# Adeno Platform Overview

Adeno is a modular platform for autonomous AI workflows. Services share a common trust fabric (CAuth), a package ecosystem (APS + Uracil), an encrypted data hub (Corpus), and an inference gateway (Athena), so each product stays small and composable instead of becoming a monolith.

## Core principles

- **Service isolation** — every capability is a separate service with explicit contracts.
- **Shared trust** — one authentication and billing fabric across products.
- **Consent-gated data** — user data moves only with explicit consent scopes and TTLs.
- **Rootless least-privilege execution** — extensions run sandboxed with declared capabilities.
- **Automation-first** — errors route to automated remediation before humans.

## The platform in layers

| Layer | Components | Role |
|---|---|---|
| Trust & identity | CAuth | Authentication, accounts, usage accounting, billing |
| Inference | Athena | LLM routing, model registry, GGUF/Neuron sidecars |
| Data | Corpus | Encrypted consent-gated cross-service data hub |
| Packages | APS + Uracil | `.aps` solution packages, `.ura` rootless bundles |
| Orchestration | Arachne | Graph workflows, OAuth connectors, campaign orchestration |
| Products | Keryx, Kairos, Mnemosyne | Outreach automation, productivity suite, sensor-fusion research |
| Reliability | Eunomia | Error reporting, triage, AI patch → sandbox → gated promotion |
| Clients | Hermes | Client-side hosting + OTA hot-patches in a WASM enclave |

## Cross-service integration

Services are intentionally interoperable:

- Keryx uses **CAuth** to authenticate users and **Athena** to run inference.
- Keryx pushes memory and campaign context into **Corpus** for consented reuse.
- **Arachne** orchestrates email and campaign actions across Keryx and Kairos.
- **Eunomia** receives a bug report, asks Athena to generate a patch, sandboxes it in Uracil, then promotes it through CI/security/compliance gates.
- APS packages are distributed by the registry and consumed by Uracil at runtime.

## CAuth transtokens

All major services use CAuth transtokens for request authentication:

- Transtokens are JWTs signed with `CAUTH_SECRET_KEY` (HS256).
- Claims include `sub`, `iat`, `exp`, `type`, and `jti`.
- `transtoken` lifetime ≈ 15 minutes; `anontoken` ≈ 2 days.
- Attach as `Authorization: Bearer <transtoken>`.
- Services validate tokens with the shared secret.

## Package and runtime model

The Adeno Package Service (APS) distributes two package styles:

- **Python packages** with `entry_point` and optional dependencies
- **Uracil service bundles** with `runtime`, `service`, and `permissions` sections

Uracil executes installed bundles with explicit permissions: each bundle carries a `manifest.json` describing identity, runtime ABI, permissions, and functions. Functions execute as subprocesses (Python or native C++). Campaigns provide persistent runtime contexts with cleanup semantics.

## Where to go next

- Browse the [product catalog](/api/products)
- Read the [AI-friendly index](/llms.txt) or the full dump at [/llms-full.txt](/llms-full.txt)