# Runestone: Defensive AI, read-only

Understand line / Stop 03. Defensive AI for code estates, read-only by architecture.

Runestone is defensive AI for software estates. Read-only crawlers map code, databases and integrations into a versioned graph, inside your own subscription.

## What It Does

- **Machine-Readable Estate**: Read-only crawlers catalogue source code, stored procedures, database objects, APIs, configs and integrations into a versioned, branchable graph.
- **See Real Risk**: RuneWeave maps each finding to its blast radius, so teams prioritise fixes by operational consequence.
- **Living Documentation**: Generates plain-language documentation continuously, so new engineers get up to speed and tribal knowledge stays put.
- **Triage and Routing**: CXQL queries, dashboards and routing rules filter findings and assign them to the right owner or playbook.

## Control and Audit

- **Guardrails**: Read-only by architecture: scoped service principals, replica access and an enforced no-write posture. Defensive use only, with no exploit generation.
- **Where a person decides**: Findings are structured for remediation and routed to an owner, who tests fixes and validates outcomes without risking production.
- **What gets logged**: Every commit, annotation and agent action is versioned with chain of custody.

Included on every line: Tenant isolation, Full audit trail, POPIA and GDPR, Model choice. Praxis is the agent framework in VectorMind. Agents plan, call tools and validate their results, and every step is logged with its tool inputs and outputs.

## Where It Runs

- **Deployment**: Inside your own cloud subscription, so code, graph and findings stay under your control.
- **Built**: In Pretoria, with sovereign deployment options.
- **Platform**: Cloud, private cloud or sovereign on-premise environments, with tenant isolation.
- **POPIA**: CohesionX platforms never train on your sensitive information, and follow strict access controls, encryption and compliance protocols, including POPIA and GDPR.

## Specs

- **Inputs**: Source code, Stored procedures, Database objects, APIs, Configs, Integrations
- **Outputs**: Versioned graph, Findings with blast radius, Plain-language documentation
- **Integrations**: CXQL, CVE feeds, Historical logs, Telemetry, Test results
- **Deployment**: Your cloud subscription, Read-only replicas

## On the Line

Runestone is on the Understand line with [Iris](/products/iris.md), [ConversationIQ](/products/conversationiq.md).

Book a walkthrough: info@cohesionx.co.za