SOVEREIGN OPERATIONAL AI
Built for environments where failure has consequence.
Evaluation-first AI systems, built to run where they are deployed — on-prem, air-gapped, log-verified. This page makes no external request. The object in this frame is the canonical mark itself, accumulating live from the public manifest — not a picture of it.
THE DESCENT — CLAIM → DEFINITION → ARCHITECTURE → MEASUREMENT → CONTROLLED → ACCESS → FLOOR
24°41′N 46°43′E · UTC+3 · RIYADH, KSA
STRATUM 01 · DEFINITION · MODE EXPLORE · AUTHORITY PUBLIC
At the surface, failure is one word. It is not one thing.
INVALID OUTPUTOutput that violates the constraints of its target domain — geometry, schema, or policy.
UNAUTHORIZED ACTIONAn action taken without a deciding rule that admits it.
UNTRACEABLE DECISIONAn output whose causal path cannot be reproduced from records.
EXTERNAL DEPENDENCYCorrectness contingent on infrastructure outside the deployment boundary.
STALE STATEA decision made against a state of the world that no longer holds.
STRATUM 02 · ARCHITECTURE · MODE INSPECT · SYSTEMS 06 INDEXED · 02 DISCLOSED
Each failure mode acquires a governing mechanism.
INVALID OUTPUT→CONSTRAINED GENERATIONCYTHERCAD · DISCLOSED
UNAUTHORIZED ACTION→DETERMINISTIC ADMISSIONINDEXED · ENTRY 005 · NOT DISCLOSED
UNTRACEABLE DECISION→EXECUTION RECEIPTINDEXED · ENTRY 004 · NOT DISCLOSED
EXTERNAL DEPENDENCY→LOCAL RUNTIME BOUNDARYSIJILOS · DISCLOSED
STALE STATE→EXPLICIT FRESHNESS STATESIJILOS · DISCLOSED
CAD-2024-001 · TECHNICAL VALIDATION
CytherCAD — Controlled Generative CAD
Production-validated · Log + external benchmark · On-prem · Private
KEY OUTCOME
IR 0.00% vs 10.00% (DeepCAD) · Text2CAD-192
SIJ-2025-001 · DEPLOYMENT OPERATIONAL
SijilOS — Event-Sourced Ledger Engine
ZATCA Phase 1 · Kingdom of Saudi Arabia · Certified compliant, April 2025 · Live beta · 2 production environments
KEY OUTCOME
Zero core cloud dependency · Full offline operation
MODELLOCAL
POLICYLOCAL
STATELOCAL
VERIFICATIONLOCAL
RECORDLOCAL
REQUIRED CLOUDNONE
BOUNDARY INSTRUMENT · LIVE · SEED 01 · DETERMINISTIC
A deliberately hostile proposer streams arbitrary tokens at the constraint boundary — junk symbols, wrong axis, out-of-range arguments, premature closure. The boundary admits token by token; an independent kernel re-verifies every program before emission. Nothing inadmissible is ever emitted: validity is a property of the boundary, not the proposer. Same seed, same stream, same admissions — on every machine.
— proposer idle —
PROPOSED 0 · REJECTED 0 · DISCARDED 0 · ADMITTED 0 · INVALID EMITTED 0
STRATUM 03 · MEASUREMENT · MODE VERIFY · CYTHERCAD v1.1 · TEXT2CAD-192
Numbers with their conditions attached.
● LOG-VERIFIED
◌ EXT-VALIDATED
— NOT DISCLOSED
| METRIC | CYTHER | DEEPCAD | T2CAD† |
|---|---|---|---|
| ◌Invalid Rate (↓ better) | 0.00% | 10.00% | 0.93% |
| ●GVR · Constrained Beam (n=100) | 100% | — | — |
| ●GVR · Completion (n=100) | 100% | — | — |
| ●Dimensional Accuracy ±3mm (n=35) | 99% | — | — |
| ●Dimensional Accuracy ±5mm (n=35) | 97% | — | — |
| ●Multi-Op Accuracy · Encoder (n=35) | 91% | — | — |
METHODOLOGYAutoregressive generation · constrained decoding · kernel-backed geometric verification
TEST ENVIRONMENTAir-gapped · No external calls · Apple Silicon M4 · Local inference only
BENCHMARK SOURCEText2CAD-192 · External · Published · Not operated by CytherAI
EVALUATED BYCytherAI internal evaluation · April 2026 · Log-verified
CONTROLLED RECORDS03 · structure indexed · values sealed
† Text2CAD-192 (T2CAD): 0.93% invalid rate. ↩
External benchmark; evaluation not conducted or curated by CytherAI.
PUBLIC RECORD TERMINATES HERE
Beyond this line: the existence, reference class, and access conditions of controlled information. Nothing secret is shown by crossing — the index becomes legible, not its contents.
BOUNDARY — CLOSED · SCROLLING PAST REMAINS FREE
STRATUM 04 · CONTROLLED · MODE REQUEST · AUTHORITY NONE GRANTED
CONTENT — SEALED PENDING ACCESS GRANT
REFERENCE — NTP-2025-001 · APPENDIX ENTRY 003
REQUIREMENT — VERIFIED CONTEXT · NDA · IDENTITY CONFIRMATION
REFERENCE — NTP-2025-001 · APPENDIX ENTRY 003
REQUIREMENT — VERIFIED CONTEXT · NDA · IDENTITY CONFIRMATION
INDEX NOT OPENED — THE BOUNDARY ABOVE IS CLOSED
Visible only at depth. Legible only across the boundary. Readable only with clearance.
Request Clearance
CLEARANCE · THREE PATHS DEEPER
Selective about what gets built. Thorough about how it gets built.
PATH 1 · OPEN
Public materials
This page and everything visible on the way down. Disclosed without qualification.
OPEN ACCESS · NO QUALIFICATION
PATH 2 · QUALIFIED
Capability review
Full validation records, the controlled strata, and a working session with the systems — under NDA and identity confirmation.
NDA · IDENTITY CONFIRMATION
Request NDA Briefing
PATH 3 · CONTROLLED
Technical diligence
Architecture, logs, and evaluation harnesses opened for inspection inside a controlled review window.
SCOPED WINDOW · SUPERVISED
Request Diligence Window
FLOOR · THE GOVERNING LAW · MODE AUDIT
The surface states.
Depth conditions.
Records substantiate.
Boundaries govern.
The reader is a record.
Nothing is stated that is not checked.
Depth conditions.
Records substantiate.
Boundaries govern.
The reader is a record.
Nothing is stated that is not checked.
EPOCHAL RECORD — SUPERSEDED, NEVER ERASED
Each prior mark remains derivable from its manifest. The record supersedes; it does not delete. Identity is the chain, not the tip. A commitment's precedence is provable only against an external anchor — repository history, a transparency log. The page renders the commitment; it does not notarize it.
STANDING CLAIMS — PREDICATES THE PAGE EXECUTES AGAINST ITSELF
PUBLIC MANIFEST — THE STATE THIS PAGE WAS DERIVED FROM
DEVELOPMENT RECEIPT — THE TERMINAL STATES THIS PAGE DEVELOPED
Each plate's terminal state is named by a checkpoint hash over its deposited field. For one world in one frame there is one development sequence and one terminal state: REDEVELOP replays it, and the next receipt is compared to this one here. A plate that stops at its iteration ceiling instead of its deposit target is printed as a fuse, not as a result.
PROVENANCE — CHAIN OF RECORD
OBLIGATIONS — WHAT THIS PAGE OWES · WHO MAY ESTABLISH IT · NO VERDICT ASSERTED HERE
CY-SEM-001 · SEMANTIC · MANDATORYDERIVED_FROM
OWED — for the current canonical record and rendered homepage: rendered canonical mark and printed state checksum DERIVED_FROM js/manifest.js canonical manifest state
WHEN — homepage reaches a settled canonical state
MAY BE ESTABLISHED BY — PURE_RUNTIME_HARNESS · BROWSER_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-SEM-002 · SEMANTIC · MANDATORYREPRODUCIBLE_FROM
OWED — for every published epoch in the current manifest: current and superseded published marks REPRODUCIBLE_FROM their published manifests and nonces
WHEN — published admissions are verified
MAY BE ESTABLISHED BY — PURE_RUNTIME_HARNESS · BROWSER_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-SEM-003 · SEMANTIC · MANDATORYDISTINGUISHABLE
OWED — for each declared sample of reading element, depth, viewport and optics mode: rendered reading ink DISTINGUISHABLE the ground actually composited beneath it — plate, envelope and panel material included
WHEN — the homepage settles at a sampled depth and the plate has developed
MAY BE ESTABLISHED BY — BROWSER_HARNESS · coverage SAMPLED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-EPI-001 · EPISTEMIC · MANDATORYDISCLOSED_AS
OWED — for the tested ledger transmission state: reader ledger DISCLOSED_AS READING SELF-REPORT
WHEN — a reader ledger is attached to a mail action
MAY BE ESTABLISHED BY — STATIC_ANALYZER · PURE_RUNTIME_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-EPI-002 · EPISTEMIC · MANDATORYAUTHORITY_NOT_ELEVATED
OWED — for the tested ledger transmission state: reader self-report AUTHORITY_NOT_ELEVATED independently verifiable evidence
WHEN — self-reported reading acts are transmitted
MAY BE ESTABLISHED BY — STATIC_ANALYZER · PURE_RUNTIME_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-EPI-003 · EPISTEMIC · MANDATORYFAILURE_REMAINS_VISIBLE
OWED — for the forced-invalid regression trace: standing invalid claim state FAILURE_REMAINS_VISIBLE claim row and aggregate footer status
WHEN — one standing claim is invalid and another claim is recomputed
MAY BE ESTABLISHED BY — PURE_RUNTIME_HARNESS · MODEL_CHECKER · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-ART-001 · ARTIFACT · MANDATORYDERIVED_FROM
OWED — for every file in the current release artifact: 27-file dist artifact DERIVED_FROM explicit tracked-source allowlist with matching integrity identities
WHEN — the release artifact is constructed
MAY BE ESTABLISHED BY — ARTIFACT_VERIFIER · coverage EXHAUSTIVE
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-GEO-001 · GEOMETRY · MANDATORYNON_OCCLUDING
OWED — for every declared mobile viewport at terminal scroll: persistent bottom instrument NON_OCCLUDING required footer record and links
WHEN — the persistent instrument and footer are simultaneously present
MAY BE ESTABLISHED BY — BROWSER_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-GEO-002 · GEOMETRY · MANDATORYWITHIN_VIEWPORT
OWED — for every required persistent-instrument control in every declared mobile viewport: required persistent-instrument controls WITHIN_VIEWPORT visual viewport
WHEN — mobile persistent controls are rendered
MAY BE ESTABLISHED BY — BROWSER_HARNESS · ACCESSIBILITY_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-GEO-003 · GEOMETRY · MANDATORYMIN_TARGET
OWED — for every required persistent-instrument control in every declared mobile viewport: required persistent-instrument controls MIN_TARGET two-dimensional rendered hit box
WHEN — mobile persistent controls are rendered
MAY BE ESTABLISHED BY — BROWSER_HARNESS · ACCESSIBILITY_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-STATE-001 · STATE · MANDATORYUNCHANGED_UNDER
OWED — for the declared same-width, same-DPR height-change trace: canonical world backing state UNCHANGED_UNDER observer-height-only geometry change
WHEN — observer height changes while width and effective DPR remain fixed
MAY BE ESTABLISHED BY — BROWSER_HARNESS · MODEL_CHECKER · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-STATE-002 · RELATIONAL · MANDATORYDISTINGUISHABLE
OWED — for the declared canonical-to-fork interaction trace: canonical and visitor-fork states DISTINGUISHABLE rendered status, controls, and canonical provenance
WHEN — visitor fork mode becomes active
MAY BE ESTABLISHED BY — BROWSER_HARNESS · HUMAN_PERCEPTUAL_EVALUATOR · ASSISTIVE_TECH_REVIEW · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-STATE-003 · RELATIONAL · MANDATORYPERSISTENT
OWED — for the declared fork-and-reset interaction trace: canonical state recoverability PERSISTENT visitor fork and reset sequence
WHEN — visitor enters a local fork
MAY BE ESTABLISHED BY — BROWSER_HARNESS · MODEL_CHECKER · ASSISTIVE_TECH_REVIEW · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-TOP-001 · TOPOLOGICAL · MANDATORYREACHABLE_WITHIN
OWED — for every one of the ten standing claim rows: standing claim REACHABLE_WITHIN its governing method, value, and computation evidence
WHEN — a claim is visible
MAY BE ESTABLISHED BY — BROWSER_HARNESS · ACCESSIBILITY_HARNESS · ASSISTIVE_TECH_REVIEW · MODEL_CHECKER · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-TOP-002 · TOPOLOGICAL · MANDATORYORDERED
OWED — for the declared initial-to-fork trace: canonical encounter ORDERED visitor-fork encounter
WHEN — homepage boot followed by a fork action
MAY BE ESTABLISHED BY — BROWSER_HARNESS · MODEL_CHECKER · ASSISTIVE_TECH_REVIEW · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-TEMP-001 · TEMPORAL · MANDATORYQUIESCENT_WHEN
OWED — for every settled visual subsystem in the declared runtime profile: visual and computational runtime QUIESCENT_WHEN state derivative equals zero
WHEN — observer and interaction state stop changing
MAY BE ESTABLISHED BY — PERFORMANCE_HARNESS · BROWSER_HARNESS · HUMAN_PERCEPTUAL_EVALUATOR · coverage BOUNDED · HUMAN_REVIEWED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-TEMP-002 · TEMPORAL · MANDATORYTRANSITION_CORRESPONDS_TO
OWED — for each declared semantic state transition: visual motion TRANSITION_CORRESPONDS_TO the governing system-state transition
WHEN — a system state transition produces visual motion
MAY BE ESTABLISHED BY — BROWSER_HARNESS · HUMAN_PERCEPTUAL_EVALUATOR · coverage HUMAN_REVIEWED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-RES-001 · RESOURCE · MANDATORYBOUNDED_BY
OWED — for each declared capability profile: plate realization BOUNDED_BY selected resource profile beta
WHEN — plate realization policy is selected
MAY BE ESTABLISHED BY — STATIC_ANALYZER · PURE_RUNTIME_HARNESS · BROWSER_HARNESS · PERFORMANCE_HARNESS · coverage BOUNDED
IF UNPAID — PROJECTION INVALID
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
CY-ORIGIN-001 · ORIGIN · RELEASE MANDATORYORIGIN_MATCHES
OWED — for every route, asset, redirect, protocol, and runtime obligation in the release closure at observation time: time-indexed production origin snapshot ORIGIN_MATCHES certified artifact and origin contract
WHEN — a production origin is proposed for release certification
MAY BE ESTABLISHED BY — ORIGIN_HARNESS · coverage EXHAUSTIVE
IF UNPAID — RELEASE NOT CERTIFIED
THIS ARTIFACT — OBLIGATION DISCLOSED · VERDICT NOT ASSERTED HERE
An obligation is what the page owes; a receipt is an observation that it paid, bound to the build observed. A receipt for this build cannot be inside this build, so none is printed here: the verdicts — PASS, FAIL, NOT_EVALUATED — are established outside the artifact by the evaluators each obligation names, and missing or stale evidence is NOT_EVALUATED, never a score. The standing claims above are the subset the page can execute against itself; CY-SEM-003 is the one CL-06 says it cannot.
NOT CLAIMED — THE BOUNDARY OF THE RECORD, DRAWN BY ITS AUTHOR
The fastest calibration of a vendor is the boundary of its claims. Drawn here, and included in the canonical checksum.
One object, one world. The mark is not framed on this page — this page is inside it. Four pre-rendered exposures of the canonical orbit are the background; scroll is the observation function, moving a derived camera from far-field into the filament core. The camera anchors are the orbit's densest cells, chosen by digest: the journey through the mark is derivation, not decoration.
The mark is derived, not designed. Its four parameters are digests of the public manifest below — systems, validation index, revision, and the count of sealed references. When the disclosed state changes, the canonical form changes deterministically. Your drag forks a local variant; the canonical state is always recoverable, and a link reproduces any form exactly.
Closed causality. No webfonts, no CDNs, no images, no external calls. Everything visible was present at initialization or derived locally from your interaction. Open the network tab — the artifact is sealed, and CL-01 observes it.
One loop, and it sleeps. The weight-field on the thesis, the weight waves on the system titles, the world's fork re-development, and the boundary proposer share a single frame loop that stops completely at rest.
Two records, facing each other. The manifest derives; the reading self-reports. They are not the same kind of record, and the page says so: the reading attests your descent to you, not to anyone else, and travels only by your explicit act. Standing claims run as predicates against the page itself; a hostile proposer demonstrates the boundary live; the record's own boundary is drawn in NOT CLAIMED. The page states nothing it cannot check.