ACR · The capability faculty
The agent’s
hands.
Typed tools. Gated invocation. Signed receipts for every action.
ACR is the Capability faculty of the Ginnung cognitive runtime. It is the boundary between what an agent wants to do and what it is permitted to do — a typed registry of tools, each invocation evaluated, signed, and emitted as a SonderEvent. Your agent can reach into the world, but only through doors you opened, and every door records who walked through.
What is ACR
Action, capability, receipt.
A modern agent is a reasoner wired to a toolbelt. The reasoning gets most of the attention. The toolbelt is where the damage happens. An email sent, a row deleted, a payment authorized — none of those are reversed by an apology in the next turn.
ACR is the toolbelt done seriously. Every capability is a typed function with an explicit schema, a stated cost, and a declared blast radius. Every invocation is intercepted, evaluated against the policies you registered, and either executed with a signed receipt or denied with a reason. The agent never touches the network or the filesystem directly. It asks ACR. ACR rules.
The same registry is the catalog auditors read. Every tool the agent can reach, every guardrail attached, every invocation in history — one structured view, queryable, replayable, diff-able across versions.
What it does
Capabilities
Registry
Tools as typed contracts
Each capability is a TypeScript or Python function with an input schema, output schema, cost class, and blast radius. No untyped wrappers, no ad-hoc shell-outs.
Invoke
Intercepted, every time
Agents call capabilities through a single SDK. The runtime resolves the tool, validates inputs, applies policy, executes, and signs the result. One choke point.
Cost
Spend as a first-class field
Tools declare token, dollar, and time costs. Budgets are enforced at the call site, not after the bill arrives. Hit the cap, the tool denies.
Sandbox
Blast radius, declared
Read-only, idempotent, mutating, irreversible — every capability carries its risk class. Sensitive tiers route through Lattice before execution.
Replay
Deterministic invocation records
Every call lands in Engram with inputs, outputs, receipts, and cost. Replay any agent decision against the exact tool state it had at the time.
Compose
A faculty, not a tool framework
ACR is one face of the cognitive runtime. Reasoning proposes, Lattice rules, ACR executes, Engram remembers. One bus. One log.
Why typed capabilities
The unbounded-tool failure mode.
The default agent pattern is to hand the model a shell, a browser, or an MCP server with a hundred undeclared tools. The model figures out what to call from documentation strings. When something goes wrong — the wrong file deleted, the wrong customer emailed — the post-mortem is “the model decided to.”
That is not an answer your reviewers will accept. It is also not the model’s job. Capability is a system concern, not a prompt concern. The set of tools, their signatures, their costs, their guardrails — these belong in a typed registry maintained by engineers and read by auditors, not in the model’s context window.
ACR puts that registry at the center. The model proposes a call. The runtime decides whether the call is well-formed, within budget, and policy-clean. Whatever happens next is, for the first time, fully accounted for.
Get started
Two ways in.
Self-host
github.com/heybeaux/acr
TypeScript SDK and a small server. Register tools, point your agent at the runtime, ship. MIT-licensed.
Compose
As a Ginnung faculty
ACR composes with Lattice for governance, Engram for memory, Parliament for reasoning. Same SonderEvent bus, one audit log.