H.A.R.I. Deterministic Governance EN·IT Private discussion
Platform Verticals — Football Verticals — From cradle to Moon Extensions — SLAM XPExtensions — Smart glasses Framework Private discussion →
Home/Platform/Core architecture
Platform / 1.3

Core architecture.

The five-layer kernel, the three canonical outputs, the determinism principle, and the Time Sovereignty Layer. Architectural depth, not implementation internals.

Never a blind wall — when it cannot say ALLOW, it says what is missing, with a recovery path
01

The five-layer kernel

Five layers — PAL, IML, CL, DCL, AGL — each with a single responsibility and an explicit boundary with its neighbours. Implementation internals are out of scope for the public site; the intent is a clean conceptual model regulators, auditors and federation officials can reason about.

PAL
Perception & Acquisition Layer
Receives authorized inputs through governed API connections. Inputs are stamped with provenance: source, time, signature, policy version.
IML
Interpretation & Mapping Layer
Maps raw inputs to typed, policy-relevant facts. Untyped, malformed or out-of-scope inputs are rejected here — they never reach the kernel.
CL
Constraint Layer
Evaluates policy preconditions against typed facts. Encodes the institution’s rules, the regulator’s requirements and the vertical’s constraints. Versioned, auditable.
DCL
Deterministic Control Layer
Emits the canonical output: ALLOW, DEFER or SYSTEM_UNVERIFIED. Same facts, same policy, same output. No probabilistic component participates.
AGL
Authority & Governance Layer
Routes DEFER and SYSTEM_UNVERIFIED to identified humans within scope — with the stated gap — manages authorization for irreversible actions, writes the outcome to the chain.
Property
Boundaries are explicit.
Each layer has a defined input and output contract. A regulator audits one layer in isolation; an insurer scopes coverage to layer-level guarantees; a federation scopes a pilot to specific constraint sets.
02

Three canonical outputs

The DCL emits exactly one of three states. The set is closed: no fourth state, no probabilistic blend, no “maybe”. This closure is what makes the platform reviewable.

ALLOW
All preconditions satisfied.
Example. A scheduled VAR review request arrives from an authorized federation API; preconditions are satisfied, inputs signed and fresh — ALLOW. Decision and inputs written to the chain.
DEFER
Pause for a named human.
Example. A trial workflow requests a protocol amendment requiring sponsor sign-off. DEFER is routed to the principal investigator with the evidence on file. On authorization, the chain records deferral and resolution.
SYSTEM_UNVERIFIED
A precondition cannot be evaluated.
Example. A stadium-safety request arrives but the sensor stream is partially missing or its signature stale. SYSTEM_UNVERIFIED names the missing stream and routes to operations. Nothing proceeds on “best effort”.
Why three, exhaustively
Probabilistic systems return a number. Numbers invite thresholds, thresholds invite tuning, and tuning invites the slow drift of governance into operations. Three discrete states with explicit semantics keep governance auditable as teams change over years and decades.
03

The determinism principle

Same input, same output, always. Given the same typed facts and the same policy version, the DCL produces the same canonical output. Decisions are reconstructible from the chain; reviewers receive the same answer when they review.

Determinism does not mean ignoring probabilistic evidence. Model outputs and sensor confidences flow in through the PAL, are typed by the IML, and evaluated by deterministic policy in the CL. The probabilistic input is evidence; the institutional judgment is deterministic.

04

The forensic chain

Every decision writes a record: typed inputs, policy version, output, provenance, and an ECDSA P-256 signature. Each record links to its predecessor by hash. Tampering with any record invalidates every downstream hash.

Two consequences. Any past decision can be replayed — reconstruct the inputs, apply the named policy version, verify the output matches. And the chain is timestamped via OpenTimestamps; the current sealed-core proof carries public ID SOV-2026-02-26. Detail on Determinism & forensic traceability.

05

The Time Sovereignty Layer

An irreversible action — one that cannot be cleanly reversed by a subsequent decision — requires a human authorization step. For any action classified as irreversible by policy, the AGL routes the request to a named human within scope, captures their signed, timed authorization, and writes it to the chain alongside the decision. No valid authorization, no action. Authority preserved by architecture, not procedure.

Reversibility classification
Defined by the vertical’s policy. In football, a referee designation change before kick-off may be reversible; a return-to-play clearance that triggers selection is irreversible. The classification lives in the CL, is versioned and auditable.
06

Architectural diagram

PAL
ACQUISITION
IML
INTERPRETATION
CL
CONSTRAINTS
DCL
DETERMINISTIC
AGL
AUTHORITY
ALLOW
DEFER
SYSTEM_UNVERIFIED
FORENSIC CHAIN — hash-linked · ECDSA P-256 · OpenTimestamps SOV-2026-02-26
The kernel: five layers, three canonical outputs, one forensic chain.
Continue

The chain, in depth.

Why determinism matters for auditors, regulators and insurers; the hash-chained trail; the replay procedure.