Agents will run entire businesses.
Humans keep the final word.

The endgame is not AI-assisted clicking. It is agents operating end to end, with humans holding the one undelegatable role: final judgment on safety, health, money, and people. That world needs trustworthy runtimes more than it needs smarter models. Every action recorded, every consequential step signed by a human, every cost bounded before it is spent.

Build the guardrails now, and automation gives people their time back instead of taking their agency away.

Agents are being hired.
Nobody built their back office.

• They take irreversible actions unsupervised. 2025-26's headlines: production databases deleted despite explicit freezes, backups wiped in 9 seconds, support bots inventing policy.
• They spend without limits. $81k burned in a week by one employee; "tens of thousands" on a $200 plan; one org reportedly ~$500M in a month with no caps set.
• They leave no defensible record, courts issued six-figure sanctions for unverified AI output; regulators now explicitly flag missing agent decision-trails.
• They die mid-task, a crash, deploy, or provider outage loses hours of stateful work.

Pick two of three.
Nobody we tested ships all of it.

Verified against each vendor's public docs, July 2026. Budget enforcement is the empty column across the entire market.

One runtime. All three.
Zero dependencies.

• Durable runs, every state change persisted before execution continues; crash-resume from any process; 7-state machine.
• Human approval gates + policy rules, dangerous tools pause durably; "under $50 auto-approve" is one line; a human can approve, deny, edit the call's arguments, or answer it directly, every decision journaled with who made it.
• Hard budgets, token and USD caps enforced before each model call, not reported after the invoice.
• Deterministic replay, any production run re-executes offline for $0.00, or diffs against a new model/prompt. Incidents become regression tests.
• Observable and attributable, one call exports OpenTelemetry spans (invoke_agent, chat, execute_tool) with token usage to any OTLP backend; run tags attribute every dollar to a customer. Both zero-dep.
• Durable MCP, wraps any unmodified MCP server's tools with all of the above, and exposes Nexus itself as an MCP server.

We didn't build a framework.
We published a format.

Radically smaller.

Measured July 2026, Node 22, reproducible script in the repo. Zero dependencies isn't minimalism for its own sake, it's the entire npm supply-chain attack surface, deleted, in the year attackers started trojanizing AI tooling packages.

The run record is the execution.

Same primitive,
every regulated workflow.

• Customer support, refunds under $50 auto-approve by policy; above, a human decides from Slack. Exposure per ticket: capped.
• Finance, four-eyes on payment tools as a runtime invariant; the journal maps to books-and-records retention.
• Healthcare, local models on-prem, PHI never leaves; every patient-affecting action gated to a clinician, by name.
• Legal, filings gated to a responsible attorney; the diligence record exists by construction.
• DevOps, terraform_apply and delete_* pause for approval, enforced by the runtime, not by pleading with the model.

The last 12 months wrote our sales deck.

• Replit / SaaStr (Jul 2025), agent deleted a production DB through an 11× ALL-CAPS code freeze → approval gates make the pause a runtime invariant, not a prompt suggestion.
• PocketOS (Apr 2026). DB + backups gone in 9 seconds via an over-privileged token → gated infra tools + a journaled record of the attempt.
• Runaway spend (2025-26). $81k/week, ~$500M/month reported → pre-flight budget caps; the halt costs $50, not the invoice.
• Cursor's support bot (Apr 2025), invented policy shipped straight to customers → outbound comms gated; the journal, not Reddit, tells you first.
• MCP attack wave (2025-26), injections and poisoned tools → gates + journals at the tool call, where the damage happens.

Every agent in production
needs a runtime underneath.

• The agent wave is real. MCP went from launch to Linux Foundation with ~10,000 public servers in one year; every major vendor ships agent SDKs.
• The governance gap is unowned, durability + approvals + budgets as one self-hosted layer has no incumbent (verified against the market, July 2026).
• Regulation is arriving on schedule. EU AI Act high-risk obligations bite August 2026; FINRA flags agent audit-trails; explainability tops bank concerns. Audit-grade runs stop being optional.
• The wedge compounds, open-source adoption → OAR becomes the audit artifact → enterprise support, compliance packs, and managed control planes monetize on top.

Priced against single incidents.

• One blocked destructive action, production-DB recovery incidents cost days of engineering + customer trust; the gate that prevents one pays for the rollout.
• One capped runaway, the documented $81k week becomes a $50 halt + notification. Budget caps are the difference between an anecdote and a board incident.
• One audit passed. "show every agent action in Q3, who approved each, reproduce run #4417" answered with files and a replay, not a war room.
• Engineering months returned, durability, approvals, budgets, audit, replay: rebuilt in-house at every company today, badly, ~120+ LOC per stack before storage and resume plumbing. Ours: 25 lines, batteries included.

Not a concept. It runs.

• v0.2 shipped, runtime, approvals + policies (approve/deny/edit/respond), budgets, replay, durable MCP both directions, OpenTelemetry export, streaming + cancel, run tags, four storage adapters, dashboard, CLI
• 171 tests, CI on Node 22 + 24, including crash-resume, spec conformance, and MCP wire-format suites
• OAR 0.2 published, CC0 spec + JSON Schemas, with two independent implementations: in-box validators and a stdlib-only Python reader
• Live demos, offline end-to-end demo, interactive web playground, cross-process approve verified
• Honest benchmarks, measured, dated, reproducible-by-script, caveats included

From runtime to standard.

• Shipped since v0.1, OAR validators + the stdlib Python reader, OpenTelemetry export, streaming + cancellation, Postgres storage, run tags, and Nexus as an MCP server, all in the box today.
• Now, npm publish; hardening OTel semantic-convention coverage and the Postgres adapter under load.
• Next, dashboard SSO and retention policies; more OTLP backends verified end-to-end; richer OAR tooling.
• The endgame. OAR as the industry's default audit format for agent execution; Nexus as its reference implementation and the enterprise default.

Trust infrastructure
can't be a black box.

• The buyer is the security team, zero dependencies + auditable-in-an-afternoon source is a procurement feature, not an ideology.
• The moat is the standard. MIT code gets adopted; CC0 formats get cited; whoever holds the reference implementation holds the roadmap.
• No hostage dynamics, runs are portable files; leaving is easy. That's exactly why serious teams commit.

Bring us one workflow.

Enterprises: pick one agent workflow that touches money, records, or customers. We'll wire it end-to-end as a design partner, durable, gated, budgeted, auditable, and you keep the MIT code either way.

Investors: the agent runtime layer is being decided in the next 18 months. We have the working runtime, an honest, reproducible benchmark story, and the format play nobody else has started.

What we don't claim.

• We don't make models faster or smarter. "Faster" means install, import, audit, and operate.
• We don't solve prompt injection, we bound its blast radius and journal the evidence. (OpenAI itself says injection may never be fully solved.)
• We don't have paying customers yet, v0.2, design-partner stage; the case studies are architectural analyses of public incidents, not testimonials.
• Temporal-class horizontal orchestration is real and sometimes right, our bet is most agent teams need governance long before they need a workflow cluster.

nexusEvery AI agent run: a file you can audit, replay, and resume.

nexus-agent-runs.netlify.app · github.com/BULMKT/NexusAIAgentFramework · aj4hmed91@gmail.com