Runtime-AI compliance terms, defined.

Operator-downloadable .zip containing the verifier + workspace identity + chain metadata.

The audit bundle is a zip download from the workspace dashboard at /workspace/[id]/handoff (or via /api/workspaces/[id]/audit-bundle). Contents: verify.mjs (the Apache-2.0 verifier), workspace.json (workspace id + signing public key + chain heads + tier), recent-receipts.jsonl + .csv (last-100 receipt metadata cache), anchor-history.jsonl (signed chain-head observations), README.md (instructions for the regulator). The bundle equips a regulator to verify a chain air-gapped; the chain itself comes from the operator's separate export.

Promethean SDK is BSL-1.1 source-available; verify.mjs is Apache-2.0 unconditionally.

The SDK source (runtime-ai-sdk.ts, runtime-ai-spec.ts, runtime-ai-receipt-log.ts, substrate-self-attestation.ts) is licensed under Business Source License 1.1 (https://mariadb.com/bsl11/). Operators may use it freely inside their own product; offering it as a competing hosted service is prohibited until the Change Date (2030-05-15), when it auto-converts to Apache-2.0. The bundled verify.mjs is separately licensed under Apache-2.0 so regulators can read, fork, and re-implement the verifier without restriction. Same model as HashiCorp Terraform/Vault, Sentry, MongoDB, CockroachDB, MariaDB MaxScale.

Deterministic byte-stable serialization rule that every signed entry commits to.

An entry's canonical form is the JSON string that gets hashed and signed. The serialization rule is explicit: key ordering is fixed, no whitespace, optional fields conditionally included. JS and Python implementations produce byte-identical canonical forms by construction. Without a canonical form, two implementations would compute different hashes for the same logical entry, breaking cross-language verification. The L12 canonical form is published in the verifier source (verify.mjs); anyone can re-implement an emitter or verifier from the spec.

Property that every entry's prevHash matches the previous entry's hash.

The L12 chain is hash-linked: entry N's content includes the SHA-256 of entry N-1's canonical form. A retroactive deletion or insertion would break this link at the affected position, and verify.mjs would report 'entry K: prevHash mismatch'. The substrate enforces continuity at ingestion: when a workspace's SDK uploads a receipt, the server checks that the reported prevHash matches the last recorded head for that spec. Continuity breaks are recorded but don't reject the entry, so a misconfigured SDK doesn't deny-of-service the workspace.

Pre-declared finite set of allowed output values for an LLM-in-the-loop decision.

The RuntimeAISpec's outputSchema fields use closed enums: a spec field with type='enum' must list enumValues explicitly. The substrate validates the model's output against the enum at runtime. Output not in the enum triggers the fallback handler. Closed-enum bounding is the substrate's structural answer to LLM hallucination risk in regulated contexts — the regulator can verify what the model COULD have output, not just what it did output.

The Ed25519 public key under which a chain's entries are signed.

Promethean publishes two trust anchors: the runtime-AI receipt-log key (y6F3rt10CEcSakCrnJIYkGymA66x3VXm0zCWbPjRxP8=) signs the three live reference deployments (paysafe/cliniclens/civicgate); the anchor cron key (S/n4yLMGhSsFt/g8X6P/Lnmw4zYNU6o6QtULzk9cE2A=) signs hosted chain-head observations. Operator workspaces generate their own per-workspace Ed25519 keypair at signup; the operator owns the private seed and the public key goes in the audit bundle.

Discrete categories of cryptographic + structural evidence the substrate emits.

Thirteen evidence kinds: l12-receipt-chain (every call signed + chained), runtime-ai-spec (the closed-enum spec the operator authored), reviewer-gate-log (when the gate fired + verdict), fallback-decision-log (when fallback fired), ots-bitcoin-anchor (OTS proof), audit-bundle (full runnable bundle), input-hash-only (PII-safe input hashing), model-identity-pin (provider + model + version per call), spec-hash-commitment (spec hash bound to every entry), ed25519-attestation (per-entry signature), schema-validation-result (Zod schema-valid flag), operator-managed-key (operator-controlled signing), operator-supplied-control (substrate doesn't directly address). Each framework template maps articles to evidence kinds.

What the substrate does when the model fails or produces invalid output.

Three closed-enum modes: reject (return an error, don't decide), deterministic-default (return the spec's deterministicDefault value), queue-for-review (route to human reviewer). The choice is part of the spec; changing it changes the spec hash. The fallback firing is recorded per-entry in the L12 chain (fallbackTriggered: true). Fallback rate over time is a regulator-side health metric for the AI system.

Cross-substrate primitive for committing decisions to a shared chain.

Federation lets two or more operators commit decisions to a shared L12 chain without trusting Promethean as referee. The chain head is committed multi-party; verification works against the federation's combined trust anchors. Available read-only on Production tier; available read+commit on Scale and Enterprise. Use case: consortium fraud detection across banks, multi-hospital clinical decision support, cross-government identity verification chains.

Per-framework Markdown + JSON document mapping articles to evidence kinds.

A handoff packet is generated for one of seven frameworks (GDPR / EU AI Act / PSD3 / DORA / NIS 2 / MDR / HIPAA). For each article: plain-English obligation, citation URL, list of evidence kinds the substrate emits, and an explicit 'operator must also' gap surfacing what the operator still owes outside the substrate. Generated from the workspace's actual state — entry counts, active specs, tier, anchor cadence. Available on Enterprise tier; see /regulators#framework-templates.

Hash-chained, Ed25519-signed log of every LLM-in-the-loop decision a Promethean-built product makes.

Each entry carries id, timestamp, productId, specId, specHash, inputHash, outputCanonicalHash, category, modelIdentity, latencyMs, schemaValid, reviewerVerdict, fallbackTriggered, prevHash, and per-entry attestation. The chain is byte-stable across implementations: a JS emitter and a Python emitter produce hash-identical canonical forms. Heads are optionally anchored to Bitcoin via OpenTimestamps. The chain is the operator's tamper-evident audit trail for regulated AI decisioning.

Bitcoin blockchain commitment of a chain head, providing third-party time-stamp evidence.

OpenTimestamps (OTS) is an open protocol that submits a hash to OTS calendar servers, which aggregate hashes and commit the aggregate to a Bitcoin transaction. The resulting .ots proof file ties the original hash to a specific Bitcoin block. Once the proof exists, the hashed content cannot have been retroactively created past the anchored block — doing so would require rewriting Bitcoin's history. Promethean anchors workspace chain heads at tier-dependent cadence (daily/hourly/30-min/15-min). The proof verifies offline against any Bitcoin full node.

The substrate's human-in-the-loop primitive for high-risk AI decisions.

Each spec declares one of four reviewer gate modes: always-human (every decision queued for review), on-schema-violation (queued only when output fails the closed-enum schema), on-low-confidence (queued when model confidence below the spec's threshold), never (no human review). When the gate fires, the L12 entry records the verdict (approved/rejected/amended) plus optional reviewer identifier. The reviewer-verdict distribution across the chain is the audit-side proxy for 'is the human exercising meaningful authority?' under GDPR Article 22 and EU AI Act Article 14.

The closed-enum contract one LLM-in-the-loop feature operates under.

A RuntimeAISpec declares: specId, displayName, category (one of classifier/extractor/drafter/router/summariser), inputSchema (closed-enum fields), outputSchema (closed-enum fields), promptTemplate (system + user), modelIdentity (provider/model/version), reviewerGate (closed enum: always-human / on-schema-violation / on-low-confidence / never), lowConfidenceThreshold, maxLatencyMs, fallbackBehavior (reject / deterministic-default / queue-for-review), deterministicDefault. The spec is hash-committed into every L12 entry it produces; changing the spec changes its hash and shows up in the chain.

Every L12 entry includes a SHA-256 of the active spec, making spec drift detectable.

When an operator changes a RuntimeAISpec (different model, different prompt, different reviewer gate, different output schema), the canonicaliseRuntimeAISpec function produces a different hash. The new hash gets committed into every subsequent L12 entry. A regulator inspecting the chain can detect silent spec changes by walking the specHash field across entries — sudden value changes mean the operator swapped the spec.

Optional field on L12 entries identifying the customer-of-the-operator who triggered a decision.

For multi-tenant operators (payment processors serving merchants, healthcare platforms serving providers, etc.), R4 multi-tenancy lets each L12 entry carry an optional tenantId. The substrate's verifier can scope verification to a specific tenant. Tenant isolation is at the chain-walk + statistics layer, not at the storage layer (entries from different tenants share the same hash chain). The tenantId is operator-supplied and operator-meaningful; the substrate doesn't interpret it.

GitHub Actions identity used to publish @promethean/runtime-ai to npm without long-lived tokens.

When @promethean is configured on npm with the GitHub Actions workflow as a trusted publisher, the workflow uses OIDC token exchange to authenticate at publish time. No long-lived NPM_TOKEN secret to leak. Promethean's publish workflow at .github/workflows/publish-runtime-ai.yml sets up the OIDC identity automatically when the workflow fires on a runtime-ai-v* tag push.