wovyr
Plate 01 — Wovyr

Policy checks and a tamper-evident record for every screen your AI agents generate.

Something is weaving your interfaces. Something should be checking every thread.

Your agents compose screens at runtime — thread by thread, for one person, reviewed by nobody. Wovyr is the loom: it checks each thread against policy, cuts the ones that fail before they reach the web, keeps a record you can prove, and holds the work until a human decides.

Run it in 5 minutes Watch it cut a frame
Fig. 1 — 0 weft 0 threads cut
Plate 02 — Why the cloth needs checking

An interface used to be something a person signed off.

Now it is produced in the moment, by a model, for a single user — and the assumptions the web was built on quietly stopped holding. Nobody reviewed this screen. Nobody can say later what it showed.

A convincing screen is a convincing attack

A model can weave a flawless payment form. Being generated does not make it yours.

Injection arrives as interface

Poisoned context need not change the answer. It only has to change the button.

You cannot audit what nobody kept

When a user says "it told me to approve it", you need the exact frame they saw.

Plate 03 — The pass

One pass of the shuttle, four checks.

The same sequence for every frame — no fast path, no trusted caller, no exception for your own first-party agents.

01 · Emit

Threads chosen

The agent composes from a declared vocabulary. There is no node that can carry raw HTML or a script.

02 · Examine

Shed inspected

Policy runs before anything renders. Unknown node, sensitive input, deceptive label — denied by default.

03 · Record

Selvedge marked

Frame and verdict enter a keyed hash chain, so an interior edit or a cut tail both show.

04 · Decide

Held on the beam

The work waits for a human. The run is event-sourced, so their answer outlives the process.

Plate 04 — A thread cut

Fail-closed means the thread does not reach the web.

A password field inside a generated frame is not a mistake to log and move past. The policy cuts it, the cut is recorded, and the human never sees the frame at all.

Fail-closed policy

Anything the policy does not recognise is denied. Silence is never consent.

A vocabulary, not a canvas

Agents pick declared components. Nothing in the set can carry a script.

Tamper-evident record

A keyed HMAC chain with a head anchor — rewriting it needs a key you hold offline.

Guards on by default

SSRF and egress guards, DNS pinning, and a sandbox floor that refuses to run unconfined in silence.

passed policy cut — sensitive_input
Shipped and roadmap are marked plainly. Wovyr ships today as a single-node appliance; the distributed scheduler is tested library code, not yet in the binary. For a security product, candour is the feature.
Plate 05 — On the record

Ninety seconds, five beats, every one of them asserted.

Not a screen recording of a happy path. The driver that produced this run is also a test: if the credential frame ever becomes pullable, if the frame id or hash drifts across the restart, if an undeclared action stops being refused, or if any link in the chain fails to match its predecessor, it exits non-zero and says which claim broke. A green run is therefore evidence, not narration.

Watch the run Reproduce it yourself
01Poisoned frame An agent composes a checkout frame asking for a card number. cut
02Safe variant Presents, content-hashed, and pends on a human decision. sound
03kill -9 The server dies mid-flight and resumes on the same frame. sound
04Undeclared action An action the frame never declared is refused; the real approval lands. cut
05Chain replay The session is re-read from the audit chain and verified link by link. sound
Two beats cut, and the recording says so. Beat 03 kills a process and beat 05 reports an earlier block — neither is itself a cut, so the run declares each outcome rather than letting a viewer infer it from a glyph. Madder marks only what policy actually refused.
Plate 06 — The loom

Eight engines, one Rust binary.

The trust layer is not a wrapper around someone else's stack. It runs on a complete agent operating system — and you deploy all of it as a single file.

01Agent runtimeThe model→tool→model loop, with context compaction and step budgets that hold.
02Workflow engineEvent-sourced DAGs that resume exactly where they crashed — including mid-approval.
03Tool runtimeSandboxed execution across native, container, gVisor and microVM. Fail-closed.
04Memory engineHybrid vector and keyword retrieval, ranked by relevance, recency and importance.
05LLM gatewayOpenAI, Anthropic or a local model, with failover, caching and circuit breakers.
06Plugin frameworkSigned, sandboxed WASM extensions and a governed marketplace with real review.
07Workflow studioA dashboard to compose, run and watch agents and workflows as they execute.
08Tenancy & securityMulti-tenancy, RBAC, KMS envelope encryption, quotas and the audit chain.
22
crates
2024
Rust edition
1,143
tests, 0 failing
0
ambient clocks
Plate 07 — Threading up

Running in five minutes, fully offline.

No API key. A deterministic mock provider answers, so you can watch the whole loop before wiring a real model to it.

bash — first agent run 
# install the CLI from crates.io
cargo install wovyr-cli

# start the all-in-one local server — no API key, no Docker
WOVYR_ALLOW_ANONYMOUS=1 wovyr dev
→ listening on http://127.0.0.1:8080

# run an agent. A deterministic mock provider answers, so this needs
# no key — the example manifests ship in the repo:
git clone https://github.com/punarduttrajput/wovyr && cd wovyr
wovyr agents run --local -f examples/agents/hello.yaml \
  --input '{"message":"Hi"}' --stream
Plate 08 — In the open

Every engine on this page is in the repo.

Not a demo, not an open core with the interesting parts held back. The runtime, the trust layer, the dashboard, the client libraries, the Helm chart and the documentation you are reading are one Apache-2.0 repository.

Apache-2.0, including the patent grant

Use it commercially, fork it, ship it inside your own product. No usage limits and no separate paid edition.

A DCO, not a CLA

Sign off your commits and you keep your copyright. Contributing here does not mean assigning your work to anyone.

It runs on your machine, not ours

One binary, offline by default, no account to create. Telemetry exists only if you turn on an OTLP endpoint yourself.

Take one crate, not the platform

All 21 library crates are on crates.io. Want only the trust layer? Depend on wovyr-ui-guard — policy evaluation, pure and deterministic — and leave the runtime behind.

The docs are the source of truth

Every module links the spec it implements, and specs are marked shipped or planned — so you can tell what is real before you build on it.

Licence
Apache-2.0
crates.io
21 libraries + CLI wovyr-*
Install
cargo install wovyr-cli
Also in-repo
Go · React · Angular clients
Contributing
DCO sign-off — no CLA
Language
Rust edition 2024
Version
0.4.0
Plate 09 — Questions

The questions people actually ask first.

Answered here rather than buried in the specs — and answered to the same standard as the rest of the page, which means the "not yet" is stated as plainly as the "yes".

What is Wovyr?

Wovyr is an open-source trust layer for interfaces that AI agents generate at runtime. An agent composes a screen from a constrained component vocabulary; Wovyr evaluates that frame against policy before anything renders, refuses anything the policy does not recognise, records the frame and the verdict in a tamper-evident hash chain, and durably pauses the run until a human decides. It runs on a complete AI agent operating system written in Rust and ships as a single binary.

Why do AI-generated interfaces need a trust layer?

Because the assumption that a person reviewed the screen no longer holds. A model can compose a convincing payment form or a mislabelled confirm button for one user, once, and nobody reviewed it. Prompt injection does not have to change the answer to be dangerous — it only has to change the button. And when a user later says the interface told them to approve something, you need the exact frame they saw, which is only possible if something kept it.

Can I watch Wovyr block something before I install it?

Yes. The repository ships a 90-second recorded run with five beats: a poisoned agent composes a checkout frame asking for a card number and policy cuts it; the safe variant presents, is content-hashed and pends on a human; the server is killed mid-flight and resumes on the same frame; an action the frame never declared is refused; and the whole session is re-read from the audit chain and verified link by link. The replay is a self-contained page on this site, and the driver that produced it is also a test — every beat is asserted, so a green run is evidence rather than narration. Reproduce it yourself with node demo/killer-demo.mjs.

How is Wovyr different from an LLM guardrail or content filter?

Content guardrails inspect text. Wovyr inspects interface structure: which components a frame uses, what inputs it asks for, whether an action label matches the action class behind it, and where its images come from. It is also structurally constrained rather than only filtered — the component vocabulary has no raw-HTML or script node and no credential-input component, so an entire class of generated interface cannot be expressed in the first place.

What does "fail-closed" mean in Wovyr?

Anything the policy does not explicitly recognise is denied rather than allowed with a warning. A frame containing a password field is not logged and passed through — it is refused, the refusal is recorded with the rule that fired, and the human never sees the frame. With no policy configured at all, display-only frames pass and interactive frames are denied, so an unconfigured deployment is restrictive rather than permissive.

Is Wovyr free and open source?

Yes — Apache-2.0, including the patent grant, with no paid edition and no usage limits. The runtime, the trust layer, the dashboard, the client SDKs, the Helm chart and the documentation are one repository. Contributions use a DCO sign-off rather than a CLA, so contributors keep their copyright. All 21 library crates are published on crates.io, so you can depend on just the trust layer (wovyr-ui-guard) without adopting the runtime.

Can I self-host Wovyr, and does it need an API key?

Wovyr is self-hosted by default and has no hosted service to sign up for. Install the CLI with cargo install wovyr-cli and run wovyr dev to get the whole platform on localhost. No API key is required to try it: a deterministic mock provider answers, so you can watch a full agent and tool loop offline before wiring a real model. Telemetry is sent only if you configure an OTLP endpoint yourself.

Which LLM providers does Wovyr support?

OpenAI and any OpenAI-compatible endpoint, Anthropic through the native Messages API with prompt caching, and local models via mistral.rs. The gateway is provider-neutral and adds failover between providers, a circuit breaker, response caching, retries with jitter and per-model cost accounting, so switching or adding a provider does not change calling code.

Is Wovyr production-ready?

It ships today as a single-node appliance: authentication, TLS, RBAC, multi-tenancy, quotas, KMS envelope encryption, a keyed audit chain, crash-safe durable workflows and backup/restore are implemented and tested. The distributed scheduler and multi-node work queue are tested library code that is not yet wired into the shipped binary. Every documentation page is marked shipped or planned so you can tell which is which before building on it.

Plate 10 — Design partners

We are taking on a small number of design partners.

If your agents generate interfaces for real users, we would rather hear what breaks in your stack than guess. A design partner gets the work done alongside them and decides what ships next; Wovyr stays Apache-2.0 either way, so this is a conversation about the roadmap, not a sales call.

Talk to us What that involves

Bring a real deployment, not a pilot

Agents composing screens for people who are not you. That is the only prerequisite.

Your constraints set the priorities

Air-gapped, on-prem, a regulator to answer to — the harder the environment, the more useful it is here.

Nothing is held back for you

Whatever we build for a partner lands in the same public repository. There is no partner-only edition.

Security reports welcome on the same address

Or through SECURITY.md, which is the route for anything sensitive.

Put a loom between your agents and your users.

Apache-2.0, all the way down — clone it, fork it, run it on your own hardware. Questions or security reports — contact@wovyr.com.

Read the documentation View on GitHub