Product · Kernel
A resolution ladder with the model on the bottom rung.
Every piece of work descends the ladder. Deterministic rungs first. A learned pattern if one has earned the right. The model only for what is left, and a person for anything the model may not decide. The ladder is the product. Everything else exists to move decisions up it.
The ladder
Five rungs. One order. Exactly one winner per decision.
Razoo records exactly one winning rung on every Decision, and the label must describe what actually ran. Plumbing never calls a model. Reasoning never executes. Judgment is a person.
Structured
0 tokensSubject fields, work type, status. Regex on strings and parsers on nested objects sit on the same deterministic walk.
Required fields present or a non-reasoning rule hit. May stage only through the resolving skill's bound actions.
Pattern
0 tokensAn authored WHEN clause from your agent YAML. Compiled, not mined.
Exact match on an active authored pattern. Stages from THEN only when action-causing and confirmed.
Learned
0 tokensThe subject against active operator-promoted patterns, over the fields you declared learnable.
Fires only if active, unrevoked, inside its envelope, and its dependency binding still holds. Proposed never fires.
Reasoning
meteredThe residual packet after the deterministic rungs, on a step the process declared as reasoning.
A model under a token contract returns schema-valid JSON. It may stage a typed action. It can never execute one.
Judgment
a personAnything the policy reserves for a human, and every field marked money_legal.
The choice is recorded as evidence. Those choices are what the learned rung above is mined from.
There is one more row in the contract: failure. A plumbing residual that cannot be resolved becomes a visible failure or a queue entry. It is never silently recovered and never a staged action.
Step kinds
Plumbing, reasoning, or judgment. The YAML says which.
A process declares its steps. The kernel refuses to let a plumbing step reach a model, and refuses to let a reasoning step execute anything. If interpretation is required, the process has to say so.
Plumbing
Deterministic rungs only. No model, ever. Residual uncertainty goes to the judgment queue or a visible failure, never to a staged action.
Reasoning
The residual after plumbing. A model is allowed under a token and output contract, on a tier named fast or capable, never a vendor. Reasoning stages. It does not execute.
Judgment
A human is required. The choice is recorded with the person who made it, and becomes evidence for the learned rung.
process: inbox_triage work_types: [ea_inbox, ea_brief] steps: - id: capture kind: plumbing skill: intake.capture - id: triage kind: plumbing skill: qualify.deterministic fields: [owner] - id: enrich kind: reasoning # model allowed, under a token contract skill: capture.structure - id: decide kind: judgment # a person, always - id: resurface kind: plumbing skill: opportunity.resurface
from the executive-assistant example agent in the repository
The replay gate
Authority is earned by replay, not by confidence.
A candidate rule is a WHEN and a THEN mined from judgments you already made. Proposals are inert. A candidate is certified by replay against your own history, and then a person promotes it. Nothing about how sure a model felt enters into it.
Replay against your history
The candidate is re-run over the judgments your team already recorded and certified by replay against that history.
The report shows its work
Every case the candidate was replayed on is listed, so you can open the ones where it and a person would have differed.
Never over identity or money
Identity keys and money_legal fields are never learnable. No candidate can key on who a party is or how much is at stake, and doctor refuses a file that tries.
One promotion path
A single function grants active status, and the CLI refuses writes that would bypass it. An imported agent starts with no active patterns.
Proof-state binding and the envelope
A rule that outlives its assumptions stops firing on its own.
Two guards travel with every learned rule. A dependency binding pins it to the registry entries it was certified against. An envelope pins what it is allowed to touch. Both are checked at fire time, at confirm, and again inside the outbox handler before any side effect.
Proof-state binding
- Pattern
- renewal-note · version valid
- Bound to
- the registry entries this rule depends on
- Recorded at
- promotion · by an operator
- Checked at
- fire · confirm · handler
- On mismatch
- skip this execution · record why · route to judgment
at promote
recorded
at fire
valid
at handler
valid
At promotion the kernel binds the rule to the registry entries it depends on. At fire time, and again in the outbox handler after a person has confirmed and before any side effect, the binding is checked. If anything the rule depends on has changed, it is skipped for that execution, the reason is recorded on the Decision, and the work goes to judgment. Nothing is dropped and nothing executes on stale authority.
The authority envelope
- Class
- action
- May stage
- request_signature
- Confirm
- required · by a named person
- money_legal
- never inside an envelope · always a person
- Checked at
- stage · confirm · handler
The envelope names a class (inform, action, or money_legal), the action ids a rule may stage, and whether a confirm is required. It can narrow what an action definition already allows and can never widen it. An action outside the envelope does not stage, confirm, or execute. Money and legal fields always need a person. The execution rule that decides whether anything may run without a confirm is machine-checked on every test run, and the inspector reports the result as an invariant verified under the declared model, not as safe.
Verified autonomy artefacts
Verified is not active. Active is not permanent.
A learned rule is wrapped in a governance record. Only the promotion path writes active, and counterexamples recorded by people take authority away. Passing a test never grants authority on its own.
Proposedinert
Verifiedinert
Activefires
Demotedskipped
Suspendedskipped
Retiredinert
The transactional outbox
One job mechanism. Sleep is normal.
Every side effect leaves through an outbox row enqueued in the same SQLite transaction as the state change that caused it. A laptop that sleeps catches up on wake. A container that restarts catches up on start. Leases, retries, idempotency keys, and a dead-letter queue are built in. Direct calls are a latency optimisation, never the mechanism, and a test fails if anyone makes them one.
Determinism
Every decision replays bit for bit.
Rules, patterns, and the kernel take their clock from the evaluation context. Nothing on a decision path reads the wall clock or a random source; a lint enforces it. So any stored Decision can be re-walked at its original context against the rule and pattern sets as of that moment, and the report either says match or names the dependency that changed. Replay persists nothing and never calls a model.
What cannot happen
- A staged action executes without a confirm, even when its definition says auto_confirm.
- A money_legal field or action executes without a person.
- A proposed pattern fires.
- A pattern becomes active without being certified by replay and promoted by a person.
- A plumbing step calls a model.
- A reasoning step executes a side effect.
- A rule fires after something it depends on has changed.
- A side effect leaves by any path other than the outbox.
- Work is dropped. Every skip, mismatch, and failure lands on a queue or a visible failure.
each line is pinned by a test that fails if the guard is removed
Read the mechanism before you take our word for it.
The invariants, the machine-checked execution rule, the threat model, and the red-team history are shared with design partners under NDA. The documentation is public.