Platform health
CHECKINGChecking the deployed runtime.
Source /healthz →
Evidence + control · Observe → Gate → Act → Prove
Control consequential AI.
Control consequential AI.
Prove every action.
A11oy is the portable operating layer between models, agents, tools, and high-stakes workflows. It observes what happened, applies policy before execution, stops what is not allowed, and emits evidence an outside party can verify. It proves its receipt state without inferring signer status from a digest or chain link.
—
Source-labelled chain records
sample records are excluded from operational receipt and traction counts
sample records are excluded from operational receipt and traction counts
Conjecture 1
Λ trust gate · advisory bound
8
Locked Lean-proven theorems
a proof of rigor, not a traction number
a proof of rigor, not a traction number
—
Overclaims caught by CI SAMPLE · SNAPSHOT 2026-07-25 · SOURCE UNAVAILABLE
Observed correction time (source unavailable): — · open ledger
Observed correction time (source unavailable): — · open ledger
The honesty doctrine · v11 LOCKED
Every figure on this page is labelled — or it isn't shown.
We grade what we say. If a claim isn't MEASURED live this session, we tell you exactly what it is instead of dressing it up as proof.
MEASURED
Read live from a running endpoint this session — receipt count, advisory Λ posture, and chain depth. Shown with a live chip; a dead probe degrades to an honest offline chip. Signer state is disclosed separately only where an actual signer-status read is present.
REPORTED
Stated by a source we name — the locked-8 Lean kernel, the 144-entry genome registry — cited here, not independently re-derived on this page.
UNKNOWN
We don't have it right now. Rendered honestly as N/A · UNAVAILABLE · BLOCKED — never a confident guess and never a fabricated number.
CONJECTURE
Advisory and unproven. Rendered in gray, never green, never a theorem. Λ lives here.
Λ = Conjecture 1
an advisory trust bound — never proven, never 1.0, and never rendered green. Theorem U is the proven conditional alternative; the unconditional claim is machine-checked false as stated.
No free energy. Joules are MEASURED only from a live exporter delta; with no live meter we label the reading SAMPLE or UNAVAILABLE and fabricate nothing. a11oy never claims over-unity, perpetual output, or free-energy efficiency — only what a real meter reports.
Runtime evidence
What is actually reachable right now.
Four read-only checks connect the product story to the running system. REACHABLE means the source answered this browser session; evidence mode (LIVE, SNAPSHOT, MODELED, or UNAVAILABLE) remains separate and never certifies model truth.
Tab contract
CHECKINGChecking the published tab inventory.
Source tab matrix →Receipt / sample-chain read
CHECKINGChecking the source-labelled chain read.
Inspect chain source →Sovereign mesh
CHECKINGChecking the current mesh posture.
Source mesh state →Checks have not completed.
One governed operating layer
Four steps. One inspectable decision trail.
A11oy turns a fragmented AI stack into one control loop. The same policy, evidence model, and receipt chain follows an action from first observation to external review.
One substrate, not six separate products. Solutions below are buyer-specific views over the same object graph: actor → policy → decision → action → outcome → receipt.
The thesis
Governed AI you can prove — not AI you're asked to trust.
Most AI asks for trust. A11oy applies the pattern used by auditable systems: a governed write can emit a signed, hash-chained receipt; policy can block an action before impact; and machine-checked obligations can be inspected independently. If a signer, source, or meter is unavailable, that state must remain explicit instead of being upgraded to proof.
01 · SIGNS
It signs its work
When the configured signer and ledger verify successfully, a write can return a DSSE ECDSA-P256 signature and a SHA3-256 chain reference. Without that evidence, the receipt is labelled unsigned or digest-only. Reads never mint signatures.
02 · REFUSES
It refuses when unsure
A self-doubt gate measures uncertainty against a bound and returns a truthful BLOCKED rather than a confident wrong answer. A refusal beats a fabrication.
03 · PROVES
It is formally backed
8 locked, axiom-free Lean 4 theorems back the kernel. The Λ trust gate is Conjecture 1 — an advisory bound, never dressed up as a theorem.
The proof · four honest tiers
Every claim carries exactly one honesty tier.
The 144-entry formula genome is graded across four tiers — and the rarest, strongest tiers are the smallest on purpose. Counts below are read live from the genome registry. A conjecture is shown in gray and is never rendered as proven.
—
LOCKED-PROVEN
Truthful labels for what each Lean obligation actually proves — e.g. F18 = Reed-Solomon parity (erasure tolerance), not "DSSE seal". Conservative and defensible.
—
SEMANTIC-VERIFIED
Sorry-free real theorems outside the frozen locked-8: the Λ min≤Λ≤max bounds, Theorem U (conditional uniqueness), DSSE verifiability. Where the real trust math lives.
—
EVIDENCE-BACKED
Runtime / algorithmic rules backed by real code and live endpoints, with no proof claim attached. Honest operational tier — not dressed up as proven.
—
CONJECTURE · ADVISORY
Λ unconditional uniqueness = Conjecture 1 (machine-checked false as stated). Gray, advisory, never green. Theorem U is the proven conditional alternative.
IMMUNE is a separate interactive evidence demo. Its own interface must disclose the current runtime, signer, ledger, and Rekor state; opening the link from A11oy does not establish current reachability or source parity.
Solutions · live source checks
Six buyer workflows. One governed core.
Each card opens an operational console view and checks its read-only source in this browser session. A reachable source proves the route answered—not that its data is correct, current, compliant, or customer-validated.
CybersecurityCHECKING
Threat-to-action control
Bring threat signals, policy gates, incident context, and evidence receipts into one response view.
signal → gate → response → receiptOpen cyber operations →FinanceCHECKING
Governed market and risk decisions
Inspect source-backed signals, apply decision policy, and retain the exact evidence behind an outcome.
market data → policy → decision → receiptOpen finance operations →Data governanceCHECKING
Lineage that survives the dashboard
Trace assets, transformations, policy decisions, and downstream use through portable provenance evidence.
asset → lineage → control → evidenceOpen data lineage →EnterpriseCHECKING
AI operations and incident command
See runtime health, governed actions, exceptions, and receipts without stitching together separate control rooms.
observe → prioritize → intervene → proveOpen enterprise cockpit →Real estateCHECKING
Governed asset workflows
Connect property signals to reviewable actions while preserving source, approval, and outcome history.
asset signal → review → action → receiptOpen real-estate operations →LegalCHECKING
Evidence-bound matter workflows
Keep source material, policy constraints, review gates, and action history attached to the matter.
matter → authority → review → evidenceOpen legal operations →CHECKINGChecking six read-only source contracts.
The living body
Watch the governed organism breathe.
The anatomical views translate named platform probes into a spatial operating map. An organ can glow only when its source answers; missing sources remain dim or unavailable. Receipt animations are evidence-bearing only when the underlying read returns a current receipt.
Public estate · versioned inventory
Models, kernels, data, and Spaces — one evidence-labelled map.
The front door no longer hardcodes organization totals. The atlas joins Hugging Face artifacts to their GitHub producers without pretending that a reachable URL proves source alignment. Counts render only after the versioned inventory API answers and retain its LIVE, CACHED, STALE_CACHE, or SNAPSHOT label.
—Models
—Governed kernels
—Datasets
—Spaces
—Collections
—Public buckets
Inventory source has not answered this session.
One chain · current ledger read
One evidence contract. Independently inspectable.
The current ledger read reports its algorithm, depth, and receipt identifiers. Durability, signer mode, chain verification, and replayability must be established by the returned evidence and deployment configuration—not inferred from this dashboard.
—
Receipt records · signer state separate
sha3_256
Chain algorithm
—
Source-labelled chain depth
—
Last receipt id
Verify it yourself
The trust center.
The versioned honesty posture, the locked-8 with truthful Lean refs, Theorem U vs Conjecture 1 explained honestly, SLSA posture, and the offline receipt-verify flow. Every claim links to its check.