Frontier Directions — Deep Research + Design (2026 H2)

1. Executive Summary

We evaluated four candidate frontier directions for unisona.ai. The pattern is consistent and uncomfortable: each direction began with a confident "AHEAD" thesis, and each was knocked down by adversarial search to MIXED or PARITY. The strategy in every case is directionally correct — the bet on owned/local, verifiable, abstaining AI is well-aimed — but the moats are execution-and-integration, not invention. In every direction a 2025–2026 product or research artifact already ships the capability we claimed was uniquely ours.

What this means practically: these are still worth building, because (a) each strengthens exactly one stage of the convergence loop, (b) each reuses code we already have rather than adding subsystems, and (c) a real, narrow differentiation survives in each (the bundle + execution rigor). But we must strip "category of one," "ahead of shipped products," and "parity on capability" from any external copy until we have measured evidence.

Ranking table

Cross-cutting caveat the completeness critic raised and we accept: the four "ahead/parity" verdicts in earlier drafts were all carried into customer-facing language unchanged despite verify.survives = false on all four. This document is the correction.

2. Direction— The Verifiable Memory Vault

Thesis. Owned, tamper-evident, decades-durable institutional memory: fuse the append-only JSONL convergence ledger + SHA-256 archive (CSF), the "500-Year Hardening" doctrine (epoch gates, attested handoffs), and event-sourcing/Byzantine-consensus ADRs (HFF), so memory is provably unaltered and readable across operator turnover.

2a. Novelty — verdict after verification

Original headline (REFUTED): "AHEAD of state of the art… category of one… none ship tamper-evidence + a succession/handoff doctrine."

Corrected verdict: PARITY. Skeptics refuting "ahead":of 3. (verify.survives = false, corrected verdicts [parity, parity, mixed].)

The researcher had already downgraded "ahead" to "mixed," crediting the edge to the fusion (tamper-evidence + succession + multi-decade durability for owned/local queryable AI memory). Adversarial search then refuted the fusion as a category of one:

• github.com/kase1111-hash/memory-vault (shipped alpha 0.2.1, 2026) — literally named "Memory Vault," self-describes as the "owner-sovereign storage subsystem for a learning co-worker," and bundles in one product: Merkle tree over recall events + Ed25519-signed roots (tamper-evidence); a designed dead-man switch with named-heir public-key enrollment + Shamir quorum recovery (succession, not git-by-accident); FTS5 recall + LangChain (queryable AI-loop memory); offline/owned. That isof ourbundled properties, fused. [confidence 0.9, https://github.com/kase1111-hash/memory-vault]
• LeanCTX (yvgude/lean-ctx, v3.8.16, 3000+ stars) — ships a "tamper-evident SHA-256 chain… local-only, on by default," portable .ctxpkg, FTS5 cross-archive search, git-anchored ed25519-signed snapshots: a mature, genuinely shipping local-first owned tamper-evident AI memory. [confidence 0.85]
• Cathedral (cathedral-ai.com) — a shipping paid product with a live "Succession Registrar" / "Agent Succession Protocol" (BCH anchoring, lineage hash, Ed25519, chain-of-custody, obligation inheritance). [confidence 0.8]
• worthprotecting.ai — ships "digital succession plans for AI agents" (Designated Agent Custodian, Owner Incapacity Protocol). Kills "succession is uniquely ours." [confidence 0.8]

The researcher's own concession holds: every isolated capability is parity-or-behind. The defensible remainder is execution rigor on the regulated AI-agent-audit wedge — external anchoring + a written multi-decade format-migration doctrine + integration into a working agent loop — not category novelty.

Completeness-critic corrections we adopt:

• Our own engine self-documents the ceiling: src/hff-api/cryptographic_proof.py says it is tamper-evident, not tamper-proof — "physical database access can still modify it," the private key is "written unencrypted," and it is "a teaching implementation." Public copy must say "local tamper-evidence," never "proof that memory was never rewritten."
• No external time-anchor exists in the design. A local hash chain proves internal consistency, not that a record existed at a past date. The real moat is RFCtrusted timestamps and/or periodic Merkle-root publication to an RFC-6962/CT-style transparency log — the in-repo Ed25519+Merkle+SQLite is table stakes.
• C2PA / Content Authenticity Initiative is the dominant verifiable-provenance standard (SHA-256, Merkle, X.509; 6,000+ members incl. Google/Meta/OpenAI/Adobe; recommended under EU AI Act Art. 50). It is the comparison the "category of one" claim omitted. The Vault should compose with C2PA/Trillian, not claim novelty over them.

Competitor gap table

2b. Demand

Strength: Moderate.

Segments. Enterprise compliance/risk teams running AI agents in regulated sectors (the strongest near-term pull: 88% had AI-agent security incidents in the past year, only 21% have runtime visibility, 33% have no evidence-quality audit trail); regulated record-keepers (HIPAA/SOX/FFIEC/AML, already legally required to keep tamper-evident logs 6–10 years); family offices / digital-legacy (latent, weak willingness-to-pay for "verifiability" specifically); long-horizon/elder care; researchers (FAIR data — soft pull); privacy/sovereignty individuals + data-localization orgs (digital-vault ~$1B, data-sovereignty-cloud ~$29B in 2026).

Drivers. Regulatory compliance is the dominant, deadline-bearing force. "AI rewrote history" integrity anxiety (documented: AI-edited media implants false memories at 2.05×). Data sovereignty (GDPR fines >€1.2B in 2024). Cost is a driver against over-engineering — buyers want minimum defensible evidence, not maximal storage.

Regulation (with citations).

Wedge. Enterprise AI-agent audit trail for regulated industries — a tamper-evident, cryptographically-chained, append-only record of everything an agent observed, remembered, and did, queryable as compliance-grade evidence. It is the only segment with all three demand ingredients at once: a hard-deadline regulation (EU AI Act Art. 12/19; HIPAA; SOX), an acute quantified pain, and budgeted buyers shopping before the deadline.

2c. Design

Loop stage strengthened: VERIFY. Pure extension, no new subsystem.

The Remember stage already writes append-only JSONL with a per-log SHA-256 hash chain (src/convergence/memory.py: prev_hash + entry_hash + Lamport seq, plus verify-by-replay). src/hff-api/cryptographic_proof.py already ships Ed25519 sign/verify, a Merkle tree with inclusion proofs, and a hash-chained AuditLog with verify_chain. Today these are fragmented: the ledger chains but is never sealed or anchored; the HFF engine is isolated with no caller over real data/ logs; csf.MemoryRecord.verify() hassrc/convergence/memory.pycallers; the doctrine is prose only. The Vault fuses them on top of the existing Memory object: (1) the ledger already chains on append; (2) a periodic epoch seal computes a Merkle root over the JSONL segment, signs it (Ed25519), appends a SealRecord; (3) each seal is anchored to an external reference (git commit, then RFC-3161 / CT-style log) so the disk-holder cannot rewrite history undetectably; (4) a succession record is a first-class dual-signed handoff. Every seal/verify is itself a ConvergenceRecord [hypothesis=vault-unaltered, evidence=Merkle proof+signature, result, confidence, source].

Honest positioning: PARITY with acluster (memory-vault, LeanCTX, Cathedral, Cortex-Persist, Letta git-backing). No public copy may say "category of one." The defensible edge is external anchoring + written migration doctrine + integration in a working loop.

Components

Data model. Extends Memory, Task, Tool, ConvergenceRecord — no new top-level object. SealRecord {epoch_id, merkle_root, signature, prev_seal_hash, git_anchor, ts} is itself a ConvergenceRecord. SuccessionRecord {outgoing_key, incoming_key, attested_root, attested_epoch, dual_signature}. The convergence JSONL ledger is the single sealed source of truth; CSF/JS records are feeders, not independently sealed (avoids cross-language root mismatch). One canonical-JSON spec is locked in the doctrine doc.

Build sequence

Risks & mitigations

• Novelty overclaim (Σ₀ violation). Refuted "category of one." → Position as PARITY + execution edge; strip "ahead/category of one"; require a deep-research pass before any "ahead" claim ships.
• Tamper-evident ≠ tamper-proof. Operator controls the disk; AuditLog docstring admits this; key is unencrypted. → External anchoring (git → CT/RFC-3161); dual-sign handoffs; document the threat model honestly (who holds the key, what disk access can do, rotation/escrow across succession).
• Fragmented checksum schemes (_integrity_hash vs CSF canonical form vs JS 1.0 ≠ 1). → One sealed source of truth, sealed/verified in Python over one canonical-JSON spec.
• Scope creep (Shamir/dead-man/TPM/BFT all tempting; byzantine_consensus.py exists). → Hard-gate to VERIFY-stage extensions: chain, seal, anchor, verify, succession-attest. Defer the rest explicitly.
• Performance as the ledger grows. → Epoch segmentation makes incremental verify O(new records); benchmark and record.

Milestones

• M1 — Proof-on-real-data. cryptographic_proof.py shared; test_vault.py green proving a mutated convergence record breaks the chain; epoch_id added. Tamper-evidence demonstrable on actual data/ logs.
• M2 — Sealer + verifier end-to-end. Signed SealRecords with git anchoring; verifier emits grounded ConvergenceRecords + CLI audit report; csf MemoryRecord.verify() has callers. One command → pass/fail integrity verdict.
• M3 — Doctrine + succession. Doctrine written + KC-carded (incl. threat model + anchoring); dual-signed handoff records.
• M4 — Product surface. routes/vault.js + public/vault.html live in dev preview; downloadable evidence bundle; core:verify declared; verified by driving the real UI on 4178.
• M5 — Live-loop + regulated wedge. Automatic periodic sealing; packaged EU-AI-Act/HIPAA/SOX audit-trail demo; external CT-style anchor + verify-cost benchmark in docs/BENCHMARKS.md.

3. Direction— On-device hallucination detection (the groundedness canary)

Thesis. Ship the benchmarked surprise-leak signal (−log₂ p, AUROC ~0.76–0.81) as a real-time "confident-but-unanchored" flag running entirely on the user's machine via local PLT/Ollama logprob decode.

3a. Novelty — verdict after verification

Original headline (REFUTED as written): "AHEAD of shipped products: cloud vendors structurally cannot expose raw token-logprobs as a user-owned safety dial; an uncopyable moat."

Corrected verdict: MIXED. Skeptics refuting "ahead-as-written":of 3 (the third confirmed MIXED and could push it neither to ahead nor behind). The thesis splits cleanly:

• The PRODUCT gap is real (genuine whitespace). Adversarial search tried hard and found no shipped consumer/local tool exposing reference-free per-token surprise as a user-owned canary. The strongest near-miss, HaluGate (vLLM, Dec 2025, Rust/Candle, 76–162ms, on-device) is NLI faithfulness, reference-dependent, developer-facing, and explicitly cannot detect hallucination "without any tool call." Braintrust'sroundup (Braintrust, Galileo, Arize Phoenix, Patronus, Promptfoo) is all cloud/dev observability. [confidence 0.75, https://www.braintrust.dev/articles/best-hallucination-detection-tools-2026]
• The MOAT claim is FALSE as stated. OpenAI exposes logprobs in Chat Completions and the Responses API (June 2025) and markets them for "reducing RAG Q&A hallucinations" [confidence 0.95, https://developers.openai.com/cookbook/examples/using_logprobs]; Google Gemini/Vertex exposes logprobs (GA mid-2025) and recommends avg-logprob as a grounding/confidence score [confidence 0.9, https://developers.googleblog.com/unlock-gemini-reasoning-with-logprobs-on-vertex-ai/]. "Structurally cannot" holds only for Anthropic (no logprobs, tied to its anti-distillation stance) and for reasoning models (o1/o3/GPT-5 suppress logprobs). The completeness critic confirms this independently — the "cloud structurally can't hand you logprobs" premise is factually wrong for at least two majors.
• Signal-strength caveat confirmed. Raw surprise AUROC ~0.76–0.81 is at/below predictive-entropy/perplexity baselines and below NLI/semantic-entropy methods; QuCo-RAG (2026) criticizes "ill-calibrated model-internal signals like logits and entropy." Position it as a zero-latency first-line flag, not an oracle.

Reframe the moat around local-first + user-ownership + hidden-state access (Semantic-Entropy Probes need hidden states only a local weight-holder has), not vendor inability. Anthropic-class users remain a clean "strictly ahead" segment.

Completeness-critic correction we adopt: the canary, as raw token surprise, structurally cannot catch fluent-but-semantically-wrong output — that is the established job of semantic entropy (Farquhar et al., Nature 2024, answer-clustering over meanings) andlogprob-time-series methods (HALT, EPR). Either adopt a semantic-entropy/clustering second axis, or scope the copy honestly to "degeneration/anchoring" and state it does NOT catch fluent factual hallucination. Selling it as general "on-device hallucination detection" would be mis-selling.

Competitor gap table

3b. Demand

Strength: Moderate.

Segments. Developers running local/self-hosted coding agents (Ollama + Cline/OpenCode/ADK) — the beachhead; regulated on-prem/air-gapped teams (legal, healthcare, finance); privacy/sovereignty enterprises; GPAI/high-risk EU providers needing Art. 14/15 uncertainty-surfacing; guardrail vendors needing an edge-deployable detector tier.

Drivers. Agent reliability (the #1 production blocker; vendors ship sub-200ms inline guardrails; Gartner: 40% of enterprise apps include task-specific agents by end of 2026). Privacy/data-sovereignty (a detector that also runs locally preserves the air-gap a cloud judge-API would break). Cost/latency (lightweight residual+logprob probes read risk "orders of magnitude cheaper than token generation"). Regulation/liability. Calibration framing: NIST reframes hallucination as "confidently stated but erroneous content" and asks orgs to measure the rate of confidently-wrong outputs and surface uncertainty — nearly a verbatim spec for this canary.

Regulation (with citations).

Wedge. Local AI coding-agent developers (Ollama/Cline/OpenCode). Already on on-device models, feel tool-call/file-content hallucination acutely, gate autonomy on "trust," no procurement cycle, and a real-time flag is the cheapest way to let the agent act with less babysitting at ~zero added latency. Then expand to on-prem legal research (highest WTP, citation-fabrication sanctions).

3c. Design

Loop stage strengthened: VERIFY. It adds the one signal the existing canary is blind to: was the model internally uncertain about the specific tokens it asserted so fluently?

The plumbing is already built and dormant. groundedness-canary.js scores the "42-state" (assertive × unanchored) from text alone; it accepts an optional tokenSurprise arg that RAISE-ONLY sharpens risk inside the unanchored corner, and an absent signal leaves scores byte-identical (graceful no-op for cloud/Anthropic). canary.js::runCanaries forwards tokenSurprise. The only missing wire is at stream-chat.js:1213, where runCanaries is called without tokenSurprise, so modelUncertainty is permanently 0. The design closes that gap end-to-end: (1) the local Ollama decode path requests logprobs and returns a per-token bits field; (2) token-surprise.js is recalibrated (the tailMass field is degenerate ~0.50 chance per the AB harness — separation lives in mean/p90 bits + split-conformal); (3) stream-chat.js passes the captured surprise into runCanaries, opening the valve; (4) the existing UI badges render the now-live signal.

Components

Data model. Extends Tool output, ConvergenceRecord, canary-events — no new store. Reply object gains optional surprise = { perToken?, field: {nTokens, meanBits, p90Bits, maxBits, tailMass, calibratedUncertainty} } — only the compact field is logged; raw per-token bits stay in-memory (privacy + size). sigma0_grounding gains non-zero modelUncertainty + surpriseField. canary-events.jsonl grounded.signals.modelUncertainty starts carrying real values (source="local-logprobs"). NEW append-only surprise-calibration.jsonl feeds a periodic split-conformal fit (Memory reused, not a new system).

Build sequence

Risks & mitigations

• Headline moat refuted. → Reframe defensibility as local-first + ownership + zero-latency + optional hidden-state (SEP); market the product whitespace, not vendor inability; Anthropic-class users stay "strictly ahead."
• Signal strength. AUROC ~0.76–0.81 is at/below NLI/semantic-entropy. → Ship as zero-latency first-line flag; split-conformal calibration for coverage; honest UI copy; keep NLI/reference path as a complementary future axis.
• tailMass degenerate (~chance). → M1 gate measures mean/p90 directly; recalibrate before opening the valve anywhere; do not ship the field as-is.
• Ollama logprob availability/format drift; reasoning models suppress logprobs. → fromOllamaLogprobs/fromOpenAILogprobs treat absent signals as graceful no-op; gate per-model via BENCHMARKS; never assume logprobs present.
• Scope creep into a "separate hallucination engine." → Every component is an EXTEND of a Verify-stage module; only new artifact is an append-only calibration JSONL reusing file-queue. SEP stays a flag-gated optional input.
• Privacy/log bloat. → Persist only the compact surpriseField; drop raw per-token bits before write; storage runtime-local.

Milestones

• M1 — Evidence gate. surprise_leak_ab.py run on real local + OpenAI logprobs; per-model AUROC in BENCHMARKS; go/no-go on which models open the valve; recalibration spec'd from measured numbers.
• M2 — Valve open end-to-end (dev). Logprobs captured; recalibrated uncertainty plumbed through stream-chat.js; modelUncertainty non-zero on local, no-op on Anthropic; canary tests green.
• M3 — User-facing dial. Calibrated confident-but-unanchored flag shown as a user-owned indicator, verified through the real chat UI on 4178; honest framing copy; calibration store appending.
• M4 — Calibration + convergence loop. Split-conformal fit running; coverage tracked; each event logged as ConvergenceRecord evidence; first precision/recall read; ship v1 to master.
• M5–6 — Beachhead + (optional) stronger signal. Package for the local-AI-coding-agent wedge; if raw surprise underperforms, prototype the local SEP hidden-state probe as a flag-gated second signal.

4. Direction— BetterSafe: verifiable, local-first AI for social services / high-stakes care

Thesis. Wrap HFF's BetterSafe schema + local-first architecture in the cite-or-abstain loop so every recommendation carries [claim, evidence, confidence, source] and ABSTAINS rather than guessing on a vulnerable person's case.

4a. Novelty — verdict after verification

Original headline (REFUTED): "AHEAD: the regulated wedge — EU AI Act / high-risk rules demand exactly this auditability + human oversight NOW; incumbents ship confident black boxes."

Corrected verdict: MIXED. Skeptics refuting "ahead":of 3. Two load-bearing pillars failed:

1. Timing. The EU Digital Omnibus (provisional, May 7, 2026) defers Annex III high-risk obligations from Aug 2,to Dec 2, 2027 (~16 months). Augkeeps only Art.transparency + GPAI. There is no imminent "demands exactly this NOW" hammer for social-services AI. [confidence 0.85, https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/]
2. "Incumbents ship confident black boxes" is too absolute. Salesforce Einstein Trust Layer already ships grounding + citations + data lineage + audit trails (parity on auditability), and explicitly evaluates abstention as a first-class trait "for trust-sensitive applications such as legal, financial, and healthcare domains." Cohere North ships grounded agentic AI on on-prem/air-gapped infra for govt/healthcare. Each of the three claimed moat axes (abstain, per-decision evidence, local-first) is individually covered by a shipped incumbent. Cite-or-abstain is even deployed in production: AVA (World Bank, arXiv 2604.17843) ran a 5-month deployment acrosscountries with mandatory source attribution + reasoned abstention. Per-decision evidence-to-legal-rule for benefits casework exists as a published artifact: the CalFresh/SNAP neuro-symbolic framework (arXiv 2512.12109) stores each rule with "citation": "MPP 63-409.111" and uses an SMT solver returning UNSAT to flag legally-unjustifiable explanations.

What survives (narrow edge): No single shipped product packages all of (a) cite-OR-ABSTAIN as default, (b) per-decision [claim, evidence, confidence, source], AND (c) local-first/on-prem sovereignty, specifically for vulnerable-person casework with consent-gated, signed determinations. We are genuinely AHEAD of the legacy black-box class — TennCare Connect (Deloitte, ~$400M) was ruled (Aug 2024) to have illegally denied thousands via wrong, unexplained determinations. [confidence 0.93, https://gizmodo.com/judge-rules-400-million-algorithmic-system-illegally-denied-thousands-of-peoples-medicaid-benefits-2000492529]

Completeness-critic corrections we adopt:

• The determination engine is a demo, not nearly-there. social_services.py._score_match is a fuzzy heuristic (match_score >= 2) with no rule citations, no per-rule {met|null}, no evidence trail. The legal-grade evaluator does not yet exist in any form. Copy must say so.
• Missing the legally load-bearing human path. SB24-205 / EU AI Act Art. 22-style rules require a human-in-the-loop appeal/override on consequential decisions. Abstain is necessary but not sufficient — we need a human-review/appeal workflow, an impact-assessment artifact generator, and an adverse-action-notice path. The first step optimizes the automated path and skips this.
• Map to named US-actionable obligations, not generic "EU AI Act": Colorado SB24-205 (covers essential government services), NIST AI RMF / ISO(compliance = rebuttable presumption of reasonable care — the actual affirmative defense), mandatory impact assessments + pre-adverse-action notice + right to human review.
• Name the govtech incumbents the thesis gestures at: Deloitte/Accenture state-benefits systems, Gainwell, Code for America (GetCalFresh), mRelief.

Competitor gap table

4b. Demand

Strength: Strong (because of one binding-NOW regulation, not the deferred EU hammer).

Segments. US behavioral-health / SUD treatment providers (bound byCFR Part 2, compliance due Feb 16, 2026); HIPAA-covered provider orgs (HIPAA named the single biggest blocker to production AI; on-prem/air-gapped is a recognized compliant pattern); EU/national public-sector benefits/healthcare-eligibility bodies (Annex III 5(a) + Art.FRIA; fines up to €15M / 3%); sovereignty-driven European public sector (EU sovereign-AI infra ~$5.1B in 2025; €180M sovereign-cloud framework; French state "Albert"); US state/local agencies (Texas HBeff. Jan 1, 2026; Colorado SB 26-189 ADMT eff. Jan 1, 2027); nonprofit human-services (82% use AI, 70% privacy-worried, but sub-$500K budgets → strong need, weak ability to pay).

Drivers. Privacy/data-residency is the binding driver today (HIPAA BAA;CFR Partsegmentation + consent-gating; GDPR). Agent reliability/verifiability is a quantified barrier (~32% cite quality as the #1 production barrier; buyers demand "audit-ready" AI that cites the exact source line + human review). Sovereignty/vendor independence (funded EU procurement). Cost is a contra-driver outside compliance-forced segments — cloud AI is $50–200/mo vs $2k–10k/mo self-hosted GPU — so local-first wins only where compliance overrides price.

Regulation (with citations).

Wedge. US SUD / behavioral-health providers. The single sharpest beachhead becauseCFR Part(binding Feb 2026) legally mandates record segmentation + consent verification + re-disclosure controls — requirements general cloud LLMs structurally cannot satisfy — making "verifiable + local-first" a compliance necessity, not a preference. It combines (1) a today-binding regulation, (2) genuine ability to pay, (3) acute OCR-enforcement exposure, and (4) demand for exactly our differentiators. Then expand to broader HIPAA healthcare, then EU public-sector as Annex III lands in Dec 2027.

4c. Design

Loop stage strengthened: VERIFY. Pure extension — no new memory system, no new agent ecosystem.

The chat verify pass (dream-chat.js verifyResponse) already extracts claims, grounds each into a [claim, evidence, confidence, source] record in data/convergence/records.jsonl (lib/convergence-records.js, schema-locked to src/convergence/objects.py::ConvergenceRecord), then lib/claim-draft.js::draftClaimsFromRecords bridges packet-worthy records into the consent-gate (lib/consent-gate.js): a validated lantern.claim_packet.v1 in draft status, inert until a human operator approves, at which point it is ed25519-signed and immutable. That is already cite-or-abstain + per-claim confidence + human override + cryptographic audit (the Art. 12/14 bundle) — but it only fires on free-text chat and does no domain reasoning about benefits rules.

The BetterSafe loop: Observe = intake profile + local social_services_registry. Remember = registry + each rule's authoritative citation (e.g. "MPP 63-409.111", "42 CFR Part 2") as the evidence corpus. Reason = a deterministic per-rule evaluator (extends _score_match) attaching the rule's citation. Verify (load-bearing) = a hard data/consent floor → abstain instead of a verdict + groundedness-canary scoring; an uncited recommendation is ungrounded → downgraded to abstain. Act = emit one ConvergenceRecord per determination, draft a claim packet for caseworker review/sign. Converge = the signed packet log is the FRIA/Art.trail; abstention + override rates are the metrics.

Honest positioning: MIXED/parity-leaning. We are AHEAD only of the legacy black-box class. Abstain defaults to "route to human caseworker," never to "deny."

Components

Data model. Four core objects by extension. Memory: social_services_registry becomes the rule/evidence corpus; each rule gains a REQUIRED rule_citation + authority_source (a rule with no citation is not usable evidence — this makes cite-or-abstain structural). Intake rows gain consent_verified, part2_segmented. Task: one screening = existing Task object. Tool: the rule evaluator is a Tool; each evaluation = ToolResult {outcome: met|not_met|insufficient}. ConvergenceRecord (spine): one per determination — hypothesis = the eligibility claim, evidence_ids = registry rule ids, result = determination (abstain is a first-class result value with source: insufficient_data|unverified_consent|no_authoritative_rule), confidence capped ≤0.85, source = the authoritative citation. Claim packet (audit artifact): each non-abstain determination drafts lantern.claim_packet.v1 in draft; caseworker approval ed25519-signs it → the FRIA/Art. 12-14 record. Abstentions are logged but never drafted as approvable recommendations.

Build sequence

Risks & mitigations

• Novelty is MIXED, not AHEAD (abstention, per-decision evidence, local-first each shipped by incumbents). → Position as an execution bundle; lead with the legacy black-box class we beat + theCFR Partforcing function, not novelty.
• Regulatory timing softened (EU Annex III → Dec 2027). → Anchor the beachhead onCFR Part+ HIPAA (binding now); treat EU AI Act as aexpansion lane.
• Wrong abstention calibration causes real harm (too-eager = denial of service; too-loose = the TennCare failure). → Abstain = "route to human," never "deny"; abstention can never terminate a benefit; tune from real override feedback; confidence hard-capped (health-journal MIN_N discipline).
• Rule corpus accuracy/freshness — a mis-cited rule makes a wrong answer look more trustworthy. → Require authority_source + last_updated; abstain on stale rules; never auto-scrape into the live evidence path without operator sign-off.
• Missing human-appeal path is itself a compliance gap. → Build the human-review/appeal + impact-assessment + adverse-action-notice path explicitly; do not ship abstain-only as "compliant."
• Scope creep into the dormant tkinter home-automation app (fridge/appliances/meals). → Build ONLY the casework/eligibility verify path on the web serving surface; leave tkinter modules dormant.

Milestones

• M1 — Cited rule evaluator + abstention floor. Per-rule {met|abstain} with required citation; casework_verify.py abstains below the data/consent floor; unit tests pin the boundary; missing inputs → ABSTAIN grid.
• M2 — Full verify-loop wiring. Schema-locked ConvergenceRecord + inert draft packet via consent-gate; canary forces abstain on any uncited recommendation; a confident-but-uncited claim is auto-downgraded.
• M3 — Caseworker review surface + human override. /api/bettersafe/screen serves the grid; approval ed25519-signs an immutable packet (Art.record) or returns it; council exec-verify catches non-reproducible determinations.
• M4 — SUD/behavioral-health beachhead. RealCFR Part+ state corpus; consent-unverified cases correctly abstain — the binding-NOW wedge.
• M5 — Convergence metrics + FRIA audit export. Abstention/override/citation-coverage metrics live; signed packet log exports as a tamper-evident Art. 12/FRIA bundle; pilot on anonymized data.

5. Direction— Self-improving autonomous coding that proves its own work

Thesis. The autowork loop (issue→research→plan→patch→test→draft-PR→council exec-verify) already grounds verdicts on real test runs. Frontier step: measurable self-improvement against an external benchmark (SWE-bench harness).

5a. Novelty — verdict after verification

Original headline (REFUTED): "PARITY-to-slightly-behind Devin/SWE-agent on raw capability, but AHEAD on verification-trail-per-change."

Corrected verdict: MIXED — and on the capability leg, currently behind, not parity. Skeptics refuting the headline:of 3 (the third confirmed MIXED outright; verify.survives = false).

• Capability leg — UNSUBSTANTIATED, not parity. Our own docs/BENCHMARKS.md (line 37) lists SWE-bench Lite as 🟡 Partial; the only measured number is Qwen single-shot 0/3 (2 applied-but-wrong); the agentic loop "landed" with no measured resolved%; SWE-bench Verified is 📋 Planned. Devin 2.0 measures ~45.8% Verified; the public board runs 77–95% (with contamination caveats); mini-swe-agent (~100 lines) >74%. You cannot claim parity on a mark you have never measured. [confidence 0.97 internal; 0.82 Devin, https://cognition.com/blog/devin-2]
• Provenance leg — at parity-at-best, not ahead. Verification trails are table stakes: Google Jules attaches test+lint output to every PR; Devin 2.2 self-verifies via computer-use with screen recordings and "logs every action for audit"; OpenHands records all actions/observations as immutable, deterministically-replayable events; SWE-agent ships trajectory logs + Docker grading. On the exact axis we lean on, the field is ahead: OpenFang/Hermes ship SHA-256 Merkle hash-chained tamper-evident logs, while our data/convergence/records.jsonl is plain mutable JSONL (grep prev_hash|merkle|sha256 =data/convergence/records.jsonlhits); src/convergence/objects.py::ConvergenceRecord.to_jsonl() (lines 183–199) emits plain JSON with no chain/signature. [confidence 0.85, https://github.com/NousResearch/hermes-agent/issues/487]
• The "frontier step" is already published. The Darwin Gödel Machine recursively self-improves a coding agent on SWE-bench (20%→50%) [confidence 0.9, https://arxiv.org/abs/2505.22954]; Absolute Zero / RLVR use execution-pass as verifiable reward.
• Strategy is sound, though. Raw SWE-bench Verified is increasingly discredited — OpenAI stopped reporting it (Feb 2026) over contamination; Rollout Cards shows reporting-rule changes alone swing scores 20.9pp. Leaning on provenance is the right bet — but it is not yet won.

Completeness-critic corrections we adopt:

• Drop "parity" from external copy until leaderboard.jsonl has a real resolved% row. The honest framing is "far behind on capability, betting on provenance."
• Provenance has incumbents we omitted: GitHub/CI attestations + SLSA provenance, Sigstore/cosign artifact signing, reproducible-build verification — all already give "a cryptographically verifiable trail per change." We must show why a hash-chained ConvergenceRecord composes with SLSA/Sigstore, or the moat is asserted.
• The abstention valve is installed-but-unspent: groundedness-canary.js fires only when opts.tokenSurprise != null, and the live runCanaries() at stream-chat.js:1199 passes no surprise — only test files do. The SURPRISE_ALPHA axis is never fed in production. (Same wire as Direction 2.)

Competitor gap table

5b. Demand

Strength: Strong.

Segments. Engineering/platform teams at regulated financial institutions (SR 11-7, EU AI Act Art. 14, MAS FEAT; BFSI = 27% of the AI-agent audit market in 2026); enterprise AI-governance owners (60% of large enterprises in production; budget stalls where they can run an agent but can't show the audit trail); DevSecOps / supply-chain security teams (SLSA/in-toto, signed provenance for agent code); healthcare/life-sciences software vendors (FDA SDLC docs); public-sector / govt contractors (NIST AI RMF-referencing RFPs).

Drivers. Agent-reliability/trust gap (~2/3 name security/risk as the #1 blocker; "can't tell outputs that look right from outputs that are actually right"). Regulatory forcing function (per-stage evidence artifacts). Auditability as a budget unlock ("most enterprises can stand up an agent… far fewer can show the audit trail — this gap is wherebudgets stall"). Supply-chain provenance. Independent-assurance economics ($0.6B in→ $23B in 2036, 44% CAGR). Risk of cancellation (Gartner: >40% of agentic projects canceled byover unclear value/risk controls).

Regulation (with citations).

Wedge. BFSI / regulated-fintech engineering teams (SR 11-7 + EU AI Act). Hardest, most explicit forcing function: every LLM/agent touching a credit/fraud/operational decision is already a "model" requiring validation evidence; code-gen must emit per-stage evidence artifacts. BFSI is the single largest segment (27% in 2026), has a compliance line item, and "proof not parity" maps 1:1 to artifacts auditors must produce. Make the verification trail (hypothesis→evidence→result→confidence, append-only) directly exportable as SR 11-7 / EU AI Act conformity evidence; then expand to healthcare/FDA and public-sector/NIST.

5c. Design

Loop stage strengthened: VERIFY → CONVERGE. Extension, not addition.

Today autowork (routes/convergence-dispatch.js) runs Observe(issue)→Remember(research)→Reason(plan)→Act(patch)→Verify(runTests + councilReview execVerdict via lib/council-review.js + lib/exec-verify.js), then writes an ungraded convergence record to data/convergence-autonomous-work.jsonl + data/agi-benchmark.jsonl. Two gaps, both real-but-unwon: (1) capability — never posted a measured SWE-bench resolved% (scripts/swe_agent_loop.py's own header says live wiring "is the next step"); (2) provenance — records.jsonl is plain mutable JSONL. The design closes both against the same loop: make SWE-bench the external terminal condition grading the Verify stage, and make the Converge stage emit a hash-chained, deterministically-replayable ConvergenceRecord series so resolved% delta over epochs is the measured self-improvement signal. The defensible seam we don't touch (execution-overrides-text council verdict + 4-way answerability gate + cross-language schema-locked record) stays as-is; we add a chain on top and a measured score under it. Self-improvement is defined operationally: resolved% on a frozen SWE-bench slice rises across record-chain epochs, with each gain traceable to a retrieved memory or plan change — living entirely inside the existing Memory + ConvergenceRecord objects.

Components

Data model. Extends the four core objects; no new top-level object. ConvergenceRecord gains prev_hash (record_hash of prior record, null for genesis) + record_hash (sha256 of canonical-JSON of all fields incl. prev_hash) → records.jsonl becomes a Merkle-style chain (any edit/reorder breaks every downstream hash); old records load as genesis (backward-compatible); schema stays cross-language-locked by tests/test_convergence_records.py. A SWE-bench Verify record = ConvergenceRecord with source='swebench:<dataset>@<slice_hash>', result={resolved, instance_id, attempts}, confidence grounded by test pass. An epoch record = Converge-stage record: result={resolved_pct, delta_vs_prev_epoch, n_instances, frozen_slice_hash}, evidence_ids → the Memory entries that differed (so a gain is traceable, not asserted). leaderboard.jsonl rows gain chain_head, binding score to chain state. The idempotent confidence fold (verify.py _evidence_hash) prevents a replayed pass from ratcheting confidence to 1.0.

Build sequence

Risks & mitigations

• SWE-bench Verified partly discredited (OpenAI abandoned it Febover ~60% broken tests + contamination). → Lead with the provenance story; treat resolved% as a secondary anchor on a frozen, slice-hashed subset where the delta-over-epochs (not the absolute number) is the claim; cross-check on Lite.
• WSL2/Docker grading is heavy/flaky on Windows. → Keep a small frozen slice always-on; reserve full runs for milestones; use grade-later mode (predict, then --grade separately).
• Hash-chaining a hot append-only log races on the chain head. → Compute prev_hash inside the existing appendJsonlQueued single-writer serialization (per file-queue.js); read the head at enqueue-dequeue, not by callers; add the CI chain-integrity check.
• Self-improvement could be illusory (overfitting the frozen slice). → Require every epoch gain to cite the specific Memory/plan evidence_ids that changed; hold out a rotating unseen slice; keep the idempotent confidence fold.
• Scope creep into a "self-improvement engine" subsystem. → Every component is status=extend; self-improvement is a delta over the existing ConvergenceRecord chain — no new top-level object or engine.

Milestones

• M1 — MEASURED BASELINE. Live-wire the loop; run a frozen 10–30 instance Lite slice end-to-end in WSL2/Docker; post the first real resolved% to leaderboard.jsonl; flip BENCHMARKS.md to ✅. The "unmeasured/behind" leg becomes a real number.
• M2 — TAMPER-EVIDENT CHAIN. prev_hash/record_hash in JS + Python with locked cross-language tests; chain verifier + replay; CI chain-integrity gate. Closes the provenance leg vs OpenFang/Hermes/OpenHands.
• M3 — ONE STREAM + ABSTENTION. Bridge autowork Converge into the canonical chained stream; open the surprise-leak valve so low-confidence patches abstain instead of opening bad PRs.
• M4 — MEASURED SELF-IMPROVEMENT. Persist refuted-instance failures as retrievable Memory; run epoch N+1; emit an epoch Converge record showing a resolved% delta traceable to the changed retrieval/plan.
• M5–6 — REGULATED-WEDGE EXPORT + VERIFIED SCALE. Ship the SR 11-7 / EU AI Act conformity export over the chained series; scale the frozen slice toward SWE-bench Verified with a posted measured number.

6. Cross-cutting: shared infrastructure, sequencing, and the "do NOT build" list

Shared infrastructure (build once, reuse across directions)

1. Hash-chained ConvergenceRecord is the single most reused primitive. Directionsrc/convergence/objects.pyneeds it (provenance leg); Direction 1's SealRecord and Direction 3's signed claim packets compose with it. Build prev_hash/record_hash once in lib/convergence-records.js + src/convergence/objects.py, schema-locked by tests/test_convergence_records.py, and all four directions inherit tamper-evidence.
2. The Ed25519 + Merkle integrity engine (src/hff-api/cryptographic_proof.py) is shared by Direction(sealer/verifier) and Direction(consent-gate signing). Promote it out of hff-api isolation first.
3. External anchoring (RFC-3161 / CT-style Merkle-root publication) is the real moat for Directionand strengthens Direction 4's conformity export. Build it once as a generic anchor service over any record-chain head.
4. The surprise-leak valve (stream-chat.js:1213/:1199) is literally the same wire for Direction(user dial) and Direction(patch abstention). Open it once; both consume it.
5. The cite-or-abstain / consent-gate / claim-packet stack is shared by Direction(casework) and the chat verify pass it already serves.

Sequencing — what unblocks what

[Promote cryptographic_proof.py to shared]  ──┬──► Direction 1 (Vault sealer/verifier)

                                              └──► Direction 3 (consent-gate signing already uses ed25519)



[Hash-chain ConvergenceRecord once]  ──┬──► Direction 4 (provenance leg)

                                       ├──► Direction 1 (SealRecord composes)

                                       └──► Direction 3 (signed claim packets)



[Run surprise_leak_ab.py — kill-switch gate]  ──► gates BOTH Direction 2 and Direction 4's abstention valve

   (if perplexity ~chance on our models, DO NOT open the valve in either direction)



[External anchoring service]  ──┬──► Direction 1 moat (RFC-3161 / CT)

                                └──► Direction 4 conformity export credibility



[SWE-bench measured baseline (Direction 4 M1)]  ──► unblocks ALL "self-improving" claims

   (no measured resolved% = no honest capability claim anywhere)

Recommended global order: (1) run the surprise AB harness (cheap, gates two directions); (2) hash-chain the record stream (one change, four beneficiaries); (3) promote the crypto engine; (4) post the SWE-bench baseline; (5) build external anchoring; then fan out into the per-direction product surfaces.

Honest "do NOT build" list

• Do NOT publish any "category of one," "ahead," or "parity on capability" copy. All four headlines were refuted (2–3/3). Public copy must use the corrected verdicts (parity/mixed + narrow execution edge).
• Do NOT build a separate dream engine, memory system, agent ecosystem, or "self-improvement engine." Every direction is a VERIFY/CONVERGE-stage extension of the one loop. (Σ₀ constraint.)
• Do NOT build Shamir escrow / dead-man switch / TPM sealing / BFT consensus for the Vault's 6-month version — defer explicitly in the doctrine.
• **Do NOT claim tamper-proof.** Only "local tamper-evidence," and only with external anchoring for any third-party-verifiable claim.
• Do NOT sell the surprise canary as general "hallucination detection." Scope it to degeneration/anchoring; state it does NOT catch fluent factual hallucination unless a semantic-entropy axis is added.
• Do NOT revive the dormant tkinter BetterSafe home-automation modules (fridge/appliances/meals). Build only the casework verify path.
• Do NOT ship abstain-only BetterSafe as "compliant." The human-review/appeal + impact-assessment + adverse-action-notice paths are legally load-bearing and currently missing.
• Do NOT bet the BetterSafe roadmap on an imminent EU hammer (deferred to Dec 2027). Anchor onCFR Part(Feb 2026).
• Do NOT ship the degenerate tailMass field. Recalibrate to mean/p90 + split-conformal first.

7. Appendix — Open questions / unverified claims

The completeness critic flagged the following. None should appear in customer-facing copy until resolved.

Missing competitors the analysis must still quantify before any comparative claim ships: C2PA / Content Authenticity Initiative (Vault); Sigstore/cosign + SLSA (coding provenance); RFC+ CT-style transparency logs (Vault durability); semantic-entropy + HALT/EPR/SelfDoubt (Canary SOTA); Cleanlab TLM / Patronus Lynx / Galileo / Vectara HHEM / NeMo Guardrails / Deepchecks (Canary "shipped products"); MemGPT/Letta, MemOS, Mem0 LongMemEval/PersonaMem numbers (which we have not measured against — docs/BENCHMARKS.md shows LongMemEval still 🟡 synthetic-only); GLM-5.2 (~62% Verified) / Qwen3-Coder-Next / OpenHands / Aider (coding capability baselines); Deloitte/Accenture / Gainwell / Code for America (GetCalFresh) / mRelief (BetterSafe govtech incumbents).