A governed micro-application platform
Charter replaces large monolithic IT delivery with small, AI-generated, purpose-built applications. Each one declares its charter: what it is, what it owns, where its data lives, what review it carries. Conformance is checked by machine, at authoring time, before a line of code ships.
The problem
Public-sector IT programs put every new requirement into a monolith's backlog or a bespoke project that reinvents auth, logging, deployment, and security review from scratch. AI code generation makes producing apps cheap, but cheap production without governance produces unmaintainable sprawl. The gap is a platform that makes generated apps conformant, observable, and accounted for by construction.
Every app is a snowflake. Identity, telemetry, and secrets handled differently each time. Review happens after the fact, by reading code. Nobody can say with confidence what a generated app owns, where its data lives, or which model produced it.
Apps conform to one scaffold and inherit shared capabilities instead of reimplementing them. Each app carries a declared charter, validated against the same schema the runtime enforces. Existing ERPs and CRMs are never modified: apps run alongside them, non-invasive by construction.
The platform
Providers are configuration: the same app runs against Entra ID or any OIDC provider, Application Insights or any OpenTelemetry backend, without a code change.
OIDC as the open standard. Auth middleware and token handling from the platform, provider chosen by config.
OpenTelemetry built in at boot. Every app is traceable and operable from day one, or it is not chartered.
Loaded once through the platform layer, including secrets via a pluggable vault abstraction.
Timeouts on every outbound call, bounded retries, declared behavior on dependency failure.
In-memory, Redis, or off, selected by config. App code never knows which backend is live.
Role and tenant targeting, per-ministry rollouts, percentage releases, cloud-neutral.
Governed Postgres persistence with write-deduplication and idempotency, for apps that own data.
App metadata, versioning, and lifecycle governance carried in the charter itself.
How it works
Generation runs through charter new, a staged pipeline with gates between stages. An app that skips the pipeline has no provenance, and an app without provenance fails conformance. The pipeline is model-agnostic: the generating model sits behind a swappable provider interface, like every other provider in the platform.
A plain-language solution spec: what the app does, its sources, cadence, outputs, and how it behaves when things fail. The spec is plain language. The translation stage proposes a charter with a rationale per field, and a person concludes ownership and classification, with the answer and the respondent recorded.
charter new assembles each stage's prompt from the spec, the live schema, and the platform templates, generates through the model provider, and gates every stage. Nothing advances past a failed gate.
The app's charter is validated against the same schema the runtime enforces. charter check runs independently after the pipeline: conformance is verified, not claimed. Owned-data apps route automatically to heightened review.
The run report captures the exact prompts sent to the model, the model identity, and the schema version, referenced from the app's provenance block. Provenance is not a runtime capability, it is the platform's answer to the question no model can answer: who authorized this app, and how was it made.
Every chartered app can prove how it was made.
Governance
Non-invasiveness to existing systems is absolute in both tiers. What varies is not whether apps can write, both tiers can, but who holds authority over the data. Ownership is never a silent default: it is declared, bounded, and machine-checked.
Not read-only. Consuming apps submit requests, trigger workflows, and update records, always through existing systems' sanctioned interfaces. What they never do is become the official record: source systems stay authoritative, and the app holds no durable state beyond caches and operational artifacts. Most apps belong here.
The app owns a Postgres database and becomes the system of record for a bounded domain. Legitimate, and deliberately expensive. It cannot pass validation without declaring:
Deployment
Charter is cloud-agnostic and built on open standards: OIDC for identity, OpenTelemetry for observability, OpenTofu for infrastructure. The portable path targets any conformant Kubernetes cluster, including sovereign cloud, on-prem, and air-gapped environments, with no cloud-provider dependency in the plan. The same app moves between environments by configuration alone. Certification currently has one public-registry dependency, the audit gate's advisory lookup, logged as a finding; offline certification is not yet claimed.
An optional Azure-native path (Bicep, Container Apps) exists as a convenience for teams already committed to Azure. It is not part of the portability claim. AWS and GCP provider implementations are deferred and incremental behind the same interface.
Status · September 2026