Governed package
Defines the admitted actions, reviewed memory, evidence identities, rights state, policy thresholds, and behavioral constraints available to one profile.
Architecture
The authority boundary
The model proposes.
The runtime decides.
The runtime decides.
Hees.ai turns evidence, reviewed memory, declared authority, and policy into executable governance profiles, then keeps generated values separate from the terminal decision.
Evidence first, decision last
The permanent product arc begins with raw source evidence and candidate memory creation:
source evidence -> candidate memory atoms
|
authorized review + rights declaration
|
v
reviewed memory atoms
|
candidate governance profile
|
Training by Committee observations
|
saved replay inputs ─┐ v
├─> compiled Hees.ai profile -> bounded Spectrum
live model inputs ───┘ |
v
governed decision -> selected memory
|
Content DNA -> receipt
The governance profile is the reusable product unit. It names the exact evidence catalog, reviewed memory, rights and review state, permitted actions, answer requirements, policy thresholds, evaluator roles, bounds, Spectrum behavior, terminal reasons, and receipt projection that apply to an interaction. A model may supply proposals and observations inside that space; it cannot write the space into existence.
The Build Week release begins later in that arc, from a supplied fictional evidence catalog and reviewed-memory package. Its Profile Studio makes the governance boundary executable: evidence and memory can be staged or unstaged in a session-local candidate and sent through the shipped acceptance interaction at the real Hees.ai boundary. It does not yet ingest arbitrary evidence, derive memory atoms, persist edits, or activate a candidate. The result keeps the stable public contract reason separate from the exact profile diagnostic; removing required evidence produces invalid_package and invalid_package_atoms. A rejected candidate probe cannot replace the shipped active profile. The Governance profiles guide explains the complete contract through the fictional Lantern Labs fields.
One boundary, three distinct roles
This separation is the architectural invariant behind the public project. The provider cannot declare its own authority, a presentation host cannot reinterpret a rejection as an admission, and a receipt cannot substitute for the terminal decision that produced it.
Implemented console_profile_0_1 path
- ProfileEvidence + reviewed memory + declared authority
The fictional package binds exact source identities, review and rights state, memory atoms, permitted actions, answer requirements, evaluator roles, and policy thresholds. The Profile Studio runs a candidate acceptance probe through Hees.ai while protecting the active package.
- RequestIntegrity-bound question
The active profile and direct question are bound before provider work begins, preventing later inputs from drifting to a different package or request.
- ProposalUntrusted structured value
Offline replay or the optional GPT-5.6 adapter supplies visible response units, an action identifier, evidence references, and identifier-only support mappings. Schema validity does not grant authority.
- CommitteeNon-authoritative observations
Hees.ai derives exact relation and synthesis targets. Role-bound evaluators return bounded observations against those targets; they do not vote and cannot select the terminal result.
- ClassificationHees.ai findings + package policy
Hees.ai validates target identities and complete coverage, classifies observations, and applies the package-owned thresholds in fixed public-reason precedence.
- AdjudicationBounded Spectrum operation
The profile reaches the checked structural runtime only after earlier validation succeeds. The profile's limited Spectrum operation then returns exactly `admit` or `reject` with a closed reason.
- ArtifactsSelected memory + Content DNA + receipt
An admission freezes the exact selected package memory and atomically constructs the profile-specific Content DNA and receipt. A rejection exposes its exact reason and a redacted rejection receipt when identity is safely established.
The Console renders the returned profile projection; it does not reconstruct authority from transport JSON. Offline replay stores requests, proposals, observations, schema identities, and an integrity digest, but it stores no decision, finding, selected memory, Content DNA, or receipt. Optional live mode supplies the same input classes through provider decoding. Both transports invoke identical compiled Hees.ai behavior after normalization.
Training by Committee without provider authority
Hees.aiDerive targets
Construct canonical subject and premise identities from the package, request, and proposal.
AdaptersReturn observations
Evaluate only the supplied targets and return bounded integer scores plus their exact target identities.
Hees.aiValidate and classify
Reject identity drift or incomplete coverage, then derive findings under package-owned policy.
SpectrumSelect the terminal state
Compose the admitted inputs and deterministic structural result. No provider majority or self-reported confidence can override this boundary.
This profile exercises a working proposal-pressure-testing slice of Training by Committee. It keeps evaluator roles bounded and non-authoritative while Hees.ai derives targets, validates coverage, classifies observations, and decides.
Kernel and application topology
The public Incan library has a small facade and focused internal modules. The native application is also authored in Incan and uses ordinary external crates only at genuine platform boundaries such as raw terminal I/O and HTTPS transport.
| Layer | Implemented owner | Responsibility |
|---|---|---|
| Nominal identifiers | identifiers.incn | Bounded identifier, digest, and revision types with distinct public namespaces |
| Generic structural kernel | runtime.incn | Fail-closed package and proposal admission against declared actions and evidence |
| Initial governed profile | console_profile_*.incn | Request binding, manifest planning, observation validation, finding classification, policy precedence, selected memory, and terminal composition |
| Authority artifacts | content_dna.incn and profile artifact module | Internal construction and sealing of Content DNA and receipt envelopes |
| Public facade | lib.incn and console_profile.incn | Checked public types and functions without exporting authority-bearing constructors |
| Native product | workspaces/hees-console | Session-local Profile Studio, evidence and memory staging, candidate acceptance probing, replay, optional provider adapter, responsive terminal state, rendering, and source-safe inspection |
Public contract identifiers are distinct Incan newtypes. A PackageId cannot be substituted for a DomainId merely because both carry the same spelling. Every symbolic identifier derives from a shared bounded IdType; digest and revision specializations enforce their own forms. The pinned compiler invokes validated-newtype construction during derived JSON deserialization, so malformed identifier text cannot inhabit a decoded typed contract. That is still only type validity: authority requires a separate declaration or admission check.
Current proof and product direction
| Working in this release | Direction enabled by the architecture |
|---|---|
| Exact source, review, rights, provenance, action, requirement, policy, and evaluator declarations are visible as one profile contract | General evidence intake, extraction, candidate-atom curation, governed activation, versioning, and durable IncQL-DB-backed workspaces |
| Candidate evidence and memory can change session-locally and reach a real Hees.ai acceptance result without replacing the active profile | Reusable profile creation, validation, comparison, publication, and deployment across providers and domains |
| Hees.ai binds requests, proposals, targets, observations, findings, and terminal artifacts to exact identities | Semantic and factual verification, claim-level support, source provenance, rights assurance, and conflict management |
| Training by Committee observations are target-bound and non-authoritative | Richer provider-neutral pressure testing of evidence, atoms, profiles, prompts, proposals, and policy |
| Spectrum, selected memory, Content DNA, and receipts run end to end for the bounded profile | Generalized Spectrum adjudication, complete Content DNA, governed response lifecycles, and durable governance receipts |
Permanent product north star
RFC 010 places evidence intake and profile creation before governed interaction. The permanent Console will let developers inspect lawful source evidence, create candidate memory atoms without pre-granting review or rights, validate package declarations through Hees.ai, pressure-test them through provider-neutral committee roles, run governed interactions, and inspect terminal Spectrum and Content DNA artifacts. The Build Week Profile Studio delivers the first working session-local portion of that workflow; the fictional package is its demonstration context, not its product boundary.
RFC 000 owns the foundational authority model. RFC 001 defines the proposed generalized Spectrum boundary. RFC 002 defines answer-time Content DNA. The Spectrum and Content DNA whitepaper explains their intended relationship, while Contracts and src/lib.incn remain the source of truth for checked behavior.