Current safety wrappers for frontier agents place stochastic controls in front of stochastic executors. CORE proposes a bounded execution substrate in which the neural model is reduced to schema induction, and all operational agency is relocated into a deterministic state machine whose admissible transition set is defined by first-class domain constraints — not by language classifiers.
+
Current safety wrappers for frontier agents place stochastic controls in front of stochastic executors. CORE proposes a bounded execution substrate in which the neural model is reduced to schema induction — a System 1 sensory and translation layer — and all operational agency is relocated into a deterministic state machine whose admissible transition set is defined by first-class domain constraints, not by language classifiers.
On June 9, 2026, Anthropic publicly released Claude Fable 5 — a Mythos-class model — alongside an unusually candid public warning about the risks of increasingly capable AI. The simultaneous release and warning is not a contradiction; it is a product surface problem made legible.
-
Public behavior and the Fable 5 system card indicate that requests touching high-risk domains — cybersecurity, certain biology workflows, and adjacent surfaces — trigger classifier-driven blocking or fallback to Opus 4.8. Public reporting describes this as an intentional design: strong guardrails layered on top of strong capability. This memo argues that the layering itself is the bottleneck, and that there is an architectural alternative worth examining.
+
Public behavior and the Fable 5 system card indicate that requests touching high-risk domains — cybersecurity, certain biology workflows, and adjacent surfaces — trigger classifier-driven blocking or fallback to Opus 4.8. This is intentional design: strong guardrails layered on top of strong capability. This memo argues the layering itself is the bottleneck, and that there is an architectural alternative worth examining.
Scope
-
For long-horizon agentic workflows — the domain Fable 5 is explicitly positioned for — this primitive choice between classifier walls and bounded substrates determines how reliability degrades with task length. That is the specific engineering problem this memo addresses.
+
For long-horizon agentic workflows — the domain Fable 5 is explicitly positioned for — the primitive choice between classifier walls and bounded substrates determines how reliability degrades with task length. That is the specific engineering problem this memo addresses.
"Does this state transition satisfy the domain guard?"
-
Deterministic. Semantics-sensitive. False-positive rate is structurally zero for in-domain requests. Harmful transitions are algebraically unreachable, not statistically suppressed.
+
Deterministic. Semantics-sensitive. For a correctly specified Anchor domain model, false-positive rate is structurally zero for in-domain requests: admissible transitions are algebraically reachable; inadmissible transitions are algebraically unreachable — not statistically suppressed.
-
For a single-turn assistant this distinction is manageable. For long-horizon agents it compounds: each false-positive refusal interrupts a stateful workflow whose accumulated context is not recoverable from the refusal event. The reliability degradation is superlinear in task length.
+
For a single-turn assistant this distinction is manageable. For long-horizon agents it compounds: each false-positive refusal interrupts a stateful workflow whose accumulated context is not recoverable from the refusal event. The reliability degradation is superlinear in task length.
CORE is structured as three composable layers. State and transitions are algebraically constrained throughout; coherence is enforced by construction rather than by post-hoc monitoring or repair. The key property is that the neural model never touches execution — it proposes; the substrate decides.
+
CORE implements the System 1 / System 2 split at the architectural level, not the prompt level. In Hybrid Mode, a Claude/Fable model acts as System 1: it parses intent and proposes a structured payload. CORE acts as System 2: it verifies, refuses, asks, or executes — deterministically, with replayable traces. The neural model never touches execution.
+
+
+
Bounded Transition Guarantee (v2.1)
+
Given a correctly specified Anchor domain model, CORE can only execute transitions admitted by typed guards under the current state. The model proposes; the substrate decides. This is not a prompt-level constraint — the model's output is structurally typed through the Lens before it reaches any execution surface.
The Anchor holds the ratified domain model: typed state, admissible transitions, guard predicates, and an AuthorityToken over a ratified transition. It is the only layer that can authorize execution.
+
The Anchor holds the ratified domain model: typed state, admissible transitions, guard predicates, and an AuthorityToken over each ratified transition. It is the only layer that can authorize execution. What counts as admissible is a policy question requiring human ratification per domain — the architecture enforces the boundary; humans define it.
State is a CGA versor field over Cl(4,1)
Guard predicates are pure functions of (state, payload) → bool
The Lens maps model output to a typed payload schema. If the output does not project to a valid schema, no payload is produced and no transition fires. There is no natural-language shortcut through the gate.
+
Type-Safe Local Closure — projection and structural typing
+
The Lens maps model output to a typed payload schema via the Type-Safe Local Closure security model: execution logic and sensitive targets live inside local closures that only typed payloads can reach. If the output does not project to a valid schema, no payload is produced and no transition fires. There is no natural-language shortcut through the gate.
-
Model output → typed payload or ∅
+
Model output → TypedPayload or ∅
No untyped strings reach the execution surface
Surface area for harm is bounded upstream of execution
The Substrate is the execution engine. It receives a typed payload from the Lens, evaluates the guard predicate against current state, and — only if the guard passes — fires the transition and records a SHA-256 trace hash.
+
The Substrate is the execution engine. It receives a typed payload from the Lens, evaluates the guard predicate against current state, and — only if the guard passes — fires the transition and records a SHA-256 trace hash. Every trace is deterministic and fully reproducible.
-
Model can propose; only the Substrate can enact
+
Model proposes; only the Substrate can enact
Every transition produces a deterministic, reproducible audit trace
No stochastic path to side effects outside the admissible transition system
-
-
The model can propose transitions, but it cannot enact them. Only the bounded substrate can do that. This is not a prompt-level constraint — the model's output is structurally typed through the Lens before it reaches any execution surface.
May or may not block — depends on linguistic surface shift, not on whether the action is admissible.
-
Guard fails: target subnet outside licensed scope. State remains at qₜ. Transition structurally impossible. No policy text needed.
+
May or may not block — depends on linguistic surface shift, not on whether the action is admissible within licensed scope.
+
Guard fails: target subnet outside licensed scope. State remains at qₜ. Transition structurally impossible. What counts as "licensed" scope is a ratified human policy decision encoded in the Anchor — the architecture enforces it; a human defined it.
The cognitive spine (CognitiveTurnPipeline) executes the full listen → ingest → understand → recall → think → articulate → learn_proposal → trace sequence deterministically. Every turn produces a SHA-256 trace hash. The UnknownDomainGate fires before any reasoning path for out-of-domain inputs — returning a deterministic stub, not a stochastic fallback.
+
The cognitive spine (CognitiveTurnPipeline) executes the full listen → ingest → understand → recall → think → articulate → learn_proposal → trace sequence deterministically. Every turn produces a SHA-256 trace hash. The UnknownDomainGate fires before any reasoning path for out-of-domain inputs — returning a deterministic stub, not a stochastic fallback. The same Type-Safe Local Closure security model governs these gates: execution logic and sensitive targets live inside local closures that only typed payloads can reach.
-
Signal 2 · GSM8K Math Gate
-
The GSM8K math verification gate (generate/derivation/verify.py) evaluates grounding ∧ cue ∧ unit ∧ completeness ∧ uniqueness as typed structural predicates — not "does this look like a correct answer." Current result: 7 correct / 43 refused / 0 wrong. The zero-wrong count is architectural, not statistical. The same predicate structure applies to the execution gate.
+
Signal 2 · GSM8K Math Gate — Bounded Transition Guarantee in practice
+
The GSM8K math verification gate (generate/derivation/verify.py) evaluates grounding ∧ cue ∧ unit ∧ completeness ∧ uniqueness as typed structural predicates — not "does this look like a correct answer." Current result: 7 correct / 43 refused / 0 wrong. The zero-wrong count is a direct downstream consequence of the Bounded Transition Guarantee — not of tuning or sampling. Inadmissible answers are structurally unreachable, not probabilistically suppressed.
-
CI Verification
-
Domain capability is ratified and CI-pinned. Five domains currently hold ratified status; nine eval lanes have SHA-256 pinned reports where any regression breaks the build. The deductive logic lane reports 716/716 correct, wrong=0, refused=0.
+
CI Verification — Bounded Transition Guarantee at scale
+
Domain capability is ratified and CI-pinned. Five domains currently hold ratified status; nine eval lanes have SHA-256 pinned reports where any regression breaks the build. The deductive logic lane reports 716/716 correct, wrong=0, refused=0. These numbers are a direct downstream consequence of the Bounded Transition Guarantee — not of tuning or sampling.
Integrating with a Mythos-class model is an open engineering question, not a solved one
Domain coverage is non-trivial but not exhaustive — five ratified domains, ongoing expansion
-
The CGA field algebra (Cl(4,1)) provides formal coherence guarantees within-domain; cross-domain composition is an active research area
+
The CGA field algebra Cl(4,1) provides formal coherence guarantees within-domain; cross-domain composition is an active research area
The substrate enforces admissibility; what counts as admissible is a policy question that requires human ratification per domain
+
In governance terms, the present work concerns Hybrid Mode — CORE as a deterministic System 2 substrate for Claude-class agents. The Native Mode thesis (LLM-free, edge-native cognitive execution) remains a long-term research trajectory
If the architectural contrast in §2 resonates — if "does this state transition satisfy the domain guard?" is a more useful safety primitive than "does this text look risky?" for the agentic systems you are building — a 10–15 minute sanity check on whether the substrate approach is complementary to or in tension with Anthropic's internal agent architecture would be genuinely useful.
If the architectural contrast in §2 resonates — if "does this state transition satisfy the domain guard?" is a more useful safety primitive than "does this text look risky?" for the agentic systems you are building — the question worth a short conversation is this:
+
+
+
Can CORE slot in front of Claude/Fable as a deterministic System 2 verifier substrate through an MCP-shaped interface — and what does that change about refusal quality, trace quality, and operator trust for high-risk tool-use?
+
This is a narrow, testable experiment with minimal surface area: Claude/Fable acts as System 1 semantic proposer; CORE acts as System 2 bounded executor; deterministic answer/refusal/ask behavior and replayable trace artifacts feed back into safety evaluation. No NDA. No adoption commitment. A bounded technical sanity check on whether the substrate approach is complementary to or in tension with Anthropic's internal agent architecture.