The engine beneath
the honest veil.

01 · Product contract

Do less than an oracle. Do it exactly.

The Interveil Engine does not decide what is true. It keeps the record honest enough that people and models can see what an answer rests on, where its support ends, how many genuinely independent roots exist, and what changed between one meaning and the next.

02 · Architecture

Two planes and a one-way membrane.

The Record Plane is append-only and content-addressed. The Lens Plane renders for an audience and purpose. Lenses read the record; they never write back into it. That boundary is a type constraint—not a promise that disappears under deadline pressure.

03 · Core object

A Truth Object is a packet, not a verdict.

Each packet declares a bounded question, explicit inclusions and exclusions, and a named revision. It carries the least transformed available artifacts, observations kept at their lowest interpretive altitude, atomic claims, evaluated evidence bearings, hypotheses, interpretations, structured loss, provenance frontiers, assessment, and revision history.

04 · Executable humility

What the Engine refuses.

The ontology earns its place where it declines a transition. These refusals are the product: a malformed graph or rendered answer must fail rather than complete the missing logic invisibly.

One invariant governs the commercial temptation more than any other: no truth score. Assessment remains seven-dimensional and attributable. Any weighting is a declared lens, never schema.

05 · Human-governed capture

The model proposes. A person authors.

Assisted authoring lowers packet-construction cost without granting a model canonical authority. Source material is segmented, candidate roles and atomic claims are proposed, dependency and omission warnings are surfaced, and a person accepts, edits, or rejects each item. Every action produces a receipt.

ingest → segment → propose roles / claims / links
      → dependency audit → human accept / edit / reject
      → invariant checks → signed revision

The working Alpha already demonstrates this boundary locally. Evidence text stays on the device. Optional improvement data is separated from the packet, disclosed before submission, and never includes source content by default.

06 · Model policy

Provider-neutral core. Inkling in shadow. Tinker after labels.

The application uses named model roles rather than a single vendor lock-in. Inkling-Small is the first multimodal proposal candidate for text, image, and audio capture; a separately benchmarked model checks evidence bearings; and a person remains the only canonical writer.

Tinker is the later post-training path, once Interveil has a diverse, rights-cleared corpus of accepted, edited, and rejected proposals. Its current inference surfaces are beta and suited to evaluation and internal workflows—not the sole production runtime. Local-only remains the default, and external source processing requires a separate disclosure and choice.

07 · External face

Every answer names its packet.

The Evidence API does not return prose alone. It returns a bounded answer with the claims, supports, dependency clusters, losses, frontiers, and rendering receipt required to reproduce it from one immutable packet revision.

{
  "answer": "bounded natural-language response",
  "packetRevision": "stable identifier",
  "claimIds": ["..."],
  "supportIds": ["..."],
  "dependencyClusters": ["..."],
  "assumptions": ["..."],
  "losses": ["..."],
  "frontiers": ["..."],
  "renderReceipt": {
    "model": "...",
    "lens": "...",
    "reviewedBy": "...",
    "generatedAt": "..."
  }
}

Two rules dominate the field list: an answer must be reproducible from a named packet revision, and a source-count feature may never ignore dependency clusters.

08 · Evidence-gated roadmap

Scale the distinctions, not the ontology.

Alpha should advance only when its distinctions survive new domains, multiple reviewers, adversarial input, and usability testing. Raw node count is not progress. Trace completeness and forbidden-collapse rate are.