How the gate works
One untrusted signal in. Three possible endings. The doctrine that decides between them is called the graduated silence law, and it is the reason the product can live inside a family chat without becoming noise.
Models propose scores; deterministic code composes verdicts from evidence. Verified-brand proof caps model panic; hard registry fails escalate with the full bundle.
The graduated silence law
The overwhelming majority: newsletters, family chatter, genuine delivery updates. Screened, recorded, digested. No member sees anything, no guardian is pinged. The quiet week is the product working.
Gray-band signals get a calm member-visible reply with hold-off guidance while the guardian reviews. Nothing is blocked; nobody is accused.
Hard evidence or emergency bands escalate to the guardian with the full court-grade bundle: claims, findings, graph taint, cost, chain hash. Humans decide anything touching money.
Full doctrine: docs/19-silence-architecture.md, including the eight layers, the engineering constitution, and the honest limits register.
What we will not pretend
- URL shorteners stay unverifiable until URL intel lands: the gate limits instead of guessing.
- Benchmark author and lexicon author share a brain; live soak is the independent judge.
- Single region, single model leg calibrated; routing changes reopen the calibration protocol.
- Guardian agreement is the newest instrument; its first weeks are the real test.
Every claim has a document
The repository carries twenty controlled documents. Each is versioned, changelogged, and linked below: nobody has to read all twenty, but every number and rule on this site lives in one of them.
Plus the running failure ledger (what broke and why) and the published evaluation artifacts under docs/eval-results/.