HELM Architecture Brief
Models propose. HELM governs execution. Every allowed, denied, or escalated decision leaves a signed receipt.
Mechanism
Each point is intentionally narrow: HELM controls execution before the side effect, records the decision, and keeps public proof separate from private customer context.
The risk is not that a model wrote a bad sentence. The risk is a proposed action reaching a tool, connector, data store, release path, or customer channel without a separate authority check.
HELM treats model output as a proposal. Policy Enforcement Point and Capability Policy Interface checks decide whether the action is allowed, denied, or escalated before the side effect.
The boundary checks actor, action, scope, connector, approval state, risk tier, and evidence. Missing authority fails closed or routes to review.
The receipt records the proposed action, policy, verdict, timestamp, proof inputs, and the canonicalized payload hash needed for later verification.
Receipts, ProofGraph edges, and EvidencePacks give reviewers a bounded way to inspect what happened without turning private company context into public proof.
The company layer connects artifacts, GeneratedSpecs, approvals, integrations, and review queues. It does not weaken the kernel boundary or make raw context into authority.
Engineering specs can cite pinned commits, CodeIndexReceipts, CodeImpact reports, affected tests, write scope, and closure diff checks without making the graph execution authority.
OrgDNA is intake. OrgGenome authority requires review, deterministic mirror, simulation, P0 ceilings, approval, attestation, and receipts.
Night Shift and business-function packs create proposals, run only low-risk allowlisted work, escalate risky work, deny forbidden work, and write closure evidence back.
HELM governs command gateways only where connector contracts, safety profiles, telemetry, approvals, jurisdiction boundaries, and EvidencePacks exist.
Unsupported robot, factory, entire-company, ERP replacement, and engineer replacement claims stay forbidden unless real source-backed evidence upgrades the matrix.
The useful first conversation names the side effect, required approval, connector scope, evidence need, failure state, and receipt a reviewer would accept.
Proof path
The OSS kernel is the public execution boundary. The Company AI OS layer is reviewed access because it involves real company workflows, integrations, approvals, and evidence needs.