Estimate a band from a direct metric or a proxy metric (with a reasoning chain), driven by caller-supplied band boundaries.

Dependency-free Toulmin argumentation primitives for attaching structured, auditable reasoning to any automated decision.

Maker-checker sign-off fields + append-only audit/decision ledger + a domain-neutral sign-off policy for gating high-blast transitions.

A checksum-tracked, resume-on-failure SQL migration runner: applies *.sql in lexical order, skips applied files, aborts on post-apply drift, resumes after a partial failure — over an injectable DB adapter.

A dataclass guard: a record physically cannot enter a consequential status without a human verbatim sign-off, with an __setattr__ rollback that closes the in-memory bypass window.

A single dispatch chokepoint that makes every agent/tool call tenant-bound, sign-off-gated, source-secret, provenance-stamped, and append-only audited — by composing five small primitives.

Four degrade-open OWL governance checks — OWL-RL consistency, SHACL conformance, SPARQL competency questions, and disjointness audit — over any caller-supplied ontology, with no domain baked in.

A default-safe bring-your-own-integration provider pattern: an abstract Provider over a generic Message, a registry whose test-mode gate returns a NullProvider before the registry is ever consulted, and typed auditable suppression instead of silent drops.

A multi-tenant Postgres data plane where tenant isolation (dual-path RLS), append-only auditability, and migration governance are structural invariants enforced at the DB + a CI coverage gate — composed from five small primitives.

An enforcing pre-commit / pre-tool-use gate that blocks ontology + config edits on SHACL non-conformance, missing/substanceless sign-off, and unmet phase prerequisites — advisory / enforce / override modes, injectable seams, degrade-open.

A default-safe transactional message dispatcher: test mode is on unless the literal 'false' opts into production, non-allowlisted recipients are redirected before any send, a format gate rejects malformed addresses, and the network send is an injectable transport (dry-run by default).

Host one MCP server for many tenants over streamable-HTTP with bearer tenant-API-key auth — the authenticated tenant overrides any client-supplied tenant id (the isolation invariant).

A tiny, stable four-dimension provenance tag schema (scope / signal_type / attribution / uncertainty) with caller-supplied vocabularies.

Explainable, config-driven, zero-ML decisioning: an ordered rule cascade where every output carries a Toulmin argument and optional ML advisors can annotate but never change the verdict.

Stamp tool/RPC responses with a Toulmin + 4-tag provenance envelope, and MECE-triage a tool surface with an anti-inflation drift gate.

Per-channel outbound compliance gates — LinkedIn cadence, WhatsApp 24h window, SMS TCPA quiet hours, social-DM rate caps — that fail closed before an outbound action is dispatched, with the only network I/O behind an injectable transport seam.

A fail-closed preflight engine for automated outbound actions: seven independent gates (format, legal footer, send-window, do-not-contact, recipient-issue, cadence, idempotency) that default to BLOCK/DEFER when their evidence is missing or their infrastructure fails.

An embeddable in-app coaching/nudge engine: event->category routing, a 6-layer suppression model, multi-axis gating, isolated pluggable personas, swappable delivery adapters, and a pluggable repository.

Deterministic OWL-extension → typed JSON config generator: extract named subclasses + individuals of caller-bound classes into per-binding config files. Domain-neutral; rdflib is lazy + degrade-open.

JWT-claim multi-tenancy for FastAPI + Postgres RLS: JWKS-cached ES256 / HS256 verification and SET LOCAL tenant-context binding, with the crypto/HTTP/driver backends behind injectable seams.