Per-counterparty trust, behavioral rules with lifecycle, cognitive memory, and an action ledger with provenance. When the substrate decides an action should happen, Cortex dispatches a signed trigger to your registered handler — you execute in your stack, on your channels, in your UI. MCP-callable from any LLM client.
Four named, sourced incidents from the past 18 months. Every one is the failure mode of “agent acting on a user's behalf without earned trust and without a ledger.” The shape repeats across verticals: outreach, scheduling, transactions, code changes. The failure isn't domain-specific; the governance gap is.
One-click remote code execution on every connected account via a WebSocket origin-validation flaw. Auth-token theft leads to arbitrary command execution. Not a prompt-injection vector; a classic web-security flaw shipped in an agent platform.
Sources: SonicWall · SentinelOneZoomInfo and Airtable publicly denied being 11x.ai customers and threatened legal action. Fake customer claims persisted on the site after companies demanded removal. Multiple sources put three-month churn at 70–80%.
Source: TechCrunch investigationMultiple users report sending 1,000–1,400+ cold emails for zero replies. Recipients identify the AI on first read. LinkedIn temporarily banned Artisan in January 2026 for platform abuse. Annual contracts; limited cancel windows.
Sources: Coldreach · MarketBetterVerified Trustpilot reviews document a $550 unauthorized credit overage with no warning, charges after account deletion, and no self-serve cancel. CostBench puts true cost ~92% above listed price.
Sources: CostBench · TrustpilotFull sourcing and dates: see the Named Incident Citations artifact (verified May 2026).
Webhook event delivery is now table stakes — Armalo, Anthropic, OpenAI all shipped it in 2026. What's not table stakes: what fires the trigger. Cortex fires on a per-counterparty learned signal — commitment going stale, behavioral rule firing, trust threshold crossed, contradiction detected. Not on a cron, not on a Sentry alert, not on a session ending. And as your users adopt more AI tools built on Cortex, their trust graph compounds across every handler you register. Starting over means starting from zero.
The moat · intelligence-driven triggers + cross-app routing (compounds over time)Read state and let your agent decide (state-only), delegate to Cortex's policy engine and get back approve / human-required / reject (engine), or both. Per primitive, your choice. When the substrate decides an action should happen, Dispatch fires a signed trigger at the handler you registered.
cortex.entities.lookup({ type: "person", email: "marcus@..." })person (the dogfood implementation); register any entity type for your vertical without re-implementing the substrate.cortex.rules.evaluate({ context })cortex.trust.gate({ userId, entityId, actionClass })agent_version + world_version + rule_set_hash). Works identically across entity types.cortex.ledger.history({ scope })trigger.complete / trigger.reverse callback contract. You execute in your stack, on your channels.cortex.handler.register({ url, action_classes, webhook_secret })The five primitives above are the architectural shape. The substrate surface below is the API surface — what your code calls. Each family is tagged by priority P0 (ships July 20), P1 (ships July 20, evaluator polled at 5-min cadence), P2 (ships July 20 with a subset live and the rest labeled “Preview”). The runtime self-description is agent.capabilities() — what's live vs preview at any moment, callable from any MCP client.
meta.why_this_action · meta.why_this_notification · meta.what_rules_fired · decision.inspect · decision.historycounterparty.profile · counterparty.list · counterparty.activity · counterparty.classify · trust.posturecommitments.list · commitments.create · commitments.resolve · commitments.snooze · commitments.delegatecommitments.delegate preview — V2 (depends on Trusted Delegate).{client_namespace}.{action_class} for your vertical (transact, commit, deploy, code, whatever your domain needs). Participates in trust state machine + dispatch protocol identically to canonical classes. No internal enum migration.action_classes.register · action_classes.list · action_classes.deregistersubscriptions.create / list / delete · watchlists.add · alerts.setrouting.handlers · routing.preview · routing.policyrouting.handlers live MVP; routing.preview + routing.policy preview — V1.x+ (depends on routing engine).outcome="executed_modified" with the applied_payload. Substantive deltas demote trust + emit a rule candidate; cosmetic deltas emit a voice-style candidate without trust impact.feedback.signal · trigger.complete executed_modified outcome (ADR-0019 amendment)modification_delta path live MVP; other signal_kind values preview — V1.1+.patterns.list · insights.summarizepatterns.list live MVP; insights.summarize preview — V1.1.identity.about_me · identity.preferences · availability.currentidentity.about_me live MVP; identity.preferences + availability.current preview — V1.1.live / preview_limited / preview_coming_v1 / preview_coming_v2 at any moment.agent.version · agent.capabilities · agent.feature_flagsMem0 and Zep store facts about your user. Cortex governs the actions your agent takes based on those facts. Keep your memory stack; add the trust, ledger, and rule-lifecycle layer on top.
// facts about user (Mem0 / Zep)mem0.search(userId, query);// decision: approve / human-required / rejectawait cortex.trust.gate({ userId, entityId, actionClass });// provenance + reversal path (Article 22-ready)await cortex.ledger.append({ decision, reasoning, reversal_path });// register a handler — Cortex pushes signed triggers here when it decidesawait cortex.handler.register({ url, action_classes, webhook_secret });
Four additional calls. Different abstractions than memory. No migration. Memory still lives in Mem0 / Zep; Cortex layers the decision substrate + push dispatch on top.
When the substrate decides an action should happen, Cortex HMAC-signs an envelope and POSTs it to the handler you registered (push). When an MCP client wants to ask — action.pending(), memory.recall(), trust.check() — it calls in (pull). Same cognitive core, two shapes, your choice per integration.
Your stack stays the execution plane. Cortex HMAC-signs a JSON envelope with the trigger contents (action_class, counterparty, payload, reasoning, reversal) and POSTs to the URL you registered. You verify the signature, execute through your app's native channels, and call back trigger.complete or trigger.reverse. Full envelope spec at /pitch/docs/dispatch; copy-paste recipes for Trigger.dev, n8n, Zapier, and a plain webhook at /pitch/docs/recipes.
Founder dogfood note: The Cortex personal-AI chat app (iOS + Mac + web) runs against this same substrate as a privileged internal consumer — the founder's production instance, used to find every sharp edge before builders hit it. It is not the public reference architecture. The public reference is the minimal example handler repo + the recipes linked above. See ADR-0020 for the public/internal MCP surface boundary.
When Cortex decides, it HMAC-signs a JSON envelope and POSTs it to your registered handler URL. You verify the signature, execute through your app's native channels, and call back. The contract below is the shape every recipe (Trigger.dev, n8n, Zapier, custom-webhook) implements identically — pick a runtime, paste the handler, register the URL.
POST https://handlers.your-app.com/cortexX-Cortex-Signature: sha256=...X-Cortex-Trigger-Id: trg_01HXP9...X-Cortex-Idempotency-Key: idk_01HXP9...Content-Type: application/json{ "trigger_id": "trg_01HXP9...", "decision_id": "dec_01HXP9...", "action_class": "communicate", "mode": "ask" // or "act" / "notify_after" "counterparty": { "id": "entity_...", ... }, "payload": { "what": ..., "why": ... }, "reasoning": "...", "reversal": { "path": "..." }, "expires_at": "2026-05-28T14:31:00Z", "schema_version": "2026-07-20"}
// Success pathPOST https://mcp.cortex.jakeselby.com/v1/triggers/trg_01HXP9.../completeAuthorization: Bearer ...Idempotency-Key: cb_01HXP9...{ "outcome": "executed", // or "approved", "rejected", "deferred" "external_ref": "slack_msg_123", "executed_at": "2026-05-27T14:32:10Z"}// Reversal path (user undid the action)POST /v1/triggers/trg_01HXP9.../reverse{ "reason": "user undo within window" }
What lives on each side. Cortex owns the substrate: memory, rules, trust, ledger, and the decision-to-dispatch pipeline. Your handler owns execution: channels, OAuth, UI, retries on your side. Cortex guarantees at-least-once delivery with idempotency keys, 30-sec response timeout, exponential backoff, and a DLQ you can inspect via trigger.history. Full envelope spec, retry policy, and reversal contract at /pitch/docs/dispatch; copy-paste implementations at /pitch/docs/recipes (Trigger.dev, n8n, Zapier, custom-webhook, MCP-executor V1.1).
Three public, dated, enforceable commitments. Versioned in the repo. 60-day forward notice required to change any of them.
Send-class triggers fire only on a Principal-initiated state change or an earned-trust crossing — never on cold prospecting heuristics. No lead-generation triggers, no “network nurture” dispatches, no triggers without explicit user authorship of the underlying intent. The substrate refuses to dispatch what the user didn't start.
Autonomy graduates per-(action-class × counterparty), never globally. A blanket “trust this AI” setting does not exist. Reversals demote the pair automatically.
Per-user DEK with KEK held by the Principal. Cloud cannot decrypt without Principal interaction. Your data is not a training corpus; not anonymized, not aggregated, not sold.
Full text, enforcement details, and change protocol: Cortex Trust Commitments.
What we're trying to prove, dated and public. We'll publish what we hit and what we miss when the public MVP ships.
Status: targets, not yet achieved as of 2026-05-27. n=1, founder dogfood. Date-stamped and contestable. We'd rather miss in public than claim a number we can't defend.
MCP standardized this year. Any LLM client can call the cognitive substrate through one protocol. Pull-mode tools (memory.recall, trust.check, action.pending) are universal across Claude, ChatGPT, Cursor, Continue, your own client. The category-naming race for the layer above raw memory begins now.
Webhook event delivery from agent platforms is now table stakes. Armalo Labs shipped HMAC-signed agent webhooks April 2026; Anthropic Claude Managed Agents shipped May 2026; OpenAI ships Standard Webhooks. The transport stopped being differentiating six weeks ago. What still isn't commoditized: what fires the trigger. Cron-fires-on-time, Sentry-fires-on-error, session-fires-on-completion — none of those compound with usage. A per-counterparty behavioral signal does. (Note: the MCP spec's 2026-07-28 release candidate forecloses in-protocol server-initiated push; Cortex push is out-of-band webhooks, by design and by spec.)
Regulators are tightening on autonomous AI decisions. Provenance, audit trails, and contestable decision paths move from optional to required under GDPR Article 22 and the EU AI Act's high-risk classification. Action governance becomes a procurement requirement, not a feature, across every consumer-agent vertical with real users; banking, healthcare, communications, dev tools, e-commerce.
Public MCP server + trigger dispatch ship July 20, 2026, ~8 weeks out. The cognitive-substrate category gets defined in the next 18 months by whoever has real time-under-load data and a credible governance story. The substrate is in production today, used daily by the founder on the person entity type. The corpus only emerges by running.
Apple Intelligence owns the iMessage data moat. The foundation-model providers (Anthropic, OpenAI, Google) will close the flat-memory gap inside 12 months; Memory Bank, Memory Stores, and ChatGPT Memory are all closing in. Cortex doesn't compete on that layer. We're positioned on the layer they structurally won't expose: per-counterparty trust + intelligence-driven triggers dispatched to the customer's own handler, callable by any LLM, working over any entity type your application registers, with cross-app routing as the compounding moat once your users adopt multiple AI products on the substrate.
Foundation-model providers fire push triggers on their own session lifecycles (Claude Code Routines, Claude Managed Agent webhooks) — the trigger says “the session ended” or “the eval finished.” Memory layers (Mem0, Zep) store facts but have no trigger model. Agent-governance runtimes (Armalo, OpenBox, Sponsio, Agentic Control Plane) score the agent or the API key, not the relationship, and fire on score / pact / safety events. The intersection — per-counterparty trust + cognitive memory + intelligence-driven triggers dispatched to customer-registered handlers across multiple consumer AI apps — is what doesn't exist anywhere else, and it's why Cortex is positioned to work with Apple Intelligence and every major model, not to be replaced by them.
Background placeholder. Senior software engineer; building Cortex full-time as a single founder. The consumer product is in production daily for the founder; every architectural decision is shaped by what breaks in real use.
Founder bio in draft. Real wording, links, and credentials land before the public MVP launch on July 20, 2026.