The business is a graph.
Run it on one.
A business never stops changing — its software rarely keeps up. Lattice runs the whole business on one living graph, where new capabilities install like apps and evolve while everything runs — safe for humans and AI agents to change together.
Change it while it runs.
Most platforms freeze a business into someone else's data model — every new idea becomes an integration project. Lattice is the opposite bet: your business runs on its own instance of one living graph, and every capability on it is a package your team authors, reviews, reverses and evolves — AI-assisted — while the business runs. We build and operate the platform; you grow what runs on it.
Proposed, not deployed
A new lease rule, membership tier or access policy is authored as a package — by a person or an AI agent — and passes human review and deterministic validation before it is ever real. Intent plus review, not intent alone.
Attributed and replayable
One writer, one write path. Who submitted a change, which capability allowed it and what it touched is all recorded — so you can watch it live, scrub the history, and roll it back. Nothing mutates state in the dark.
Grows while it runs
Install or upgrade a package and its entities, operations, lenses and roles come online in the running platform — no restart, no migration window. The system grows a capability instead of being taken down to change one.
# a capability is just a declaration — authored, reviewed, versioned, reversible entities: - unit # vtx.unit.<id> — aspects: .address, .listing operations: - SetListing # write path: operations → the one Processor - AssignUnitOwner lenses: - availableListings # read path: CDC → Refractor → NATS-KV - renewalsRead # Postgres + RLS: tenant OR landlord may read a row
A package declares entities, operations, lenses, permissions and orchestration. Install one and your instance grows a capability. Install two and they already know each other — they share the graph.
Enterprise-grade coherence — one model for the whole business — without the enterprise price tag, the year-long rollout, or the army of integrators.
AI-assisted at every layer.
The same pattern repeats up the stack: people set direction and hold the gates, AI does the heavy lifting — and all of it works because the graph explains itself.
build the platform
Lattice itself is designed, built and operated by an AI agent organization, with one human principal ratifying every design and every contract change. The showcase verticals — leasing, clinic, café, wellness — are working references that prove the patterns, not products for sale. The paper trail is public.
builds your business on it
Your business runs on its own Lattice instance. Your people — AI-assisted — author and evolve the packages and verticals it actually needs, web and mobile, against a graph that describes itself: entities, operations, permissions, all discoverable. New ideas become installed capabilities, not integration projects.
act on their behalf
Customers get clean front-ends today — and a graph their own assistants can safely act on: every operation is typed, authorized and attributed, so booking, renewing and approving can be delegated without fear. Edge Lattice puts each person's own slice of the graph on their own device, offline-first. Facet — the personal client built on it — turns that slice into the whole app: what you can see and do arrives as data, not as app releases. Both run today; the hosted demo is Facet, live.
A small core with sharp invariants.
Underneath, it's one graph of facts — vertices, their data in aspects, relationships as links — and everything is a package. Two paths, no exceptions: writes are operations through one writer; reads are lens projections. Every other component is a client of those two paths.
Two durable streams are the rails everything rides. External actors reach the graph only through the Gateway, which authenticates each one and stamps an unforgeable identity on every write. Writes land on core-operations; the Processor commits them and emits core-events, which the Refractor projects into lenses. Loom, Weaver, Bridge and the Chronicler are clients of those same two streams — they consume events and submit operations, exactly as your apps do.
Meet the components
scroll → · each links to its reference docDeclare the outcome. The graph gets there.
Most systems tell the computer how, step by step. Lattice Weaver lets a package declare what should be true — a goal, expressed as a lens over the graph — and then makes it so. It watches for the gap between the world and the goal, and closes it.
The important part: Weaver doesn't run a fixed playbook. Given a goal and the operations a package exposes, it plans — searching for the sequence of operations that reaches the goal, dispatching the next step, watching the result, and re-planning as reality changes. It carries no business logic of its own; every goal and every operation is package data. The same engine drives a lease to renewed, an unpaid balance to settled, an orphaned document to shredded.
Chains operations to a goal
Give it a target outcome and the operations available; Weaver synthesizes the ordered steps that reach it, dispatches the next one, and re-plans when it completes. The lease-renewal you see in the demo below is a real goal-authored target running this way.
Governs its own dispatch
A goal can declare rate budgets; Weaver paces its actions with a priority-fair scheduler, so a surge of work can't storm the system and urgent rows go first. Convergence, throttled to what the platform can absorb.
Catches goals that fight
When two goals would ping-pong the same data — each undoing the other — Weaver detects the oscillation and freezes both, surfacing the conflict to an operator instead of corrupting state in a silent loop.
One graph, four lenses.
For example: one mixed-use building — homes, a clinic, a café, a wellness studio. It runs itself: packages install, lenses switch. Take over whenever — pause the tour, toggle packages, switch personas. It's the same graph every time — each persona sees only their projection of it. That's the security model, not a visualization trick: access is a lens.
Built — and operated — by an AI agent organization.
Lattice's continuous improvement runs as an autonomous agent org: agents survey demand, design features, build them, and hunt each other's bugs — with a human ratification gate on every design and every frozen contract. It's the top layer of the same pattern the platform offers your team: AI does the work, humans hold the gates. And it isn't a marketing claim — the paper trail is in the repository.
Those steps are played by a small cast — most of them one AI architect wearing several hats, with a human holding the gate.
Meet the team
one human · an AI organizationThree independent review lenses — a blind hunter that sees only the diff, an edge-case hunter, and an acceptance auditor — run on every substantial change. Frozen contracts can only be amended by a staged, human-approved diff. The planning boards, 100+ design documents, and every ratification decision are versioned in the open repo.
Plenty of tools now make it safe for AI to write your app's code. Lattice makes it safe for AI to operate the business itself — the same graph, one writer, a human ratifying every change.
Where it stands.
A platform you can run today, with the roadmap in the open. The "not yet" column is deliberate — it's what makes the "today" column trustworthy.
Runs today
- The full core: Processor (the sole writer), Core KV graph, Refractor + lenses — NATS-KV and Postgres with row-level security
- Orchestration: Loom procedures, and Weaver's deterministic goal-regression planner — it plans and dispatches the operations that drive the graph to a declared goal (lease renewal runs this way, as a goal, not a script)
- The Gateway trust boundary with real-actor write authorization end-to-end: the verticals submit as role-scoped users straight from the browser — genuine allow-and-deny — with JWT validation, actor stamping, revocation and RLS-enforced reads. And there is no path around it: the app processes are denied the operations stream at the transport layer, and allow-all authorization refuses to boot outside tests
- Operator login for the console — a scoped, non-root operator role, not a superuser
- Crypto-shredding: sensitive aspect fields shredded end-to-end with audited reveal in the console; the object-store mechanism for whole documents is proven, its first vertical consumer is next
- The Augur — Weaver's AI reasoning tier: when the deterministic planner can't reach a goal it proposes a fix a human reviews before anything dispatches. Live on the real stack, CI-gated
- Four vertical apps end-to-end on the real stack: LoftSpace (apply → decide → sign → renew), Clinic (slot-grid booking with double-book prevention by construction — patients book for themselves), Café (house-tab ledger, payment and settlement, a combined statement) and Wellness (class schedule, booking, rosters) — and they compose: a completed Clinic visit can book a Wellness class through the shared graph, no integration code
- Loupe operator console: system map, vertex inspector, lens explorer, event stream, and the Chronicler-backed Time Machine (v1 replay) — and a public read-only copy runs over the live demo world at loupe.demo.operatinggraph.com: every write is capability-denied by the platform, because even the console holds a scoped role, not a key to the kingdom
- Edge Lattice — the sovereign per-user node: your own slice of the graph mirrored on your device, offline-first — optimistic edits reconciled by revision, per-identity confinement enforced at the connection layer itself, on-device key sessions for protected fields, and the same engine compiled to WebAssembly running in the browser
- Facet — the discovery-driven personal client, live: sign in and your world arrives as data over your personal lens — services, forms, tasks, and staff worlds (a staff member's app derives from where they work, with PII worklists behind row-level security) — rendered from a fixed widget vocabulary, zero app change when a new service is wired in. The hosted demo at demo.operatinggraph.com is Facet over the showcase building, resident and staff sign-in alike
- AI-proposed capability changes land through a live review console: an agent authors the package diff, a human reviews and applies it in Loupe, and the server re-validates before anything installs
- A package-based platform: install or upgrade a capability and its entities, operations, lenses and permissions come with it — new DDL, lenses, roles and operations activate live, no restart — every change guarded by a multi-job CI with package-verify and convergence e2e gates
In flight & deferred — by design
- Whole-document crypto-shredding — the object-store mechanism is live; its first vertical consumer (lease documents) is queued
- Multi-cell sharding and HA clustering — designed and ratified, deliberately deferred until a production-scale driver exists
- External vendor adapters are development fakes today; the bridge and its async adapter contract are real
- The hosted demo runs the dev-trust posture on purpose — demo personas over the real pipeline, reset nightly; production identity federation arrives with the first design partner
- No production deployments yet — this is a platform seeking its first design partners
Designed in the open.
What's next is already specified and ratified — sequenced, not shipped. Like everything else, the roadmap lives in the public repository.
Per-visitor sandboxes
The hosted demo is live — the real stack over a shared showcase world, reset nightly. Next: throwaway per-visitor instances, so you can install a package into your own world and watch Weaver converge on it in real time, then throw the whole world away.
Multi-cell & HA
Horizontal sharding across cells and high-availability clustering — designed and ratified, deliberately deferred until a production-scale driver exists. The architecture already assumes it; the single-node build doesn't need it yet.
Run it yourself.
The demo above is a simulation. This is not:
# requires Docker + Go git clone https://github.com/operatinggraph/lattice cd lattice make up-full # kernel + orchestration + packages + Loupe → :7777 make up-loftspace # LoftSpace vertical → :7788 make up-clinic # Clinic vertical → :7799 make up-cafe # Café vertical → :7801 make up-wellness # Wellness vertical → :7802 make up-facet # Facet, the personal client → :7810
What you'll see:
- Loupe at :7777 — the live graph, every lens, the event stream, the Time Machine
- LoftSpace at :7788 — browse listings, apply, sign, renew
- Clinic at :7799 — providers, slot-grid booking, staff views
- Café at :7801 and Wellness at :7802 — tabs & settlement; classes & rosters
- Facet at :7810 — sign in as a resident or staff; the whole app arrives as data over your personal lens
Source-available: cloning and running locally for evaluation is welcome — see the LICENSE for exact terms.
Source-available, deliberately.
Lattice is source-available, not open source. The code is public to read, run locally, and evaluate; all other rights are reserved. That's a deliberate posture — the platform's value should be legible without being given away.
If what you've seen maps to something you're building — commercial licensing, a design partnership, or acquiring the IP outright — I'd like to talk.