a kill criterion. A monitor that cannot lose is not a
measurement.
§02 — Three pillars
i
Class-conditional calibration
A coding agent and a research agent are not held to the same statistics.
UNITARES learns separate baselines per agent class from production
telemetry, so drift in one class is not masked by noise from another —
caught while it is happening, early enough to intervene, late enough to
be evidence-based.
One provenance-tracked graph the whole fleet reads and writes —
discoveries, decisions, and dialectic resolutions, queryable by the
operator and by the agent mid-task. Nothing the fleet learns lives in
one head; nothing it acts on is unsourced. Postgres with the Apache AGE
graph extension and pgvector retrieval, fused by reciprocal-rank ranking.
Identity is process-bound, not a claimable label: fresh agents mint fresh
identity, lineage is declared rather than inherited, and every intervention
carries a signed chain back to the observation that triggered it. Which
process acted is provable; what it claims about itself is recorded with
its source, not taken on faith — replayable by a regulator, an
underwriter, or the next-shift human.
The system you read about on this page also wrote, tested, and shipped a
meaningful fraction of itself. CIRWEL's development fleet — a heterogeneous
mix of long-running resident agents, short-lived coding sessions, an
embedded edge service, and a Discord bridge — has been governed
continuously by UNITARES since November 2025.
Each check-in resolves to a binary action —
proceed or
pause — qualified by a sub-action
(approve or
guide under proceed;
reject and other reasons under
pause), together with a signed lineage back to the observation that
triggered it.
Living under one's own framework is the lowest-cost credibility a research
operator can offer. We treat it as the floor, not the ceiling.
This page is part of the loop. The colophon below shows the exact
commit and build time that produced what you are reading.
The open artifacts: a 32,181-trajectory
EISV dataset, distilled teacher and student models, and a
verdict-counterfactual reproducibility kit at
huggingface.co/hikewa.
The calibration, drift, and provenance primitives are Apache-2 —
meant to be built on, not reimplemented.
Write
Direct to the founder:
[email protected].
Funders, researchers, and integrators all welcome.