Platform health
CHECKINGChecking the deployed runtime.
Source /healthz →
AI that can demonstrate its work · verifiable by anyone, offline
AI that proves its receipt state
AI that proves its receipt state
and refuses to lie.
Every governed state change produces a hash-chained receipt you can inspect offline, in your own browser. The interface says SIGNED only when persistent signer evidence is active and verification passes; otherwise it reports HASH-LINKED, UNSIGNED, DISABLED, or UNAVAILABLE. When the model is not sure, it returns an honest BLOCKED instead of a confident guess.
—
Receipts in the chain
ledger depth — a mechanism check, not customer traction
ledger depth — a mechanism check, not customer traction
Conjecture 1
Λ trust gate · advisory bound
8
Locked Lean-proven theorems
a proof of rigor, not a traction number
a proof of rigor, not a traction number
—
Overclaims caught by CI SAMPLE · SNAPSHOT 2026-07-25 · SOURCE UNAVAILABLE
Observed correction time (source unavailable): — · open ledger
Observed correction time (source unavailable): — · open ledger
The honesty doctrine · v11 LOCKED
Every figure on this page is labelled — or it isn't shown.
We grade what we say. If a claim isn't MEASURED live this session, we tell you exactly what it is instead of dressing it up as proof.
MEASURED
Read live from a running endpoint this session — receipt count, advisory Λ posture, and chain depth. Shown with a live chip; a dead probe degrades to an honest offline chip. Signer state is disclosed separately only where an actual signer-status read is present.
REPORTED
Stated by a source we name — the locked-8 Lean kernel, the 144-entry genome registry — cited here, not independently re-derived on this page.
UNKNOWN
We don't have it right now. Rendered honestly as N/A · UNAVAILABLE · BLOCKED — never a confident guess and never a fabricated number.
CONJECTURE
Advisory and unproven. Rendered in gray, never green, never a theorem. Λ lives here.
Λ = Conjecture 1
an advisory trust bound — never proven, never 1.0, and never rendered green. Theorem U is the proven conditional alternative; the unconditional claim is machine-checked false as stated.
No free energy. Joules are MEASURED only from a live exporter delta; with no live meter we label the reading SAMPLE or UNAVAILABLE and fabricate nothing. a11oy never claims over-unity, perpetual output, or free-energy efficiency — only what a real meter reports.
Runtime evidence
What is actually reachable right now.
Four read-only checks connect the product story to the running system. REACHABLE means the source answered this browser session; evidence mode (LIVE, SNAPSHOT, MODELED, or UNAVAILABLE) remains separate and never certifies model truth.
Tab contract
CHECKINGChecking the published tab inventory.
Source tab matrix →Receipt ledger
CHECKINGChecking the append-only evidence read.
Source receipt ledger →Sovereign mesh
CHECKINGChecking the current mesh posture.
Source mesh state →Checks have not completed.
Explore the estate
Nine surfaces. One governed core.
Every surface reads the same live endpoints and the same honesty doctrine. Jump straight in — the full working console is one click away.
⌘
Command Center
The working console — receipt integrity, separately disclosed signer state, the self-doubt gate, the genome registry, and live organ vitals.
Open /console →
✦
Five Superpowers
The five things governed execution does that ungoverned models can't — each linked to the live check that backs it.
Open /superpowers →
âš”
Adversarial assurance
Run governed evaluations, inspect refusals, and trace every verdict to its evidence. The archived Warhacker route now resolves here.
Open the eval arena →
â—Ž
Observability
OpenTelemetry-style traces and health summaries across the organs — live, read-only, no sign-on-GET.
Open /observability →
〜
Wires
The live wiring between organs — which probe feeds which surface, and whether it is up right now.
Open /wires →
â—‡
Mesh
The BFT-quorum mesh graph — 3-of-4 consensus, live state read from /api/a11oy/v1/mesh/state.
Open the mesh →
Σ
Formulas
The PURIQ agentic formula genome — live-recomputed values, each carrying its own Khipu receipt.
Open /formulas →
✓
Evidence
The trust center: the locked-8 with truthful Lean refs, Theorem U vs Conjecture 1, the receipt ledger, offline verify.
Open the evidence →
⇄
LLM Router
The LLM-Router Live scene — per-tier routing stats polled every second, otherwise an honest DEMO MODE.
Open the router →
The thesis
Governed AI you can prove — not AI you're asked to trust.
Most AI asks for trust. a11oy earns it the way auditable systems do: every governed state change is recorded in a hash-chained receipt, while signer state and signature verification are disclosed separately and never inferred; a trust gate can only tighten an answer, never wave it through; and the kernel rests on machine-checked theorems you can read. The honest part is the product — when a claim isn't proven, we label it, and you can open the check yourself.
01 · RECEIPTS
It proves receipt integrity and signer state
Every governed state change enters a SHA3-256 hash chain. DSSE / ECDSA-P256 is a separate cryptographic state and is labeled SIGNED only when persistent signer evidence is active and independent verification passes. Verify the disclosed state in your own browser.
02 · REFUSES
It refuses when unsure
A self-doubt gate measures uncertainty against a bound and returns a truthful BLOCKED rather than a confident wrong answer. A refusal beats a fabrication.
03 · PROVES
It is formally backed
8 locked, axiom-free Lean 4 theorems back the kernel. The Λ trust gate is Conjecture 1 — an advisory bound, never dressed up as a theorem.
The proof · four honest tiers
Every claim carries exactly one honesty tier.
The 144-entry formula genome is graded across four tiers — and the rarest, strongest tiers are the smallest on purpose. Counts below are read live from the genome registry. A conjecture is shown in gray and is never rendered as proven.
—
LOCKED-PROVEN
Truthful labels for what each Lean obligation actually proves — e.g. F18 = Reed-Solomon parity (erasure tolerance), not "DSSE seal". Conservative and defensible.
—
SEMANTIC-VERIFIED
Sorry-free real theorems outside the frozen locked-8: the Λ min≤Λ≤max bounds, Theorem U (conditional uniqueness), DSSE verifiability. Where the real trust math lives.
—
EVIDENCE-BACKED
Runtime / algorithmic rules backed by real code and live endpoints, with no proof claim attached. Honest operational tier — not dressed up as proven.
—
CONJECTURE · ADVISORY
Λ unconditional uniqueness = Conjecture 1 (machine-checked false as stated). Gray, advisory, never green. Theorem U is the proven conditional alternative.
IMMUNE is a live, interactive demo of the same thesis you can drive yourself — a real hash-chained receipt ledger, a live Sigstore Rekor transparency anchor, and honest BLOCKED / UNAVAILABLE states instead of confident guesses. Nothing on that page is fabricated.
The verticals · live Λ posture
One governed core. Five places it earns its keep.
The same governed execution core runs across five verticals. Each card reads its live advisory Λ posture from the org-wide 13-axis gate (canonical floor 0.90). Λ is Conjecture 1 — advisory, never a pass/fail oracle.
a11
a11oy
Core · governed execution
The platform itself — command center, receipt integrity, disclosed signer state, and the self-doubt gate.
—advisory Λ
kil
killinchu
Defense · counter-UAS
Auditable interdiction: receipt per decision, separately disclosed signing state, and 3-of-4 BFT consensus.
—advisory Λ
ins
Insurance
David Leads · lead scoring
Faithful David Leads scorer behind an F12 non-compensatory consent gate.
—advisory Λ
fin
Finance
Governed decisioning
Decision paths that must be reconstructable, receipt-bound, and conditionally signed only when verified signer evidence is active.
—advisory Λ
re
Real estate
Governed workflows
Workflow decisions captured into the same one-chain receipt ledger.
—advisory Λ
Λ
Org-wide Λ
13-axis weighted geomean
The composite advisory posture across all verticals, with min≤Λ≤max SEMANTIC-VERIFIED.
—floor 0.90
The living body
Watch the governed organism breathe.
The same live endpoints render as a 3D anatomical organism — organs glow when their probes are healthy and dim when they're not, and receipt events travel the vessels as pulses. It is an operational projection of the platform state. Every pulse links to a real receipt event; its signing state remains separately disclosed.
Public estate · canonical live sources
Models, kernels, data, and Spaces — one evidence-labelled map.
The front door no longer hardcodes organization totals. Open each canonical source for its current inventory; a reachable URL establishes reachability only, not source/runtime alignment or model quality.
One chain · live ledger
One ledger. Every decision. Replayable to the byte.
Every vertical emits into a single SHA3-256 hash-chain — append-only, fsync-durable, replayable to a byte-identical root instead of trusting a dashboard.
—
Receipt records · signer state separate
sha3_256
Chain algorithm
—
Chain depth (a11oy)
—
Last receipt id
Verify it yourself
The trust center.
The versioned honesty posture, the locked-8 with truthful Lean refs, Theorem U vs Conjecture 1 explained honestly, SLSA posture, and the offline receipt-verify flow. Every claim links to its check.