Queldrex is built as a government
Not a scanner and not a vendor of alerts. An institution that governs the actions AI agents take, and is itself accountable through a record no one can rewrite. A government makes rules, enforces them, judges what happened, keeps the record, and answers for it. A system that only detects and blocks is policing, and policing without adjudication, record, or appeal is not legitimate authority.
One precise choice runs through all of it: we govern actions, not agents. An AI agent cannot consent and cannot be held responsible, so we bind each governed tool call to the accountable operator instead, and scale oversight to how much autonomy the agent was given. That is the form the emerging literature on separation of powers for AI is converging on, and it is why this institution is complete within its honest limits even though it can never govern an agent that never routed through it.
The organs
Legislature
Owns: Declares the rules.
Cannot: Makes no decision about any specific case.
A corpus of citable laws, each with a permanent id, plain-language text, a rationale you can argue with, the ruleset version it came into force under, and whether a finding under it can be contested. A rule you cannot read is one you cannot comply with, so the whole corpus is public.
Executive
Owns: Applies the rules to actions.
Cannot: Cannot write them.
Enforcement runs inside your own process as a zero-dependency package. Every allow, require-approval, or deny is reachable deterministically with no model call, and each decision now names the law it was made under, so a record reads "decided under QX-L-0004" instead of just "decided".
Judiciary
Owns: Determines what happened, assigns proportionate consequence, hears challenges.
Cannot: Cannot change the rules to fit the case.
Pending decisions route to a human, and each one now names the law it was made under so a challenge can contest something specific. A contestable finding can be appealed from the console; overturning it records a signed exoneration on the same ledger that carried the accusation, as visibly as the original finding, and re-pins the version. The original is answered, never erased. A tripped canary stays not-contestable at decision time, and the appeal path says so rather than opening a case that could not succeed.
Archive
Owns: Keeps the record. Answers to nobody, including us.
Cannot: Cannot quietly rewrite what it already recorded.
Each decision produces an Ed25519 receipt a third party can verify offline, with no Queldrex account and without trusting this page. Blocks are sealed to a hash-chained ledger. A Merkle commitment over that ledger lets anyone prove a specific record is included, seeing only sibling hashes, and a consistency proof lets anyone confirm the log only ever grew, that nothing already recorded was removed, reordered, or rewritten. Both verify offline with our published package. The ledger head is now timestamped daily at an independent authority, so even we cannot back-date or rewind a root a third party already witnessed. A public transparency-log anchor (Rekor) is the fuller version still to come.
Constitution
Owns: The shared standard that binds Queldrex too.
Cannot: Cannot exempt its own author.
The open Trust Receipt spec and the published npm verifier are how anyone holds us accountable without our permission. It was built first, which is the correct order: the way to check us existed before the thing being checked.
Rights of the governed
You can read every rule before you are judged by it, and a stricter rule shipped tomorrow does not make yesterday's receipt a lie.
A decision names the law it was made under. The full reasoning goes to the record and the account owner, never to the agent being governed, which would be a map for an attacker.
Contest a specific ruling from the console and have a reversal recorded as visibly as the accusation, on the same tamper-evident ledger, verifiable offline. The original finding is answered, not erased. A finding a human can overturn on the record is safer to make than one that cannot.
Consequences are graduated and recoverable before they are permanent. There is no automated action at the scope where a wrong decision would take a whole fleet offline at once.
We commit to the record, never to your payloads. A Merkle commitment over the ledger lets anyone prove a specific entry exists and was not altered, seeing only sibling hashes. Your operations stay yours; only the commitment is permanent.
We measure our own judge for drift and publish it. The deterministic layer scores the whole corpus repeatedly with zero verdict variance, and every change across ruleset versions is attributable to a named, dated rule rather than to silent drift. This is the piece almost nobody does.
Restraints on our own power
An institution is defined as much by what it refuses to do. These are limits on Queldrex, not on the governed.
- ✕No automated denial at the scope where a wrong decision would take a whole fleet offline. The maximum autonomous action there is to require a human, plus an alert.
- ✕No false receipts, ever. In an institution whose entire value is that the record says what happened, a deliberately false record is disqualifying.
- ✕No pooling of one customer's behavior against another's. Baselines are per-customer and self-referential, and saying so plainly is an honesty asset.
- ✕No explaining the tripped rule back to the agent. Reasons go to the record and the owner. An API that explains itself is one an attacker binary-searches.
- ✕No unsolicited public grading of anyone until funded legal review exists. We publish what someone asked us to publish about themselves.
Where this sits in the field
We did not invent these ideas, and pretending otherwise would fail the first thing this institution is built on: being checkable. Each governed agent is a non-human identity with a scoped set of permissions, and the structure below has real prior art. What we bring is that it is shipped, commercial, and verifiable, not a proposal.