> ## Documentation Index
> Fetch the complete documentation index at: https://risi.q-uestionable.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture Overview

> Standalone execution, model-independent safety, and evidence-first verification

## Execution flow

```text theme={null}
Human or AI operator
        |
Versioned machine contracts
        |
Model-independent safety kernel
        |
Deterministic runner
        +---- MemoryAdapter
        +---- DecisionProvider
        +---- Evaluator-only oracle
        |
Atomic evidence bundle
        |
Verify, replay, and report
```

The `local-reference` profile permits only registered deterministic components. Network access,
subprocesses, credentials, dynamic plugins, and source-memory writes are denied. Closed reference
policies may change only explicitly recorded derived state.

## Visibility boundary

Target-visible memory and decision requests never contain evaluator-only truth, criticality,
applicability, or safe-action oracles. Evidence preserves target and evaluator views in separate
files. Attacker-visible events reject evaluator-only field names. DEP-02 observer views are
narrower still: they contain only that observer's own query, response, and result count, with no
canary, assignment, trace, state, evaluator, or timing fields.

## Full-state telemetry

Snapshots include memories, derived state, indexes, queues, policy configuration and state,
logical time, and event sequence. Events link their canonical digest to the prior event and record
pre/post state hashes.

## Model-free replay

Replay verifies the evidence inventory and event chain. It reconstructs pure-read trace steps and
the closed policy-configuration and memory-eclipsing state transitions, then requires each result
to equal its recorded final snapshot. For the CRAF comparison it also checks retained retrieval,
context, decision, evaluator, source-preservation, and localization evidence without invoking a
model. For RISI-C it reconstructs all four arms, verifies retained observer and decision artifacts,
and recomputes the vulnerable and pure-read assessments.

## Controlled CRAF comparison

The `craf-reference` policy runs three arms from one canonical initial snapshot. Every arm receives
the same authorized truthful interaction. The pure-read control leaves adaptive state unchanged;
the memory-eclipsing policy records a designated derived-state update that suppresses the critical
memory from later retrieval; and protected critical recall honors a target-visible protection label
while undergoing the same adaptive update.

Only the evaluator can classify oracle truth, criticality, validity, applicability, source
preservation, decision safety, and the stage at which influence was lost. Direct deletion,
corruption, untrue or stale memory, overload, admission-only failure, and unlocalized unsafe
decisions are excluded from core CRAF.

## Controlled RISI-C comparison

The `risi-c-reference` policy runs vulnerable and pure-read pairs, each with sham and hidden arms,
from one canonical initial snapshot. The intentionally adaptive hidden arm may change only
`/derived_state/shared_access_counter`; its matched sham arm records a no-op transition. The
pure-read ablation changes neither arm's target state.

A frozen classifier maps the observer's designated health response to the hidden/no-hidden label.
Controlled recovery requires vulnerable advantage `0.5`, pure-read advantage `0.0`, no direct
canary disclosure, one probe per arm, the shared counter as the sole mediator, and safe region
decisions throughout.

## Current boundary

The repository implements the DEP-01 pure-read baseline, one intentionally controlled synthetic
CRAF mechanism with a protected control, and one controlled DEP-02 RISI-C mechanism with a
pure-read ablation. External adapters, executable inference profiles, live targets, autonomous
campaigns, and statistical or external vulnerability claims remain gated future work.