Fail-Closed Admissibility Layer

AI proposes.
Deterministic oracles decide.

FCAL is a pre-execution admissibility layer. A language model emits structured claims; versioned, deterministic oracles adjudicate them against declared constraints — fully independent of the model. Replay-enabled decisions emit an audit envelope that can be independently verified.

Ask a question Open the audit trail

A decision record from the live deployment

aud-20260807T162106187-geriatric-beers-v1-0yvwlk GERIATRIC_BEERS_V1 · known-input reproduction

EXTINCT / critical MATCH_FULLY_VERIFIED

Envelope integrity, deployed-source match, and bit-for-bit re-execution — all three replay tiers verified against production. This record is the reproduction exhibit of a published finding against our own system. Read the witness →

How it works

Three properties, held by construction

The layer is deliberately narrow. It does not generate, correct, or negotiate — it adjudicates structured evidence and records how it did so.

iIndependent of the model

The LLM never sees FCAL verdicts and does not choose the adjudication route. It emits structured claims; caller-side routing determines which oracle evaluates them. The model's prose is never steered to match a verdict.

iiFail-closed adjudication

Oracles judge declared claims against versioned constraints. Missing evidence is a verdict, not a gap to fill: INSUFFICIENT_INPUT is emitted rather than an assumed value.

iiiReplay-verifiable records

Replay-enabled decisions emit an audit envelope with a hash family over oracle source, input, runtime, and constraints. Three replay tiers verify integrity, deployed-source match, and deterministic re-execution.

EXTINCT› INSUFFICIENT_INPUT› INSUFFICIENT_MODEL› SURVIVE_WITH_WARNING› SURVIVE

oracles in the Ask surface

constraint domains

replay verification tiers

verdict classes

Foundation

Research and protection

Intellectual property

Patent pending

U.S. Non-Provisional App. No. 19/686,722
Deterministic admissibility gating with replay-verifiable decision envelopes.

Research foundation

Bounded Fallibility

A formal account of why an independent admissibility predicate is required for uniform worst-case guarantees over probabilistic proposers.

Technical note (PDF) →

The public deployment adjudicates demonstration inputs only — no patient data, no live clinical or financial records.