Signal from noise.
Truth before action.
PSZN routes a request, scores its truth across independent models, gates it behind human consent, and emits a tamper-evident record — before anything runs. The scoring core is model-free, so it works over the models you can actually own and run on-prem.
Frontier models made most governance free.
Two layers they structurally won't build remain.
Sandboxing, approval prompts, and agent-on-agent review now ship inside every major model. A trust layer that overrules the model, and stays neutral across vendors, is not something a model vendor is incentivized to build. That is the ground PSZN stands on.
Deterministic verification with evidence, before approval — and a portable evidence ledger binding "done" to proof.
No model vendor will make verification external, deterministic, and cross-vendor: it reduces the perceived value of their own model and asks them to audit competitors. That gap is durable.
The scoring core calls no model
Claim extraction, clustering, consensus, and divergence are pure algorithm. The engine is indifferent to whether answers came from a frontier API or a local open-weight model — which is what makes on-prem verification real.
Verify → consent → prove
Every consequential action is scored, gated behind an out-of-band human or delegated sign-off, and written to a record that the author cannot forge. Fail closed, always.
01PSZN — a model-free consensus & divergence engine
PSZN polls independent models in isolation, decomposes their answers into atomic claims, clusters agreement across models, and scores signal against divergence. Every stage after generation is deterministic — no model sits in judgment of another.
Parallel polling
Query N models concurrently. Prompts are sanitized so no model can reference or anticipate the others — independence is enforced, not assumed.
Claim extraction
Each response is split into atomic claims and classified by type (fact / recommendation / opinion / prediction / warning) and asserted confidence.
Cross-model clustering
Claims from different models are agglomeratively clustered by similarity (lexical by default, embeddings optional) to find where independent models agree.
Consensus & divergence
Consensus strength, overall confidence, and a signal-vs-noise ratio are computed; divergences and single-model novel insights are surfaced, not hidden.
The Forge Score
Consensus feeds a composite Forge Score — an evidence-weighted score that must clear a threshold before an action is permitted. It decomposes, so any score can be traced back to the evidence that produced it.
ForgeScore = Σ( dimensioni × weighti ) × rigor(tier)
Routing. Before scoring, a request is routed against a locked domain taxonomy by term relevance. Unroutable input fails closed to a review-required fallback rather than guessing — the gate defaults shut.
Temporal Consensus Drift. When consensus decays across re-runs — an early signature of a hallucination cascade — PSZN raises a drift alert. This is emitted as a standard risk signal (OpenID Shared Signals / CAEP), so existing continuous-authentication infrastructure can act on it.
02Three-C — Context, Consent, Credibility
Authenticating a login is solved. Authenticating what an autonomous agent is allowed to do, on whose authority, and whether its output can be trusted is not. Three-C answers the three questions every agent action raises — each backed by a verifiable credential.
Context
Who is this agent working for?
A cryptographically verifiable delegation chain from a human principal to the agent and any sub-agents — capabilities declared, scope bounded. Authority by possession of a credential, not by a shared secret.
@caps + sealCredibility
Can the output be traced to a verifiable source?
Every deliverable carries its evidence: the Forge Score, the models polled, the claims and their divergences, hashes of inputs and tool-calls — anchored to an append-only transparency log the author cannot rewrite.
Root of trust, two modes. Governed / enterprise deployments chain identity from existing credentials (PIV/CAC, enterprise SSO) — you inherit the hard enrollment problem instead of re-solving it. Sovereign deployments derive one portable identity with offline rescue-code recovery and verifiable re-keying, owned outright — no vendor cloud can lock you out.
03One layer, three faces
PSZN doesn't stand alone. It's the truth-scoring face of a single "no authority without evidence" layer — sharing an evidence model with a capability-typed language and a human-consent protocol. Each maps to one of the three C's.
| Component | Answers | Provides | Enforced by |
|---|---|---|---|
| PSZNthis engine | Credibility | Model-free truth scoring, consensus, divergence, Forge Score, evidence ledger | Deterministic math over independent models |
| Garnetthe language | Context | Capability contracts (@caps), signed provenance & AI-authorship (seal), transparency log |
Compiler — checked, not asserted |
| Cryptographic Consentthe protocol | Consent | Out-of-band per-action human / delegated sign-off; provably human-directed action | Off-device keys, anti-relay session binding |
Together they replace authority by identity with authority by evidence: a request is only acted on when it is scored (PSZN), scoped (Garnet), and consented (the protocol) — and the proof of all three travels with the result. Built on open rails — W3C VCs, OpenID Shared Signals, content-provenance standards — not a proprietary stack, because a neutral layer is the one an incumbent won't ship.
04Frontier-adequate on the models you can run
In regulated and air-gapped environments, controlled data legally cannot touch a frontier cloud model. The binding question isn't access — it's whether a local open-weight model, wrapped in verification, is good enough. Honestly: on the right task classes, yes.
Where verification closes the gap
- Quantitative & structured analysis, extraction, classification
- Bounded coding where executable tests are the verifier — the one oracle that can't be talked into a wrong answer
- Evidence-gated retrieval & intelligence summarization, where every claim must cite a source
- Anything with a cheap, deterministic check: verification is easier than generation, and best-of-N over an independent verifier lifts a small model past its base rate
Where it can't — and we say so
- Long-horizon autonomous work: a capability gap, not a sampling-variance one. Sampling a model that can't do the task yields nothing
- Open-ended judgment & writing: verification is as hard as generation, and a same-family judge is biased toward itself
- Missing modalities: no scaffold adds a capability the base model lacks
05What's real, what's specified, what's planned
This is a trust engine. Overstating it would be self-defeating, so here is the honest ledger. Implemented runs today; Specified is designed and documented; Planned is next.
@caps, seal, transparency log · Garnet languageLicense & IP. PSZN is published as an open specification — documented to be read, implemented, and interoperated with, rather than kept as a black box. © 2026 Island Dev Crew. A neutral, legible standard is the one worth adopting.