HELM AI Enterprise

The loop from company work to proof.

HELM reads company and code work, finds gaps, drafts specs for review, routes approved actions through PEP/CPI, writes proof back, and summarizes recurring Night Shift work without making the report source truth.

Define the loop terms
CompanyArtifactGraph
A source-backed map of company work, like tickets, docs, calls, PRs, and receipts.
TruthConflict
A mismatch between what one source says and what another source proves.
DriftSignal
A warning that work is moving away from the plan or policy.
GeneratedSpec
A draft work plan made from sources. It is not approved yet.
CPI
The check that validates a plan before HELM lets it continue.
PEP
The boundary that enforces the decision before a tool call runs.
ProofGraph
A record chain that helps replay and check what happened.
EvidencePack
A small bundle of records used to verify one event or review path.
Night Shift
A recurring governed loop that ingests signals, proposes work, runs only low-risk allowlisted actions, and reports evidence.
Code Intelligence Graph
A read-only map of code files, symbols, routes, calls, tests, and impact.

Operating loop

Each step moves work closer to a reviewed action, not around review.

  1. Ingest company artifacts Meetings, decisions, tickets, PRs, commits, deployments, customer notes, specs, receipts, and EvidencePacks enter with source and permission data.
  2. Build CompanyArtifactGraph Artifacts become a source-backed graph. The graph makes work visible. It does not approve action.
  3. Query company state Answers say if they are draft, canonical, disputed, stale, or unavailable.
  4. Compare should-vs-is HELM compares what should happen with what is happening.
  5. Emit TruthConflicts and DriftSignals Conflicts and drift become review items, not automatic action.
  6. Generate source-backed specs GeneratedSpecs include goals, evidence, risk, approvals, connectors, and receipt needs.
  7. Route approved action through PEP/CPI CPI checks the plan. PEP gates the side effect. Missing authority fails closed.
  8. Record Receipt / ProofGraph / EvidencePack The decision, policy, evidence, and proof needs are recorded for review.
  9. Close the loop with evidence Closure evidence shows which gap changed and what proof remains.
  10. Summarize the morning report Night Shift reports cite receipts and EvidencePacks. The report is a summary, not source truth.

Recurring operation

Digital, analog, and kinetic examples use the same authority boundary.

Low-risk allowlisted work can run only inside explicit policy. Risky work escalates. Forbidden work denies. Simulator-labeled physical gateway examples stay labeled as simulator proof.

Digital

Engineering GeneratedSpec proposes a PR. Serious SaaS Mode requires CodeIndexReceipt, CodeImpact, affected tests, CI, rollback, and closure diff within write_set.

Analog

Support proposes a bounded refund. Small allowlisted refunds may ALLOW with receipt; high-risk refunds ESCALATE; forbidden refunds DENY.

Kinetic

AMR mission gateway receives a simulator-labeled mission. Missing safety profile DENYs; approved mission needs safety, telemetry, emergency halt readiness, and command/outcome receipts.

Concrete example

A promise gap becomes a reviewed action.

Customer promise gapartifact to receipt
StageWhat changes
ArtifactA customer promise and a release ticket disagree about what will ship this week.
Review itemHELM emits a TruthConflict so a human can decide whether the gap matters.
DraftA GeneratedSpec proposes the release-note update, owner, tests, approval, and proof need.
BoundaryThe approved action crosses CPI and PEP before any issue, PR, or message is dispatched.
ReceiptThe final decision records policy, approval, action payload, and closure evidence.

Authority rule

Company context can inform proposals. It cannot authorize side effects.

Query answers, drift labels, and GeneratedSpecs stay proposals until reviewed, approved, and routed through HELM.

All side-effectful action crosses PEP/CPI and produces receipts.