The architecture under the five faces
~8 min read
How one engine does five things at once.
Audit, factory, corpus, rail, capability transfer are five views of one engine. This page describes the engine underneath them — the deterministic core (technical name: substrate) that makes the same predicates gate compliance, generate the next product, and feed the next entry in the cross-organisational corpus, all from the same machinery.
01 — Three pillars
How the architecture fuses the five faces.
Read the diagram below from the bottom up: three architectural commitments hold up one engine, which emits five consequences. Below the diagram, each pillar in its own terms — and which faces it carries.
Three pillars · one engine · five consequences
load path
Read the diagram from the bottom up. Three architectural commitments hold up one engine. The engine emits five consequences — not as five products bolted together, but as five views of the same machinery. Remove any pillar and the load above it falls.
Deterministic gates
Every consequential decision (publish, evolve, heal, govern) reduces to a closed-enum predicate. The same predicate gates audit (Face I), generation (Face II), and regulator citation (Face IV). One machinery, three faces.
Closed feedback loop
Every production run feeds the corpus the next decision draws from. The corpus (Face III) compounds because the factory (Face II) ships through it. Frontier-model improvements raise corpus quality, which raises the substrate's discriminating power.
Provenance everywhere
Every predicate carries provenance — corpus origin, regulation cited, CWE class covered. Same provenance trail satisfies the audit (I), seeds the corpus (III), satisfies the regulator (IV), and instructs the next configuration the factory ships (II).
02 — The five faces in detail
Each face is one view of the same engine.
Below: each consequence in its own terms. The architectural claim is that they are inseparable — what looks like five features in different products is, in our architecture, five angles on the same machinery.
Audit is the build.
Every consequential decision the substrate makes reduces to a deterministic predicate carrying provenance — which corpus it came from, which regulation cites it, which CWE class it covers. External auditors verify the same logic the substrate enforces. There is no second look. The audit IS the build, not a later step.
Marginal cost approaches zero.
The same predicates that gate publication generate the next configuration. 49 product generators encode every recurring shape of a modern SaaS — config, auth, schema, billing, analytics, email, compliance, observability, audit-log, multi-tenant, legal pages. New products are not built. They are configured. 25 products live on the substrate today as proof. From this flows a portfolio strategy where conventional SaaS plays a single product, and a moat against engineering scale.
The economics inversion
conventional vs factory
Conventional SaaS economics are linear in product count. Substrate-factory economics asymptote toward substrate fixed cost as N grows. A 3–5 person team running a substrate is structurally competitive with a 500-person engineering organisation building one product at conventional ratios. That is the moat against engineering scale.
The leverage curve
cumulative cost vs n products
Compounds across operators.
Every gate decision feeds a cross-organisational empirical layer the next decision draws from. License-aware harvesting. Provenance-tracked predicates. Cross-validated across thousands of repos. A new entrant starts at zero. We compound from where every previous operator left off.
Regulator-cited by design.
GDPR + EU AI Act curated obligations with EUR-Lex permalink citations and risk-tier mapping. APPI, PIPA, DPDP, PDPA converging toward similar shapes. The substrate is regulator-aware by design — not retrofitted, not paper-checked. The first reference implementation cited by an EU certification body becomes the default the unaligned middle adopts next.
Capability flows to the operator.
One install command. The same engine runs anywhere. Empirical layer inherited at install time. Capability flows to the operator, not the platform. This is what the brand encodes — fire stolen from the gods of frontier intelligence, made small enough to install in one command, transparent enough to audit in one read of the allowlist.
03 — Evidence
Calibrated, not promotional. Every figure is in code.
The substrate at v1.0 is not a deck. It is 206 test files, 7,175 passing assertions, a self-scan that runs the substrate's own gap-detector against its own source (allowlist applied, zero residual findings), 25 products built by the engine and deployed on its own infrastructure, and six structurally independent evidence streams flowing into the corpus, an analytics layer that turns raw evidence into operator-personalised risk profiles, a closed reverse loop wired into every product the factory ships, and a four-wire "self-adapting substrate" that turns those analytics from reporting-mode into substrate-behaviour-mode. Public test-pattern harvest, CVE NVD vulnerability data, GitHub Security Advisories (npm/PyPI/Maven), EU Data-Protection-Authority enforcement decisions, Stack Overflow developer-near-miss pairs, and bug-bounty/postmortem narratives all feed the corpus through different gates. A failure-landscape analytics module aggregates the streams into per-CWE × per-ecosystem growth-rate maps; a domain-fingerprint module projects them onto an operator's actual repo; an auto-mapper proposes new CWE → predicate mappings from fix-commit evidence; and Path B's four wires (ADR aa) feed the analytics back into promotion thresholds and factory selection — two operators with different stacks now get different products from the same factory. Phase 2 operational deployment with paying operators is still ahead — but Phase 2 is no longer the critical path for substrate compounding, and the operator-pilot demo is runnable today via npm run factory:fingerprint-demo.
Five evidence streams · operational today
four live · one wired-and-waitingThe corpus grows from five structurally independent sources tonight. Four are flowing live; the fifth (operator runtime) has its plumbing wired and is waiting on Phase 2 GTM. Phase 2 is no longer the critical path for substrate compounding — the dataset streams produce evidence at volumes a single pilot operator wouldn't approach in years.
GitHub + GitLab harvest of test predicates · 60 promoted corpus entries · 25 cross-language convergences · running unattended
CVE NVD descriptions + GitHub fix-commit pattern harvest + GHSA ecosystem-specific (npm/PyPI/Maven/RubyGems) · CWE-classified · license-aware
ICO/CNIL/AP/BfDI/AEPD/GPDP/EDPB · article citations + fines + dates extracted · multi-language (HTML MVP) · the regulatory rail's enforcement-evidence layer
Stack Overflow accepted-answer pairs · "expected vs actual" phrasing extraction across 5 patterns · production-failure evidence at developer scale · earlier than CVE/incident evidence
emitter baked into every factory-built product · ingester + contribution-governance review queue surfaced · waiting on first Phase-2 operator
The substrate now compounds without external operators. When the first paying pilot operator does arrive, their attributions enrich an already-rich corpus and the cross-organisational moat (Moat A) activates additively rather than as the path-dependent prerequisite it was before. The architecture is documented across 45 ADRs (the May 8 through May 12 series in `docs/adr/` in the substrate repository), with the v1.0 schema-lock ADR (the May 12 series) the most recent.
Analytics layer · raw evidence → insight
shipped Phase D · May 8 2026Five evidence streams are necessary but not sufficient. An operator does not buy raw JSONL — they buy a personalised risk surface for their codebase, ranked by actual exposure, with concrete predicates to enforce. Phase D ships the analytical surface that turns the four dataset streams into operator-actionable insight.
aggregates HarvestedCve records · per-CWE frequency · per-ecosystem distribution (npm vs PyPI vs Maven CWE skews differ structurally) · monthly time-series + growth-rate projection · CLI: failure:landscape
manifest-based ecosystem detection · framework + domain hints from dependency names · cross-references against §65 → operator-personalised CWE risk ranking · CLI: failure:profile
reads §54.1 fix-commit patterns · groups by CWE class · proposes new mappings with alreadyCurated flag · reviewer-signed promotion · closes the §63 routing loop the dataset arc surfaced · CLI: failure:auto-map
This is what an operator's CLI actually shows them. Point failure:profile at your repo, get back: detected ecosystem(s), inferred framework + domain, and a CWE-ranked risk list calibrated to the empirical landscape your stack lives in — not the global average. The §54.1 fix-commit harvest output that previously sat write-only on disk now feeds the curated mapping set through §67's reviewer-gated proposal flow.
Each face · proof in code
v1.0 · today
The substrate is not a slide deck. Every figure here is in code, tested every push, and reproducible from a clean clone. We have run the discipline on ourselves before asking anyone else to trust it.
Multi-repo trial — N=4 external EU-relevant repos
Detector verified clean on prowler (5,878 .py files / 10,510 resolved edges) and forgejo (4,000+ .go files, production graph excluding tests). The two repos with findings have real cycles; the two without do not — and now we can prove it.
§47 harvester · ongoing · May 8, 2026
running · 600+ cycles · resumableThe 60 promoted corpus entries are not uniform — they cluster into five distinct strata, each a different kind of evidence about how testers think across the global ecosystem. The §47.5 cross-language convergence count grew from 7 to 25 in 24 hours — the moat metric is now a measurable signal, not an aspiration:
defined · membership · equality · regex-match — the highest-evidence predicates, observed across ts/js/tsx/py
Option / Result / .is_empty() / .is_some() — language-native correctness checks that cannot exist outside Rust
.total · .state · .call_count · !<id> — predicates observed independently across 2–3+ language ecosystems · 0 → 25 in 24 hours · the moat metric
HTTP status codes · state-management · structural delimiters · exception throws — vertical-tied
result.X === expected.X family — at threshold, weak operand variance, gate working as designed
stratum C going from 0 → 25 in 24 hours is the strongest universality signal the corpus can produce — empirical evidence that the cross-organisational moat is measurable, not aspirational. And every promoted entry is now also a generator slot: the factory-inverter emits each entry as a TypeScript (Vitest), Python (pytest), and Rust (#[test]) test stub, with full provenance comments, included in every product the factory ships. Half the test directory of a Promethean product is hand-built; half flowed from the corpus. The corpus-as-generators thesis is now operational end-to-end.
04 — Proof of discipline
We run the substrate on itself first.
Six things we have learned from running the discipline on ourselves before asking anyone else to trust it. Each one improved the substrate before it ever touched an external operator.
The audit pattern · run on itself first
loop
Every section the substrate has ever shipped (§43–§64) followed this loop. The unit of work is small enough to ship in a session and large enough to surface something the substrate's own rules will fire on. We tighten the loop on ourselves before asking anyone else to run it.
Type-only imports are not runtime cycles
The architecture detector originally flagged any import (value or type-only) as an edge. Dogfooding caught it: the kernel showed a critical 5-file SCC inflated by 2 type-only edges that get erased before runtime. Tightened the regex to match madge / dpdm semantics; the SCC shrank to a true 2-file runtime cycle which then dissolved with one keyword change.
Allowlists are not for silencing — they are for documented decisions
Every allowlist entry must carry kind, match, reason, reviewer, and reviewedAt. Our own allowlist documents 11 entries covering ~18 individual findings. None are architectural debt; all are 'this rule does not apply because…' — written in form an external auditor can read. Operators copy this file as a starting point for their own.
The audit pattern is the entire methodology
Ship a small unit. Run it against a small target. Document what surfaces. Triage. Fix or write down why not. Repeat. Every section the substrate has ever shipped (§43–§64) followed this pattern. The discipline scales because the unit of work is small enough to ship and large enough to surface something.
Auto-pilot rotates the harvester through language axes when growth flatlines
The §47.4 plateau detector watches §47.1 signature growth; when it stays flat for 8 consecutive cycles, the orchestrator rotates the harvest axis (language × tier × page) and resumes. May 8, 2026: the substrate self-directed exploration through five ecosystems — TypeScript → Python → Java → Rust → Ruby — over 12 hours unattended. Each rotation triggered cleanly. First-contact with Java and Rust corpora produced 32 new entries, including 7 cross-language convergences the corpus had never seen before. The discipline scales because exploration scales without supervision once the rotation rule is correct.
Every promoted predicate is dual-use — a verifier and a generator slot
Curry–Howard says a closed-enum predicate that gates publication is also a constructive recipe for a configuration that satisfies it. The factory-inverter operationalises this: each of the 60 promoted corpus entries is now emitted as a TypeScript (Vitest), Python (pytest), and Rust (#[test]) test stub — 180 stubs in total, with full provenance comments and operand-quality warnings. The product builder includes those stubs in every product it ships. A real Promethean product directory contains 263 files: 143 from the 49 hand-built generators, 180 corpus-derived. Half the test directory is hand-built; half flowed from the corpus, with full provenance, into a product configuration. The factory's expressivity is no longer bounded by 49 hand-built generators — it grows monotonically with the harvester. Every overnight harvester run is now also a factory upgrade.
Phase 2 stops being the critical path. The corpus compounds without external operators.
The May 8–9 compounding-loop arc closed the §62 reverse loop and operationalised six independent dataset evidence streams: CVE NVD (with GitHub fix-commit pattern harvest), GitHub Security Advisories (npm/PyPI/Maven/RubyGems), EU Data-Protection-Authority enforcement decisions (ICO English + CNIL French), Stack Overflow developer-near-miss (accepted-answer pairs), HackerOne/Bugcrowd/Intigriti bug-bounty disclosures, and danluu-format postmortem narratives. Combined with the existing §47 public-repo harvester, the substrate grows from seven structurally independent sources, none of which require external operators. A Phase D analytics layer (§65 failure-landscape, §66 domain-fingerprint, §67 cwe-auto-mapper) turns the raw streams into operator-personalised risk profiles. The §47.6 cross-stream jackpot detector empirically verified itself on May 9 against real CVE fix-commit data — 2 strength-3 convergences (predicates observed in ALL THREE evidence streams: public-harvest + fix-commit + production-runtime) plus 15 strength-2 candidates, surfaced in 5 minutes wall-clock. Phase F shipped §65.1 forward-projection — proper OLS linear regression with 95% prediction intervals and sample-size honesty — the substrate's first regulator-grade statistical claim. The model verified itself by refusing to over-claim: against 1 month of CVE data it flagged all 13 CWEs as `insufficient-data`, the deltaPct heuristic next to it produced numbers like `+4341.7%` from the same data — showing exactly why the statistical model matters. 23 ADRs, 26 commits, ~17,200 LOC, ~890 new tests, 0 regressions.
05 — Cryptographic attestation
Every state.json is Ed25519-signed.
The substrate publishes its self-attestation document at /state.json. That document carries an Ed25519 signature over its canonical form. Any partner, regulator, or customer can independently verify the document came from this substrate and hasn't been tampered with — no trust in us required. This is the foundation of the verifiability story: every claim Promethean publishes is mechanically checkable, not socially attested.
Substrate public key
Base64-encoded raw 32-byte Ed25519 public key. Bake into your own verifier; treat as the trust anchor for every claim on this site.
HM6MRfGkwyFa1HN+/XG40rGmYwPyaYvhnINJmv4ntME=
algorithm ed25519 · canonical-form v1 · rotation documented via ADR with historical-key archive
Verify in one command
Clone the substrate repo (or just the verifier), fetch state.json, run the verify CLI:
# fetch the published attestation
curl -s https://promethean.software/state.json \
-u $USER:$PW > state.json
# verify (exit 0 = signature valid + trusted key)
npm run substrate:verify -- state.json
# or do it inline — no Promethean code required
node -e "
const c=require('crypto'), fs=require('fs');
const s=JSON.parse(fs.readFileSync('state.json'));
const a=s.attestation; s.attestation=null;
const der=Buffer.concat([
Buffer.from('302a300506032b6570032100','hex'),
Buffer.from(a.publicKey,'base64')]);
const key=c.createPublicKey({key:der,format:'der',type:'spki'});
console.log(c.verify(null,
Buffer.from(JSON.stringify(s,null,2)+'\n'),
key, Buffer.from(a.signature,'base64')));
"The signature commits the substrate
Every published state.json is signed at generation time. Tamper with any field — corpus counts, audit-trail rows, statistical claims, wire activity, promotion-log head hash — and the signature breaks. The substrate cannot silently revise history.
Embedded pubkey ≠ trust anchor
The attestation block embeds the pubkey it was signed with so the file is self-contained. BUT verifiers MUST compare that pubkey to the trusted constant published here. A forger could embed their own pubkey and sign anything; the check is the embedded-vs-trusted comparison.
Promotion-log transparency surface
Every §47.3 promotion event appends to a SHA-256 hash-chained log. The HEAD hash of the chain is committed in state.json (covered by the Ed25519 signature). Three guarantees: chain valid (recomputed locally) + state.json valid (Ed25519 check) + log head matches state's committed head. Any silent rewrite breaks at least one.
Verify the promotion log end-to-end
The promotion log records every signature graduating from §47.1 memory into the active corpus. Each entry hash-links to the previous — tamper with any line and the chain breaks at that line. The HEAD hash is anchored in state.json's signed attestation.
# 1. Fetch the signed attestation + the log curl -s https://promethean.software/state.json -u $USER:$PW > state.json curl -s https://promethean.software/promotion-log.jsonl -u $USER:$PW > log.jsonl # 2. Three independent checks via one command: npm run substrate:verify-log -- log.jsonl --state=state.json # Expected: # ✓ CHAIN VALID · N entries chained from genesis to head ... # ✓ state signature VALID · trusted public key # ✓ ANCHORED · log head matches state.json's committed head
All three must pass for the substrate's history to be trusted. Each failure mode is detected independently — if chain breaks: someone modified an entry; if state signature breaks: someone modified state.json; if head mismatch: state.json is stale relative to the log.
The full cryptographic stack — twelve layers, one trust anchor
Each layer is independently verifiable and committed to by the layer above. A successful attack must defeat every layer simultaneously — and any single broken layer is detected on its own. As of substrate v1.0 (May 12 2026), eleven numbered layers are in place plus per-cycle autonomous-loop receipts and per-product build receipts — all under the same Ed25519 trust anchor.
Ed25519 signature on state.json
Every state.json carries a 64-byte Ed25519 signature over its canonical form.
↳ anchor: Public key baked into substrate source · trust root for everything below.
npm run substrate:verify -- state.json
SHA-256 hash-chained promotion log
Every §47.3 promotion event is an append-only entry. Each entry references the previous entry's hash.
↳ anchor: Chain HEAD hash committed in state.json → covered by L1 signature.
npm run substrate:verify-log -- promotion-log.jsonl --state=state.json
Corpus Merkle tree
Every promoted corpus entry contributes a leaf hash. Tree root commits to per-entry contents. Inclusion proofs in O(log N).
↳ anchor: Merkle root committed in state.json.corpus.merkle.rootHash → covered by L1 signature.
npm run substrate:verify-corpus -- corpus.jsonl --state=state.json
Reproducible build receipts per product
Every product the substrate emits carries a signed receipt committing to: ProductSpec hash, corpus root, generator-versions hash, output-file Merkle root, state.json hash, and (since v0.3-4) the full meta-generator lineage of every meta-emitted generator that contributed to the product.
↳ anchor: Receipt signed with the same Ed25519 key as L1 → customer can re-run and compare every byte.
npm run substrate:verify-receipt -- receipt.json --product-root=. --state=state.json
Per-stream signing keys + trust weights
Each of 7 evidence streams (public-harvest / cve-harvest / fix-commit / ghsa / stackoverflow / production-runtime / library-patchnotes) signs its observations with its own key. Cross-stream convergence uses weighted strength (production-runtime=1.0, stackoverflow=0.4) — multi-stream poisoning becomes asymmetric. §72 library-patchnotes added v0.2.5.
↳ anchor: 7 public keys published in state.json.publishedStreamKeys → covered by L1 signature.
Each observation carries an Ed25519 signature verifiable against the stream's published key.
Honeypot signatures (gate validation)
5 synthetic 'vulnerability' patterns planted in Promethean-controlled repos. The detector scans corpus + signature memory continuously — if any honeypot ever reaches the active corpus, §47.3 gates have a flaw.
↳ anchor: Honeypot manifest hash + scan status in state.json.honeypots → covered by L1 signature. Silent honeypot removal breaks the manifest hash.
npm run substrate:check-honeypots
State-transparency log
Every state.json regeneration appends one entry to a SHA-256 hash-chained log. Each entry records the canonical content hash of the state at that moment, plus claim/convergence/evidence counts. Silent revision of past self-attestations becomes detectable — a verifier who snapshots the log at time T can prove every future state.json must include all entries up to T.
↳ anchor: Chain HEAD hash committed in state.json.transparencyLog.headHash → covered by L1 signature.
npm run substrate:verify-transparency -- transparency-log.jsonl --state=state.json
OpenTimestamps Bitcoin anchor
The L7-head digest is submitted to three independent public OpenTimestamps calendar servers. Each receipt eventually anchors to a Bitcoin block. The qualitative leap: prior to L8 every claim rested on trusting Promethean's clock. After L8 the upper bound on 'when state.json existed' is set by a Bitcoin block — externally verifiable, not under the operator's control. Backdating past the anchor block becomes provably impossible.
↳ anchor: state.timeAnchor.receipts (base64 OTS receipts) → covered by L1 signature. Bitcoin verification delegated to standard `ots verify`.
npm run substrate:verify-anchor · ots verify (Python)
Self-evaluation log
Every substrate-self-build-evaluation (8 deterministic structural checks against an emitted product) appends to a SHA-256 hash-chained log. The substrate measures its own output quality and carries a tamper-evident record over time. `summariseQualityTrend` requires ≥ 3 entries before declaring rising/falling/flat — same §65.1 small-N stance the substrate uses on external CWE forecasts.
↳ anchor: Chain HEAD hash committed in state.json.selfEvaluationLog.headHash → covered by L1 signature → L7 → L8.
npm run substrate:self-evaluate ; npm run substrate:verify-all
Audit-receipt log (per-entry Ed25519)
Every `substrate:verify-all` run appends a signed entry committing to the full audit-result hash plus per-layer outcomes. Per-entry signing (not trust-through-reference) because audit conclusions have no underlying signed object — the conclusion itself must be signed at point of recording.
↳ anchor: Chain HEAD hash committed in state.json.auditReceiptLog.headHash → covered by L1 signature → L7 → L8.
npm run substrate:verify-all · verifyAuditReceiptLog
Substrate-component log (per-entry Ed25519)
Every meta-synthesized substrate component (the reflexive bootstrap — substrate authors substrate) appends a signed entry committing to intentHash + emittedContentHash + componentFilePath. Two components currently in runtime: corpus-trend-analyzer.ts (133 lines, intentHash ccc8e5c4…) and lineage-chain-summarizer.ts (150 lines, intentHash 52bde153…). Both behaviourally tested with no mocking.
↳ anchor: Chain HEAD hash committed in state.json.substrateComponentLog.headHash → covered by L1 signature → L7 → L8.
npm run substrate:component-synthesize ; npm run substrate:verify-all
Runtime-AI receipt log (per-entry Ed25519, v1.1 Phase R)
Every LLM call a substrate-emitted product makes at runtime appends a signed entry committing to specHash + inputHash (PII-safe, redacted) + outputCanonicalHash + modelIdentity + latency + schemaValid + reviewerVerdict + fallbackTriggered. Three live chains under one trust anchor: paysafe-fraud-classifier (12 entries), cliniclens-note-structurer (10 entries, all reviewer-gated), civicgate-message-router (10 entries). Multi-tenant via optional tenantId (R4); federation via signed commitments (R5).
↳ anchor: Chain HEAD hash committed in state.json.runtimeAiReceiptLog.headHash → covered by L1 signature → L7 → L8.
npm run substrate:verify-runtime-ai -- <path> · verifyRuntimeAIReceiptLog
Plus AC autonomous-cycle receipts (every nightly capability-loop cycle, signed under L1) and L4 build receipts (one per emitted product). All under the same Ed25519 trust anchor; all checkable by a single regulator command — see Regulators for the one-call audit story.
The reflexive bootstrap (v0.7 → v0.8)
The substrate authors its own components.
The meta-generator (v0.1) lets the substrate emit product generators — TypeScript files that produce code at product-build time. v0.7 closes the recursion: the same primitive emits substrate components — modules placed under contrib/jarvis/src/synthesized/ that the rest of the substrate's own code imports at runtime.
Two meta-synthesized substrate modules are in the runtime surface today, both compile cleanly with the 113 hand-written modules, both behaviourally tested against real fixtures with no mocking. Every emission is hash-chained into L11 and Ed25519-signed at point of recording.
The compounding loop now runs at the meta-substrate layer, not just the product layer. Every operator engagement that surfaces a missing substrate primitive can result in a new substrate component that future substrates inherit. The vision claim — "the substrate produces the systems that produce software" — is operational at every layer.
Federated substrates (v0.17)
From instance to ecosystem.
Each substrate instance has its own L1 Ed25519 keypair. A substrate publishes signed federated signature claims — "we observed signature X across these provenance classes locally" — under its own key. Peer substrates verify the claim against the publishing substrate's pubkey in a shared federation directory.
Cross-substrate convergence: a signature observed by ≥ N distinct substrates from independent operators carries stronger evidence than any single-substrate observation. No corpus exchange — only signed signature summaries flow between substrates. Each substrate's corpus stays sovereign.
The disappearance contract extends naturally: if Promethean vanishes, peer substrates continue exchanging signed claims among themselves. The compounding claim — "operator N+1 benefits from operators 1..N's prior intents" — becomes architecturally operational, not just rhetorical.
Runtime-AI containment · Phase R (v1.1, May 12 2026)
The pattern that bounds the build-time LLM call now bounds the runtime one too.
v0.1 used Claude for exactly one build-time step (intent → ProductSpec) then handed off to 49 deterministic generators. Phase R extends that discipline to customer-product runtime: every LLM call a substrate-emitted product makes goes through runConstrainedAI, which validates input against the spec's schema, calls the LLM, validates the output against a closed-enum schema, applies the spec's reviewer-gate (§67), handles the declared fallback, and appends a signed L12 receipt.
Product code never sees an unconstrained LLM output. The closed-enum schema is enforced before the result reaches any deterministic handler. Direct LLM-SDK imports outside src/lib/runtime-ai/ are flagged by adversarial autoplay as containment violations. CI catches the shortcut.
Three live references — paysafe / cliniclens / civicgate — each shipping a real signed L12 chain visible at /products/<id>/runtime-ai. Multi-tenant L12 isolation (R4); federated cross-substrate convergence on shared specs (R5).
v1.0 stable · schema-locked baseline (May 12 2026)
From v1.0 forward, the substrate's external surface is stable:
- Schema versions locked — bumping requires an ADR + migration path
- Canonical-form versions locked — hashing semantics for every commitment chain stable
- Closed-enum vocabularies locked — adding new values requires an ADR
- External-consumer API surface stable —
@promethean/verify,@promethean/gap-detect, the runnable audit bundle'sverify.mjs - v1.x changes are additive only; breaking changes require v2.0
7,175 tests across 206 files · 45 ADRs · `tsc --noEmit` clean · the architecture is locked; what remains is operator engagement and observed reality.
For partners and customers
The strongest pitch isn't "we have great security." It's you don't have to trust us — you can verify us, byte for byte. Every claim on this site links to state.json. Every figure in state.json is covered by the L1 signature. Every product the substrate emits carries a build receipt that proves bit-for-bit reproducibility against a corpus root that's covered by the same signature. Six independent layers, one Ed25519 public key, every link cryptographic. That's regulator-grade. That's the posture no incumbent compliance vendor offers.