# A11oy Research & Reference Lineage ## Purpose This document traces which open-source projects and publications influenced A11oy's design, what specific idea each contributed, and how we re-implemented it in our own voice. --- ## Agentic AI Runtimes & Orchestration ### Anthropic Constitutional AI / Responsible Scaling Policy - **Link**: https://www.anthropic.com/research/constitutional-ai-harmlessness-from-ai-feedback - **Idea borrowed**: The notion of a constitution as a hierarchical set of principles that govern model behavior at inference time, not just training time. - **Our implementation**: A11oy's Constitution is a runtime-enforced contract, not just documentation. Every agent action cites which article it honored or refused. We extended this with the new **Adversarial Covenants** chapter (Article IX) that governs what the predictive swarm is allowed to simulate — matching Anthropic's responsible scaling commitments but in an operational, proof-chained form. ### Anthropic Mythos / Agent Research - **Link**: https://www.anthropic.com/research (agent architecture papers) - **Idea borrowed**: Structured tool use, multi-step reasoning with intermediate artifacts, and the idea of a "proof chain" that lets humans audit each reasoning step. - **Our implementation**: Praxis (A11oy's AI assistant) emits a proof packet for every answer — model, lane, latency, cost, tool calls, trust score. The Praxis toolbar implements named first-class actions (Analyze, Search the Web, GitHub) rather than unlabeled icons. ### LangGraph (LangChain) - **Link**: https://github.com/langchain-ai/langgraph - **Idea borrowed**: Cyclical graph-based agent workflows where state is passed explicitly between nodes, enabling loops, branches, and human-in-the-loop checkpoints. - **Our implementation**: A11oy's Playbook Engine uses a similar node graph model (trigger → action → decision → gate → HITL → remediation) but adds covenant policy enforcement at each node boundary. Every policy-gated node produces a proof ledger entry. ### Microsoft AutoGen - **Link**: https://github.com/microsoft/autogen - **Idea borrowed**: Multi-agent conversations where specialized agents collaborate, with a human-proxy pattern for HITL integration. - **Our implementation**: A11oy's Swarm Orchestrator assembles agent pools with explicit role assignments, bilateral scope approval for cross-agent tool sharing, and intelligence compartmentalization. The "governed adversary loop" in the Predictive Defense Cortex adapts AutoGen's multi-agent pattern with constitutional covenant gates. ### CrewAI - **Link**: https://github.com/joaomdmoura/crewAI - **Idea borrowed**: Task decomposition across a crew with defined roles — analyst, researcher, writer. Sequential and parallel task execution with crew-level context sharing. - **Our implementation**: The Swarm Orchestrator's mission model (each agent has a role, progress bar, and inter-agent intelligence graph) is inspired by CrewAI's crew concept, but adds proof-ledger logging for every intelligence-sharing event. ### OpenDevin / SWE-agent - **Link**: https://github.com/OpenDevin/OpenDevin - **Idea borrowed**: Agentic code execution with sandboxing, environment state, and iterative action-observation loops. - **Our implementation**: A11oy's Praxis GitHub tool operates in a read-only inspection mode — it can search repos and pull file context but cannot write code without explicit HITL approval, honoring Article II of the Constitution. ### Letta (MemGPT) - **Link**: https://github.com/cpacker/MemGPT - **Idea borrowed**: Agents with hierarchical memory — in-context, archival, and recall — enabling persistent, long-running agent identities. - **Our implementation**: A11oy's memory layer separates agent working memory from the archival proof ledger. The Adversary Swarm agents maintain per-run memory of the digital twin's state while their outcomes are persisted in the cortex prediction database. ### DSPy - **Link**: https://github.com/stanfordnlp/dspy - **Idea borrowed**: Declarative, optimized prompt programming — signatures, modules, and automatic optimization. - **Our implementation**: A11oy's model router uses a lane-based dispatch (fast / sovereign / reason / code) that mirrors DSPy's module philosophy. Each lane has its own signature and the router optimizes selection based on cost, latency, and trust requirements. ### smolagents (Hugging Face) - **Link**: https://github.com/huggingface/smolagents - **Idea borrowed**: Minimal, auditable agent loops with code execution as a first-class tool. - **Our implementation**: A11oy's tool boundary enforcement (connector firewall + MCP token scoping) mirrors smolagents' philosophy of small, auditable tool surfaces. We extended it with zero-trust credential rotation. ### Mastra - **Link**: https://github.com/mastraai/mastra - **Idea borrowed**: TypeScript-native agentic framework with built-in memory, tracing, and integration connectors. - **Our implementation**: A11oy's TypeScript-first architecture and the proof chain API shape are inspired by Mastra's developer experience. Our implementation adds governance gates not present in Mastra. --- ## Frontier Safety & Governance ### NIST AI Risk Management Framework (AI RMF) - **Link**: https://airc.nist.gov/docs/AI_RMF_Playbook.pdf - **Idea borrowed**: GOVERN → MAP → MEASURE → MANAGE lifecycle with organizational accountability for AI risk. - **Our implementation**: A11oy's four governance primitives (Constitution, Approval Queue, Proof Ledger, Model Router) directly mirror the RMF quadrant. The Constitution is the GOVERN layer; the Proof Ledger is the MEASURE layer. ### MITRE ATLAS - **Link**: https://atlas.mitre.org/ - **Idea borrowed**: A structured adversarial ML threat catalog analogous to ATT&CK but for AI systems. 84 techniques across the ML attack lifecycle. - **Our implementation**: A11oy's ATLAS Shield surface maps each of the 84 techniques to a specific defense layer. The Adversary Swarm agents are each loaded with ATLAS technique profiles. ### OWASP LLM Top 10 / Agentic Security Initiative - **Link**: https://owasp.org/www-project-top-10-for-large-language-model-applications/ - **Idea borrowed**: Prompt injection, insecure output handling, overreliance, training data poisoning — the canonical risk taxonomy for LLM deployments. - **Our implementation**: A11oy's ATLAS Shield OWASP Agentic section maps all 10 risks to specific runtime controls. Agent Zero Trust's MCP token scoping directly addresses OWASP A01 (Prompt Injection) and A06 (Excessive Agency). ### AISI Evaluation Methodology (UK AI Safety Institute) - **Link**: https://www.gov.uk/government/publications/aisi-approach-to-evaluations - **Idea borrowed**: Structured capability evaluations before deployment, with defined threat scenarios and red-teaming protocol. - **Our implementation**: A11oy's MirrorEval and the Alignment Review Gate are modeled on AISI's eval methodology — structured dimensions, threshold gates, mandatory re-evaluation on model substitution (Article VI). --- ## Predictive Defense Cortex — Specific Lineage ### Swarm-vs-Twin Pattern - **Inspired by**: Caldera's adversary emulation architecture (MITRE) + OpenAI Swarm's multi-agent coordination - **Our twist**: Runs faster than wall-clock time in a sandboxed digital twin. Governed by Adversarial Covenants (Article IX) throughout. Every swarm step produces a proof packet. ### Prediction Ranking Model - **Inspired by**: Elastic Detection Rules' severity × confidence scoring + Velociraptor's threat hunt scoring - **Our twist**: Likelihood × Impact × Time-to-Exploit triple-factor ranking mapped to both ATT&CK and ATLAS techniques, with forward-looking horizon windows (24h / 72h / 168h). ### Pre-emptive Countermove Proposer - **Inspired by**: TheHive + Cortex's automated response playbooks + Iron Dome's layered intercept doctrine - **Our twist**: Every countermove is a covenant-gated Approval Queue item with the constitutional clause cited. The operator approves or denies from inside Sentra; the decision flows into a11oy's proof ledger. ### Adversarial Covenants (Article IX) - **Inspired by**: Anthropic's Responsible Scaling Policy's capability thresholds + NIST AI RMF's GOVERN layer - **Our twist**: Machine-readable covenant DSL clauses that govern what the swarm can simulate, what countermoves it can stage, and what evidence threshold triggers pre-emptive action. Fully editable, versioned, with diff history.