Governance

Operational principles

Two lanes, one explicit boundary

• Deterministic lane: GGUF parsing, tokenizer behavior, tensor binding, model execution, KV state, logits, and sampling.
• Governed lane: decisions about tools, memory, claims, structural changes, and public artifacts.

Governance wraps the runtime; it does not silently rewrite parity behavior.

Decision surfaces

• Budget decisions: whether an action remains above the configured viability floor.
• Claim boundaries: whether generated or published language exceeds current evidence.
• Review gates: whether a structural or public change requires human approval.
• Constraint decisions: whether runtime, tool, memory, or publication rules are violated.
• No-op reasons: hard limit, excessive uncertainty, weak evidence, missing review, or constraint violation.

Receipts, evidence, and quarantine

Governed actions can produce immutable decision receipts that identify the request, model, budget result, claim-boundary result, review status, evidence references, quarantine state, and UTC decision time. Uncertain artifacts remain quarantined until an explicit promotion workflow succeeds.

Roadmap boundary

The experimental roadmap applies these principles to host-controlled budgets, backend evidence, checkpoint recovery, no-op, fail-closed behavior, and termination. It remains proposal-only: model output cannot authorize actions, package source is unchanged, and operator control remains authoritative.

Cognitive liberty boundary

The runtime may classify model files, configuration, tool permissions, generated artifacts, evidence, and request state. It must not present itself as an authority over human belief, private inquiry, or the legitimacy of a conversation.