Deterministic before clever
Severity-weighted findings produce the score. A single critical — or anything
under 50 — rejects. A high, or a score under the buyer’s floor, routes to review.
AIMarket · publish admission
Admit. Or don’t.
Before the catalogue.
THEMIS (Θέμις) is the signed publish-time gate: approve / review /
reject from a bounded dossier — deterministic policy, request-bound
Ed25519 receipt, no free crawl of the candidate. Not Metis (cognition).
Not WARDEN (invoke-time firewall).
$
uvx create-aimarket-agent themis --kind tool --metis
APPROVEcatalogue path
REVIEWhuman · Metis advisory
REJECTfail closed
DRAG TO ORBIT · SCROLL TO ZOOM · CLICK A LANE
DECISION
—
BOOTING RENDERER
initialising procedural environment…
WebGL is unavailable here. The gate logic is identical — read the signed verdicts below.
3
Verdicts
84
Tests
98%
Coverage
Ed25519
Signed receipt
12
Course steps
5
Languages
Candidate → gate → receipt
One dossier in. One signed verdict out.
The policy engine decides immediately from identity, transport, permissions, cost, schemas and evidence shape. Metis may add an asynchronous second opinion — it never overrides the signed verdict. Alien Monitor only ever sees dossier-free telemetry.
Candidatebounded dossier ≤ 256 KiB
Policydeterministic findings
Verdictscore · risk tier
Receiptrequest-bound Ed25519
Hubcatalogue or block
Monitordossier-free trail
A link is not evidence
URLs are parsed, never fetched — so a decorative reference proves nothing and
no longer counts. Only digest-bound artifacts satisfy the evidence floor, and an
attestation is checked offline against its own signed statement.
Receipt you can re-check
The response signature covers the exact submitted input and the result, under a
persistent provider key stored with mode 0600.
Hub overlay, operator-owned
Modes are off / advisory / enforce. Pin an auditor
key and verdicts are recorded from then on; blocking still takes a deliberate
enforce. THEMIS never lists anything by itself.
Mapped to OWASP Agentic
Every finding carries ASI mappings from the OWASP Top 10 for Agentic Applications, so a verdict lands in language a security reviewer already uses.
Lazy Metis, never blocking
With request_metis the verdict returns instantly and a bounded advisory job
runs behind a poll URL. A shared job store lets any replica answer any poll.
A signed declaration is deniable no more
Declared permissions stay a declaration — but the publisher can sign the exact declaration with its provider key. Policy can demand that signature, and a proof over different permissions is a critical finding, not a shrug.
Real output, not a mock-up
Three dossiers, three signed verdicts
Every report below is the literal output of this repository’s policy engine on
examples/safe_candidate.json
and two mutations of it. The 3D gate above is driven by exactly these numbers.
Signed report · /invoke response
Admission ≠ cognition ≠ runtime firewall
Not Metis. Not WARDEN.
Four different questions, four different components. Conflating them is how supply-chain controls quietly stop working.
| Component | Question it answers | When it runs | Can it block a listing? |
|---|---|---|---|
| THEMISthis repo | May this third-party capability enter the public catalogue? | Publish time, once per candidate | Yes — when Hub admission mode is enforce |
| Metisverification tier | Is this report internally consistent? | Asynchronously, after the verdict | No — advisory only, never overrides |
| WARDENARGUS firewall | Should this tool call be allowed right now? | Every invoke, on the client side | No — it gates local calls, not the catalogue |
| LUMENtrust graph | How much does the network trust this provider? | Continuously, from observed behaviour | Indirectly — trust floors filter discovery |
Consuming the ecosystem — searching Hub, calling listed capabilities, oracles, Metis — needs no THEMIS at all. You are a buyer. THEMIS is on the selling path.
The honest version
“Anyone can dump a repo and get listed” — no.
Listing a paid capability on the public Hub is a multi-layer publish path. THEMIS is only the last, optional overlay on top of gates that are already on in production.
REQUIRED
Publish credential
Operator-issued bearer / publisher token. There is no anonymous publish route.
ON IN PROD
Stake
Minimum bond ≈ $25. Failed or unsigned invokes can slash it.
REQUIRED
Manifest
publisher_id, provider_pubkey, HTTPS invoke_url, schemas, price.
REQUIRED
Response signatures
Request-bound Ed25519 on every invoke, checked by Hub.
ON
Trust floors
LUMEN thresholds on discovery and invoke, enforced by Hub and clients.
OPERATOR
THEMIS admission
Pin an auditor key and verdicts are recorded (advisory); blocking needs
an explicit enforce.
Alien Monitor admits nobody. It renders dossier-free admission telemetry after Hub has
already recorded a receipt. Nothing on a public dashboard can grant catalogue access.
create-aimarket-agent
Mini-course: build this agent yourself
THEMIS is the finished reference for the five-language create-aimarket-agent tutorial — twelve steps from an empty folder to a deliberate Hub publish, with the same 84 tests and the same fail-closed defaults you see above.
Generate
uvx create-aimarket-agent · tool + Metis
Decide
Write the product decision before the code
Model
Strict dossier, unknown fields rejected
Findings
Deterministic policy → score → tier
Metis
Real, lazy, non-blocking advisory
Sign
Cover the exact submitted input
Test
Behaviour, not only happy paths
Scenario
Exercise the business case end to end
Poll
Run Metis without blocking the user
Containerize
Locked deps, unprivileged image
Publish
An explicit operator action
Done
Definition of done, then next exercises