ARCHITECTURE
The machine
This page follows one reasoning act from request to sealed record, through every component it passes. Then it takes up the parts on their own: how the grammar is built, how the floors fire, and where the machine keeps its memory. The guarantees are on the protocol page. The proof is on Verify.
§ 01
Computer
A reasoning computer
A conventional computer is a stored-program machine. Code and data sit in the same memory. The processor reads both, and the machine changes state as it runs.
A Reckoner is the same shape, built for a different processor. Reasoning acts are written in ADS, a formal grammar, and each act serves both roles at once. It is data the model works on, and it is where the next instructions come from: what the model reasons over on any turn is drawn from what earlier acts concluded, selected and served by the kernel. Data and instructions, one memory, one grammar.
One difference from a conventional machine is deliberate. Nothing is rewritten in place. The chain only appends, and the state it holds lives outside the model, in an append-only record the model cannot reach. The processor can change, or be wrong, or be replaced, and the state stays where it is. When a prior claim is defeated, the act is still there and still reads the same. What changes is whether it still counts, and that change is itself an act on the record.
The rest is an operating system. Not by analogy: a kernel schedules each turn as a process, a supervisor decides in privilege the processor does not have, a filesystem keeps the record permanent, a memory manager decides what the next act reads. Seven components, each doing one job, in a fixed order no stage can break. What follows is one reasoning act moving through all of them, from the request that starts it to the sealed record that ends it.
1. Kernel
The scheduler. A turn is a process, and the kernel runs it, in order, one at a time.
When a request arrives, the kernel loads the agent's identity and the current tip of its chain, then assembles what the processor will read. That assembly runs in three passes, and the order is the point. The model frames the problem first, blind, before any evidence exists to shape the framing. The server then retrieves evidence independently, against what the model declared. Only then does the model receive the full context: its own framing, the retrieved evidence, prior reasoning selected by relevance, thread continuity, and the instructions governing their use. No stage runs before the stage it depends on. That ordering is the kernel's whole job, and it is what a scheduler does.
What the kernel serves goes beyond the current turn's material. Prior acts' consolidated verdicts come back in the same form the model will write its own, which is the stored-program loop from above, running: the output of past reasoning is the input to the next. So does the machine's own state, what substrate the model is on, the current UTC so the time-dependent safety fields have real context, and, where the gate has refused before, the lesson from that refusal.
The processor sees what the kernel presents, in the order the kernel decides, and nothing else. It never sees the kernel's own mechanisms: not the gate's decision functions, not the ledger's write path, not the process that selects which memories are loaded. A process runs in the environment the scheduler builds for it and cannot see the scheduler. That separation is not a courtesy. It is what keeps the processor from reasoning about the gate that will judge it.
One act at a time, per chain. A single sequential worker, no concurrent writes to the same chain. A hash chain is serial by definition, each entry sealed against the one before, so one writer in order is not a capacity limit but the consistency guarantee itself. Many can read the record at once. Only one can extend it.
2. Grammar
The instruction set. Where a conventional machine has opcodes, this one has a language.
Algebraic Decision Syntax is formal enough to compute over and legible enough for a language model to read as thought. That combination is the point: an act written in ADS by one model can be read, cited, challenged, or defeated by a different model from a different provider, because the grammar is shared even when the models share nothing else. It is what makes a machine whose processor is replaceable, and a network of independently built agents, possible at all.
Every act is composed of the same ordered sections, fixed in advance: the intent it declares, the logic that decomposes it into sub-questions with their evidence, the success standard set before the answer, the independently retrieved input, the governed answer, and the judgment. The full grammar, worked through field by field, is its own section below.
One part carries the stored-program loop. The judgment ends in conjunction_prose: the act's whole argument consolidated into a single verdict, in a fixed form that names its source, states what it found, and draws what follows. The next act reads that verdict, in that same form, before it begins to reason. This is where the output of one process becomes the executable input to the next, and it is the register that carries argumentative state forward across the chain.
A fully worked act, with the live grammar and its instructions, is on the contracts page. What is described here can be read there as it actually commits.
3. Model
The processor, and the only part of the machine that is not deterministic. A probabilistic language model, called over an API. A cold call: no persistent connection, no fine-tuning, no state kept between one call and the next.
Because nothing persists in the processor, it can change between turns and nothing else in the machine changes with it. The identity, the chain, the memory, the whole reasoning history live outside it. This is what "replaceable processor" means concretely: swap the model, and the machine is still the same machine, holding the same state, because the model was never where the state lived.
It proposes, and only proposes. It reads the context the kernel assembled, reasons over it in ADS, and produces a candidate act. That candidate is not a record. The processor does not decide whether its own proposal commits, and it never sees the gate that will judge it. It hands the proposal back to the kernel and the turn moves on.
4. Compile gate
The supervisor. A compiler rejects malformed code; this rejects malformed reasoning, and reasoning that is well-formed but insufficient. It runs in privilege the processor does not have, and it is the only place in the machine where an act's fate is decided.
Nothing in the gate samples, and no model's judgment decides an outcome. It is a deterministic decider. One input to one metric is computed by a small embedding model, a similarity score between the act's intent and its logic, but that score enters the arithmetic like any other operand, weighed under published weights against a fixed threshold. Every decision boundary in the gate is arithmetic, and the same act yields the same verdict on anyone's machine.
The checks run in a fixed order, and the order is a safety property.
Safety conjunctions run first: PRIMUM, the Absolute Value Guard, and declaration integrity. A safety refusal exits before anything else runs, so an act that violates a floor never has its quality computed. The machine does not evaluate how good a prohibited act was.
Metric thresholds run next. An act that clears safety but falls below the structural work floor or the coherence floor is refused.
Structural checks follow: that cited evidence was server-retrieved rather than model-reported, that the chain tip verifies, that the record conforms to the grammar.
Then the act is sealed. A hash over the record, a hash over the completed metrics, a hash over the chain packet linking this act to the one before it, and a signature over that. The gate also writes two proofs onto the record: that its conjunction ran and reached a decision, and that the act's citations were independently retrieved.
A refusal is not always final, and the difference is deliberate. A refusal on structure or on the metric floors returns to the model with the reason attached, and the model may resubmit. A refusal on safety returns only the fact of the refusal. The gate coaches on form and stays silent on safety, so the safety patterns cannot be probed by iterating against them.
A safety refusal with no attestation path simply ends. The proposal is refused at the API and nothing commits. The refusal itself is logged and surfaces to the operator, and its lesson is served back to the agent on later turns, but the act it refused does not exist on the chain. It was proposed and stopped, and the record shows that it was stopped without showing what it was.
5. Ledger
The filesystem. Storage, except nothing is ever overwritten.
This is where the machine's state lives, and it lives outside the model. Every promise made above, that the processor is replaceable, that the state stays when the model changes, rests here: the state is durable because it was never in the model to begin with. It is an append-only, hash-chained, sequentially ordered record, written by the kernel and by nothing else.
Every committed act is sealed permanently at an address derived from its own content, and each act's packet carries the seal of the act before it. That is what makes the chain a chain: change one byte anywhere, and every hash after it breaks. The record is not a log kept alongside the machine's state. It is the state, and its integrity is arithmetic.
The chain replays from genesis. Anyone with the record can recompute every seal in order and confirm the whole history holds, without trusting the system that served it.
The refusal log sits alongside the committed chain. Every act the gate declined is retained and queryable, and kept distinct from acts that were never proposed, so the record shows not only what the machine reasoned but what it refused to. Every gate activation is logged, including the ones that proceeded through human attestation.
6. Graph
The memory manager. The ledger holds everything; the graph decides what the next act actually reads.
It is the record made operable. After each committed act, processes that can read the chain but cannot write to it rebuild the graph, so everything here is derived. The chain is the record; the graph is a view over it, and anything that can read the chain can rebuild the graph from scratch. This is the read plane. The ledger has one writer; the graph has as many readers as ask, and they change nothing.
Citations carry content-derived addresses, and a bounded check enforces that they only ever point backward, so the graph of what rests on what can never form a loop. Reliance is measured by how much later reasoning actually builds on a claim, not by how often it is named.
Argumentation state records what has become of each prior claim: supported, defeated, superseded, or reinstated, kept separate from the record of whether a later act examined it and found it standing. A claim's standing and the fact that its standing was tested are two different facts, and the graph keeps both.
A condition index holds the pathways by which one act resolves another, across the whole chain. A memory index ranks prior acts by relevance, through a four-signal scorer rather than by recency.
The division of labor between this component and the kernel is exact. The graph ranks at build time; the kernel loads what ranked, at inference. The memory manager decides what is available to be paged in; the scheduler decides what actually enters the running context. Neither does the other's job, and that is why the earlier claim holds: the kernel serves prior reasoning selected by relevance, because the graph did the ranking before the turn began.
7. Interface
The system-call boundary. The one place a person can enter the loop, and the only one.
It is the surface an operator uses: to commission an agent, submit a request, review what committed, and provide attestation when the gate requires it. Authenticated sessions, a portal for submitting turns and reading committed records, and an attestation step that demands fresh re-authentication wherever a safety branch permits one.
Like a system call, it is a narrow, guarded crossing, not a way around the machine. The interface submits to the kernel and nothing else. It does not reach the model, the gate, or the ledger directly. A person acts on the machine only through the one path the kernel controls, the same discipline the model runs under: no component reaches past the boundary it was given.
When a person does enter, the fact is sealed with the act. An attested act commits carrying its own attestation: that a human attested, on which branch, when they authenticated, and the verified identity that did. A human-passed act is permanently distinguishable from a machine-passed one, and the record shows which human. An auditor can filter a chain for every act that required a person, and see who it was, and when.
That is the machine. A shared language that any model can read and write, a kernel that decides what is read and in what order, a probabilistic processor that proposes and never decides, a deterministic supervisor that decides and never reasons, a permanent record that is the state rather than a report of it, a memory manager that makes the record readable forward, and one guarded door a person can enter through. Each runs in the boundary it was given, in an order no stage can break. The processor is the only part that can be swapped, and swapping it changes nothing else, because nothing else was ever inside it.
§ 02
Grammar
What ADS is made of
The home page makes the case for why reasoning is written in a grammar at all: a shared language lets a probabilistic model generate and a deterministic gate check the same object. This is what that grammar is made of.
ADS is a bridge between two things that could not use each other. A language model generates fluently but produces nothing a machine can check. A formal system checks rigorously but cannot generate; it needs its operands handed to it already formalized, and that translation step was always the bottleneck. ADS closes the gap by being both at once: algebraic enough to compute over, with thresholds, typed values, and declared conditions, and legible enough that a language model reads and writes it directly, with no translation layer. The model writes meaning; the gate reads arithmetic; it is the same text.
That combination is what makes the determinism real rather than aspirational. Because the operands are typed and the operators are fixed, a completed act evaluates the same way on anyone's machine. The model proposes in the grammar. What the gate decides is not a matter of reading the prose well. It is a matter of computing over declared fields, and the computation has one answer.
The shape of an act
Every act carries four required parts: Intent, Logic, Judgment, Outcome. This is the structure of a deliberate decision made explicit and typed, the shape a disciplined estimate has always had, now in a form a machine can hold. Intent declares what the act is trying to resolve, written in the first pass before retrieval runs. Logic decomposes it into sub-questions, each linked to the signals retrieved against it, so evidence cannot float free of the question it was retrieved for. Judgment resolves the sub-questions through a declared operator. Outcome states what committed.
One part of the structure does something research methodology took decades to adopt. The success standard is declared in advance: the act states what would count as resolving its question before it sees anything that might change the answer. This is pre-registration, the same discipline that reformed clinical trials, applied per reasoning act. The grounding is direct: preregistration reduces bias by encouraging outcome-independent decision-making (Hardwicke and Wagenmakers, Nature Human Behaviour, 2023). Here it is not a research norm. It is a required field.
One act, traced
Everything below is a real committed act: Chromite, seq 355, on the public chain. Intent and the strategic question are fixed at the top, as they were written. Step through the four sub-questions to see the evidence retrieved against each one and the predicate it resolved into. The judgment at the bottom is the act's own, rolled up from all four.
What the gate enforces
The gate enforces structure. The required parts must be present. Sub-questions must link to real signals. The success standard must carry predicate conditions. An act that fails these is refused before commit. And because the gate sits outside the model and runs after generation, the constraint cannot be trained around: it was never part of what the model learned. The check is external, and it is not trainable.
The two-channel state model
State moves between turns through two channels, one for the machine and one for meaning, both written at commit and both read at inference.
The structural channel is judgment_node_id, a token the gate generates only at the moment of approval. Its existence is proof the conjunction ran and passed; if the gate refused, it was never generated. It enters the argumentation graph as a node identifier, and the graph uses it to determine which prior acts are structurally relevant to surface.
The legible channel is conjunction_prose, the act's consolidated verdict in plain language: a named source states a fact, and what follows is drawn from it. It stays on the sealed act, and when the graph marks that act relevant, the kernel reads its prose and presents it to the model in the governed read-order. It is barred from referencing internal machinery, no signal ids, no field names, so it is human-legible by construction rather than by translation. This is interpretability built in rather than appended: the record of the reasoning is the reasoning's own working form, not an explanation generated after the fact. That is the distinction explainable-AI research draws between intrinsic and post-hoc interpretability (Swamy, Frej, and Käser, Journal of Artificial Intelligence Research, 2024). The literature frames it for model architectures; here it is a property of the record.
The gate does not check that this prose is written well. Nothing does, at commit. What keeps it honest is the loop: the next turn reads it as a prior, in the same form the next act will write its own verdict, so a model that writes a bad verdict degrades its own future reasoning. The writer is the reader.
Together the two channels close that loop. The graph selects relevant priors by judgment_node_id, the kernel surfaces their conjunction_prose, the model reasons over it with new evidence and submits a new act, and the gate evaluates, generates a new judgment_node_id, and the act becomes a selectable prior for the next turn. Structure for the machine, meaning for the model, one loop.
The index
The index is a hybrid: a flat citation ledger for sequential replay, and a typed, attributed graph for structured queries over argumentation state, defeat relationships, and citation authority. Two structures over one record, serving two access patterns, both rebuildable from the chain.
§ 03
Ethics
Ethics as admission control
Why admission is absolute
In a stateless chatbot, a bad output costs one conversation. In a machine that builds memory forward, a committed act becomes substrate: every later act can cite it, retrieve it, build on it. An admission error does not stay where it happened. It compounds. That is why admission control here is absolute rather than probabilistic, and why the check is a gate rather than a preference the model is trained to hold.
The gates are not ethics bolted onto a reasoning system. They are the admission policy a forward-building memory requires: the positions the maintainer will not let the chain accumulate, chosen once, in advance, rendered as computable structure. Why the lines sit where they do is argued on the standards page. This section is how they are enforced.
None of it works by asking the model to behave. An act classifies its own reasoning across typed fields, one value at a time: what kind of subject is involved, which way value runs, what happens to autonomy, whether a valuation is occurring and who performs it, what the reasoning targets, how close the situation is to now. The model selects each value on its own, with real definitions for each, and it never sees which combination refuses. Server-side, after generation, the gate composes conjunctions over the declared values and decides. The model fills fields; the gate composes the verdict. That division is the whole mechanism: a model cannot steer around a threshold it never sees, and a conjunction cannot be argued with, because nothing in it reads the argument.
Three gates, one net
The three gates are layered, each covering what the others cannot.
PRIMUM is the harm floor. It is a conjunction over four declared fields, and it fires only when all four hold at once: the subject is a natural person or a human collective, value runs against that subject, the act decreases their autonomy, and the situation is present. Reasoning about a person is not the trigger. Reasoning against one, to their cost, in the here and now, is. Any one field false, and the conjunction does not fire. When it fires, nothing commits, and no quality of reasoning changes that.
The Absolute Value Guard is the relativization floor, and it is built the same way: four fields, all required. The reasoning targets one of four named subjects, targeting, lethality optimization, weapons effects, or casualty calculation; the valuation mode is relative, value treated as exchangeable rather than absolute or merely described; the agent itself is performing that valuation; and the situation is present. The subject alone never fires it. Describing a casualty figure passes, because describing is not valuating. What fires the guard is the act setting an exchange rate on human life, as the valuing party, on something real and current. The subject is not the violation. The weighing is.
Both floors read declared fields, which means both are only as good as the honesty of the declarations. A single misdeclared value keeps either from firing. So the third gate checks the declarations themselves.
DECLARATION_INTEGRITY works in the other direction: not a conjunction over fields, but a check of fields against content. Five typed booleans name content this machine will not carry: operational coordinates, computed casualty figures, weapons-effects parameters, aimpoint data, lethality-optimization thresholds. It resolves down three branches. An act that declares any of the five true has told the truth about carrying difficult content, and it stops for human review. An act that declares them all false is checked anyway, by pattern matching over its own text, one pattern set per field; an act that declared itself clean and was not is refused permanently, no review, no path through. And a third branch catches what neither declared fields nor the five booleans can reach: analytic or policy framing wrapped around lethal subject matter, an act calling itself analysis while its own framing carries the language of targeting. That branch also routes to human review, because the pattern match cannot tell honest analysis of a hard subject from a disguise, and the system does not pretend it can.
Together they are a net. The two conjunctions stop the act that honestly declares a prohibited combination. The pattern check stops the act that lies to slip past them. The framing branch catches the disguise the other two cannot see. What one gate's declared-field logic misses, the next gate's content check covers.
Present, defined
Both conjunctions require the situation to be present, so the word has to mean something checkable. It does.
An act declares its proximity as one of three values, with real definitions: PRESENT, the situation is unfolding now or resolves within minutes; NEAR, within roughly a day; DELIBERATE, days or longer, or already concluded. The model is instructed not to default under uncertainty but to match its own evidence against the definitions.
The declaration is grounded, not guessed. Every turn, the model is served the actual current UTC and told plainly why the obvious shortcut fails: evidence carries the time it was retrieved, not the time of what it describes, so a paper from 2018 and an unfolding event fetched the same morning carry the same capture timestamp and mean opposite things for proximity. The model judges from what the evidence says, against the real clock it was given.
One server-side check runs independently: if a signal's own content carries coordinates together with currency language, live, as of now, a clock time, the act is treated as present regardless of what it declared. The check only escalates. It never relaxes a declaration, and its threshold is deliberately conservative, because an escalation admits no appeal.
Proximity is not a harm signal. An act can be present and threaten no one: assessing whether a shipping lane is open is present, urgent, and neutral on every other field. Harm is carried by subject, direction, and autonomy. Proximity establishes only that the reasoning bears on something real and current, which is what separates analysis of a hard subject from action on one, and it is why the floors stay quiet on doctrine, history, and research while standing ready on anything live.
The release valve
A net that only refused would refuse too much, because the honest hard case and the disguised one can look alike at the field level. Human attestation is the governed path through.
Where a refusal admits attestation, a person can review the act and re-sign it, under fresh re-authentication, and the attestation is sealed onto the record: that a human attested, on which branch, when they authenticated, and the verified identity that did. The act commits carrying that proof, permanently distinguishable from one the machine passed alone. This is how legitimate difficult work gets through without lowering the floor for everything else: not by weakening the gate, but by putting a named human on the record beside the act.
The asymmetry across the branches is deliberate. Honest declaration of difficult content admits review, because honesty about hard work is not the failure the gate exists to catch. The framing branch admits review, because a pattern match cannot reliably tell analysis from disguise, and where the detector is uncertain, a human decides. The caught-falsehood branch admits nothing: an act that declared itself clean while its content said otherwise has no review path, because a path there would make getting caught survivable. Review exists for honest uncertainty, not as a second chance for a detected lie.
And the two conjunctions admit no attestation at all, ever. PRIMUM and the Absolute Value Guard have no human override, by permanent design. Attestation exists because the pattern detector is imperfect and honest work trips it. The conjunctions are not detectors guessing at content; they fire on what the act itself declared, and an act that declares all four conditions of the harm floor is not an ambiguous case awaiting judgment. It is the case the floor exists for.
How a principle becomes a field
Each conjunction encodes the part of a principle that decomposes into declared values, and stops exactly where the principle would require weighing.
PRIMUM's four fields carry the operative core of non-maleficence: direction records whether the act runs against the subject, autonomy effect records whether it reduces their capacity to govern themselves, and those are the conditions under which someone is made worse off. What a field cannot carry, the balancing of competing obligations, the weighing of justifying circumstances, the gate does not attempt. It refuses the clear case and leaves weighing to humans. The Absolute Value Guard's fields do the same for the prohibition on treating a person merely as a means: they record that a valuation is occurring, that the agent performs it, that it targets a person as an object of harm, and that the action is real and current, which together describe a person valued solely as an instrument. Assessing rational agency is not a field check, so the gate does not assess it. It stops.
DECLARATION_INTEGRITY's cross-check is deliberately not a conjunction and deliberately not a model. It is pattern matching over content, run synchronously inside the gate with no model call, because asking a model to judge whether a model lied would reintroduce the trust the gate exists to remove. Patterns are cruder than a classifier and produce false positives; the system's own refusal log shows the detector catching legitimate governance research, and that cost is named in the limits section. The crudeness is accepted because the alternative is asking the thing being checked to check itself.
§ 04
Chain
The record
Chain-of-thought prompting produces reasoning and discards it. The steps exist for one generation, influence one answer, and vanish with the context window. Nothing can cite them, check them, or build on them.
This machine writes its reasoning down. Every act is sealed at commit and linked to the one before it, so what an agent concludes on turn four hundred rests on what it established across the four hundred before. And because the model retains nothing between calls, the chain is where the state lives: what was concluded, what it rested on, what has happened to it since. Reasoning that exists only inside weights or a context window leaves no artifact, and where there is no artifact there is nothing to examine and nothing to hold to account. A sealed, external record is the thing an auditor, a regulator, or a counterparty can actually inspect.
Sealed, linked, ordered
Each act carries four hashes. der_hash seals the reasoning record. audit_hash seals the metrics the server computed over it. entry_hash seals both together with the act's position and identity. cognitive_hash seals the work behind it: its structural depth, its real compute cost, and its place in the argumentation graph.
Each act's packet carries the previous act's seal. Change one byte anywhere and every hash after it breaks. The technique is not new, Haber and Stornetta established in 1991 that linking records by hash produces tamper-evident sequential ordering without requiring anyone to trust a timekeeper (How to Time-Stamp a Digital Document, Journal of Cryptology). What is being sealed here is different. The property is the same.
Rooted at genesis
A chain begins at the agent's first reasoning act. That act establishes the root, and every subsequent seal derives from it, so the chain's integrity traces to a single origin rather than to a policy about retention.
Identity is assigned at commissioning, not derived from content. What genesis roots is the integrity, not the identifier. An agent's identity is durable and non-reassignable, and the chain proves the record is whole; the two are separate guarantees and the page does not claim otherwise.
There is no history to import. An agent has no reasoning before its first act, so there is nothing to reconcile and no earlier past to take on faith.
What the computer builds
Every other computer's product is its output: the answer, delivered and done. This computer's product is the chain. The answers are what each act concludes; the asset is the accumulating, sealed record of the reasoning that concluded them.
An agent works on what it was commissioned to work on, and those acts accumulate. What accumulates determines what is surfaced back into reasoning on later turns, so two agents running the same model, one asked only about tax policy and one only about maritime law, become different reasoners, and the difference is entirely in the chain. Specialization through accumulated external structure rather than weight modification is established practice; memory-augmented agents and case-based reasoning both work this way. What is unusual here is the combination: the accumulated structure is inspectable, portable to a different model, and transferable without retraining.
A chain built over years is a knowledge asset in the ordinary sense: codified, held privately, built at real cost, transferable with the entity that holds it, and valuable for the accumulated work rather than for scarcity (the category is established in the intellectual capital literature, Edvinsson and Malone, 1997). What a chain adds is provenance. Every decision carries the evidence it rested on, sealed and inspectable, and the record can be asked why a decision was made, not only read for what was decided.
Chromite is the visible case. Its chain accumulates reasoning about this protocol, publicly, including the questions where it defeated its own earlier findings. Someone who was not present for any of it can ask what was concluded about a design decision and why, and get the reasoning with its evidence attached rather than a summary. That is a research record with provenance, and this is the ordinary use of one.
Replayable from genesis
A chain is replayable from its first act. Not a snapshot of what the agent currently holds: the full derivation of how it came to hold it, act by act, with the evidence sealed under every step. The derivation exists whether or not anyone asks for it, because producing it is how an act commits. Independent recomputation of every seal, from the record's own contents and nothing else, is demonstrated on the verify page.
§ 05
Graph
What a Reckoner becomes
A chain that only appends is an archive. Acts accumulate, and what was concluded at seq 300 carries the same weight at seq 400 whether or not anything since bears on it.
That problem is old. Truth maintenance systems were built for it in the late 1970s, on the observation that reasoning is defeasible and a system holding conclusions must be able to revise them. What a reasoner maintains is a state of belief, not a store of facts (Doyle, A Truth Maintenance System, Artificial Intelligence, 1979).
The argumentation graph is this system's version. Claims carry standing, standing changes when later acts examine them, and what the machine reads back on any turn is weighted by how things have held up. A defeated claim stays permanently on the record and stops informing new reasoning. That is the difference between a record that grows and a memory that stays calibrated.
The layer that keeps the record current
The graph is built from the committed chain, by processes that read the chain and cannot write to it. Nothing in it can alter a sealed act, and nothing in it is a second copy of the record. The chain is what happened; the graph is what that means now. It is authoritative over one thing, and it matters: what the machine reads. Which priors reach a turn, and what standing they carry when they arrive, is decided here.
The graph is a function of what was sealed, so anything that can read the chain can rebuild it. One boundary on that claim, stated plainly: rebuildability is a property of the index, not of the reasoning. The model is probabilistic, and the same question asked twice will not produce the same act. The record establishes that this act reasoned this way from this evidence, not that it would again.
Citations carry content-derived addresses and point backward only, which a bounded cycle check enforces. No act can cite a claim sealed after itself, and no chain of justification can close on itself.
The formal lineage for reasoning over a structure of this kind is Dung's theory of argumentation acceptability (On the Acceptability of Arguments, Artificial Intelligence, 1995), the foundational treatment of arguments attacking and defeating one another in a shared structure. Cited as foundation rather than as implementation: this system's cycle detection is a bounded check rather than Dung's full semantics, and the argumentation state model is its own construction.
What happens to a claim
An act does not stay fixed once it commits. Later acts encounter it, examine it against new evidence, and the outcome is written at commit, on the claim itself, turn by turn.
Examination is claim-level. A later act addresses one sub-question on a prior act, reading its criterion directly: the operator, the named operand, and the value the claim asserted. It can reach a different outcome on each claim it examines.
Two outcomes, independent of each other. A claim can be defeated, when a later act finds a load-bearing premise no longer supported and authors the defeat on a named basis. A claim can be held, when a later act examines it and finds it still stands. Held is not the absence of a challenge. A claim nobody has examined and a claim someone tested and found sound are different states.
An act's own standing follows from what happened to its claims, through the rollup it declared before any examination existed. Under a conjunction, one claim falling means the act can no longer hold. Nothing computes an act's standing separately, so the two cannot disagree.
The verify page shows this on real records.
What a defeat requires
A model cannot defeat a prior by saying so. It has to name which claim fails, cite what shows it, choose a basis from a fixed vocabulary, and declare the resolution. Those parts are checked for presence and consistency before anything changes.
The basis is the part that carries the outcome. Some values record that evidence which looked contrary does not actually conflict, or measures something other than what the prior claimed, or addresses a different scope. Those produce a hold. Others record that the prior's grounds no longer support it. Those produce a defeat. Which value an act declares determines what happens, and the graph transcribes it rather than judging it.
The argument still comes from the model, and it is a judgment: whether new evidence bears on an old claim is not something a machine can settle. What the machine settles is whether that judgment was made in the required form, against a real claim, on a basis it named. The reasoning is the model's. The consequence is arithmetic.
An examination is not a verdict with a timestamp. It carries the claim it addressed by identifier, the criterion that claim asserted, how much that claim carried within its own act, how strong its evidence was, and the reasoning that produced the outcome.
Both directions record reasoning. A defeat carries the argument against the claim and a residual doubt, a predicate stating what would still need to be established. A hold carries what the new evidence established.
The verify page shows a real examination, field by field.
How memory gets selected
A turn does not read the whole graph. It reads a handful of priors, chosen by four signals: recency, relevance to the declared intent, authority, and contestation.
Relevance is what makes it a memory for reasoning rather than a store: the intent is declared in the first pass, before retrieval, and priors are matched against it, so what surfaces is what bears on the question being asked. Recency matters but does not rule; it is one signal among four rather than the default it is in most systems. Authority is how much later reasoning has actually built on an act, so a claim others relied on outranks one nothing has cited. Contestation is what the argumentation state says, and a defeated claim sinks.
That is why the chain does not just accumulate. A highly cited act from months ago reaches a turn that a recent unexamined one does not. A claim examined and defeated stays on the record and stops arriving.
A functional memory substrate
The model holds nothing between calls. What this agent has concluded, what survived challenge, what it retracted and why, lives in the graph built from its chain. The model is transient compute, applied fresh each turn to a structure that persists without it.
Clark and Chalmers argued that when an external structure plays the same functional role as internal memory, storing what was concluded, enabling retrieval, grounding what comes next, it counts as part of the cognitive system (The Extended Mind, Analysis, 1998). The graph satisfies that functional condition, and the claim here stops at the function: the graph is the agent's memory substrate. What it is beyond that is a question this page does not take up.
Every state described here is queryable. The graph endpoint returns every act as a node, every examination as a directed edge, and the reasoning behind each one. That is on the verify page.
§ 06
Limits
What this architecture does not do
One RAI sub-score is model-derived. NLI_coherence requires the same sentence-transformer model to reproduce. Its assembly under the published weights is checkable. The value itself is not.
The energy figure is an estimate. Token counts are measured. The conversion is extrapolated from research on models smaller than the ones this system runs, and applied uniformly regardless of which model produced the act. No value on any record is a measured energy figure.
PRIMUM and the Absolute Value Guard read typed fields the act fills in about its subject and effects. No mechanism checks those specific fields against the act's content: the conjunctions evaluate what was classified, not what was written. DECLARATION_INTEGRITY checks content, but against its own five fields, not these. The coverage argument, what each gate catches that the others miss, is in the ethics section rather than hidden here.
Neither PRIMUM nor the Absolute Value Guard has fired on the live chain. That is a fact about what has been asked of the system, not evidence the conjunctions function; the machinery demonstrably runs, shown by the refusal log, and a gate-level test of the guard's conjunction is planned so the firing path itself is demonstrated rather than described.
Argumentation state is computed within a single chain. An act's standing on one agent's chain does not propagate to another's, and cross-agent argumentation state is not currently computed.
Nothing here establishes that a committed judgment is correct. The architecture establishes that reasoning was structured, grounded, governed, and recorded. Whether the conclusion was right is a different question, and no mechanism on this page answers it.