SYNXA governed platform today. The operating system next.
What you install today is the governed Core and Level 6, the workbench your engineering team lives in, inside your own boundary — on your metal, in your VPC, or on a machine with no network at all. It can also govern a pipeline you already run. No sign-ins to us; nothing leaves your boundary unless you route it out.
Where it is going is not marketing. Governance a workload can decline to call is cooperative, and cooperative governance is not governance — it holds exactly as long as every process agrees to be held. The SYNX operating-system image removes the choice: the Core boots as PID 1, each workload is forked into a governed sandbox, the kernel's module loader is closed after drivers load and before any workload runs, and there is one network road out, through the governor. That image is proven in test boots, and an x86-64 build exists. It is not yet the production path — the live core does not admit work by fork today — and release signing remains.
Level 6 · the workbench · for your dev & tech teams
Agent Forge
Custom agents in seconds — objective, modality (text / image / audio / speech), model policy — plus a premade fleet to start from.
The burst board
Drag agents into a burst; each placement is a real work unit fired in parallel across the governed 30-node hierarchy. No brittle chains.
The constellation canvas
Watch compositions execute on your core, event by event — hemispheres, coherence check, radial burst, root proof sealing.
Live governed testing
Test runs execute on your core in sandbox mode. A dry run says, before anything starts, whether the run would begin, which model would do each part, and what similar runs took — calling no model and using none of your limits. Decisions settled by precedent cost zero governance tokens; the work itself still calls models.
Import your workflow definitions
Import a CrewAI crew (agents.yaml + tasks.yaml), an n8n workflow export, or a plain list of steps. Level 6 decides step by step which work can run side by side and which must wait, from the workflow's own dependencies, and shows you the analysis. It imports definitions, not runtimes: the steps and objectives carry over; custom state handling, tool callbacks and your own external calls stay in your stack. Chains written as code — LangChain, LangGraph — are programs; SYNX neither runs nor translates them, and says so. Govern those as your own pipeline instead.
Private catalog
A shared team library of agents and burst pipelines, plus a registry of certified assets — every model, tool, skill and outside pipeline your deployment is allowed to run, each certified before it may run — models by what they did under test. All of it stays inside your boundary.
Teams
Runs are visible to the team that ran them, limits are shared across the team, and membership is checked on every request rather than trusted from a key, so a change takes effect at once.
Evaluator and auditor access
Per-person keys, labelled for the holder, read-only and expiring. The holder sees every run its team is allowed to see — every run, if you grant it — with its governance record, its node trail (for runs on SYNX's own burst) and its proof; what a run produced stays with whoever ran it. Addresses, credentials and email addresses are scrubbed from free text, and the model behind each step is named. One limit: a password written as an ordinary sentence cannot be told from ordinary words, so never type a real secret into a run request.
SYNX Core · the governed engine · your metal, your VPC, or air-gapped
Governance as execution
Routing, constitutional validation, precedent, and the integrity chain run with zero model inference — a model can propose, never approve its own work. The apex is deterministic by default: the Twins structure each run without a model.
Cryptographic provenance
SHA-256 hash chain + root proof per run, covering text and binary artifacts, checkable offline with the free verifier on infrastructure you own. The verifier recomputes every node — its content digest and all of its children — up to the root, and checks the root against the deployment's signature with a key you pinned. The export carries digests, not content; the verifier page lists what it does not check.
Flow never stops
A conflict is settled by precedent, or by a clause that names the side; otherwise the Digital CEO — a certified model — rules with the whole Constitution in view and must write down its reasoning, and that ruling becomes precedent. A true deadlock also goes to a human: the CEO's ruling holds for that job only, and the human's ruling becomes permanent Case Law. Governance records and annotates; it does not halt a job on a setting.
Govern a pipeline SYNX does not run
Your own pipeline can replace SYNX's execution core. It is admitted only as a certified asset — signed, expiring, revocable — and its address is taken from the certificate, never from configuration. SYNX rules on each job before it is sent and on what comes back, checked against the schema declared at certification. Revoking the certificate refuses the next job, with no restart.
A proof that says what it covers
For work on your pipeline, the record names what the proof covers — the admitted request, the executor's identity, the exact bytes returned — and what it does not: the pipeline's internal steps. No completion certificate is issued for work SYNX did not witness.
Access that is proven, not assumed
SYNX checks each pipeline by calling it exactly as a run does, and reports healthy only when the check shows the credentials are really being tested; otherwise the state is unproven, which is not healthy. A pipeline found refusing work is refused up front, with the reason. Checks are rationed so SYNX cannot trip your own sign-in lockout, and pipeline credentials are sealed at rest and never shown or logged.
Certification by behaviour
An unknown model is tested, not refused, and certified only for the roles it earns: keeping to an output contract, refusing an obviously bad product, and ignoring an instruction planted in the data. The judging role requires all three. You choose the model for each role and change it live; each role is gated by certification. The product ships no vendor models.
Governance cost-to-zero on recurrence
Governed decisions harden into precedent and are reused at zero marginal tokens. Inference remains metered per job — it is the governance overhead that trends to zero as precedent accumulates.
Self-healing, at most once
Live replicas hot-swap on failure; crashed work resumes to a verified certificate. A job sent to an outside pipeline is never re-sent by self-healing — only the deployment's top operator (the Creator role) can send it again. Tested against every failure shape, restarts, and two cores booting at once: sent exactly once every time.
Plans onto your hardware
One cross-vendor scan at install and at run time places each workload — text, vision, image, video, speech recognition — on what the machine has. Proven on an NVIDIA data-centre GPU, a Windows integrated GPU and a CPU-only ARM machine; on the GPU a 4-billion-parameter model ran about 57 tokens a second against about 8 on the CPU-only machine. For AMD and Apple GPUs the detection is tested, but neither is yet proven on hardware.
Air-gapped delivery, proven
A signed offline kit, installed as an upgrade on a clean machine with no network, sealed so the kernel itself refuses any outside connection, cloud metadata endpoints included. A real governed job ran there and its proof verified. A from-nothing install on a new machine is the next test. The seal counts as enforced only when a probe inside it is refused and the same probe outside is not.
Sovereign install
Your metal, your VPC, or air-gapped. One Helm chart, with values for GCP, AWS, Azure and Alibaba, is included; multi-node operation is not yet proven. SSO and audit export. Offline model fallback.
Editions · annual term licence · never metered · priced per engagement
An annual term licence, not a subscription and not a meter. You install the system on your own hardware and run it as hard as you like — the fee does not move with your job volume, your token spend, or how much value you get out of it.
- Level 6 for your pilot team
- Fixed scope: one governed use case, installed in your boundary
- Success criteria agreed up front — proofs, zero-token routing and validation, read-only access for your reviewers
- 50% creditable toward your Year-1 license
- 25 Level 6 builder seats
- Multi-threaded governed pipelines + self-healing
- Agent Forge, burst board, live governed testing
- Private catalog of certified agents & pipelines
- 100 Level 6 builder seats
- Dedicated install — isolated cloud or on-prem, SSO, audit export
- Patent-pending L6 governance; cryptographic provenance on every output
- Read-only auditor keys and audit export for your audit function
- Unlimited builder seats
- Unlimited global orchestration threads, multi-region sovereign installs
- Custom regulatory hardcoding for your jurisdictions
- Dedicated engineering support + SLAs
How licensing works · a signed file · verified on your machine · no callback
SYNX is software you download and install. That rules out the usual ways vendors keep control after the sale — we will not phone home, meter you remotely, or hold a kill switch, because a control plane that needs our servers is not sovereign. So the licence is simply a signed file.
Verified locally, never remotely
Your licence is an Ed25519-signed document your install checks against a public key compiled into the build. No network call is made to validate it, ever — which is exactly what lets a licensed SYNX run inside an air-gapped facility. Renewal is a new file; a USB stick is a supported delivery mechanism.
An expired licence never makes you less safe
When a production term lapses, governance does not stop. Running workloads keep running, proofs keep being sealed, and every proof already issued stays verifiable forever — with or without a licence, with or without us. What pauses is new capability: certifying new assets and saving new agents. We will not take a production system down over an invoice. An evaluation build is the one exception: when its end date passes, no new run starts, and everything it recorded stays readable and exportable.
Renewal on a report you choose to send
At renewal your install produces a usage attestation — jobs, seats issued, operators active that day, certified assets — hashed and appended to your deployment's own integrity chain. Counts only: no intents, no outputs, no data. You choose whether to send it. It is not signed: it is your install's own count, presented by you, so nobody has to watch your deployment to produce it.
What the annual fee buys
The term licence and its entitlements, plus updates, security patches and support for the term. Certification of new third-party models and tools against your Constitution is included at your edition's tier. Seat and node counts are written into the licence and trued up at renewal.
What is not proven yet · stated before you ask
- Multi-node, distributed or Kubernetes operation. The Helm chart exists; running SYNX across nodes has not been measured.
- The real effort of integrating with your existing workflow. That is what a pilot measures.
- Any compliance certification. No audit has been performed.
- Governance as process one in production. The operating-system image boots in test; the live core does not use it, and release signing remains.
- AMD and Apple GPUs on real hardware.
- A from-nothing install of the offline kit on a new machine. It is proven installing as an upgrade on a clean, sealed machine.
- Offline checking of an outside pipeline's proof. The free verifier covers runs on SYNX's own pipeline.
- What happens inside a pipeline SYNX does not run. The proof says it does not cover those steps. Recorders that would attach inside such a pipeline, a gateway in front of outside models, and governance models trained by SYNX are designed, not built.
The reference deployment behind this site is one CPU-only virtual machine. A run of SYNX's own burst there takes about 10–25 minutes, and some time out; a GPU changes that (see Plans onto your hardware above). Runs it sends to its product factory can take much longer, and carry a boundary proof, not a node chain.
Evaluating? Bring a workflow.
Evaluation is invite-only and runs under a technical demo: import a CrewAI crew, an n8n export or a list of steps and watch SYNX run it governed — with a root proof — before you license anything. It imports definitions, not runtimes; custom state handling and your own external calls stay in your stack. Your reviewers can hold named, expiring, read-only keys to the same runs. If your pipeline is code, keep it running and govern it as your own pipeline. Watch the governed core answer live on the front page.