This page is the technical record. No commercial narrative: structure, limits, and what can be checked. If your job is to decide whether this holds up, start here.
Measured 2026-10-19 on 8b536cd, by running the full suite: 2,502 tests across 278 suites, 0 failures and 1 skipped. A figure without a date claims to be current; one without its commit cannot be checked.
Not three systems. One mechanism — the order with its record — behaving in three ways depending on the level that receives it. Each layer bounds the one below, and no order can touch the layer that bounds it.
What is never ordered: guarantees, invariants, the mandatory human signature on any effect, the version pinning of every part, and the ranges within which everything else may move. A constitution does not take orders: it is amended, and only by human decision.
What is ordered as a cascade: the governing body moves a criterion and it descends into concrete controls, always within constitutional bounds. A strategic order reaches the last adjustment without losing its rationale — and if a single step rejects it, none of them apply.
Day to day: the limits an authorised person moves within their permitted range, with a mandatory reason and a record. No reason, no order — the system rejects it, and the rejection is recorded too.
The parameter is the what. The range is the limit. The order is the means. The record is the memory.
This separation is what makes the whole auditable — and it lives in the structure, not in a usage policy.
| Part | What it can and cannot do |
|---|---|
| The specialist | Perceives, interprets, compares and consolidates. Each step is performed by a certified part with its capability declared by contract and its inputs and outputs fixed. It does not issue the verdict. |
| The decision criterion | For each case it decides which parts are activated — or whether none are. It is sealed: its content is fixed by hash, and the decision it produces is stored next to the data that caused it, in the same record. |
| The authority | Issues the verdict over the consolidated picture, using legible and deterministic rules. It owns no execution parts: it holds authority. |
| The effect | Materialises a decision already taken. Before any action with external consequence it verifies authorisation — structure, signature and scope — and if it is missing, returns the block as a state of its own. It does not judge: it checks. |
No language model takes part in the deciding path. What gets activated is decided by measuring the quality of what was perceived — counts and divisions over the extracted text — and applying written rules. The same case twice produces the same answer twice, with the same figure and the same reason.
That is what makes a decision defensible two years later: you do not need to reproduce a model's state — you re-apply the rule to the same data.
Language models do take part where they add value — reading a contract, recognising a clause — and there their criterion is compressed inside a hash-sealed prompt. The product does not hide this: it declares it part by part, and distinguishes legible criterion from compressed criterion.
| Property | What it guarantees |
|---|---|
| Hash chain | Each entry includes the hash of the previous one. Altering one breaks the chain from there on and verification detects it. It is tamper-evident, not tamper-proof: the hash is keyless, so whoever controls the database can recompute the whole chain. Against that, external anchoring — being built. |
| Append-only | The system never edits or deletes: it only appends. A rejected order is recorded too — the "no" has the same memory as the "yes". |
| The refusal, recorded | When the system refuses to work, that decision is sealed with its author, its type and its reason in figures. And it produces no case file, because there is no effect to document. |
| Seals and certification | Every part carries its definition hash, covering its contract and its implementation. Adjusting a value within its range does not move the seal: knowledge adapts without breaking the asset. |
| Third-party reconstructible | An external auditor can rebuild the decision history with their own tools and without privileged access. Verifying it without trusting our infrastructure also requires external anchoring of the chain — being built. |
A language to describe cognitive systems: fractal, deterministic, auditable and verifiable. It preserves human intent without loss, from the strategic order to the smallest step of execution. It aims to be for cognitive systems what JSON was for distributed software: a common format.
CCS v0.1.1 · NIST CAISI
Docket NIST‑2025‑0035 · Comment NIST‑2025‑0035‑0180
Tracking mm9‑m8z8‑mjjx · FR Doc 2026‑00206 · under evaluation
Public submission with six downloadable technical documents: specification, comparative analysis, roadmap, valuation and signed letter.
Verifiable at:
https://www.regulations.gov/comment/NIST-2025-0035-0180