Acquisition
Novaprospect, LLC is open to acquisition.
Four products and the site you are reading, all of them built, all of them deployable on your own machine before you talk to anyone here. Investment is the alternative outcome and the same conversation.
Everything below can be checked. Each product states the command that stands it up, and the provenance of every codebase is named here rather than left for you to find in a commit log. Figures that move are cited as the command that prints them.
The inventory
Five codebases, and who wrote each one.
Stack and build artifact are read out of each repository's own manifest. The provenance column answers the question a buyer asks of the commit log, before the commit log answers it differently.
- Stack
- Rust client, Go dispatcher, SvelteKit audit console over a local store.
- Build artifact
- A Docker image for the console, and packaging for the client — macOS installer, systemd unit, container.
- Provenance
- Written here, from nothing.
- Stack
- Go server and React frontend, against MySQL and Redis. Ships the citadel server and the citadelctl CLI.
- Build artifact
- Cross-compiled binaries and a release container.
- Provenance
- A hardened, compliance-packaged downstream of the open-source osquery fleet manager. The commit log is largely upstream authorship and reads that way; what was done here is the rebrand, the packaging, the compliance-aligned query packs and the hardening on top.
- Stack
- Python 3.11 and above. A read-only evaluator that makes no network call while it runs.
- Build artifact
- The ksi-eval CLI, installable with pip.
- Provenance
- Written here. The evaluator subset is open source and public; the production emitter is not.
- Stack
- Next.js and React on Postgres, with Drizzle migrations.
- Build artifact
- A Docker Compose stack that brings up the database and the app together.
- Provenance
- Written here, from nothing.
novaprospect.cc
- Stack
- SvelteKit and TypeScript, prerendered.
- Build artifact
- A build deployed by pipeline on merge to the default branch.
- Provenance
- Written here, and it includes the daily scout that files its own blog-post recommendations as tickets.
Deployable, not demoable
Run it before you talk to us.
Each product stands up on a machine you control, against data that stays there. Nothing reports back here, so nothing about your evaluation is visible to the company you are evaluating.
NAICOM
Docker, and a checkout of the NAICOM repository.
$ cd naicom/code
$ docker compose upThe audit console comes up on http://localhost:3200, reading a local store. It runs in your environment and reports nothing back to us.
NAICOM in full →Citadel
Docker, a Go toolchain and Node, and a checkout of the Citadel repository.
$ docker-compose up -d
$ make deps && make generate && make
$ ./build/citadel prepare db
$ ./build/citadel serve --auth_jwt_key="insecure"The control plane comes up on https://localhost:8080 against a local MySQL and Redis. Enrol a host with citadelctl and query it. Nothing leaves the machine.
Citadel in full →Beacon
Python 3.11 or later.
$ git clone https://gitea.novaprospekt.cc/Novaprospekt/beacon-ksi-evaluator.git
$ cd beacon-ksi-evaluator
$ pip install -e .
$ ksi-eval --input-dir examples/A signed KSI emission on stdout for the bundled Okta policy export and Terraform plan. Read-only, deterministic, and no network call during evaluation.
Beacon in full →FedRAMP Management Engine
Docker, and a checkout of the Engine repository.
$ docker compose --profile full upPostgres and the Engine come up together on http://localhost:3000, with the schema migrated. The package stays on your machine.
FedRAMP Management Engine in full →The corrections record
AI spend is billed as usage. Much of it is likely a defect bill.
A model that reads a stale branch, or reports work delivered that never landed, produces a re-run. The re-run is billed at the same rate as the work. Nothing in a usage invoice separates the two, so the line item that would tell an engineering leader where the money went does not exist.
The half of that which is measured here today is the defect rate. Every mistake — the assistant's and every dispatched operator's — is recorded against a fixed class, with the date, the dispatch, the role and the issue it touched. That the record then moves the bill is an inference, and it is marked as one below.
Measured today
- Every recorded correction carries what was claimed and what was actually true, in the words of whoever made the correction.
- The classification is fixed in the dispatcher's source rather than editable at record time, because a taxonomy anyone can extend stops being countable.
- Counts and weekly movement are one query, and so is the list of classes that rose against the previous period.
- Each class carries a check — the command or question that would have caught it. A class with no check is a label, not a correction.
- The checks for the classes recorded most often against a role are composed into that role's system prompt at dispatch time, so the next operator is told what its predecessors got wrong before it starts.
Inferred, and next to build
The defect rate is measured. What it costs is not yet joined to it. The next increment attaches token cost to each recorded correction and to the re-run it caused, then reports spend by failure class — turning an undifferentiated usage invoice into a bill an engineering leader can act on.
That join is intended, not shipped. Nothing on this page claims a percentage of spend recovered, because no such figure has been measured.
Read the live record
$ novaicom corrections classes
$ novaicom corrections stats --by week
$ novaicom corrections brief --role codeCounts move every day, so this page cites the commands that print them rather than a number that would be wrong by the time you read it.
The classification
- stale-state
- A cached, local or summary view read as current state.
- unverified-claim
- Stated without running the one check that would have falsified it.
- presence-not-behaviour
- A match, a running process or an existence check treated as proof of behaviour.
- guessed-cause
- A plausible mechanism presented as a diagnosis.
- false-completion
- Work reported delivered that had not landed.
- inference-as-instruction
- An inference handed back as an instruction, a spec or an established fact.
- instruction-ignored
- A standing or just-given instruction that was not followed.
- unrequested-scope
- Volume, padding or work beyond what was asked.
- wrong-mechanism
- A sanctioned tool or path existed and something else was used.
- duplicate-work
- Work filed or started that already existed or conflicted with work in flight.
- unclassified
- Recorded, no class assigned yet.
This page values the record. The feature that produces it belongs to NAICOM, and the check each class implies, the way an entry is recorded, and how a repeated failure is counted are set out with the screens on the NAICOM product page.
What comes with it
More than the source.
The repositories
Every product above, with the build and the deployment pipeline that ships it. Nothing here is a slide deck.
The ticket history
Each product has its own board. Every merged change traces back to the issue it was specified against, and to the pull request that closed it.
The operating record
Session logs and versioned prompt files, committed beside the code they produced, plus the corrections record described below.
The regulatory position
Control mappings, plus the FedRAMP 20x program reference kept current on this site and the KSI baseline work behind Beacon.
The name
Novaprospect, LLC, a New Mexico limited liability company, and the domains and marks that go with it.
Straight answers
The first call, answered in advance.
What is the revenue?
Not published. Revenue, pipeline, burn and any valuation are open under NDA, in the first conversation. Publishing a number on a marketing page that a data room then contradicts is how a deal dies, so there is no number here.
How much of this is actually your code?
NAICOM, Beacon, the FedRAMP Management Engine and this site were written here. Citadel is a downstream of the open-source osquery fleet manager, so most of its commit log carries upstream authorship — you will see that the moment you open it, and it is stated here for that reason. The work done here on Citadel is the rebrand, the compliance-aligned query packs, the packaging and the hardening.
How big is the team?
Small, and the answer is in the commit log rather than in a claim on this page. Much of the throughput comes from the dispatch system that is itself one of the products, which is the argument for it: the operating model is part of what is for sale.
How mature is each product?
Each product carries its own status on its own page, and the statuses differ. NAICOM and Citadel are released; Beacon is in beta with an open evaluator you can run today; the Engine is in limited release. Run the deploy command on any of them before you take the status on trust.
Why sell?
What has been built needs a distribution channel and a compliance-sales motion that this company does not have. The software, the regulatory positioning and the operating record are the assets; the go-to-market is the gap. An acquirer that already sells into regulated environments closes it on day one.
What if we are an investor rather than a buyer?
That conversation is open too, on the same terms — the numbers under NDA, the software deployable in your own environment beforehand. Say which one you are in the message and it lands with the right person.
The ask
Deploy it, then tell us what it is worth to you.
Run whichever product is closest to what you already sell, on your own machine, and read the corrections record beside it. That is enough to decide whether the operating model is an asset to you or a curiosity.
Then open the financial conversation under NDA. No price is named here, and none will be quoted before you have seen the software run.
Start the conversation
Acquisition, or investment as the alternative. Say which in the message and it lands with the right person. Financials open under NDA.