Governed capability runtime. Value loop: discover → execute → trace. The agent proposes; the runtime decides.

Traverse governs portable business capabilities — pricing, eligibility, authorization, escalation — as contracts with sandboxed artifacts and a verifiable trace. Usual authoring is skill-first plain English via traverse-capability-author (interview → registry check → contract → WASM → human-reviewed PR). You do not need to write Rust for that path; manual authoring still uses Rust→WASM under the hood.

One shared runtime.wasm. Browser, native desktop, CLI, and MCP are clients / embedders, not different Traverse runtimes. Shipped consumers today: JS/TS (traverse-embedder-web), Rust (traverse-embedder), agents via traverse-mcp. Web loads the bundle's digest-checked runtime/runtime.wasm; the Rust embedder links traverse-runtime natively and ships no separate runtime-WASM artifact — same contract/ABI (Q&A). Python works by shelling out to traverse-cli capability-package execute — no Python SDK. Swift (xcframework on swift-host-v* releases), Kotlin (Maven Central com.traverse-framework:traverse-embedder 0.15.0), and .NET (nuget.org TraverseEmbedder 0.15.0) are published, pre-1.0, and not Certified. Edge is planned; cloud placement is an explicit non-goal for v0.1. Cite what is real today and Platforms before assuming a host.

Specs and CI gates stay in Governance below — honesty hygiene, not the pitch. Working implementation of Universal Microservices Architecture.

1. What is real today
2. The agent freestyled a $2.4M wire. The runtime said no. (deny + trace)
3. Deny / multi-host direction (blog-first): agent freestyle → blocked · same-wasm multi-host · signed exact-ref digits · agent MCP exact-ref · catalog model.execute · agent + real traverse-mcp · How do I run the deny demo? — weekly-demos is not publicly cloneable yet (.github#30)
4. Where business logic lives (hosts stay thin; non-UI domain logic in capabilities; apps-not-ready ≠ host-forever): Q&A · blog
5. Print-support domain pack (living pack; none of print.* published yet; apps-not-ready ≠ no packs): Q&A · blog
6. Published capability versions are never edited (deprecate / revoke instead): blog · Q&A
7. Model rights are data, not a README: blog · Q&A

→ traverse-framework.com · llms.txt · start here · start in traverse

Platform reach: five embedder SDKs on one embedder-api/1.0.0 contract and one CI conformance suite — Rust and Web/TypeScript published (crates.io / npm traverse-embedder-web@0.15.0); Swift (iOS/macOS, wasmi) via swift-host-v* release assets (currently swift-host-v0.15.0-1, the v0.15.0 rebuild that Package.swift on main pins); Kotlin (Android, Chicory) on Maven Central com.traverse-framework:traverse-embedder 0.15.0; .NET (Windows, Wasmtime) on nuget.org TraverseEmbedder 0.15.0. All three natives are published, pre-1.0, and not Certified under Spec 529 (no host is Certified yet). Signed exact-ref model packages now run on every embedder (Rust, browser, Swift, Kotlin/Android, .NET) with model rights enforced on every host. Apple hosts can opt into a signed Core ML variant under the same policy and evidence rules. Governed-path iPhone evidence landed on main after v0.15.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max at p95 141 ms per 3 s clip on Core ML. It needs an unreleased manifest change, so it is not in a release yet. Edge is planned; cloud placement is an explicit non-goal for v0.1 — see Platforms.

The same business rule now has to run in a web client, on a server, and inside an AI agent a user is talking to — and teams often invent a fourth copy for each new host. Copies drift; behavior stops being one thing. Traverse’s answer is one governed capability on the hosts that have actually shipped (not an unbounded “anywhere,” and not cloud orchestration). One caveat for v0.15.0: hosts don't yet agree on the exact input bytes they hand a capability, so input-hashing outputs can differ across host types. Fixed on main (every host feeds RFC 8785 canonical JSON input), shipping in v0.16.0 (#1722, write-up).

AI coding agents make this sharper: an agent asked to "add the discount logic" re-derives it from scratch every session — unversioned, unreviewed, and authoritative only because it ran last. Traverse's position is the opposite: a capability is a contract, an immutable version, a signature, and a WASM artifact; the runtime validates inputs/outputs against schemas, isolates execution in a sandbox, and emits an auditable trace. The agent's job is to find and compose existing capabilities — not to be the source of truth for what the business does. The public registry already holds dozens of them, so that logic is a lookup, not a regeneration.

Specs and CI gates are how we stay honest — not the product. Approved specs are versioned and merge-gating; contracts are the source of truth for runtime behavior.

See constitution.md for the full rules, GOVERNANCE.md for the ownership and decision model, and each repo's own CLAUDE.md / AGENTS.md for what's specific to it. One CLA signature covers every repo in the org.