PWOS governance layer
pwos-core publishes reusable TypeScript packages and reference patterns for PII boundaries, audit evidence, gated tools, workflow controls, documents, and related operational safeguards.
Role in the system
This is the governance and safety substrate in the public stack. It defines reusable controls around other applications and agent runtimes; it is not the client portal, the research engine, or a complete deployment of Protocol Wealth's private operating environment.
Current repository posture: The repository describes itself as a public reference and starting point under active development. Adopters remain responsible for their own security, compliance, deployment, and review.
Inspectable capabilities
Each capability is paired with a concrete inspection test. If the source does not support the claim, the page should change.
The package workspace includes deterministic PII-guard patterns that downstream applications can call before data reaches an AI workflow.
Check: Inspect packages/pii-guard and its tests. If inputs can pass the documented direct-identifier tripwires unchanged, this claim fails.
Audit-log primitives provide typed structures for recording governed events and their provenance.
Check: Inspect packages/audit-log and the validation paths. If a downstream event cannot carry the documented audit fields, this description is too broad.
The public package map includes MCP tool registration patterns so capabilities can be declared and governed rather than invented at runtime.
Check: Inspect packages/mcp-tools. If tool definitions bypass the declared registry and policy metadata, the control boundary does not hold.
Auth, compliance, document, workflow, planning-contract, security-header, and related packages can be adopted independently.
Check: Compare the README package map with packages/. A named capability without a corresponding inspectable package is a documentation defect.
Primary sources
Repository README →
Status, package map, architecture, adoption guidance, and open-versus-private boundary.
Package workspace →
The inspectable TypeScript packages described by the public capability map.
PII guard →
Deterministic PII tripwires and related package documentation.
Security policy →
Vulnerability reporting and the repository security posture.
System of systems
Reality check
The repository is open-source software provided under its stated license and without warranty. It is not investment, legal, tax, or cybersecurity advice. Protocol Wealth is an investment adviser, not a software vendor; publishing this code does not create a support, hosting, or implementation agreement.
Next
Start with the README, inspect the implementation and validation paths, and open an issue in the repository if the public description and source do not agree.