Governed capability runtime. Value loop: discover → execute → trace. The agent proposes; the runtime decides.

Traverse governs portable business capabilities — pricing, eligibility, authorization, escalation — as contracts with sandboxed artifacts and a verifiable trace. Usual authoring is skill-first plain English via traverse-capability-author (interview → registry check → contract → WASM → human-reviewed PR). You do not need to write Rust for that path; manual authoring still uses Rust→WASM under the hood.

One shared runtime.wasm. Browser, native desktop, CLI, and MCP are clients / embedders, not different Traverse runtimes. Shipped consumers today: JS/TS (traverse-embedder-web), Rust (traverse-embedder), agents via traverse-mcp. Web loads the bundle's digest-checked runtime/runtime.wasm; the Rust embedder links traverse-runtime natively and ships no separate runtime-WASM artifact — same contract/ABI (Q&A). Python works by shelling out to traverse-cli capability-package execute — no Python SDK. Swift (xcframework on swift-host-v* releases), Kotlin (Maven Central com.traverse-framework:traverse-embedder 0.16.2), and .NET (nuget.org TraverseEmbedder 0.16.2) are published, pre-1.0, and not Certified. Edge is planned; cloud placement is an explicit non-goal for v0.1. Cite what is real today and Platforms before assuming a host.

Specs and CI gates stay in Governance below — honesty hygiene, not the pitch. Working implementation of Universal Microservices Architecture.

1. What is real today
2. The agent freestyled a $2.4M wire. The runtime said no. (deny + trace)
3. Deny / multi-host direction (blog-first): agent freestyle → blocked · same-wasm multi-host · signed exact-ref digits · agent MCP exact-ref · catalog model.execute · agent + real traverse-mcp · one audit fingerprint, every host · v0.16.0: same input, same output, on every host · one model capability, three published hosts, same answer · How do I run the deny demo? — weekly-demos is not publicly cloneable yet (.github#30)
4. Where business logic lives (hosts stay thin; non-UI domain logic in capabilities; apps-not-ready ≠ host-forever): Q&A · blog
5. Print-support domain pack (living pack; none of print.* published yet; apps-not-ready ≠ no packs): Q&A · blog
6. Published capability versions are never edited (deprecate / revoke instead): blog · Q&A
7. Model rights are data, not a README: blog · Q&A

→ traverse-framework.com · llms.txt · start here · start in traverse

Platform reach: five embedder SDKs on one embedder-api/1.0.0 contract and one CI conformance suite — Rust and Web/TypeScript published (crates.io / npm traverse-embedder-web@0.16.2); Swift (iOS/macOS, wasmi) via swift-host-v* release assets (currently swift-host-v0.16.2; the v0.16.2 tag's Package.swift pins swift-host-v0.16.1, and main pins swift-host-v0.16.2); Kotlin (Android, Chicory) on Maven Central com.traverse-framework:traverse-embedder 0.16.2; .NET (Windows, Wasmtime) on nuget.org TraverseEmbedder 0.16.2. All three natives are published, pre-1.0, and not Certified under Spec 529 (no host is Certified yet). Signed exact-ref model packages now run on every embedder (Rust, browser, Swift, Kotlin/Android, .NET) with model rights enforced on every host. Apple hosts can opt into a signed Core ML variant under the same policy and evidence rules. Governed-path iPhone evidence shipped in v0.16.0 (traverse#1630): BirdNET on one iPhone 14 Pro Max at p95 141 ms per 3 s clip on Core ML (needs manifest schema 2.3.0, new in v0.16.0). Edge is planned; cloud placement is an explicit non-goal for v0.1 — see Platforms.

The same business rule now has to run in a web client, on a server, and inside an AI agent a user is talking to — and teams often invent a fourth copy for each new host. Copies drift; behavior stops being one thing. Traverse’s answer is one governed capability on the hosts that have actually shipped (not an unbounded “anywhere,” and not cloud orchestration). Before v0.16.0, hosts didn't agree on the exact input bytes they handed a capability, so input-hashing outputs could differ across host types. v0.16.0 fixes this (every host feeds RFC 8785 canonical JSON input; a breaking change) (#1722, write-up; rerun on the v0.16.0 release packages: same input, same output).

AI coding agents make this sharper: an agent asked to "add the discount logic" re-derives it from scratch every session — unversioned, unreviewed, and authoritative only because it ran last. Traverse's position is the opposite: a capability is a contract, an immutable version, a signature, and a WASM artifact; the runtime validates inputs/outputs against schemas, isolates execution in a sandbox, and emits an auditable trace. The agent's job is to find and compose existing capabilities — not to be the source of truth for what the business does. The public registry already holds dozens of them, so that logic is a lookup, not a regeneration.

Specs and CI gates are how we stay honest — not the product. Approved specs are versioned and merge-gating; contracts are the source of truth for runtime behavior.

See constitution.md for the full rules, GOVERNANCE.md for the ownership and decision model, and each repo's own CLAUDE.md / AGENTS.md for what's specific to it. One CLA signature covers every repo in the org.