Integrations
Every connector below states what it was proven against, not what it is aimed at. The live service reads EDI (X12 and EDIFACT), ISO 20022 bank statements and spreadsheet templates, pulls from three warehouses, and sends signed events and an MCP server to your agents; that list comes first below, built and tested. The eight ERP connectors further down (two specified from reviewed conformance specifications, six from public vendor documentation) are stated as conformed in an engineering build that is not published, so the results cannot be rerun from anything here, and a connection to one is refused by name until it ships. Nine more are scaffolds that report validated: false until they are promoted against a real system.
The tables further down describe the engineering release, whose eight ERP adapters are not in the live service and whose conformance results are self-verified and cannot be rerun from anything published here. This one describes the AssetShop service that runs now: 24 connectors, each with a test for every rule it enforces. Live means the code is in the live service and tested against the published format; it runs for your organization when you make a connection or send a document. Scaffold means built and running and not yet through its promotion; the line above it names what is missing. Conformed (the three warehouse pulls) means the code runs in the service and passed its tests against the vendor's published API through a fake transport; an organization's run on its own data promotes it to live.
Envelope verified before content; purchase order and invoice reconcile line by line.
In · X12 850 purchase order, X12 856 advance ship notice, X12 810 invoice, X12 997 acknowledgment (generated), envelopes 004010 and 005010, GS1 GTIN and SSCC
Live
The same records and reconciliation as X12.
In · EDIFACT ORDERS, EDIFACT DESADV, EDIFACT INVOIC, syntax 3 and 4, UNA service advice, decimal comma
Live
Balances and booked entries in minor units, with a footing check reported as a derived figure.
In · ISO 20022 camt.053, IBAN (ISO 13616), BIC (ISO 9362), no DTD, no external entities
Live
Ten function templates (procurement, finance, supply, factory, distribution, point of sale, customer, contracts, workforce, generic), released as CSV or as a workbook with a Read me sheet; the adapter reads either and accepts exactly the columns the template carries.
In · RFC 4180 CSV, Office Open XML .xlsx (ECMA-376), ISO 8601 times, ISO 4217 currencies
Live
A SELECT whose columns are a function template's, on a SQL warehouse the organization names. Nothing is written to the warehouse.
In · Databricks SQL Statement Execution API 2.0, personal access token or OAuth machine-to-machine, read-only SELECT into a function template
Conformed
A SELECT whose columns are a function template's; TIMESTAMP values arrive as epoch seconds and are turned into ISO 8601 here. Nothing is written to the warehouse.
In · BigQuery REST API v2 (jobs.query, jobs.getQueryResults), OAuth 2.0 JWT bearer grant, read-only SELECT into a function template
Conformed
A SELECT whose columns are a function template's, run on a schedule or on demand; rows pass the same refusals, idempotency and reconciliation as a spreadsheet. Nothing is written to the warehouse.
In · Snowflake SQL API v2, key-pair JWT (RS256), read-only SELECT into a function template
Conformed
Records mapped to observations with their source and time; refused by name when incomplete.
In · ISA-95 production performance (MES), JSON over HTTPS
Live
Signed, bounded summaries from registered devices.
In · HMAC-SHA256 device signatures, windowed summaries (no raw streams)
Live
Any system with an API can push in and receive events, as a system and never as a person.
In and out · HMAC-SHA256 request signing, five-minute replay window, per-system scopes and rate limits
Live
Subscribed per event through the gateway; delivered, signed, retried and replayable.
Out · HMAC-SHA256 over timestamp.body, retries over about 45 hours, then dead letter and replay, https only; private and metadata addresses refused at connect
Live
Any catalog event, posted to a channel as an Adaptive Card from the same declared fields the signed JSON carries; nothing else leaves.
Out · Teams Workflows webhook, Adaptive Cards 1.4, HMAC-SHA256 signature headers
Live
Any catalog event, rendered as a channel message from the same declared fields the signed JSON carries; nothing else leaves.
Out · Slack incoming webhooks, Block Kit messages, HMAC-SHA256 signature headers
Live
Your agents read labeled state, evidence and timelines, check an action before taking it, propose actions a person decides, and, only where an owner grants execute, carry out what a person approved through your own executor.
Out · MCP over Streamable HTTP (JSON responses), JSON-RPC 2.0, protocol versions 2025-11-25 and 2025-06-18
Live
The same tools as the MCP server, as plain HTTP.
Out · REST over HTTPS, every figure labeled OBSERVED, DERIVED, INFERRED, SCENARIO, DECISION, ACTION or OUTCOME
Live
Every person is a named identity, joining from your organization's roster with a verified work email; no consumer identity check applies.
In · OpenID Connect ID tokens
Live
An owner names the provider configured for the organization at onboarding, proves each email domain by DNS, and may require every session to come through it.
In · SAML 2.0, OpenID Connect, DNS TXT domain proof
Live
Okta, Microsoft Entra ID and other providers create, update and deactivate members; deactivation removes access at once; owner is never provisioned.
In · SCIM 2.0 (RFC 7643, RFC 7644), bearer token
Live
Payments, subscriptions, identity verification (on the consumer estate, at a person's first purchase or listing) and payee onboarding; configured by the operator, not per organization.
In and out · signed webhooks, Stripe Identity verification, Connect Express payouts
Live
Mercurial only: the account holder's own account, under a mandate; never withdraws. Live orders wait for the account holder's conformance record.
In and out · ES256 JWT per request
Scaffold
The delegation checks are built; the on-chain redemption path is not.
In and out · scoped, expiring delegation
Scaffold
Mercurial only, under the same rules as Coinbase.
In and out · Ed25519 request signatures
Scaffold
Funding, tickers, stablecoin supply, chain TVL, fees and candles, each figure with its source.
In · public REST
Live
Token transfers for labeled wallets on Ethereum mainnet; stays off until the operator's key and verified address labels exist.
In · Etherscan API v2, CAIP-10 accounts, EIP-55 checksums
Scaffold
Generated from the service's own connector registry; the service answers the same list at /connectors/catalog. 8 conformed (self-verified) and 9 scaffold connectors belong to the engineering release, not the live service; 3 are conformed in the live service, and 2 are planned.
Most of the world's orders, ship notices, invoices and bank statements still move as X12, EDIFACT and ISO 20022. The service reads them into the same records as every other source, so a purchase order and the invoice against it can disagree, and Nerio raises it.
Control numbers and segment counts are checked before any content is read. A broken interchange is refused whole, by name, and nothing from it is recorded.
Order (850, ORDERS) and invoice (810, INVOIC) meet on the same order line, quantity and unit price; a spreadsheet export from the ERP joins the same line. Ship notices (856, DESADV) stand as evidence against it.
A line without its number, an order without its number, an amount without its currency is refused by name. A currency the partner leaves implied comes from the connection, and the record says so.
UPC, EAN, GTIN-14 and SSCC check digits are verified; a failing key refuses that line, not the document.
An X12 997 acknowledgment is generated for you to return to the sender. AssetShop does not transmit it; your channel does.
camt.053 balances and booked entries are carried in minor units, and whether opening plus credits less debits equals closing is reported as a derived figure. XML with a document type definition is refused.
A worked example, static
Order line PO 4471820, line 2. The ERP export and the EDI 850 both carry a unit price of $1.95; the EDI 810 invoice carries $2.05. Nerio records three observations, keeps all three as evidence, and raises the line as contested with a gap of $0.10 (derived: highest less lowest). It does not choose a side. A person decides, through the approval the policy routes, and the decision is recorded. The live version of this runs inside the platform on your own documents.
Every connector passes the same checks, so a record from Frankfurt, Mumbai and Chicago means the same thing on arrival.
177 ISO 4217 codes with their minor units; 14 withdrawn codes recognized and flagged. Money moves as integers in minor units: 12.345 dollars is refused, never rounded, and 1.234 dinars is exactly 1,234 fils.
All 249 ISO 3166-1 codes. A declared country is checked, and so is the country inside every IBAN and BIC.
Every instant carries its offset, or names the IANA time zone it was recorded in (418 zones). A time inside a spring-forward gap is refused; one inside a fall-back hour is flagged. Records are stored in UTC, so different offsets sort correctly.
Read as the sender writes them: 1.234,56 in Germany, 1 234,56 in France, 1,234.56 in the United States, 12,34,567.8 in India. The result is an exact decimal; no floating point touches an amount.
UN/ECE Recommendation 20 codes, with the X12 unit codes that map to them. A conversion is labeled derived and happens only within a dimension; a kilogram never becomes a meter.
GS1 GTIN, GLN and SSCC; IBAN, BIC and LEI; CAIP-2 chains and CAIP-10 accounts, with EIP-55 checksums on EVM addresses.
Where the data lives: the service and its records run in Google Cloud, region us-central1, one region. Regional data residency is not offered today, and this page will say so until it is.
A system your owner or admin registers can subscribe to events. Only the fields listed leave; values stay home. Each delivery is signed with that system's key over the timestamp and the body (HMAC-SHA256), carries a delivery id that stays the same across retries, and should be rejected by your receiver if its timestamp is more than five minutes from your clock. Failed deliveries retry with backoff over about 45 hours, then wait in dead letter until an owner replays them. A receiver that answers 410 Gone ends its subscription. Delivery is https only, to hosts the organization allowed, and an address that resolves to a private, loopback, link-local or metadata network is refused at connect time.
| Event | Fields that leave | When |
|---|---|---|
discrepancy.raised | entity, field, sources, raisedAt | two sources disagree about one field of one record |
discrepancy.resolved | entity, field, sources, resolvedAt | the sources agree again |
proposal.raised | requestId, entity, title, raisedAt | an agent proposed an action; a person decides |
decision.made | requestId, decision, decidedBy, clause, decidedAt | a person approved or rejected a step |
observation.batch.ingested | family, connectionId, observations, duplicates, refused, contested, at | a connector delivered a batch |
portunus.disposition | passportId, kind, state, closedAt | an item reached the end of its life |
command.acknowledged | commandId, deviceId, state, ackAt | a machine acknowledged a command |
costing.scenario.saved | scenarioId, name, savedAt | a costing scenario was saved |
webhook.ping | subscriptionId, at | a test an owner sent to check a destination |
A subscription names the shape its receiver reads. forculus is the signed canonical JSON above. slack renders the same declared fields into a Slack incoming-webhook message (Block Kit); teams into an Adaptive Card for a Teams Workflows webhook. The signature headers travel with the rendered message, computed over the canonical body, and a Slack or Teams destination is accepted only at the vendor's own webhook host. No field leaves in a channel message that would not leave in the signed one.
SAML 2.0 or OpenID Connect through Identity Platform, configured for your organization at onboarding. Your owner names the provider, proves each email domain with a DNS TXT record, and may require every session to come through it. The sign-in page resolves a provider only for a proved domain, so no organization can route another's sign-in. No consumer identity check applies to your organization's members.
Okta, Microsoft Entra ID and other providers create, update and deactivate members under a bearer token your owner minted. A provisioned person is a pending membership until their first sign-in; deactivation removes access at once. Provisioning grants up to admin and never owner. Groups are the five role groups, read and patched, never created.
An owner or admin invites by email and role, changes roles and removes members; an organization always keeps at least one owner; an agent principal never manages people. Every change is on a hash chain the organization can verify. All of it is done in the organization console.
A connection names the warehouse, a read-only SELECT whose columns are a function template's, and the Secret Manager reference of a read-only credential. A run executes the statement through the vendor's published REST API (Snowflake SQL API v2 with a key-pair JWT; BigQuery jobs.query under a JWT bearer grant; Databricks SQL Statement Execution 2.0) and hands the rows to the same template adapter a spreadsheet goes through, so they pass the same refusals, idempotency and reconciliation. Runs are on demand or on the connection's freshness schedule. Nothing is written to the warehouse; a statement that could write is refused before it is sent. These three are conformed in the live service: tested against the vendors' contracts through a fake transport.
The ten function templates are released under the master services agreement as CSV and as an Office Open XML workbook (.xlsx) whose first sheet is the template, typed, and whose Read me sheet states each column's rule. The adapter reads either: a workbook arrives as base64 in the same ingestion call, a cell typed as an Excel date is read in the batch's named time zone, a text-typed identifier keeps its leading zeros, and a workbook that is not one (encrypted, zip64, not a zip, the wrong sheet) is refused by name with nothing recorded.
Nerio's tools are served as an MCP server, so any MCP-capable agent reads your organization's labeled state, evidence and timelines without custom integration, and checks an action before taking it. Authority is granted per key by your owner: read, reasoning, draft and propose, and execute only where an owner grants it with a per-action and a daily limit. The tool list shows only what that key may call. An agent holding execute can carry out only an action a person in the policy's named role already approved: Minerva sends your own executor a signed, single-use authorization, your executor makes the change with your credentials, and EOS verifies that every system reached the decided state. Every figure arrives labeled by what it is (observed, derived, inferred, scenario, decision or outcome), and every step is on the record.
These are on the roadmap with no code yet. Each row says the route that works today.
| System | Standards | What works today | Status |
|---|---|---|---|
| HubSpot | REST | Push orders through the operational CRM family. | Planned |
| Payment initiation, ISO 20022 pain.001 | ISO 20022 pain.001 | Would run only under Minerva's controls, after a person's approval; not built. | Planned |
Conformed means the adapter was executed against the published contract and passed every case. It does not mean it has run against a live instance of that vendor's system. That distinction is the difference between a claim we can prove and one we cannot, so it is labeled on every row rather than in a footnote.
For the eight ERP connectors below, conformance is self-verified, not reproducible here: the adapters and their suites (tests/conformance/run-conformance.mjs) belong to an engineering build that is not published and is not in the live service, so the results cannot be rerun from anything on this site, and a connection to one of them is refused by name. Until a connector carries a certification record anyone can rerun, read its counts as self-verified.
| System | Entity | Contract provenance | Cases stated | Status |
|---|---|---|---|---|
| SAP S/4HANA | PurchaseOrder | Reviewed conformance specification. OData v4, OAuth client credentials, LastChangeDateTime delta | 12/12 | Conformed · self-verified |
| NetSuite | PurchaseOrder | Reviewed conformance specification. Self-identifies the account-timezone trap on lastmodifieddate | 12/12 | Conformed · self-verified |
| Oracle Fusion | PurchaseOrder | Derived from public REST documentation | 6/6 | Conformed · self-verified |
| Microsoft Dynamics 365 F&O | PurchaseOrder | Derived from public OData documentation | 6/6 | Conformed · self-verified |
| Coupa | PurchaseOrder | Derived from public Core API documentation | 6/6 | Conformed · self-verified |
| Infor CloudSuite | PurchaseOrder | Derived from public ION/M3 documentation | 6/6 | Conformed · self-verified |
| Workday | Worker (HCM) | Derived from public RaaS/REST documentation | 8/8 | Conformed · self-verified |
| Generic REST | PurchaseOrder | Configuration-driven. You supply the field map | 6/6 | Conformed · self-verified |
Stated in the service's connector registry; the source and suites it names (src/adapters/, tests/conformance/) are not in the live service or on this site.
Nine further systems have adapter scaffolds carrying 117 conformance cases at mock maturity. They are not conformed and the suite enforces that. After a successful fetch, each must still report validated: false; forcing it true fails nine cases immediately.
| System | Cases | Status |
|---|---|---|
| SAP Ariba | 13 | Scaffold |
| SAP ECC | 13 | Scaffold |
| Jaggaer | 13 | Scaffold |
| Ivalua | 13 | Scaffold |
| Anaplan | 13 | Scaffold |
| o9 Solutions | 13 | Scaffold |
| DocuSign CLM | 13 | Scaffold |
| Ironclad | 13 | Scaffold |
| Salesforce | 13 | Scaffold |
Why a scaffold cannot be promoted from here
Passing against a faithful mock proves an adapter conforms to a specification derived from public documentation. It does not prove the vendor's real API matches that reading. Endpoint paths, field names, status enumerations and pagination shapes are customer-configurable and version-dependent. Ariba realms, ECC release levels, Salesforce custom objects and Ivalua configurations all vary per deployment. Promotion requires tenant access or a customer-confirmed field mapping, a written conformance specification, a run against the real system, and a signed tenant-confirmation artifact. Until all four exist, the honest label is the one above.
Specified for the engineering-release adapters: changed records since the last cursor, never a full corpus scan. The live service's warehouse pulls have no cursor yet: each run reads the whole view, and one above 5,000 rows is refused.
Source fields to the canonical object, with the source, timestamp and record reference retained so the trace reconstructs later.
There is no write method to disable. The write-path suite passes 9/9 because no write call exists to fail with.
When two systems report different values for one object at the same timestamp, the connector surfaces the conflict rather than picking a winner.
A malformed source row is skipped and reported, never fatal. Cursor never advances past an unpersisted record.
A mid-sync 401 invalidates the cached token, re-authenticates and rebuilds the request rather than exhausting retries.
| Item | Detail |
|---|---|
| Credentials | Read-only service account per system. OAuth client credentials where the vendor supports it, API key where it does not. Held in a secrets vault, never in configuration. |
| Scope | One entity to begin, typically PurchaseOrder. A slice, not the estate. |
| Network | Outbound reachability from the hosted service to your warehouse, for a pull; files and pushed records need none. An air-gapped deployment is not built yet. |
| Time | Thirty minutes to scope. An afternoon to deploy against a read-only slice. |
The Generic REST connector is configuration-driven and takes a field map you supply. Where the source is honestly still a spreadsheet, there is a spreadsheet path, because most estates have one and pretending otherwise wastes the first meeting.
Tell us the two systems that disagree and we will say plainly whether a connector exists, whether a scaffold can be promoted, or whether it is new work.
By function
A department does not care which vendor is conformed; it cares whether its own work can be read. This is the readiness by function: the systems we read, the spreadsheet template for the estate no system holds, and a status that means one thing each. Every read is a read-only service account you create and can revoke, and every observation passes through the same reconciliation, so a factory figure can disagree with an ERP figure and be seen to.
| Function | Systems and what is read | Spreadsheet template | Status |
|---|---|---|---|
| Procurement | EDI purchase orders and invoices (X12 850 and 810, EDIFACT ORDERS and INVOIC): live. SAP S/4HANA, NetSuite, Oracle Fusion, Coupa: conformed, self-verified. SAP Ariba, Jaggaer, Ivalua: scaffold | procurement_purchase_orders | Live Conformed · self-verified Scaffold |
| Finance | Bank statements (ISO 20022 camt.053) and EDI invoices: live. SAP S/4HANA, NetSuite, Oracle Fusion, Dynamics 365 F&O: conformed, self-verified | finance_invoices | Live Conformed · self-verified |
| Supply chain | Advance ship notices (X12 856, EDIFACT DESADV) with SSCC checks: live. SAP S/4HANA, Infor CloudSuite: conformed, self-verified. o9, Anaplan: scaffold | supply_inventory_positions | Live Conformed · self-verified Scaffold |
| Factory | MES production performance, ISA-95 shape: good and scrap quantities, run and down minutes | factory_production | Live |
| Distribution center | WMS stock, allocation and location capacity | dc_locations | Live |
| Point of sale | Transactions and returns by store and SKU, currency required | pos_sales | Live |
| Customer | CRM orders and status, currency required. Salesforce: scaffold | customer_orders | Live Scaffold |
| Sensors | Signed edge-gateway summaries: run rate, utilization, temperature bands. Raw streams refused | none: a spreadsheet cannot carry a device signature | Live |
| Workforce | Workday: conformed, self-verified. Capacity by cost center and role, no personal data | workforce_capacity | Live Conformed · self-verified |
| Legal and contracts | DocuSign CLM, Ironclad: scaffold | contracts_register | Live Scaffold |
| Anything else | Generic REST: conformed, self-verified. You supply the field map | generic_entity | Live Conformed · self-verified |
Live means the adapter is in the live service with a test for every rule it enforces, against the published payload shape; every spreadsheet template is live, so every function can be read today. Conformed, self-verified means the registry records a conformance suite passing in an engineering build that is not published and not in the live service; the results cannot be rerun from anything here, and a connection is refused by name until the connector ships. Scaffold means the contract is written and the cases are defined, and the connector is finished within the assessment. The nine statuses are defined in the Trust Center.
Measured on one core: 100,000 point-of-sale transactions mapped to 200,000 observations in 58 milliseconds, and a bounded batch of 5,000 transactions ingested, de-duplicated and reconciled in under a second against an in-memory store. Production write latency to the record will dominate that second figure, and it is stated here so nobody reads it as a production number.
The templates, field maps and conformance specifications are released to you under the master services agreement, not before. Each template is generated from the same definition the adapter enforces, so a template cannot promise a column the adapter refuses.