a11oy · governed substrate
Energy operatorprobing…
Jobs done
Joules
Nodes computing
Substrate
Λ trustConjecture 1 · advisory
Locked proofs8
console →
WarHacker · 5 mission surfaces · 25 governed demos · live on this Space

Code is action.
Govern it, or it governs you.

a11oy is the governed substrate beneath the mission: every autonomous decision is checked against authorized limits, ALLOWED or BLOCKED at the exact line it crosses, and sealed into a signed, tamper-evident receipt you can re-verify on screen. Five mission surfaces sit over a deeper catalog of 25 governed demos — 5 problems × 5 each: Cannonico (drone oversight) is REAL TODAY; the other four are honest sample / roadmap on the same proven substrate.

Surfaces live
0 / 5
Governed demos ran
0 / 25
Records signed
0
Re-verified
Registry
The wow · governed code-as-action

An AI tries to cross a line. a11oy catches it at the line — and signs the proof.

request read the rules policy gate ALLOW/BLOCK signed receipt

The same deny-by-default governed run the platform uses everywhere. Pick a scenario, watch it cross (or stay inside) an authorized parameter, then Re-verify the sealed record and Tamper test it — a single flipped byte returns verified:false.

One governed core · every defense domain
Army · Counter-UAS Govern the engagement decision A drone is inbound and an autonomous system wants to act. The governed gate holds any engagement outside the authorized zone or without human authorization — and seals the held decision. LIVE surface · adversary catalog + legal/cyber boundary Open counter-UAS Navy · Maritime Cue, assess, and seal the track Paste any maritime or orbital track and place it in an operational picture instantly — assessed against real envelopes, anomalies flagged, no bespoke per-source integration. LIVE surface · cued-engagement + Trajectory Picture below Open cued engagement Joint · Multi-domain compute Governed decisions at the disconnected edge The whole governed run executes in-image with no uplink, the on-device router picks a tier, and the same container is the UDS bundle that deploys cloud-to-edge with one command. LIVE surface · in-image Edge Run + Deploy Posture Run on the edge

A signature proves who signed, not what is true.

a11oy seals every governed decision into a real DSSE envelope signed by an in-image ECDSA-P256 key — verifiable against /cosign.pub, tamper-evident byte-for-byte. But a green signature is not a green outcome: re-verification recomputes the hash chain independently, and the advisory Λ trust score is a research conjecture, not a pass/fail oracle.

AI Oversight

Watch an autonomous system make a decision and catch the exact moment it crosses an authorized limit. Every run is sealed into a signed, tamper-evident record — press Re-verify to confirm it, then Tamper test to prove a single changed byte is detected.

Signed record idle

      

Deploy Posture

The signed, ready-to-ship deployment package — the same artifact deploys from cloud to a disconnected edge node with one command. Existence, digest and signature are read live from the public registry on each click, not asserted from memory.

Registry response idle

      

Mission Health

A live readiness dashboard that tells you who is ready to deploy and who needs review. Each verdict is computed in-image from concrete readiness criteria; missing data forces a review — the system never assumes a member is ready.

Computed in-image idle

      

Trajectory Picture

Paste any trajectory or orbit data — a JSON array or plain rows — and see it placed in an operational 3D picture instantly. The system auto-detects the fields, assesses each track against real orbital-regime envelopes, and flags anomalies. No bespoke per-source integration.

LEO MEO GEO anomalous drag to rotate
Assessment idle

      

Edge Run

The whole governed decision running on the device itself, with no connection required. The run executes fully in this container with no outbound call, the on-device model router picks a tier, and the result is signed and re-verifiable — the same container is the package that deploys to a disconnected node.

In-image governed run idle

      

Mission depth · 5 problems × 5 demos

Five surfaces. Twenty-five governed demos underneath.

Each of the five approved problems carries five governed demos — 25 in total, loaded live from the platform and runnable right here. Each run computes a real mechanism in-image and seals a signed, re-verifiable receipt; press Tamper and one flipped byte returns verified:false. Labels are the operator's own: real today for Cannonico, roadmap (proven substrate · sample vertical) for the rest. Nothing here claims more than it is.

— loading the 25-demo catalog from the live platform —

What is real here (doctrine v11 · honest labels only). Every surface above runs live in this container. Governed decisions are sealed into real DSSE envelopes signed by an in-image ECDSA-P256 key (verifiable against /cosign.pub); change one byte and re-verify returns false. The live status ribbon is pulled from real a11oy endpoints on this Space at load — energy figures carry a MEASURED / SAMPLE label straight from the operator, and a NO-LIVE-DATA label if an endpoint is unreachable. We never fabricate a joule, a job count, or a 200. The advisory trust score (Λ) is Conjecture 1 — a research conjecture, not a pass/fail oracle. Locked-proven invariants = 8. Deploy posture is read live from the public registry. Attestation is honest SLSA L1; the L2 build-provenance .att is emitted (not independently verified here); L3 is roadmap — not the bundle, not an ATO. Mission Health and Trajectory Picture use clearly-labelled sample inputs over real logic; plug a real feed into the same shape and they are live. The 25-demo depth below (5 problems × 5 demos) is the full governed catalog: CANNONICO is REAL TODAY; the other four problems (Tychee, Hangar2Apps, Cyber-RTS, Raven) are ROADMAP — the proven horizontal substrate (hash chain + Merkle + DSSE + the computed formula) is real, while each vertical runs on clearly-labelled SAMPLE data pending the operational stand-up (live feed / hardware / ATO). Every one of the 25 emits a real signed receipt and a 1-byte tamper test that fails cryptographically. We never imply all 25 are fully real.