# Promethean System Architecture

> How the substrate, SDK, and verifier compose into a cryptographically auditable AI runtime.

## Layers

1. **L1–L11 (substrate)**: deterministic constraint synthesis from regulatory corpora. Each layer signs its output; the chain back to L1 is preserved in state.json.
2. **L12 (runtime-AI receipt chain)**: per-decision audit log. Each entry contains spec id, model identity, schema-bound output hash, prevHash, Ed25519 signature.
3. **Anchor cron**: hourly-to-15-minutely commit of chain heads to OpenTimestamps Bitcoin calendars (cadence by tier).
4. **Verifier (verify.mjs)**: standalone, Apache-2.0. Re-derives every hash, verifies every signature, reports any continuity break.

## Signing keys (Ed25519, RFC 8032)

- Runtime-AI receipt-chain trust anchor:
  - public key: `y6F3rt10CEcSakCrnJIYkGymA66x3VXm0zCWbPjRxP8=`
  - sha256 fingerprint: see `/api/facts/trust-anchor`
- Substrate state self-attestation:
  - public key: `HM6MRfGkwyFa1HN+/XG40rGmYwPyaYvhnINJmv4ntME=`
  - sha256 fingerprint: see `/api/facts/trust-anchor`

## Canonical form

The verifier rebuilds each entry's canonical form from a closed allowlist of fields:
`id, recordedAtMs, recordedAtIso, productId, specId, specHash, inputHash, outputCanonicalHash, category, modelIdentity, latencyMs, schemaValid, reviewerVerdict, fallbackTriggered, prevHash, tenantId (optional)`.

Adding an unknown top-level field to a stored entry causes the verifier to FAIL with "unexpected top-level field" — a regulator reading the .jsonl directly cannot be tricked into believing a field is signed when it isn't.

## Authoritative refs

- HTML: https://promethean.software/system
- Verifier source: https://promethean.software/verify.mjs
- Example chains: https://promethean.software/examples