Architecture
The machine this site runs on
Serious AI systems are built from three things: a reasoning layer, a set of constrained tools, and a runtime that fails safely — with memory as the hub that makes the whole thing compound. This site is a small, public instance of that architecture, run in the open.
Typed records, not posts
Every page is a record with a schema: title, epistemic status (established framework · consensus view · contested · practitioner judgement · exploratory), qualitative confidence, an issue date, named sources, and typed connections to other records. An untyped record is ungovernable; nothing untyped exists here.
Deterministic compilation
The public surface is compiled from the records by a deterministic build — the same input always produces the same site. Models may help draft; they never compute a number a reader sees, and they never publish. The serve path is static files: if the pipeline dies, the last verified version keeps serving (fail-stale), and if a gate fails, nothing ships at all (fail-closed).
Gates that refuse
Before any publish, mechanical gates scan for what must never appear: unsourced claims, undated pages, predictive or promotional language, secrets, and anything from the private practice that is operational rather than teachable. Every gate run is logged to an append-only ledger. A pipeline is only as trustworthy as the list of things it refuses to do — that list is maintained as a first-class artifact.
Memory as the hub
Underneath the site is a single memory system, built as infrastructure rather than a model feature. The raw record is always authoritative, and the system can ingest, store, serve, and version with no model in the loop at all — swapping or dropping the model changes nothing about the data or its guarantees. That independence is an invariant, not a convenience: a memory whose quality depends on the model is not one.
Every consumer reads through a scoped, read-only view — the public site sees only what is public-safe, and nothing reaches it that was not meant to. New material enters through one gate or not at all. A later fact supersedes an earlier one visibly rather than overwriting it, because returning a stale fact with confidence is the single failure this system treats as disqualifying. Every read leaves a trace, so an answer can be replayed rather than trusted.
The promotion discipline
One rule orders everything: instrumented → hardened → stable signal → only then orchestration. A single governed loop ships first and earns its complexity; coordination between multiple agents is admitted only after the single loop proves deterministic, ledgered, and signed off. Machinery promoted to compensate for missing instrumentation is the failure mode this discipline exists to prevent.
Why this is the point, not the plumbing
Capability is table stakes; the product is provable governance — a system that can be delegated to precisely because its refusals, its lineage, and its blank spaces are all inspectable. Most of the field ships capability and skips the governance; the order is reversed here, and that reversal is the deep claim this site demonstrates by running on it.
That is the silhouette. The specific fusion rules, thresholds, and internal structures stay private — the point of a governed system is that its guarantees are inspectable without its internals being extractable.