Moonwalker is the control plane for autonomous agents. Every action is typed to a declared scope, sealed into a tamper-evident audit trail, gated by risk, and bounded by policy you own. Moonwalker is the plumbing, not the destination: bring your own agents, storage, models, and systems. Full data custody stays yours, and everything an agent does lands in a heat-death-resistant evidence log. Built for government and enterprise.
An agent is asked to modify one file. The task succeeds and every test passes — but the record shows it also read forty-seven others, several it had no stated reason to touch. Legitimate context-gathering, or drift toward material it should never have seen? In most deployments nobody notices. Even a team that notices cannot say which it was.
Observability tools trace execution. Guardrails block selected actions. Evaluation suites score models before deployment. None of them answer whether a departure from the declared envelope was reasonable adaptation or unjustified bypass.
A dependence-aware sequential adjudication engine that weights outcome evidence by measured reliability, maintains explicit error control, and abstains when the evidence is insufficient. The hypothesis is falsifiable; if it fails, the boundary of what agent monitoring can honestly claim gets documented instead.
HIPAA audit controls, SOC 2 evidence expectations, FedRAMP and ATO processes, and federal AI-governance requirements all demand defensible records of automated activity. The buyer is the executive who has to explain it — compliance officer, CISO, head of AI governance.
Capability without governance is a liability. Moonwalker puts the same four guarantees beneath every agent and every tool — not as a wrapper, but as the plane the work runs on. Mirror, not cop: we record everything and hand you the configuration panel. What gets gated is your call, not ours.
Every tool call is bound to a declared, typed scope, and every action against it is recorded — in scope or out, read or write. Whether a departure is refused at the boundary, flagged loudly, or simply logged is a setting you arm.
Each action is sealed into an append-only, cryptographically verifiable record. Content-addressed, so the trail announces tampering instead of hiding it.
A risk actuary scores every operation before it runs — consequential, credential-bearing, irreversible — and the score is always recorded. What earns friction, an approval, or a hard stop is yours to configure. Governed power, not governed friction.
Governance is configuration you control, not a vendor's black box. Your rules, your keys, your audit domain — running on your ground, under your control.
Governance that stops at the model boundary governs nothing. Moonwalker sits where autonomous work becomes real — local machines, project vaults, browser sessions, worker agents, scheduled jobs, and the evidence they leave behind.
Read and write access, shell execution, code workers, and browser sessions — each bound to an explicit scope, a backup posture, and policy the customer owns. Governed database access is the next surface on the same contract: scope and evidence over the query, with the data never leaving your systems.
Long-running autonomous work becomes reviewable: a task packet, a bounded dispatch, a required artifact, run history, review, and a closeout that says what actually happened.
Routine actions flow without ceremony. Consequential, credential-bearing, outward-facing, or hard-to-reverse actions meet warning, attestation, approval, or a hard stop.
Because instructions, task context, and available evidence all cross the control plane, the record preserves what the agent was told and what it knew at the moment it acted — context that otherwise vanishes the instant the action completes.
SHA-384 chain digests and AES-256-GCM at rest — CNSA 2.0-aligned today, with no MD5, BLAKE, or legacy ciphers anywhere in the sealed path. The signature lane is deliberately swappable, so post-quantum ML-DSA is a module change rather than a format migration. Every record states its own module identity and FIPS-validation status instead of assuming it; FIPS-validated signing lands with the first procurement that requires it.
Early-stage research lanes — in design, not yet built, and labelled that way on purpose. Each extends the same contract: typed commands, a safety floor beneath the agent, and a tamper-evident record of everything that happened.
A scripted factory cell is mindless behaviour inside a fence. An AI controlling embodiment can actually think about what it is doing — and judgment is precisely what needs governing. The pattern: commands over a typed seam, the safety envelope resident in the controller below the agent, every command hash-chained into a trail bound to the machine’s own log. Simulation-first, and honest about the ceiling — unattended autonomous flight has no legal path today, so human override and visual line of sight are the envelope by law, not by choice.
A governed control room on the same substrate: many surfaces, many operators, one stream of recording. Completion is proven by the receiving system’s own evidence record rather than the actor’s self-report, and a stale grab is visible rather than silently prevented. Working budget is sub-second glass-to-glass, anchored to remote-tower precedent instead of a marketing number.
Agent research today runs on snapshots — benchmarks, evals, and after-the-fact traces. A governed control plane produces something different: continuous, attributable, tamper-evident records of what an agent was told, what it knew, what it touched, and what happened next. That is a dataset the field does not currently have, and it is the substrate the adjudication research runs on.
Trust the byte, not the summary.A pointer is not proof. Every load-bearing claim resolves to its source, at a pinned reference — never to a description of it.
Fail loud.An unresolved guarantee is treated as unavailable, not quietly patched over. Divergence is an alarm, not a detail.
The checker is not the claimant.The system that does the work cannot grade its own work. Verification authority is held apart from the thing being verified.
Moonwalker is being built for government and enterprise. Early conversations with operators and design partners are open now.