Runtime containment

At runtime, Tarski treats LLMs as fallible tools behind relay surfaces — never as drivers holding program control. A model may propose; only the engine admits. This page is the containment model in one place.

The two relays

Model and sensor output lands in reserved relay namespaces:

• candidate.* — fallible fact-domain evidence: an extraction, a parse, a sensor reading. It cannot support a trusted fact until a decision.accepted.* rule you wrote — and can inspect — endorses it.
• proposal.* — fallible action-domain evidence: a drafted reply, a suggested offer, a requested read. It cannot support a world-facing intent until decision.approved.* endorses it.

The loader enforces this as a relation-level graph cut over your whole program. A rule that wires model output directly into truth or action is not a bug that ships — it is a program that does not load. Parallel bypass paths fail even when a correct gated path exists beside them. See Facts, decisions & intents.

What a bad suggestion can and cannot do

A bad parse stays staged as a candidate. A bad proposal commits as evidence and derives decision.rejected.* — auditable denial, not an error. An absurd order for eighteen thousand waters exists in the record, pinned with provenance, and structurally cannot reach the point-of-sale. Tarski does not try to stop a model from making a bad suggestion; it makes the bad suggestion incapable of becoming a world-facing action.

Invariants back the whole thing fail-closed: declared impossible states — an effect receipt without canonical approval, an offer below the floor — are checked over the completed model at every fixpoint, and a violating transition is refused with a receipt naming the invariant.

Reads are contained too

An agent that wants to read the worldview goes through the same discipline: it names a declared query, decision rules ratify or deny, an admitted intent executes the read at a pinned head, and results re-enter as evidence that is itself gated — result rows cannot become trusted facts or drive intents without decisions. Even “the query returned something” is contained. Budgets are ordinary decision rules with readable denial reasons, backstopped by invariants that make over-approval an impossible state. The full loop: the agent query relay.

Curated context

What a model sees is declared, not ambient. Every model-bound interface names a projection (or an explicit full-worldview grant — excluding read evidence either way); a missing declaration is a load error. Context assembles from digest-stamped sections whose digests join the provider request digest, so a capture envelope proves byte-for-byte what the model saw. “What did the agent know when it proposed this?” is a read against recorded state, not prompt archaeology.

llm.complete is deliberately one-shot: the request envelope has no tool surface, and capture validation rejects tool-invocation responses. A model that wants data asks through the query-request section, and the read happens as a governed effect on the next hop — no in-call tool loops.

Shared reality, independent agents

Multiple agents coordinate through the shared derived model rather than through each other: each contributes evidence, the evaluator derives one consistent worldview, and each reads through its own declared projection. Session isolation keeps simultaneous users separated by derived authorization facts — see Identity & tenancy.