Skip to content

PLATFORM · THUNDERLINE SUBSTRATE

We built the governed substrate
so you don't hand-roll it.

If you are building an agent stack today, you end up maintaining ad-hoc guardrails, unhashed receipt tables, and auth boundaries that fail open. Thunderline provides the policy gate, action law, 17-field receipt sealing, and lineage graph in one OTP substrate.

Read the 10 code snippets See the receipt spine → Walk through a governed workflow →

ACTION LAW & CAPABILITY TIERS

Four capability tiers. Zero implicit elevation.

Every action in Thundercrown.Actions.Catalog declares one of four capability tiers. PolicyGate.validate_and_execute/2 checks the caller's explicit grant before dispatching to any of the 42 executor modules.

Tier 01 · :read

:read — Scoped Observation

Inspect workspace state, query lineage graphs, and read permitted context without mutating world state or triggering external side effects.

Tier 02 · :mutate

:mutate — Bounded State Change

Propose and persist changes to workspace artifacts, memory nodes, or mission steps inside the ThunderBlock's transactional boundary. Always emits an ActionReceipt.

Tier 03 · :admin

:admin — Policy & Grant Governance

Modify workspace roles, approval thresholds, and boundary rules. Restricted to human operators or explicitly delegated governance executors; never inferred from telemetry actors.

Tier 04 · :execute

:execute — Hermetic & External Effect

Run untrusted skills inside a zero-import K1WasmCell (wasmtime NIF with fuel and wall-clock bounds) or invoke approved external connectors after explicit policy sign-off.

13-DOMAIN SPINE SUMMARY

The 13 domains of the Thunderline spine.

Thunderline partitions runtime responsibilities across 13 explicit domains so authority, memory, transport, and execution never blur into a single unvalidated namespace.

  1. 01 · Thundercrown — Authority, capability grants, PolicyGate, and the 42 action executor modules.
  2. 02 · Thundervine — Lineage graph persistence, LineageEdge seal hashing, and causal provenance queries.
  3. 03 · Thunderblock — Managed workspace unit, cell lifecycle, and K1WasmCell hermetic skill execution.
  4. 04 · Thunderlink — Inter-component transport and per-message MessageReceipt.seal/2 binding (step_id, domain, action_id).
  5. 05 · Thunderflow — Mnesia-backed EventBus and workflow stage routing under back-pressure.
  6. 06 · Thundermem — Durable episodic and semantic working memory scoped per ThunderBlock.
  7. 07 · Thundervault — Credential custody, secret references, and key-isolation boundaries.
  8. 08 · Thundergate — Ingress/egress membrane enforcement and external connector policy checks.
  9. 09 · Thundergrid — Multi-cell scheduling, placement, and supervision across ThunderBlock nodes.
  10. 10 · Thunderwave — Deterministic tick propagation and burst coordination across local rules.
  11. 11 · Thunderlens (Prism bridge) — Read-only operator projection, telemetry formatting, and receipt inspection feeds.
  12. 12 · Thundercomsec — Traffic-budget monitoring and recommendation-only anomaly signaling.
  13. 13 · Thundercore — Shared canonical serialization, SHA-256 seal primitives, and invariant types.

POLICY GATE + ACTION LAW

Why authz_actor and telemetry_actor are separate.

A common failure mode in agent platforms is trusting the reporting agent's metadata as the authorization principal. In Thunderline, the authorization principal (authz_actor) is bound at the policy gate and sealed into the 17-field ActionReceipt alongside—but never substituted by—the telemetry reporter.

See PolicyGate code in /docs Explore 3D Substrate Scene →

EXECUTION INVARIANT

Caller (Human | Agent)
  │
  ▼
Thundercrown.PolicyGate.validate_and_execute(action, ctx)
  ├─ 1. Verify capability tier (:read | :mutate | :admin | :execute)
  ├─ 2. Resolve EvidenceRefs & bind authz_actor
  ├─ 3. Dispatch to 1 of 42 Crown Executors
  ├─ 4. Compute 17-field @seal_fields SHA-256 ActionReceipt
  └─ 5. Persist LineageEdge & cross-verify (verify_persisted_edge/4)