Endoskeletal

Describe the company. Let it run.

Endoskeletal is a language for describing a software company precisely enough that people, programs and AI agents can run it together. You write who holds which seats, what the company wants, which rules are in force and who may change them. The compiler checks it, explains it back in plain English, and draws it as the org tree and circuits you see below.

module northwind.core @ 1.0.0  import lib.org         @ 2.* as org  import lib.agents      @ 1.* as ag  import lib.realization @ 1.* as rz scope Northwind : org.Organization {  persona NorthwindCo   position CEO : org.Owner {    cardinality 1  }   position VPEng : org.Officer {    cardinality 1  }   scope Platform : org.Team in Northwind {    position OnCall : org.Member {      cardinality 2..    }     position Deployer : org.Member {      eligible when self is ag.Program    }  }   scope Product : org.Team in Northwind {    position PM : org.Officer {      cardinality 1    }     position Triage : org.Member {      eligible when self is ag.ModelBased    }  }   intent ApiUp : org.SLO {    maintain holds ops.availability(Api) >= 99.95 %  hard  }   use rz.RealizationEnvelope(    holder      = Deployer,    requirement = Api,    operation   = eng.Deploy,    admissible  = c.risk = "low" and holds ci.passed(c)  ) as AutoShip   use org.Approval(    approver   = VPEng,    subject    = eng.Change,    threshold  = c.risk = "high",    deadline   = 4 h,    escalateTo = CEO  ) as Review}

What you write, what you get

A real circuit: the observability bill

A provider changes its log-ingest price and Northwind's observability bill heads 38 % over budget. Nobody files a ticket. Watch seven separate responsibilities resolve it: observation, finance, research, security, a council vote, platform and verification. Each act can only be performed by one seat, and one seat tries to act outside its role.

use fin.Budget(
  scope    = Platform,
  resource = econ.Money,
  limit    = 13_500 USD per month,
  reserve  = 1_000 USD,
  window   = month,
  orElse   = ops.Throttle(level = "debug")
) as ObsBudget

norm ProposeOnBreach {
  obligation of Architect to persona
  when holds fin.projected-breach(ObsBudget)
  aim within 5 d: occurred assert(arch.Proposal(_, Observability)) by Architect
}

use rz.ExperimentPower(
  holder   = Architect,
  pattern  = Experiment,
  budget   = 400 USD,
  duration = 7 d
) as Research

norm EgressReview {
  obligation of SecurityLead to persona
  when p is arch.Proposal and holds data.contains-pii(p.moves)
  aim within 3 d: occurred decide(clear | refuse, p) by SecurityLead
}

norm CouncilVote {
  power of InfraCouncil to decide vote-approve | vote-reject about arch.Proposal
}

norm BindObservability {
  power of CTO to bind | unbind _ about Observability
  when p is arch.Proposal
       and count decide(vote-approve, p) by InfraCouncil over 24 h >= 2
       and occurred decide(clear, p) by SecurityLead
  level collective
}

norm VerifyCutover {
  obligation of Verifier to persona
  when occurred execute(rz.CutOver(Observability, r))
  aim within 48 h: occurred derive(ops.coverage(r)) by Verifier
  or-else Rollback
}

position Architect : org.Member {
  eligible when self is ag.Autonomous
  incompatible with CTO, SecurityLead, Verifier
}

position Verifier : org.Member {
  eligible when self is ag.Program
  incompatible with Deployer
}

A compiler, pointed at an organization

A compiler turns something written for people into something a machine can run. Along the way it rejects programs that can't mean anything, infers what the programmer left unsaid, and chooses the cheapest of many equivalent instruction sequences for the exact chip in front of it. The programmer never picks registers.

Endoskeletal's compiler does the same jobs for a company. The program is the specification. The machine is everything available to run it: people, programs, models and providers, each with measured costs and limits. Two differences matter: it never stops compiling, because that machine changes every week, and it proposes but never binds, because an organization has to consent to what runs it.

What compilers have always done, and how each job maps to an organization.

You write the need. The compiler works out the rest.

A specification never names a vendor, a product or a model. Below is an enterprise audit trail declared with no properties at all. The compiler derives nine from the rules and intents around it, including three that design reviews routinely miss. It then tests 31 offers and 212 compositions against measured evidence, not against what providers say about themselves.

Four designs are equivalent, and none of them is the one an experienced architect would sketch first: a compliance-locked object store fed by a queue you already run; your search cluster plus an email-journaling archive; the customer's own bucket; and two ordinary stores whose root keys sit in seats the org chart declares incompatible. See all four, and how the engine chooses among them.

Watch it work through real situations

Four situations from one month at a SaaS company. Step through the log: each entry says who acted, in what capacity, and why the engine accepted, held or refused it. The strip above each log shows who carried the work at each step, a program, a model, or a person.

requires capability TicketTriage {
  operation triage(t : Entity) -> label : Claim
  property  accuracy            >= 0.9
  property  cost-per-invocation <= 0.10 USD
  for SupportResponsive
}

use rz.Crystallize(
  holder      = Architect,
  requirement = TicketTriage,
  promoteBy   = OpsLead
) as TriageCrystal

norm RotateExposed {
  obligation of Ops to persona
  when holds sec.exposed(k) and k is sec.Credential
  aim within 30 min: occurred execute(sec.Rotate(k)) by Ops
  or-else RotateByHand
}

use rz.RealizationEnvelope(
  holder      = Ops,
  requirement = Secrets,
  operation   = sec.Rotate,
  admissible  = holds sec.reissuable(a.k)
) as RotationEnvelope

use org.Approval(
  approver   = VPEng,
  subject    = sec.Revocation,
  threshold  = r.affects-customers,
  deadline   = 4 h,
  escalateTo = CEO
) as RevokeReview

use org.SegregationOfDuties(
  act      = decide(approve, c),
  subject  = eng.Change,
  separate = { c.author }
) as NoSelfApproval

use fin.Budget(
  scope    = Northwind,
  resource = econ.Money,
  limit    = 560_000 USD per month,
  reserve  = 40_000 USD,
  window   = month,
  orElse   = gov.Freeze(except = { Const.Materialize, SecurityDisclosure })
) as OpexBudget

use ev.TrustPolicy(
  source-kind = fin.BillingSource,
  base        = T,
  vocab       = { fin.forecast }
) as BillingTrust

use ev.ContestResolution(
  owner    = FinanceLead,
  vocab    = fin.forecast,
  deadline = 3 d
) as ForecastContest

use rz.RealizationEnvelope(
  holder      = Ops,
  requirement = Search,
  operation   = ops.Scale,
  admissible  = holds fin.headroom(OpexBudget) >= a.delta
) as SearchEnvelope

norm ReviewCode {
  power of Platform.Reviewer to decide approve | reject about eng.Change
  when c.repo in Platform.repos
}

norm Reassign {
  obligation of VPEng to persona
  when unknown org.owner(k) and k is Commitment
  aim within 1 d: occurred assign(k, _) by VPEng
}

Ten kinds of thing

Every specification compiles to records of ten kinds. Teams, workflows, tickets, approvals, budgets, KPIs, databases, agents and LLMs are configurations of these ten.

Four ideas that make it work

• The log is the only state. Who holds what, which commitments are open, which facts hold, which provider is bound: all computed from one append-only, bitemporal log. Any past moment can be rebuilt exactly.
• Authority is computed. Every act is checked against the powers in force for that party, in that seat, at that instant. An act without authority is recorded as a misfire and changes nothing.
• Unknown is a first-class answer. Facts are four-valued and evidence expires. Nothing unknown is ever treated as true, and every unknown gets an owner.
• Learn once, apply everywhere. What one organization proves about a provider, a pattern or a distilled piece of judgment can be published as evidence and imported by others, under their own trust rules. How pooling works.

Built for software companies