How it works

Every claim — a rung of the ladder, a step of reasoning, a crossing between domains, and the answer she is about to serve — is submitted with its own evidence to an adjudicator that runs as its own supervised process. Independent oracles run in parallel, their verdicts compose, and the resulting proof is sealed to an audit chain. It carries its own evidence rather than querying the stores, so it can never be starved by the thing it is gating.

An always-on adjudicator runs as its own supervised process. It records its verdicts and their proofs to an audit chain and can never write to the knowledge graph.

A genesis spine with five sidechains, each carrying one domain of events, anchored externally so that tampering is detectable by a third party. Sealing happens at a real boundary rather than on a timer, verification runs before anchoring rather than after, and a reference resolves to a version-qualified address so an auditor can tell exactly which revision of a fact was cited.

What she infers from conversations and research is kept in a separate store and is never answered from. It reaches the company record through exactly one gate, which re-derives the claim from documents alone before it may cross.

Clearance is evaluated per node, at the point keys are wrapped, so access is enforced by cryptography rather than by filtering results after the fact.

A Stage-3 concept: an independent process that observes the system and co-signs its records, isolated structurally rather than by policy, and able to verify before signing without needing any decryption rights.

Retrieval enters the graph at the granularity the question needs, and a pinned fact is answered by structural traversal rather than by ranking. The document is never a retrieval unit.

A spec-wide invariant forbids recency-and-frequency — popularity — from acting as a retrieval ranking signal anywhere in the system. Usage is recorded and may serve as evidence about a fact, but it may never decide which fact is returned. In an organisation this is the difference between a system that surfaces what everyone already knows and one that surfaces what actually answers the question.

Where every node and every edge physically lives across three stores — a graph store, a vector index, and a columnar store — assigned by what each is best at, up the ladder. The isolated inference domain sits alongside the standard graph rather than inside it.

She keeps reasoning while an impasse remains and stops when the judge has run out of objections and every part of the question is answered or honestly declared unanswerable. How long she thinks is learned, not configured.

When the corpus cannot answer, she says so and records the gap as a question the company has asked, weighted by how often it is asked. Over time that becomes a map of what the organisation does not have written down anywhere.

Documents become answerable one at a time rather than in one batch, so she is useful before a large corpus has finished loading. That creates a state a plain answer cannot express: "I don't find X" is false when X is still in the queue, and worse than a refusal because it closes the question. Every outcome therefore carries a qualifier naming what had not yet been read.

The reasoning loop answers one question well. Planning decides which questions there are, what each one owes the person who asked, in what order, and who does it. A plan never enters the corpus — it is the shape of the work, not knowledge about the company.

A single learning substrate that every learning part of the system plugs into. It learns this company's relation grammar and its productive paths while the facts themselves stay in the graph and are fetched, with a citation, at answer time. Not one fact lives in a weight — so a model that is stolen, copied or compromised carries no company knowledge with it.

Self-learning loops do the work beyond answering: keeping memory consistent, filling what she does not know, and refining her own policies. The division is a hard rule — a routine that runs while answering is deterministic and never learned; a routine that learns runs only when idle. There is no third kind, so learning can never make a live answer unpredictable.

At ingest the model proposes ATOMS and nothing else — five kinds (numerical, lexical, boolean, logical, temporal), each a single indivisible value. A deterministic check verifies every atom against the span it was cited from and rejects what does not anchor. Everything above an atom is built by the system, not the model. This is the hard line the whole architecture is organised around: it is what lets the system be audited, because the parts a model cannot be held to account for are the parts a model never wrote.

Every rung above atoms is built by symbolic workers with embeddings used as a representation service, never as a decision-maker. Each rung dedups by identity and carries an occurrence weight. Because the assembly is deterministic it is reproducible: a disputed conclusion can be walked back down the ladder to the documents that produced it.

Every membership link is bidirectional and tested; a derived view is invalid unless its atoms resolve. Recovery is a first-class routine, not a repair script run by hand after someone notices.

A readable per-subject page in which every claim traces to a concept and is checked by dereference plus entailment before it may appear. Never free composition.

Two kinds of knowledge deserve two kinds of trust. Company documents are verified and answerable. Meeting minutes, chat threads and conversation transcripts are useful to reason over and unsafe to answer from: they are unverified, contradictory, and an attack surface. They live in a separate domain she may reason across and may never quote as fact. Mk1 had nowhere to put the second kind, so it either excluded it — losing the company's real, current context — or admitted it, losing the audit trail.

The single door between the system and everything outside her own memory. Each capability is a plug: registered here, invoked here, budgeted here, and logged here. Deciding which capability to use is a reasoning act and happens elsewhere — this layer may refuse a call on budget or availability, and may never select one. The separation is what makes the log of what she reached for outside herself complete and trustworthy.

Procedural knowledge: a goal, a declared set of capabilities with how to use each, scripts that run in a sandbox, and evidence or an artefact as the result. A skill is not a decision about truth — the adjudicator does that — and never writes knowledge itself. Skills cannot be installed at runtime, which is a security property rather than a limitation.

The execution substrate every file capability resolves under, with both scopes, the sandbox's guarantees, a recorded egress trail, and a defined answer for what a run becomes as evidence. An artefact enters content-addressed storage when it is created; approval sets its domain, not its existence.

The same binary, the same cryptosystem, the same chains. On-prem, the customer runs the host. Managed, we run the host — and the keys column is identical, which is the entire product claim. Managed therefore has to contain one extra adversary: us, or anyone who compromises our cloud, our hypervisor, or one of our employees. Updates in managed are applied blue-green and re-attested rather than in place. The mode is a signed field in the licence, never a flag someone can set.

One invariant chose the whole front-end stack: every access decision is made server-side, before bytes are rendered. An application that fetches data and hides the rows a user may not see has already sent them, and the employee can open developer tools. Rendering where the data lives is the posture, not a preference — and it means there is exactly one place a clearance decision can be made later.

The installer is the first thing that runs and the only thing that runs before there is a body: not supervised, holding no resources, with nowhere to cascade an error to, because at the moment it runs none of that exists yet. The licence is verified once to decide whether to install, and re-checked at runtime for the years afterwards through two checks with deliberately different trust properties.