TENET

Verification-first AI agent framework — open-source TypeScript.

An agent turn either answers with a grounded, verified citation, or it abstains / hands off to a human. It never states a fact it cannot ground in a source. That guarantee — grounded-or-abstain — is enforced in code, not in a prompt.

TENET is a framework, not a model: it calls whichever frontier model you bring and makes that turn provably harder to hallucinate through. Anti-hallucination, source-grounding, capability-token tool sandboxing, and pre-tool-call governance are first-class layers, not bolt-ons.

Architecture · FAQ · BENCHMARKS · Roadmap · GitHub →

What ships today

Every row is a package in the monorepo — no capability claimed here that isn’t in the code, and the repo’s own numbers (1328 tests across 98 suites) are checked against the live suite in CI (pnpm counts:check).

Capability	Package	What it does
Fail-closed agent turn	`@tenet/agent`	`runAgent` drives the turn as a graph to a single emit edge; abstain/handoff are carried as values (never thrown); a top-level catch fails closed to abstain.
Deterministic verifier pre-checks	`@tenet/verifier`	Before any LLM judge: quote-grounding, and fabrication checks for numbers (incl. spelled-out), `http(s)://` URLs, and contact emails absent from the sources.
Multi-judge verifier + fail-closed mode	`@tenet/verifier`	Atomic-claim strict-then-permissive judging; an opt-in `failClosed` mode resolves extractor/judge infra failures to not-supported, never a spurious pass.
HHEM judge adapter	`@tenet/judge-hhem`, `@tenet/judge-hhem-onnx`	An adapter surface for a Vectara-HHEM-style hallucination judge — you bring the model weights; a deterministic token-overlap scorer ships as the reference.
Pre-tool-call governance	`@tenet/governance`	Per-tool deny / allow / require-approval policy, an idempotent approval gate, and a structured audit trail — the tool executor only sees policy-allowed calls.
WASM tool sandbox	`@tenet/tools-wasm-sandbox`, `…-wasmtime`	Capability-token-gated tool execution in a WASM sandbox (wasmtime adapter).
MCP client + OAuth gateway	`@tenet/tools-mcp`, `@tenet/tools-mcp-gateway`	Model Context Protocol tools with an OAuth gateway.
Answer-quality orchestration	`@tenet/refine`	Knowledge-boundary gate (abstain before drafting on thin retrieval), claim-repair loop, best-of-N, and a `groundedOrAbstain` reference orchestrator.
Resilience	`@tenet/rate-limit`	Retryable-vs-fatal error taxonomy, jittered-backoff retry that fails closed (never retries an AbortError / 4xx), and a circuit breaker.
One canonical `ChatModel`	`@tenet/core` + `models/*`	A messages array, a required `AbortSignal`, tool round-trips, and a lossless `StopReason` union — 6 model adapters (Anthropic, OpenAI, Gemini, Mistral, Ollama, Bedrock) speak it.
Surfaces & connectors	`surfaces/`, `connectors/`	9 surface adapters (Discord, Slack, Telegram, Teams, web widget, REST, gRPC, Matrix, voice/Twilio) + ticketing connectors (Zendesk, Intercom, Freshdesk, ServiceNow), each transport-injected.

How a turn stays honest

inbound guard → retrieve + knowledge-boundary → cache re-verify → reason → tools → verify → EMIT
   (block →      (thin →                        (candidate       (ambiguity (fail  (uncited   the ONE
    handoff)      abstain)                       re-verified)     → abstain) →abstain)→abstain) place a
                                                                                             fact ships

A fact-bearing reply leaves the agent at exactly one call site, reachable only past the verifier, a grounded-citation guard, and an outbound leak gate. The graph fails closed by default — a retriever error, a compaction error, a truncated (max_tokens) response, and any unexpected throw (via the orchestrator’s top-level catch) all resolve to abstain. The verifier’s own infra failures (a judge timeout or an extractor error) fail open by default and resolve to not-supported only under the opt-in failClosed mode.

The honest read

Measured, not marketed:

Pre-1.0. APIs may change. The core is real and code-complete in the monorepo, with a green test suite gated in CI.
Benchmark numbers come from a hermetic CI stub SUT — they measure the framework’s contracts, not a frontier model’s behavior. Real-model numbers are produced locally with your own API key (apps/measure-real), never asserted in-repo.
Surface adapters take an injected transport you wire to a concrete client at composition.
The HHEM judge is an adapter, not the model — you supply the weights.

Get started

README — quickstart and the capability map.
SKILL.md — a framework-agnostic guide to building a verification-first, grounded-or-abstain agent.
FAQ — how it prevents hallucination, what grounded-or-abstain means, supported models and surfaces, and whether it’s production-ready.
llms.txt — an LLM-readable index of the whole project.

Apache-2.0. Free to use, self-host, and modify.