sha3:37e2e750d0739a76f16fc6f4417d2a3ecec6bcec99ee28eb422a188a9a7add88IntactRegister / AI / The Cage
We built the engine. Then we built the cage.
sha3:6b028eba85bfIndependently verifiable0f9b0c51dd2fce46c358c1fe1ed7a7e4043fd3f6d0976c1ae2108d99803d0484prev:60826bf389daThe engine is not the product. The cage is.
Every vendor in this market has an AI engine now. Ours is called Xovyr, and this register will show it to you. But an engine is not what makes it safe to let software modify regulated infrastructure at two in the morning. What makes that safe is the structure around the engine: a gate that rules on every proposal before it moves, a proof that checks every change after it is drafted, and a reversal path that exists before anything is touched. We built the engine first. Then we spent the harder years building the cage. The cage is what we sell.
- the.engine
- Xovyr. It generates remediation proposals by grammar-constrained compositional reasoning and publishes a confidence figure with each one. It holds no credentials and has no execution path. Its entire output is a proposal object.
- the.cage
- The Safety Sandwich. An OPA policy gate rules before the engine reasons. Terraform planning with SMT formal verification proves the change after it is drafted and before it lands. A rollback identifier is armed before any modification. AI proposes; deterministic gates verify.
- the.record
- Every gate ruling, proof result, and rollback arming is hash chained into the same register that carries Proof of State, Proof of Change, and Proof of Agency. The cage does not ask to be believed. It writes evidence.
The mechanism is the subject of 4 U.S. patent applications, including Neuro-Symbolic Policy Reasoning and an Autonomous Cloud Governance Engine. That is the whole provenance claim, stated once.
7bc5f391fd6673652313aeee848c3ce053796e6758c794b1c39e0b6672d2d478prev:0f9b0c51dd2fXovyr: an engine that can only propose.
Xovyr does not free-generate infrastructure changes. It composes them inside a grammar: a closed vocabulary of action types, parameters, and targets that the reasoning is constrained to at generation time, not filtered against afterward. A change that would fall outside the grammar is not caught later. It cannot be formed. That is the difference between telling a model what not to say and giving it a language in which the forbidden sentence does not exist.
{
"action": "nsg.rule.restrict",
"targets": 8 resources, each pinned by state hash,
"params": { port: 22, source: "any", effect: "deny" },
"confidence": 0.96 # published and recorded, run or not,
"captureState": plan ref cs_58f2a1,
"restoreState": plan ref rs_58f2a1
}
# no credentials field exists on this objectThe engine publishes a confidence figure with every proposal, and the figure is recorded whether or not the action ever runs. But what the engine cannot do is the load-bearing fact on this page: it holds no credentials, it has no execution path, and its output is inert until the cage rules on it. A hallucinating model with write access to production infrastructure is a catastrophe. A hallucinating model whose only output is a proposal object headed into a deterministic gate is a Tuesday.
767ba3b928788367c2bfe8b41c4751efaec134d2456bbb85c95d0c679f811c1aprev:7bc5f391fd66The Safety Sandwich, walkable.
The cage has four load-bearing members, and every proposal passes through them in order. Each member is deterministic: same input, same ruling, every time. Each writes its own chained record, so the act arrives with its context attached. Walk them.
- 00 OPA PRE-GATE
- Before the engine reasons at all, an Open Policy Agent gate rules on the condition and its scope against the autonomy envelope and every applicable policy as code. ALLOW moves the work forward. DENY is a chained record, not a silence, and nothing the engine produces can route around this member.
- 01 THE GRAMMAR
- Xovyr composes the remediation inside a closed grammar of permitted action types. This member is structural rather than evaluative: an out-of-grammar action is unrepresentable, so the proposal that would need catching never comes to exist.
- 02 SMT VERIFY
- The proposal is rendered as a Terraform plan, and the plan's postconditions are proved by SMT formal verification against the policy constraint set. Proved for the stated properties, before anything lands. A failed proof stops the walk, and the failure is recorded.
- 03 ROLLBACK ARM
- The target state is captured and hashed, and a rollback identifier is issued before any modification. If the identifier cannot be armed, execution is refused. The reversal exists before the act does.
action nsg.rule.restrict target.scope staging/web-tier params { port: 22, source: any, effect: deny } postcondition deny_public_ingress holds capture.hash sha3:41c2e97a10bd (live) confidence 0.96
sha3 over this proposal, computed in your browser: cbae24bf8f2f
Walk runs in GATED mode; the human signature step is shown at 03.
Not yet walked.
Illustrative proposal. The members, their order, and the refusal shapes are real; the values are sample data. The digest above is a real SHA3-256, computed in your browser over the text you see.
One sentence carries the whole architecture: AI proposes, deterministic gates verify. The engine is probabilistic, and we treat that as a property to be contained rather than denied. Everything that touches your infrastructure is deterministic, evaluated in order, and recorded.
6f6137e3f8a2a8f689d840864343f6bc52498df07ecfd9cda4efa9a5be046c23prev:767ba3b92878Who holds the key: three trust modes.
A cage with no lock is scenery. Every autonomy envelope carries a trust mode, and the mode decides whether a human signs before member 03 arms. SHADOW watches and executes nothing; every deployment starts there. GATED, the default, puts a named human approval on each action, and the approving identity becomes part of the act's record. AUTONOMOUS exists only for narrow, well-tested action classes, and still runs every member of the cage on every act.
The full trust-mode record, including graduation and the andon cord, is on the agency record. This register states only who holds the key: you do.
0a37946146e41c9d24bcc9519129efc40c06633a1b56b1a6c4e6f3b3e444df23prev:6f6137e3f8a2The cage watches the other AI too.
Ours is not the only model acting in your tenant. The same register inventories every model and agent in scope: the identities they hold, the channels and egress paths they use, the envelope that binds them. Xovyr is entry one on that inventory, held to the same rows as every other agent. Shadow AI, meaning a model or agent operating outside the inventory, is detected and surfaces as a finding, and a finding closes only one of two ways: the entry is claimed and bound to an envelope, or it is removed on the record. The register never shrinks silently.
- inventory
- Models and agents enumerated with identities, channels, egress paths, and binding envelope, as of a timestamp you choose. This is the annual AI use-case inventory, answerable from data rather than from a spreadsheet somebody maintains.
- MITRE ATLAS
- Exposure mapped against 64 ATLAS adversarial techniques, with unbounded techniques recorded as declared gaps rather than omitted. The six techniques most probed in review are itemized in Proof of Agency.
- prompt.injection
- Ingress paths to each agent are enumerated. An injected instruction can change what a model proposes. It cannot change that the proposal lands in the cage, which cannot be talked out of a DENY.
- token.cost.anomaly
- Sustained anomalous invocation is treated as a security event, not a billing footnote. Cost ceilings are gate inputs, and every ceiling evaluation is a chained record.
The full estate record, including the per-technique ATLAS ledger and the counterfactual machinery that replays any act one notch different, lives in Proof of Agency. This record states what is watched. That one proves it.
f931e6f5a78bddf6813e0046e0cc1d743f5637b3cd4a4f387aec93d4a7fc8f8bprev:0a37946146e4September 2026 is not a forecast.
OMB M-25-21 requires agencies to classify high-impact AI and to have minimum risk management practices in place for it. The deadline for those minimum practices is September 2026. Annual AI use-case inventories are already due on a cycle, and the DOE AI Compliance Plan asks the same questions of the laboratories. Contractors are not addressees of the memo, but the obligations arrive anyway, as evidence their federal customers must produce and therefore must demand. Every one of those obligations reduces to the questions this register answers: what AI is acting in the environment, what was it permitted to do, what did it do, and what would have stopped it.
- OMB M-25-21
- High-impact AI classification and minimum risk management practices. The envelope, the trust modes, and the chained gate records are those practices, in force and evidenced, rather than described in a memo. The classification judgment itself stays with your accountable official: the record holds it, your CAIO makes it.
- NIST AI RMF
- GOVERN is the envelope. MAP is the estate inventory. MEASURE is published confidence and gate results per action. MANAGE is trust modes and the andon cord. All four are evidenced from the records above, not from a questionnaire.
- DOE AI Compliance Plan
- Use-case inventory, risk determination, and documented safeguards, answerable from the estate record as of a date.
- MITRE ATLAS
- Adversarial technique exposure per agent, with unbounded techniques declared as gaps.
If the minimum practices exist only as narrative, the deadline is a writing assignment. If they exist as machine-enforced objects with chained evaluations, the deadline is an export. This mapping is this register's reading, not legal advice; the memo and your counsel control.
2987fbe430aca0791a6e9538e733f1561d29030cba5a98f8faed91a4b0f01155prev:f931e6f5a78bHow the cage is audited.
Every member of the cage writes a record: the OPA ruling with the policy version it applied, the proposal with its grammar version and published confidence, the SMT result with the constraint set it proved against, and the rollback identifier with the state hash it captured. Each record commits to the digest of the record before it, SHA3-256, on the same chain that carries every other proof layer.
$ pcx verify --stream cage gate_rulings 18,204 proofs 6,411 rollback_arms 6,411 head sha3:0b8e41c7d2a9 gaps 1 declared (interval and reason on record) result INTACT
A second party verifies without us in the loop. Export the stream, recompute the digests, compare. The answer is intact, or the exact sequence number where it is not. When a reviewer asks whether the gate actually ruled before the act, the ordering is not asserted by us. It is arithmetic.
37e2e750d0739a76f16fc6f4417d2a3ecec6bcec99ee28eb422a188a9a7add88prev:2987fbe430acWhat the cage does not do.
Walk the cage in your own tenant.
Request verification