Scythian

How it works

In development

Inside your deployment

Scythian is being built to run beside the Omphalos gateway in your own deployment. It will read the figures Omphalos computes for each reader, and never the content behind them.

How Scythian connects

Two ways in, one door.

Scythian will call Omphalos’s HTTP door like any other app, and get figures back computed for the person reading them.

Your Omphalos deployment

Diagram. Inside your Omphalos deployment, the Scythian web app (a person-app, planned for the first release) and report jobs (a service principal, planned later) will each call the gateway’s HTTP door. The person-app door is built; the aggregate, person-view and report operations it would serve figures through are planned. The gateway runs the permission law, which is built and tested, over the record. Nothing per person leaves the deployment.

Nothing per person crosses this line.Scythian gets no database role, no vendor keys and no BI tool.

Two principals, both on the record.

Each will be a named identity in Omphalos, with its own grant and its own audit rows.

The web app Planned: first release

It will register as a person-app, like any other app on the node. A reader signs in as themselves, and every figure is computed for them at read time, so two people can see two different, correct pages.

  • For department leads and the executive sponsor first.
  • Group figures only by default.
  • The person-app door, with its tokens and app seats, is built in Omphalos today.

Report jobs Planned: later

A service principal holding an aggregate grant. It will write each month’s report into the deployment, so a stored report clears the same floors as a live page.

  • Stored inside your deployment.
  • Group pages export to PDF.
  • Omphalos’s law already admits a Scythian service under an aggregate grant, in its tests.

Figures, never content.

Five families are written into Omphalos’s law today, each over fixed 30-day windows. More are designed.

FamilyWhat it countsStatus
AdoptionWho uses AI tools, by tool, client, department and weekIn the law
UsageHow much AI tools are used, by client and departmentIn the law
OutcomesDrafts confirmed or rejected, edits accepted, pull requests, tickets resolved, documents publishedIn the law
Retrieval qualityWhether answers were given, suggested or held back, by kind of sourceIn the law
Knowledge gapsQuestions that found no grounded answerIn the law
And moreGoverned share, grounding, answer quality, agents, cost, governance, freshness and healthDesigned

“In the law” means the rules for each family are built and tested in Omphalos. No door serves them yet; that is Scythian’s first release.

Your deployment keeps it.

Scythian is designed to hold as little as it can.

Never read

Message text, documents, keystrokes, screens, emotion or off-duty use. No machine-learned inputs.

Designed

Stays inside

Per-person figures and stored reports stay in your deployment. Group figures leave only if your contract opts in, which is planned for benchmarks.

Designed

Never given

No database role: Omphalos’s store refuses one. No vendor credentials, and no BI tool inside the deployment.

Refusal built

In the code

The floor can be raised, never lowered.

From Omphalos’s permission law, store and tests as they stand today. Trimmed where marked, never changed.

packages/permissions/aggregate/stats.tsOmphalos
/**
 * Minimum number of distinct people who must stand behind a number before it
 * can be printed. Below this a "department" statistic is one person's diary.
 *
 * Five, not three: with k=3 a reader who knows two of the three contributors
 * (trivial in a small department) subtracts them and recovers the third.
 */
export const MIN_COHORT = 5;

/** A figure derived from content (topic counts, gap clusters) needs this many people (AG-5). */
export const CONTENT_FLOOR = 10;

// …
export function resolveMinCohort(requested?: number | null): number {
  if (requested === undefined || requested === null || !Number.isFinite(requested)) return MIN_COHORT;
  return Math.max(MIN_COHORT, Math.floor(requested));
}
A figure needs five people behind it, ten when it comes from content. A deployment can ask for a higher floor, never a lower one.
packages/permissions/law/read.test.tsOmphalos
describe('decideFamily: who may view a metric family (the law spec, 4.8)', () => {
  // …
  it('6. a live K12 admits its person, a member of its group or department, or its service', () => {
    // …
    const e = aggregate('e1', 'f_eng_adoption', [P('sam'), D('sales'), S('scythian')]);
    // …
    expect(verdict(view({ subject: service('scythian'), edges: [e] }))).toBe('allow');
    expect(verdict(view({ subject: person('bob') }))).toBe('no-path');
  });
A Scythian service may view a family of figures through an aggregate grant (K12). A person with no grant gets no path.
packages/store/unit-of-work.tsOmphalos
export async function openServiceStore(role: ServiceRole, backend: Backend): Promise<ServiceStore> {
  if (!isServiceRole(role)) throw new StoreError('refused', `${String(role)} is not a service role; the egress service and Scythian have none`);
  // …
The store opens only for Omphalos’s own services. Scythian has no database role.

Setup

Two ways to start.

Scythian always needs an Omphalos deployment, and enterprise Duit runs on one. Every step below is planned.

On enterprise Duit

Enterprise Duit runs on an Omphalos deployment, so the node Scythian needs is already there.

  1. Add Scythian to the deployment Duit runs on.

    Planned
  2. Register it as a person-app and choose who may view which figures.

    Planned
  3. Duit’s own activity feeds Scythian.

    Planned: later
About Duit at duit.sh

On your own Omphalos

You run Omphalos in your own cloud. Scythian runs beside its gateway.

  1. Run Scythian’s own image next to the gateway.

    Planned
  2. Register it as a person-app and choose who may view which figures.

    Planned
  3. Start from the door’s own record. One vendor-analytics importer, metadata only, comes later.

    Planned: later
About Omphalos at omphalos.sh

Not for standalone or solo Duit. The floors need at least five people, so Scythian is built for teams and companies, not one person on one computer.

Planning a rollout?

Tell us what your teams need to see. Scythian is in development, and early conversations shape it.