The organisation's only active project
“Why another agent framework?” It isn't one. Everyone can generate. Almost nobody can tell you, six months later, whether the number in their README is still the number their code produces — and prove it to a stranger. That is the layer this builds.
Truth generated by code that is forbidden to import the code under test. Gate reports a kernel reads without caring what language the work is written in. Runs that are content-addressed and hash-chained, with the environment recorded inside the artifact. And every number published here tied to the artifact that produced it — checked in the repository nightly, and on this website by a check of its own on every push and nightly, because a website is exactly the surface where a number goes stale unwatched.
It is an agent-based operating system, built on QM — and that part is the how. The paragraph above is the why.
Open the canvas → Check the numbers yourself Repository
The first is the demo: a canvas of activity. One row is one flow, left to right is time, and every square is one flow in one bucket of time held by somebody — the colour is who held it, the texture is what happened. Click any square and it tells you, with the address it read. The orchestration is simulated; the numbers come from the projects' own artifacts. The second link is not a demo at all — it is the evidence, with real artifacts re-derived in your own browser. Use the first to see what this is. Use the second when you want to stop taking our word for it.
coclea-sr, every one green, every one declared before its run
0.906
composite AUC where no right answer exists, against a kill line of 0.80 written down first
1207 / 1207
fields bit-identical when that report was rebuilt somewhere that had never seen it
The part that is actually new
None of the machinery underneath that sentence is new. Content addressing is old. Hash chains are old. Experiment tracking, eval harnesses, CI, build provenance — all of it exists and most of it is better engineered than ours. What is not common is treating it as an epistemological rule of the system rather than as a feature. Not you can look up how this was produced, but a result that cannot be reproduced from an independent artifact is not a result this system will repeat.
The reason to care is coming, not hypothetical. As agents get more autonomy the hard question stops being can it produce something and becomes which of the things it produced may I treat as true, and how do I show that without asking it?
Agent: "I improved myself 17%." Human: "How do I know?" Agent: "I ran the benchmark." Human: "Who wrote the benchmark?" Agent: "I did." Human: "Who read the result?" Agent: "I did."
So the boundary is structural. In this repository
truth/ is forbidden to import src/: the code
that decides whether an answer is right cannot see the code that produced it.
A gate is declared before the run it judges. unknown is a
different verdict from passed, and did not run never
becomes fine. Runs are content-addressed, hash-chained, and carry the
environment inside the artifact. Every number on this website is tied to the
artifact that produced it and re-checked before publication.
agent / code
│ produces
▼
hypothesis, result
│
───────────── trust boundary ─────────────
│
▼
independent verifier
│
▼
evidence
│
▼
attestation
Where this sits, next to the things it resembles
| Prior art | What it does | What it is not built to do |
|---|---|---|
| SLSA · in-toto · Sigstore | Prove cryptographically where an artifact came from and how it was built; sign attestations and publish them to a transparency log. | It is aimed at the software supply chain. Its subject is a binary, not a claim an agent made about its own work. |
| MLflow · W&B · DVC | Record parameters, code version, metrics, artifacts and environment per run; build a lineage graph across runs. | Tracking and reproducibility. Nothing refuses to promote a result, and the tracker is inside the trust boundary with the thing it tracks. |
| LangSmith · Braintrust · Inspect AI | Traces, datasets, versioned experiments and immutable eval snapshots for agents. | They record what happened extremely well. They do not turn a published claim into something a stranger can verify offline. |
| ai-os | The same materials, wired as a rule: truth generated by code that cannot import the code under test, gates declared first, and a number that stops matching its artifact failing the build. | Younger, smaller, and — see below — not yet signed by anything a stranger could check without trusting us. |
The closest antecedent is in-toto, which generalises SLSA's build provenance into authenticated claims about how something was produced. Read the analogy across:
SLSA / in-toto ai-os
───────────────── ─────────────────
binary claim
↓ build ↓ evaluation
source, dependencies gate declared first
↓ builder ↓ artifact
attestation hash + environment
↓ reproduce
The sentence on this page that is too strong
Above, and in the repository, we say “prove it to a stranger.” That overstates what a hash chain inside our own repository can do. It demonstrates integrity and consistency — nobody changed the number after the fact. It does not demonstrate truth:
result = 92% sha256(result) = abc123… ✓ nobody altered the 92% ✗ the program that computed it may have had a bug → 92% wrong, with perfect cryptographic integrity
GitHub makes the same distinction explicitly about its own artifact attestations: an attestation establishes provenance and integrity, and does not certify that the artifact is correct or safe. It is worth saying plainly on our own front page rather than letting the phrase do work it cannot.
What narrows the gap here is not the hash. It is the independence:
the checker cannot import the thing it checks, the threshold was written down
before the run, and make reproduce re-derives the artifact on a
machine that has never seen it. That is why the two projects below found
defects in their own author's work — a quadrature biased 2.6%, a sign error,
a report that could not have come from the code beside it — rather than
producing five plausible numbers.
What it does not close: everything still runs inside repositories we control, and the last mile is trust in us.
What would close it
Not more cryptography of our own. The parts exist: GitHub can produce attestations bound to the workflow, repository, commit and event that made an artifact, and public repositories can record those in Sigstore's transparency log. Wiring the gate reports through that chain is the next thing worth building.
claim "0.906 AUC" │ ▼ ai-os gate evaluation artifact ├── dataset hash ├── code hash ├── environment ├── raw results └── metric │ ▼ in-toto attestation │ ▼ Sigstore signature │ ▼ transparency log │ ▼ README / paper / website
At which point a third party runs something like verify claim
0.906 and has to trust neither the agent that produced it nor the
person who wrote the README. That is the version of “prove it to a
stranger” that earns the phrase, and it is not built yet.
One reservation about our own name, while we are being exact: the part described on this page is more precisely a verification and provenance substrate for agentic work than an operating system. The word earns itself only because flows, memory, storage, an interface and execution sit on top of it — the OS is the how, and this section is the why.
Two pointers we have not checked from here. A
proposal for an eval-result predicate for AI/ML evaluation
results in the in-toto attestation framework, and 2026 work on execution
provenance for LLM agents, were both reported to us as evidence that other
groups are arriving at this problem independently. The machine that built this
page has no outbound network access, so neither was fetched, and neither is
cited here as established. They are worth looking up; they are not evidence
until somebody does.
The strong version of this argument is false, and we measured it
The pitch that would sell better is “a model cannot tell whether its own output is wrong.” It is not true. A companion experiment handed a frontier model twelve fabricated physics results and nine subtly defective ones, and it caught all of them, twice — naming causes at the level of “the boundary treatment at the free end fails to halve the control volume” (results).
So the claim is the narrow one that survives it. A model can judge a task; it cannot generate one with a known answer — you do not create truth by asserting it. And a judge that is right every time still hands you no ledger, no freeze and no reproduction command. Detection is not the same product as attestation, and the second is what a reviewer, a regulator, or a colleague six months later actually needs.
What it caught, in one day, on its own author's work
The checkers were finished on 2026-08-23 and immediately run by somebody who had never run this system. None of these was reachable by reading the code:
Neither project could be started from its own documentation either — one carried a committed symlink to a path on one laptop, the other had no dependency manifest at all. A single-author project cannot find that for itself, because the author always already has it working.
What the same day also produced, on the other side of the ledger: the gate suite ran 135 checks green in 23 minutes 27 seconds on a CI runner — the first time the whole thing has executed anywhere but the author's machine — and the H0 report from the second project reproduced 1,207 of 1,207 fields bit-identical on a third environment. The attestation machinery did its job on hardware it had never seen. The project that did not have that machinery is the one that had the problems above.
Four questions today's agents cannot answer
Four pillars
What if the unit of work outlived the conversation?
Runs. A flow is a declared, persisted, resumable object with a goal, a shape, a state and a lineage. Agents and their sub-agents are markdown files; a declared tree executes as real work. A flow started by one process is finished by another, after a restart and after context compaction.
What if the interface were the state, not the transcript?
Runs. A desk: flows are documents, agents are cubes that stack on them. Drag a cube onto a document and that agent gets a step in that flow. The system composes the arrangement from the flow's state and never re-arranges what you moved.
What if memory had an address space?
Four levels — system, user, project, flow — with different lifetimes. Flow memory is expected to die. Promotion between levels is explicit, recorded and reversible. It is now built end to end around a local model held to 8,192 tokens on purpose, and its first benchmark came back against the design: a flat memory file does not fit at any size — 200 notes is already 12,566 tokens — but exact lexical search beats the hierarchy it was built for, 3/3 against 1–2/3, reading less to do it. Published because the rule was that it ships whichever way it comes out.
What if we did not rebuild the part that works?
QM, vendored as a subtree and pulled weekly. Identity, scopes, sandboxes, policy, audit and six model harnesses. We did not write it and we are not rewriting it.
Where this actually is
Three pillars run. ai-base is vendored and runs.
ai-flows runs — the flow engine, a signed HTTP API,
multi-agent composition from markdown-declared trees, and the measurement
harness below. ai-ui runs — the activity canvas pictured here.
828 tests of our own, on top of the 3,768 ai-base carries from
upstream. Memory is now agents rather than a store — an archivist that
decides what one unit of a document is, an indexer that writes one note per
unit against an index that has to keep fitting, a reconciler, a librarian and
a coverage auditor, all of them markdown files. Every decision is an agent;
every mechanic is code. ai-storage now has a first
implementation — the model boundary, the local-only guarantee, the 8K context
invariant, the note schema, the provenance pipeline and the navigable index, 79
tests — built around a local model. Its agents and every one of its
benchmarks are not built, and the model it is built around has not been
verified to exist from the machine that wrote it. Nothing on this page describes running software unless it
says so.
The canvas on coclea-sr. Five flows, five rows; the holes are buckets nothing was written down in, and the two dimmed rows with a chevron have their work further back than this window reaches. Switch it to memory lab and two flows index the same notes with the same five agents and both are green — until you click the faint square, which arrived at a step that used nothing it was given. That is the answer to "how do you inspect this, and how do you interfere": you point at it, and what answers carries the address it read.
INSPECTOR, a
system agent with one tool (read), attaches to any flow.
Scopes — organisation, projects, groups, individuals — each carry a roster and an agent tree. A name declared in an agent's markdown with no file behind it is shown struck through, because a declared name is a claim and a file is a fact.
Each pillar ships with the measurement that would show it is not worth building, written before the code. Two have now come back and neither flattered us. A flow does survive what a plain session loses — proven by starting one in one process and finishing it in another, on two harnesses. And the question of whether adding a reviewer to an agent tree helps came back unmeasurable: across four attempts the producer was already correct, so a review stage had nothing to add.
That second result is the one worth reading. It is the shape of Google's g-AMIE study, where physician oversight of an agent improved 6.7% of cases and reduced quality in 21.7% — oversight adding least where the output was already strong. Our first run appeared to reproduce it, reporting a reviewer that damaged a correct answer. It was an artefact of a check that scored “The answer is 24.” as wrong, and retracting it invalidated four other numbers. All of it is written up rather than deleted, because a finding that was wrong and the reason it looked right is the most useful record we can keep.
The demo, and the thing that is not a demo
There is one demo, and it is the desk above. The real client, generated from source so it cannot drift from the product, with a simulated backend so nothing is installed and nothing is spent. It is what shows you the system: flows as documents, agents as cubes that stack on them, a step you append by dragging, a trace you open. Two honest limits travel with it — the pillar it shows has never had its own falsification run, and because the backend is simulated, every number on it is invented.
Which is why the second link is not a demo. Real
artifacts out of projects/, embedded verbatim, checked in your own
browser with no network and no server: the hash chain re-derived entry by
entry, run directories shown to be the first twelve digits of their own
contents' hash, six published sentences resolved out of the runs that produced
them, and the one statistic that moved between library versions sitting red
among seven that did not. Edit a ledger entry from the page and watch exactly
one link break; re-chain the tail and watch the break vanish and the head move
instead. The code doing it is a second implementation, in a second language, of
the repository's own verify_ledger.py — because a verifier sharing
code with what it verifies checks self-consistency, not truth. It illustrates
nothing about how the system works, on purpose: it exists so that the numbers
the system produced can be checked by somebody who has never met us.
The workload that makes it real
COCLEA-SR is a biophysics hypothesis from 1995 — that the ear uses noise to detect signals too weak to cross a threshold — taken end to end on this system. It is here because the answer mattered to one of us, which made it dangerous in the right way: a beautiful graph confirming a thirty-year-old intuition would have taught nothing.
The system's first important answer was that the model was wrong. The traveling wave died before reaching the place the same model said it should peak — the response fell twenty-eight orders of magnitude before arriving — because the membrane impedance sat in the numerator of the local wavenumber instead of the denominator. Not a bug. The abstraction. The replacement was accepted against a condition registered before it was built, and only then did the original question get to run: 24 of 24 curves show the pre-registered interior maximum, at 11.6% of a parameter-free prediction with nothing left in it to tune.
Then the part nobody was aiming at. The old operator's only knobs were the membrane's own tension and mass, and no drug reaches either. The replacement put the fluid inside the operator — and fluid is what a diuretic acts on. A falsified model was replaced by one with a therapeutic surface: seven pathologies, each entering on a different parameter, each producing a different signature, and the discrimination itself gated. It predicts, among other things, that an ototoxicity monitoring protocol should watch the compression knee rather than the audiogram, because the two move with different powers of the same parameter.
28 gates, 135 checks, all green. And the page linked below is honest about the four things it does not show — including a companion experiment that came back against the usual argument for gates, and our own ratio experiment which came back null: ten flows, three mixes of exploring and verifying agents, 100% accurate in every arm and zero corrections. Verification bought nothing because nothing was ever wrong, and the rule that would have caught that before we paid for it was already written in our own contributor guide.
And the case where there is no right answer to check against
COCLEA-SR is the easy half in one specific sense: an exact solution exists, so a gate can compare against truth. Most real work has no closed form. HEMO-VERIFIED asks what a gate is worth when nothing can be compared — can physics checks tell you a flow prediction is wrong without ever seeing the right answer? — and then puts the checks themselves on trial against a threshold declared first: 0.906 composite AUC against a kill line of 0.80, while six of its seven oracles are near a coin flip alone.
Its most useful finding is not the AUC. Built from a clean clone on a
different machine, the attested report turned out to be one the code beside
it could not have produced — regenerated mid-change and never again — and
one of the seven per-oracle numbers moved, 0.706 → 0.652, because 66 of
its 98 measurements are exactly zero and a single case sitting at
1.03e-13 on one machine and 0.0 on the other crosses
into the tie block and drags a rank statistic. The composite is bit-identical.
A statistic that moves with a library version rather than with the data is
not a property of the physics, and the only way to learn which of your
numbers are like that is to run them somewhere else.
The predecessor of this project shipped eighteen thousand lines describing five subsystems and three test functions — an architecture written down and never pinned to anything that could contradict it. This is the correction.
Twenty-six frozen experiments, 2025 – 2026.
Agent memory, self-modification, interpretability and constrained decoding — each labelled by how much evidence stood behind it, including the ones where the evidence went against us. Kept because they are still true, not because they are maintained.