For developers · the SDK
Ship LLM features that survive audit.
Without rewriting your stack.
One function call wraps every LLM invocation. Closed-enum schema in. Typed result out. Signed L12 entry written. Reviewer-gate + fallback + audit trail handled. Three languages, byte-identical canonical form.
The 10-line integration
One function. The whole substrate behind it.
TypeScript · SDK (v1.2)
ts
import { defineRuntimeAISpec, runConstrainedAI }
from "@/contrib/jarvis/src/runtime-ai-sdk";
const fraudSpec = defineRuntimeAISpec({
specId: "fraud-classifier",
displayName: "Fraud risk classifier",
description: "Classifies a transaction into a four-tier risk band.",
category: "classifier", // ∈ classifier|extractor|drafter|router|summariser
inputSchema: { /* substrate-defined schema */ },
outputSchema: { /* closed-enum risk band */ },
promptTemplate: { system: "…", user: "Tx: {{transaction}}" },
modelIdentity: { provider: "anthropic", model: "claude-sonnet-4-5", version: "2026-05-01" },
reviewerGate: "on-low-confidence", // closed enum
lowConfidenceThreshold: 0.7,
maxLatencyMs: 5_000,
fallbackBehavior: "deterministic-default", // closed enum
deterministicDefault: { risk: "medium", reason: "model-failed-schema" },
});
const decision = await runConstrainedAI(fraudSpec, transaction, {
privateKeyBase64: process.env.SUBSTRATE_KEY,
logPath: "/var/log/runtime-ai-receipt-log.jsonl",
client: anthropicRuntimeAIClient,
});
// decision.output is typed + schema-valid; L12 entry already written + signedPython · verifier primitives only (v1.2)
python
# v1.2 Python port ships verifier primitives, not the full SDK.
# Full Python run_constrained_ai is v1.3 roadmap.
from promethean_runtime_ai import (
canonicalise_entry, sha256_hex,
sign_canonical, verify_signature, derive_public_key,
)
# Verify a JS-emitted L12 entry from Python:
ok = verify_signature(canonical_bytes, attestation)
# True iff the entry's Ed25519 signature is valid + cryptographic chain holds.
# Or re-derive canonical bytes byte-identically with the TS version:
py_canonical = canonicalise_entry(entry_skeleton)
py_hash = sha256_hex(py_canonical)
# 8 fixture-driven differential tests assert byte-identity vs JS.Live · spec authoring surface
Author a spec visually. Closed-enums all the way down.
Below: three live RuntimeAISpecs across the reference deployments. Click any to drill into its config + every entry produced under it. The 9-step wizard creates new ones in minutes.
What you write
A RuntimeAISpec.
Five fields. All closed-enum or schema-typed. The spec is the contract bounding every LLM call inside an emitted product — and the only thing you have to author.
- 01category · closed enum (5):
classifier · extractor · drafter · router · summariser - 02modelIdentity · provider (closed enum: anthropic / openai / azure-openai / local-llama / mock) + model + version — committed to every receipt
- 03inputSchema · outputSchema · substrate-defined
RuntimeAISchema· closed-enum vocabularies enforced at request time - 04reviewerGate · closed enum:
always·on-low-confidence·never— routes through your reviewer queue - 05fallbackBehavior + deterministicDefault · what to return when the LLM fails the schema — no exception, no surprise
(Plus specId · displayName · description · promptTemplate · maxLatencyMs · schemaVersion · canonicalForm — 13 fields total. The full interface is in runtime-ai-spec.ts.)
What you get
Six things, automatic.
- Typed result — your outputSchema is enforced before the value reaches your caller. Schema failures hit the fallback, not your downstream code.
- L12 receipt — one signed entry per call, hash-chained, covering specHash + inputHash + outputCanonicalHash + modelIdentity + latency + schema-valid + reviewer-verdict + fallback-triggered.
- Reviewer-queue routing — when your predicate fires, the call is gated by your reviewer queue before responding. Built-in human-in-the-loop.
- Fallback execution — declared at spec-time, executed deterministically when the model fails. Liability surface is bounded, not arbitrary.
- PII-safe audit — inputs hashed before recording. The L12 chain proves what happened without exfiltrating customer data.
- Regulator-verifiable chain — your L12 file is signed under the same Ed25519 trust anchor as our reference deployments.
node verify.mjswalks it in 50 KB.
Latency budget
The SDK costs sub-millisecond. Your LLM cost dwarfs it.
Schema validate
~0.1 ms
Zod / Pydantic on the LLM output
Canonicalise + hash
~0.2 ms
JSON.stringify in fixed order + SHA-256
Ed25519 sign
~0.3 ms
32-byte seed in-memory · HSM adds 1–5 ms
JSONL append
~0.2 ms
O(1) via head.json sidecar · fsync deferrable
LLM round-trip
200–2000 ms
Anthropic / OpenAI · the actual cost
Reviewer-queue (if gated)
seconds–minutes
Async — caller gets a deferred handle
Fallback path
~0.5 ms
Pure function, no I/O
Total SDK overhead
~1 ms
On every successful path
Failure modes, by design
Closed-enum exit states. No "the model did something weird."
ok
LLM output passes the schema, reviewer-gate doesn't fire.
L12 receipt
schemaValid: true · reviewerVerdict: null · fallbackTriggered: falsereviewer-approved
Reviewer-gate fired; queued; human approved.
L12 receipt
schemaValid: true · reviewerVerdict: 'approved' · fallbackTriggered: falsereviewer-amended
Reviewer-gate fired; queued; human modified the output before approving.
L12 receipt
schemaValid: true · reviewerVerdict: 'amended' · fallbackTriggered: falsereviewer-rejected
Reviewer-gate fired; queued; human rejected. Fallback executed.
L12 receipt
schemaValid: true · reviewerVerdict: 'rejected' · fallbackTriggered: trueschema-invalid
LLM output failed the outputSchema. Fallback executed.
L12 receipt
schemaValid: false · reviewerVerdict: null · fallbackTriggered: truemodel-error
LLM API call threw (rate limit / timeout / provider 5xx). Fallback executed.
L12 receipt
schemaValid: false · reviewerVerdict: null · fallbackTriggered: true · errorClass: 'provider-error'spec-violation
Caller-side bypass attempt (someone tried to skip the SDK). Caught by autoplay tests in CI; never reaches prod.
L12 receipt
rejected at build-time · the substrate's component log records the attempted bypass patternTesting your integration
Property-based fuzz, byte-identity, mutation testing — your tests inherit ours.
Golden chains
6 deterministic reference chains with pinned hashes. Regenerable. Any drift in your spec's canonical form fails the build.
npm test -- runtime-ai-golden-chains
Property-based fuzz
700+ random scenarios per CI run. Tampering anywhere in the canonical portion breaks verify; tampering outside (signedAtIso metadata) doesn't. Both proven.
npm test -- runtime-ai-property-tests
Differential verifier
Embedded 50 KB plain-JS verifier and TS verifier agree byte-for-byte. The regulator-grade verify.mjs is independently testable against the SDK.
npm test -- runtime-ai-differential
Cross-language byte parity
8 fixture-driven differential tests. Python canonical bytes == JS bytes. Python Ed25519 signature == JS signature. Same fixture, both languages.
pytest runtime-ai-py/tests/
Mutation testing
Stryker mutates the runtime-AI containment modules against their test suites. Below 75% kill rate fails CI. Your tests catch real regressions, not trivial ones.
npm run mutation-test
Adversarial autoplay
8 closed-enum attacker strategies run against your spec in CI. SDK-bypass attempts, schema-relaxation tricks, fallback-poisoning, reviewer-queue evasion — all caught before prod.
npm test -- runtime-ai-adversarial
Install
Two packages shipping today. One canonical form.
TypeScript · v0.1 today
@promethean/runtime-ai (tarball)
npm install https://promethean.software/runtime-ai/latest.tgz
BSL-1.1 SDK + Apache-2.0 verifier · tarball install today (stable URL); npm-registry publication is a tooling/credentials task pending NPM_TOKEN setup — code itself is registry-ready
Python · roadmap
promethean-runtime-ai (PyPI)
# package not yet published
Verifier primitives + canonical-form math exist in `runtime-ai-py/` but PyPI publication is roadmap; not currently installable
Rust · roadmap
promethean-runtime-ai (crates.io)
# crate not yet published
Substrate emits Rust products today; standalone crate is roadmap
What's open · what's commercial
The SDK + verifier + canonical-form spec + Python port + ADRs + test suites are all Apache 2.0 open source — because a closed-source verifier is a contradiction. Read every line, fork it, run it air-gapped, integrate without asking us.
The substrate's commercial engine — meta-generator factory, multi-tenant management, federation protocol implementation, HSM integration, continuous-watch infrastructure, hosted Author service — sits behind operator-pilot and platform tiers. That's where the value-creation lives; the verifier is where the trust lives.
See /licensing for the exact open-vs-commercial split, the seven operational moats outside the code, and why open-source is the moat (not the vulnerability) for this category.
Three doors
Run the verifier
node verify.mjs
Download any of the three reference L12 chains and run the 50 KB plain-JS verifier. 30 seconds. No npm install. Node 18+ stdlib only.
Read the docs
Technical architecture (8 pp)
L1–L12 commitment stack · runtime-AI primitive · L12 canonical form · verification surface · cross-language byte parity · performance · deployment topologies. The 60-min deep read.
Request source
SDK + substrate access
Commercial-tier access to the substrate emitter (meta-generator factory, multi-tenant management, federation implementation, HSM ops). The SDK + verifier are already public Apache 2.0; this is for teams who need the factory layer.