Halofy

Halofy

The open access and governance layer for AI agents across your organization. Give every agent the right organizational context through one identity and policy model, with provenance, audit, and signed erasure.

As AI spreads across an organization, every agent needs access to shared context without becoming its own identity system, policy engine, or audit silo. Halofy sits between organizational knowledge and the agents that use it. It resolves identity, enforces access, governs change, records every outcome, and makes erasure independently verifiable.

Underneath that governance boundary, Halofy maintains durable context and keeps retrieval replaceable. The result is infrastructure you can inspect, self-host, run offline, and connect to any agent over MCP or HTTP.

Why Halofy

What ships in this repository

• One governed access surface over MCP and HTTP: mem_write, mem_read, mem_search, mem_assemble, mem_fault, mem_stats, mem_forget, policy, sharing, pinning, export, and manifest operations.
• Organization-wide identity and access control: credentials resolve actor, role, namespace, and source scope server-side before any read or write.
• A governed context lifecycle: provenance, entity resolution, exact and semantic dedupe, supersedence chains, and append-only audit.
• One organizational authority across two tiers: Postgres/pgvector for operational context and encrypted, Git-versioned knowledge for the cold tier. Embedded PGlite is the zero-setup local default.
• A frameworkless control room: access, teams, sources, policies, conflicts, retrieval quality, audit, alerts, skills, connected apps, and export.
• Four public connectors: filesystem, Postgres, Obsidian, and manual CSV import. All feed the same governed write path.
• A hermetic test lane: embedded PGlite, deterministic StubLlm, HashEmbedder, and zero network access.

Quickstart

Run the complete offline story

git clone https://github.com/halofyai/halofy.git
cd halofy/kernel
npm ci
npm run demo

No API key. No database server. No model download. No network call. The demo boots the real kernel on embedded PGlite, then exercises pinning, assembly, writes, hybrid search, an L3 context fault, audit, import, fragmentation, and signed erasure.

== T0 ·· boot in-memory, pin the refund policy, assemble the working set
booted: embedder=hash(dim=256) llm=stub

== T3 ·· mem_fault - page missing context in from L3
fault: hit=true source=L3 injected=2

== T7 ·· mem.forget - erase the customer and mint a signed certificate
certificate 01... verifyCertificate === true
after forget: mem_search surfaces 0 matching facts

demo complete - kernel closed.

Then prove the kernel and its retrieval boundary:

npm test
npx tsx src/cli.ts conformance baseline