NewBegin AI -- Zero-Trust AI Governance Platform

Built on Trust

Privacy and ethics are not features -- they are the foundation. Every capability is designed with human oversight at its core.

NEOops Command Center

v3.4

18 Controls ActiveZero Trust

NEOops Unified Operational Framework

Zero-trust, PQC-secured, AI-governed operations pipeline. Synchronizes Figma design agents, DelusionGuard meltdown scoring, Agentic RAG retrieval, Golden Signals monitoring, K8s PQC-sealed secrets, and burn-rate SLO alerting into one cohesive TypeScript 6.0 system.

Active Agents8Figma + IaC + RAG + Gov

IaC Resources247AWS + GCP + Azure

NEOops Uptime99.87%99.9% SLO Target

Meltdown Score0.028Threshold: 0.15

PQC mTLS P954.2msML-KEM Kyber-1024

K8s Sealed100%PQC-encrypted

HITL Approval96.3%ML-DSA-65 Signed

Drift Rate0.4/dayTerraform Auto-Scan

Security Controls

Control	Technology	Status	Metric
Clerk Zero-Trust Identity	Clerk Edge	Active	100% auth required
PQC mTLS Transport	ML-KEM (Kyber)	Active	P95 < 5ms
Rate Limiting	Redis Token Bucket	Active	1000 req/min
HMAC-SHA256 Webhooks	Web Crypto API	Active	100% verified
DelusionGuard Gate	Meltdown Scorer	Active	Threshold: 0.15
ML-DSA-65 HITL Signing	NIST FIPS 204	Active	96.3% approval
K8s PQC-Sealed Secrets	ML-KEM Kyber	Active	100% sealed
Binary Authorization	GKE Admission	Active	Zero bypass
Golden Signals Scorer	bandScore() weighted	Active	4 signals
Terraform Drift Detection	CronJob 4h	Active	0.4 drift/day
Confession Channel	Honesty Scoring	Active	> 0.95 rate
Circuit Breaker	Redis-backed	Active	5 fail/60s trip

Production Readiness

KEDA ScaledObject v2 Deployed

0-to-20 replicas with fallback

pnpm ignoredBuiltDependencies

Sharp/esbuild/turbo excluded

Vitest E2E Harnesses

90% coverage KEDA + DelusionGuard

8 Active Agents Deployed

Figma + IaC + RAG + Governance

TypeScript 6.0 beta

Strict mode + noUncheckedIndexedAccess

Zero mocks

Real OpenAI, ChromaDB, OTel

Immutable types

Readonly modifiers prevent mutations

ES2025 features

RegExp.escape, Promise.try, Temporal

Golden Signals converted

Python -> TypeScript

OTel distributed tracing

GCP + OTLP adapters

ML-DSA-65 PQC

Signature verification in CI

Binary Authorization

GKE admission control

Vitest hermetic tests

90% coverage gate

TS7 Go readiness

stableTypeOrdering alignment

Terraform IaC Agent

Multi-cloud drift 0.4/day

247 IaC Resources

Cryptographically verified

Drift Detection Automated

30-minute scan interval

State Locking PQC-Sealed

GCS backend ML-KEM

Agent Capabilities

Production-grade controls mapped to the NewBegin AI NEOops architecture (TypeScript 6.0)

Codex Layer Annotation

INFO

Reads the selected Figma node, builds a full CodexLayer JSON payload with schema v2.0, and persists it via setPluginData. Tracks node geometry, export settings, component IDs, and visibility state.

setPluginDataJSON Schema v2

DelusionGuard Agent

CRIT

Computes a real-time meltdown_score analyzing action disempowerment patterns, reality distortion signals, and conversation turn counts. Scores above 0.15 auto-block writes and route to human review.

meltdown_scoreHITL Gate

OWASP Security Scanning

CRIT

Scans all text children for PII (email, phone, SSN patterns), leaked API keys, hardcoded secrets, and XSS vectors before persisting annotations. Blocks or redacts detected violations.

PII DetectionSecret Scan

Status Badge System

INFO

Creates color-coded FRAME+TEXT badges positioned above annotated nodes. Supports Pending, Reviewed, Approved, Flagged, and Meltdown states with severity labels (INFO through CRIT).

Visual Badge5 Status Levels

Agent Context Tracking

WARN

Every annotation records whether it originated from a human, AI agent, or hybrid source. Tracks agent ID, conversation turns, task type, and links to the DevGPT A10 observability layer.

DevGPT A10Source Attribution

Export and Webhook POST

WARN

Exports all annotated layers as structured JSON with summary statistics. Supports POST to arbitrary endpoints for integration with NewBegin AI webhook listeners with HMAC-SHA256 verification.

HMAC-SHA256Webhook POST

NEOops Workflow Engine

CRIT

3-phase operational pipeline: Edge Ingress (Clerk + PQC mTLS), Core Execution (DelusionGuard + parallel governance), and Cryptographic HITL (ML-DSA signed). SRE burn-rate analytics and error budget contracts.

NEOopsBurn-Rate SLO

K8s Secrets PQC-Sealed

CRIT

All Kubernetes secrets encrypted at rest using ML-KEM (Kyber) post-quantum key encapsulation. Zero plaintext secrets policy enforced via admission controller with 100% seal ratio monitoring.

PQC-SealedZero Plaintext

NewBegin AI Agent Map

NEOops-synchronized: Figma API capabilities mapped to zero-trust agent controls. All 7 agents Active.

Agent	Figma Endpoint	Zero-Trust Control	OTel Span	Status
DesignRetrievalAgent	GET /v1/files/:key	Read-only PAT, team-scoped	figma.api.files.get	active
DesignFeedbackAgent	POST /v1/files/:key/comments	HITL approval + ML-DSA signed	figma.api.comments.post	active
DesignEventListener	Webhooks (FILE_UPDATE)	HMAC-SHA256 verification	figma.webhook.received	active
DesignTokenAgent	Variables API	Drift detection every 30m	figma.tokens.sync	active
DelusionGuardAgent	Internal pipeline	meltdown_score < 0.15 gate	gen_ai.meltdown.*	active
DesignObservabilityAgent	Usage/analytics	Read-only, Grafana feed	figma.analytics.*	active
NEOopsOrchestrator	Internal pipeline	PQC mTLS + K8s sealed secrets	neoops.orchestrate.*	active

NEOops Operational Workflow

3-phase pipeline: Edge Ingress, Core Execution, Cryptographic HITL

SRE Error Budget Contract

SLO: 99.9% pass DelusionGuard without Tier 3 HITL (30d)
Error Budget: 0.1% (mathematically provable via Prometheus)
Fast Burn 14.4x: consumes 2% budget in 1h, PAGE sre-primary
Slow Burn 3x: consumes 5% budget in 6h, TICKET ai-platform-queue
Multi-window: overlap required (1h+5m, 6h+30m) to prevent false pages
SLI Intervals: pre-computed at 5m, 30m, 1h, 6h recording rules

NEOops SRE Metrics

SLO/SLI definitions synchronized with burn-rate analytics and PQC controls

SLO Target< 5msPQC mTLS Latency P95histogram_quantile(0.95, rate(envoy_pqc_mtls_duration_seconds_bucket[5m]))

SLO Target< 0.10Meltdown Score P99histogram_quantile(0.99, rate(gen_ai_meltdown_score[5m]))

PAGE Threshold< 1.44%Fast Burn Rate (14.4x)job:gen_ai_evaluations:error_rate1h > (14.4 * 0.001)

TICKET Threshold< 0.30%Slow Burn Rate (3x)job:gen_ai_evaluations:error_rate6h > (3 * 0.001)

30-day Window0.1%Error Budget Remaining1 - (sum(rate(gen_ai_evaluations_total{outcome='meltdown_rejected'}[30d])) / sum(rate(gen_ai_evaluations_total[30d])))

SLO Target> 95%HITL Approval Ratesum(rate(hitl_mldsa_sign_total{result='approved'}[5m])) / sum(rate(hitl_mldsa_sign_total[5m]))

Zero Plaintext100%K8s Secrets PQC-Sealedk8s_secrets_pqc_sealed_ratio{namespace='newbegin-ai'}

Zero Bypass100%Webhook HMAC Passrate(figma_webhook_hmac_pass_total[5m]) / rate(figma_webhook_total[5m])

Source Files

Drop these into your Figma plugin folder, compile main.ts, and run

manifest.json

json

{
  "name": "NewBegin AI Codex Annotator",
  "id": "newbegin-ai-codex-annotator-001",
  "api": "1.0.0",
  "main": "main.js",
  "ui": "ui.html",
  "editorType": ["figma"],
  "networkAccess": {
    "allowedDomains": ["*"],
    "reasoning": "POST codex-layer JSON to NewBegin AI webhook endpoints, AIOps telemetry"
  },
  "capabilities": [],
  "permissions": [],
  "documentAccess": "dynamic-page",
  "relaunchButtons": [
    {
      "command": "annotate",
      "name": "NewBegin Annotate",
      "multipleSelection": false
    }
  ]
}

Live Schema Preview

Toggle status to see how the NewBegin AI CodexLayer v2.0 JSON output changes. Includes agent context, OWASP flags, NEOops phase telemetry, K8s PQC-sealed status, and meltdown scoring.

Annotation Status

Badge Preview

NB APPROVED [INFO]

Your Figma layer

Agent Context

Source: hybrid
Meltdown Score: 0.02
DelusionGuard: PASSED
HITL Required: NO

NEOops Status

Phase: 2
PQC mTLS: VERIFIED
K8s PQC-Sealed: SEALED
Burn Rate: nominal
Circuit Breaker: closed

newbegin-ai-codex-v2.json

{
  "schemaVersion": "2.0.0",
  "nodeId": "42:108",
  "nodeName": "Hero/CTA Button",
  "nodeType": "INSTANCE",
  "status": "approved",
  "severity": "info",
  "annotations": [
    {
      "text": "Needs contrast check on dark theme",
      "author": "human",
      "createdAt": "2026-02-19T10:00:00.000Z",
      "agentGenerated": false
    },
    {
      "text": "Accessibility audit passed",
      "author": "newbegin-agent",
      "createdAt": "2026-02-19T10:15:00.000Z",
      "agentGenerated": true
    }
  ],
  "metadata": {
    "width": 240,
    "height": 48,
    "x": 320,
    "y": 580,
    "exportSettings": [
      "PNG",
      "SVG"
    ],
    "componentId": "12:34",
    "childCount": 3,
    "visible": true,
    "locked": false,
    "blendMode": "PASS_THROUGH"
  },
  "agentContext": {
    "source": "hybrid",
    "agentId": "newbegin-design-agent-v1",
    "conversationTurns": 4,
    "taskType": "review",
    "meltdownScore": 0.02,
    "delusionGuardPassed": true,
    "hitlRequired": false
  },
  "owasp": {
    "piiDetected": false,
    "secretsDetected": false,
    "injectionRisk": false,
    "xssVectors": []
  },
  "neoops": {
    "phase": 2,
    "pqcMtlsVerified": true,
    "k8sSecretsPqcSealed": true,
    "burnRateStatus": "nominal",
    "circuitBreakerState": "closed"
  },
  "timestamp": "2026-02-19T14:30:00.000Z",
  "signature": null
}

Agent Request Console

Execute an agent request through the NewBegin AI NEOops control plane

Response

Submit a request to see the agent response

Governance Pipeline Console

5-phase Clerk + OTel + DelusionGuard pipeline adapted for Vercel serverless. NEOops-synchronized: PQC mTLS, K8s PQC-sealed secrets, burn-rate SLO-gated.

1Identity Enforcement

2Quantum Security

3Governance Evaluation

4HITL Webhook

5Fulfillment

Pipeline Result

Submit a request to run the 5-phase governance pipeline

DesignObservabilityAgent

Active

NEOops Grafana feed | figma.analytics.* | neoops.orchestrate.* | Auto-refresh 15s

End-to-End Flow

Canonical request path through the NEOops zero-trust control plane (TypeScript 6.0 / es2025)

PHASE 1: EDGE INGRESS & AUTHENTICATION
  User  -->  Clerk Identity Edge  (zero-trust verify)
        -->  PQC mTLS Termination  (Envoy + ML-KEM / Kyber)
        -->  Lua Rate-Limiter  (Redis token bucket, anti-DoW)
        -->  K8s Secrets (PQC-sealed)  [ACTIVE]

PHASE 2: CORE EXECUTION & GOVERNANCE GATES
  Payload  -->  Orchestrator  (Vercel/GCP API Gateway)
           -->  DelusionGuardAgent  (meltdown_score)
           -->  Parallel: Hallucination | Sycophancy | Quantum Anomaly

  FAST PATH:  meltdown_score <= 0.15 AND no OWASP flags  -->  FULFILL
  TIER 3:     meltdown_score >  0.15  -->  Circuit Breaker trips
              -->  Shadow LLM (Self-Check GPT)  -->  GuardrailAgent

PHASE 3: CRYPTOGRAPHIC HUMAN-IN-THE-LOOP
  Vercel  -->  202 PENDING_HUMAN_REVIEW  (async webhook, prevents 504)
  SHA-256  -->  signDecision(traceId + status + timestamp + payloadHash)
  Operator  -->  ML-DSA (Dilithium) digital signature
             -->  Immutable, non-repudiable audit trail (SHA-256 verified)

OBSERVABILITY
  OTel spans (gen_ai.meltdown.*, figma.analytics.*)
     -->  Prometheus  -->  SLI Recording Rules (5m, 1h, 30m, 6h)
     -->  Burn-Rate Alerts: 14.4x PAGE | 3x TICKET
     -->  Alertmanager  -->  PagerDuty / ServiceNow

Security Controls

Clerk Zero-Trust Identity EdgeActive
PQC mTLS (ML-KEM / Kyber)Active
Lua Rate-Limiter (anti-DoW)Active
HMAC-SHA256 Webhook VerificationActive
SHA-256 Decision Signing (Web Crypto)Active
PQC Quantum Signature (ML-DSA)Active
Circuit Breaker (Redis-backed)Active
GCP SA Least-Privilege (Terraform)Active
ML-DSA Cryptographic HITL SigningActive
DesignObservabilityAgent (Grafana)Active
K8s Secrets (PQC-sealed)Active
NEOops Orchestrator PipelineActive

QA/QC Engineering Gates

Build --> SAST --> Unit Tests --> Integration --> Canary --> Full Deploy
Hallucination: SelfCheck GPT + NLI model + evidence extraction
Sycophancy: fine-tuned classifier, env-configurable threshold
Confession channel: honesty rate scoring, counterargument tracking
SHA-256 signed decisions: every governance result cryptographically verified with timestamp
Async HITL: 202 PENDING_HUMAN_REVIEW prevents Vercel 504 timeout
Terraform-managed GCP SA: per-secret IAM binding, not project-wide
K8s Secrets PQC-sealed: Kyber + ML-KEM encrypted at rest
Canary: Argo Rollouts 5% > 25% > 50% > 100% with auto-rollback
NEOopsOrchestrator: 3-phase pipeline (Edge, Core, HITL) with burn-rate SLO gating

NewBegin AI

Built on Trust

Your Data, Your Control

Human Always in the Loop

Transparent AI Governance

Ethical AI Boundaries

NEOops Command Center

NEOops Unified Operational Framework

Security Controls

Production Readiness

Agent Capabilities

Codex Layer Annotation

DelusionGuard Agent

OWASP Security Scanning

Status Badge System

Agent Context Tracking

Export and Webhook POST

NEOops Workflow Engine

K8s Secrets PQC-Sealed

NewBegin AI Agent Map

NEOops Operational Workflow

Edge Ingress & Authentication

Core Execution & Governance Gates

Cryptographic Human-in-the-Loop

SRE Error Budget Contract

NEOops SRE Metrics

Source Files

Live Schema Preview

Agent Request Console

Governance Pipeline Console

DesignObservabilityAgent

End-to-End Flow

Security Controls

QA/QC Engineering Gates

NEOops SRE Metrics

Agent Request Console

Governance Pipeline Console

DesignObservabilityAgent