Evidence is not action
Seeing a signal never triggers a dispatch by itself. Observation and execution are separate, gated steps.
Governance — GAOS/HARMONIC
Trust is not a feeling. It is an architecture.
GAOS/HARMONIC is the governance and evidence layer beneath the fleet. Agents act only on verified evidence, every sensitive action is gate-checked before it happens, and everything returns an inspectable receipt. Fail-closed by default.
Default fail-closed · Gate classes five · Done means verified
Scroll
01 — The doctrine
Four refusals,written into the runtime.
Most agent failures are category errors — a signal mistaken for an order, a memory mistaken for a fact. The governance layer exists to make those mistakes structurally impossible. Its core doctrine, verbatim:
Evidence is not action. Advice is not dispatch.
Memory is not truth. Implementation is not activation.
Advice is not dispatch
A recommendation — however confident — executes nothing. Only an authorized instruction crosses into action.
Memory is not truth
Stored state must be re-verified before it is acted on. A current directive always outranks a stale memory.
Implementation is not activation
Code that exists is not code that is live. Turning something on is its own gated decision, never a side effect.
When any of the four is uncertain, the system fails closed — the action does not happen.
02 — The pipeline
How a request becomesa governed action.
Every job in the fleet walks the same six stations. No station can be skipped, and three of them can stop the job cold.
G-01
Signal
A request, event, or schedule enters the grid. At this point it is information — nothing more.
G-02
Authority ranking
Sources are ranked before anything moves: a current operator directive outranks a cached plan, and both outrank stale memory. If authority is ambiguous, the job stops here.
G-03
Gate check
If the action falls into a gated class — comms, spend, credentials, canon, deployment — it must pass its policy gate before execution. Stale evidence or unclear authority fails closed.
G-04
Act
Execution runs inside a fixed lane with scoped authority, metered per tool call. The agent does the job — nothing adjacent to it.
G-05
Verify
The claimed artifact or state is independently confirmed to exist. The agent's own report is never sufficient — verification checks the world, not the story.
G-06
Receipt
An inspectable record is archived: what ran, under whose authority, what it cost, and a checksum over the evidence. This is the receipt you keep.
03 — The gate classes
Five things that neverhappen ungated.
Anything that touches the outside world, moves value, or changes what the system believes must clear a gate first. Each class fails closed if evidence is stale or authority is unclear.
Posts & communications
Nothing is published or sent outward without an authorized instruction. Drafts are not sends.
Spend & transactions
Money movement is hard-gated. No agent improvises a payment, a purchase, or a transfer.
Credentials & configuration
Key rotation, permission changes, and config edits pass review before they land — never silently.
Memory & canon changes
What the system holds as true is itself gated. Updating the record requires evidence, so a bad claim cannot quietly become tomorrow's fact.
Deployments
Shipping is a decision, not a momentum. Builds are verified before activation, and activation is its own gate.
The gate does not negotiate
If evidence is stale, if authority is unclear, if verification cannot complete — the action does not happen. An ungated miss is treated as a defect in the gate, not an acceptable exception.
04 — The evidence gate
“Done” meansverified. Nothing less.
Language models can assert success they never achieved. The evidence gate is the anti-fabrication mechanism: a task is accepted as done only when the claimed artifact or state is independently verified to exist — the file written, the record created, the state changed. Never on the agent's word.
- A claim without a verified artifact is rejected, not logged as done.
- Verification checks the destination — the source of truth, not the transcript.
- Rejected claims are recorded too. Failure is auditable, not silent.
- This is what makes a GridFleet receipt real instead of decorative.
Evidence gate · checkfail-closed
claimreport delivered
artifactfound at destination
checksummatch
statusACCEPTED · receipt issued
Evidence gate · checkfail-closed
claimtask complete
artifactnot found
statusREJECTED · returned to work
05 — Trust labels
A green panelcannot lie.
Every value the system surfaces — every metric, every status light — carries a provenance label. You always know whether a number was just verified against the world, read from a record, estimated, or has gone stale. Representative labels:
live-verified
Checked against the source of truth moments ago. The strongest claim the system makes.
file-backed
Read from a durable record with a known origin. Solid, and it says so — no more, no less.
estimated
Derived or modeled. Useful for judgment, and explicitly barred from posing as a measurement.
stale
Once true, now past its freshness window. Stale values cannot authorize gated actions.
unknown
The system would rather show you “unknown” than a confident guess. So it does.
Labels are enforced at the display layer — a dashboard cannot paint an estimate green.
06 — Why this matters to you
The moat isthe receipt.
Single-model products can sound trustworthy. They cannot be inspected. It is a separate governance layer standing between the model and the world — which is why GridFleet can make guarantees a speech-to-speech chatbot structurally cannot.
W-01
No hallucinated bookings
An appointment exists when the calendar says it exists — verified at the destination, not assumed from the conversation.
W-02
No fabricated “done”
Results are accepted only with the artifact in hand. Confidence is not evidence, and the gate knows the difference.
W-03
An auditable trail
Every governed action leaves a receipt — authority, evidence, cost, checksum. When you ask “what happened?”, the answer is a record, not a recollection.
07 — Put it to work
Send one job.Inspect the receipt.
The fastest way to evaluate a governance layer is to watch it govern. Send one real operational job — the fleet runs it under GAOS/HARMONIC, and you get a receipt-backed result you can verify yourself.