the press that prints truth.
Knowledge, engineered like code.
Here is the whole idea, in one breath.
Hands an agent an ungoverned pile of context and hopes for the best (no record of where a fact came from, no way to agree on which version is true).
Makes knowledge a compiled, source-gated, content-addressed artifact (so every agent reads from the same governed source of truth, you can prove what it knew and why, and the bytes you stored are the bytes you retrieved).
Infrastructure-as-code, but for what your agents know.
Said plainer: knowledge should be authored in plain text, validated by a gate before it ships, and content-addressed (so storage, retrieval, and later training can never silently disagree. The compiler is open; the durable moat is the curation judgement of what is worth gating into a World).
And governance doesn't end at the artifact: DDaC follows a fact from sourced, to inference that runs on your own hardware, to the specialist model you aim to own. Born, checked, run, become.
Today, knowledge is hearsay. There is no shared "what's true."
Agent and team knowledge accumulates as scraped notes, vector dumps, scratch logs, half-remembered facts, and it drifts out of sync. Each agent and each teammate carries a private, unverified version of the truth, so they quietly fall off the same page. Ordinary RAG and vector stores don't fix this. They are the rumor mill: ungoverned, with no record of where a fact came from, no map of how facts relate, no sense of whether they're still current, and no way to agree on which version is true.
DDaC isn't wired to one product: point it at any corpus and it compiles, standalone. Underneath, it is Documentation-as-Code and Declarative Data as Code at once (one compiled, gated artifact that is both a human-readable encyclopedia and a byte-tight machine corpus), and it does four distinct jobs to get there. Two real systems already build on it: ARAIL, a research lab where Buddy and the AutoResearch agents design and score experiments while DDaC governs the knowledge base they build; and qukaizen-geoai, a zero-egress humanitarian mapping runtime where DDaC is the control plane that compiles the sealed inference bundle a model runs under.
Pins the schemas everything else has to obey: task definitions, output schemas, bundle manifests, per-World grammars, run declarations (dac.manifest/v2). In geoai, this is what turns a fuzzy question into a closed answer sheet before a model ever runs.
Turns scattered, unsourced context into one closed, sourced World. assertClosedSourcedGraph refuses a claim that can't cite where it came from or an edge that dangles. In ARAIL, this is what a research agent's finding has to pass before it becomes shared knowledge.
Turns a gated World into a teacher-verified training corpus, stamped with corpus_sha256 so the weights trace back to the exact source bytes. Already run once for real: 310 sourced disaster-mapping observations became a 288-item corpus.
One governed manifest names which engine serves a request (on-device, cloud, or your own endpoint) and which sandbox profile it runs under, then a receipt proves what actually executed. This is DDaC's role as geoai's control plane.
Registry + contract built; live router is roadmapEvery fact cites a source. A bake stamps corpus_sha256 of the exact bytes it consumed (provenance as a hash chain, not a footnote).
A closed graph: every term is sourced, every edge resolves. assertClosedSourcedGraph refuses a dangling reference or an undeclared category.
Drift is detected and reconciled, not silent. roster-drift.mts reports the gap between what's declared and what's built (out loud).
→ we aim to ship DDaC as a drop-in component for any agent stack, not only ARAIL (starting with a components.json git package with a fetched model). The engine and read API are live today; the packaged plugin is the direction we're building toward.
The gate is the law: nothing becomes truth without a source. A red gate blocks the merge (exactly like failing CI on a pull request).
● available now the provenance gate (src/gate.ts), the closed-graph assembler, and the open read API are live.
Knowledge matures through three layers. Only one of them is the truth everyone builds on, and that boundary is exactly what "on the same page" means.
Scraped docs, notebooks, agent drafts, research claims. Allowed to be wrong. Traceable and on hand (but it never gets a vote on what's true).
A fact lands here first, as a proposal.Only what passed the gate, with provenance. The single source everyone reads from (no consumer holds its own copy, no consumer imports another).
"On the same page" = the gate.Distill the compiled World into a model you own, so it knows the domain by heart and looking it up resets toward zero. The step that builds the training set has already run on real data (a governed World turned into a teacher-checked corpus. The owned model that corpus feeds is what we aim to next).
The corpus is real today. The owned model is the aim.Only COMPILED is truth: sourced, gated, live today. RAW is available, never authoritative. And BAKED has begun: the step that turns a World into a training corpus has run on real data; the owned model it feeds is what we aim to next.
A World is the first thing you build with DDaC: a sourced, gated, queryable corpus that is at once a readable dictionary and a machine API. Below is the real gated taxonomy of Worlds. Pick a containment and watch the field nest (every edge carries the authority) that justifies it. Nothing is drawn broader than its source allows.
Tap an edge label to read its real citation.
You walk into the World and read it (categories, plain definitions, a worked example for each term. The Docent grounds on this same compiled corpus).
An agent retrieves a bounded, sourced slice over the open read API (/what, /story, /dac), CORS-open, every item traceable to one immutable version.
● available now five live Worlds (about 698 sourced terms today, and the counter climbs as new facts ship) plus this gated taxonomy index, each edge sourced. → we aim to the zoomable multi-world rollup and the LLM router next.
Worlds is the first use case of DDaC(not DDaC itself). DDaC is the engine, and its governance doesn't stop at the page: it follows the fact to where it runs and to what it becomes.
It can recall from its own weights, it can search the live web, or it can look it up in a reference World. The first is cheap but can't be trusted. The second can be trusted-ish but is expensive and never the same twice. A World is the empty quadrant: cheap and reliable and yours.
“It just knows.”
A frozen snapshot. Free and instant (but unverifiable, stale at the edges, and it can't cite or repeat itself. Confident is not the same as correct).
“It looks it up.”
Current and broad (but a noisy mix of SEO pages with no authority ranking, un-adjudicated and irreproducible. You pay latency and tokens on every call, and two runs can disagree).
“It consults the press.”
Cheap like memory. Cited and versioned like an authority. And yours(gated, owned, the same answer every call. The lookup an agent can actually defend).
“What is a snake plant, really (and is that name even current)?”
A name that points at neither a snake nor one plant. Before an agent can act, it has to pin the species to one accepted name (and “snake plant” maps to a binomial that was reclassified in 2017, so the three routes don't even agree on what the plant is. Watch the same naming question through each).
Emits the now-superseded Sansevieria trifasciata as if current (frozen weights never absorbed the 2017 reclassification. Fluent, confident, and citing nothing. You can't tell stale from right).
Returns pages titled both Sansevieria and Dracaena, threads calling them interchangeable, no authority ranking. Contradictory names, no version, latency and cost every call (and a different top hit next run).
One cheap, versioned, citable lookup. The World adjudicates names, not advice: it returns the Kew-accepted Dracaena trifasciata, the dated homotypic synonym Sansevieria trifasciata, and the rank. Same answer, every call.
A reference World · illustrative record →
{
"accepted_name": "Dracaena trifasciata",
"synonym": "Sansevieria trifasciata",
"synonym_type": "homotypic",
"synonym_since": 2017,
"rank": "species",
"common_name": "snake plant"
}
Names & synonymy after Plants of the World Online (POWO), Royal Botanic Gardens, Kew (illustrative of what a botanical reference World returns. The World returns nomenclature, not care advice).
The same trap, in every domain (one surface word, three answers)
reads as a gratuity
is Treasury Inflation-Protected Securities (and the deflation floor protects principal at maturity, not the interim coupon).
TreasuryDirect, U.S. Treasuryreads as one chemical
is three: a reprotoxic solvent (CAS 68-12-2), an MS drug, a biofuel. “Get the CAS” has no answer without context.
PubChem CID 6228, NCBI / NLMreads as thoughtfulness
is the bargained-for exchange that makes a contract enforceable (almost the opposite of the everyday word).
Black’s Law Dictionary, 12th ed.reads as one drug
is two (morphine or magnesium sulfate. The cited rule: never auto-expand; spell it out. Guessing is the bug).
ISMP error-prone list · TJC do-not-useillustrative Everything above teaches the pattern every agent faces (one surface word, three answers) not live DDaC returns. Today's shipped Worlds are AI, Astronomy, Mathematics, Quantum, Biology, and Ecology (plus Nucleus, World-Models, Neural-Networks). These fields stand in for the domains a World could govern.
Cheap and reliable and yours.
That third corner is the whole reason an agent reaches for a World. But there is one case where it isn’t the best option: it’s the only one.
Nucleus sign?”
Memory No weights contain it. It guesses the cell nucleus, the atomic nucleus, or invents a “core training module.”
Search Nothing public (or, if it reaches a stale doc, a contradiction: an old 6-artifact claim vs. the shipped 4-artifact chain).
World A private World returns the canon: Ed25519 over sha256(corpus|teacher|config|training) (four artifacts, flat hash-of-hashes, not a Merkle tree. The “six components” framing is a deprecated overclaim).
For your private, proprietary terms there is no parametric memory and no web result. A World is not the cheaper path; it is the only path to a fact you can prove.
Because the documentation is the data, the same compiled World serves both readers at once. There is no second copy to drift, just two ways of meeting the one truth.
You read it to learn. An agent retrieves a sourced slice. And later, a model can bake it and own it.
Learn walks you through the dictionary in plain language (a place to learn the ropes, every term with a worked example.
)An agent pulls a small, sourced slice over the open read API (bounded by the gate, traceable to a version.
)The forward bet: Nucleus distills the compiled World into a model you own (pinned to corpus_sha256, so the weights trace back to the exact source). Designed, on our timeline.
Every change to truth, a researched claim, a correction, an observation, travels the same pipeline a code PR faces. We call it Continuous Intelligence Integration. The git diff is the changelog of truth.
A new claim lands as a raw/ proposal (available, never authoritative).
The assembler runs the closed-graph gate, then determinism (--check) and corpus-closure. A red gate blocks the merge.
Gate green → terms.json is rewritten and committed. The git SHA is the merge record.
bake-corpus.mts stamps corpus_sha256 (the lockfile binding the corpus to its exact source). It refuses an ungated World.
An autonomous Theorist proposes the next hypotheses; the gate keeps the loop tethered to sourced evidence. Designed, not yet built.
A new method arrives, a pull request for a fact lands on main,
the number climbs. Five live Worlds prove the pattern at scale,
each provenance-gated, every term sourced, the reference graph closed.
Knowledge, declared and versioned(the way software treats code).
sourced terms today across five live Worlds (AI, Astronomy, Mathematics, Quantum, Biology) and the counter climbs as new facts ship.
Every one cites its origin and passes the gate before it ships.
A World, compiled and gated, is knowledge at rest. But a fact you can trust is only worth as much as what you can do with it, so DDaC governs the rest of the path, and each step inherits the trust of the last. ARAIL gathers the context; DDaC sources and gates it; it runs where you decide; and, the aim, an owned model internalizes it. Born, checked, run, become: one continuous chain.
A claim is authored in plain text, carrying where it came from. Available on hand, but not yet truth.
● available nowOnly sourced facts whose relationships resolve become truth. A claim that can't cite its origin never gets a vote.
● available nowOne governed contract names where a request runs: your own machine, a cloud, or your own engine. The on-device path runs egress-less and disposes of itself when the work is done.
● contract available now→ automatic routingThe corpus that would train it has already been built from real data. The specialist model it feeds (knowing the domain by heart) is the aim next.
● corpus built on real data→ the owned modelA separate product already builds on this. A zero-egress runtime for humanitarian disaster mapping, for the MapSwipe and HOT fAIr ecosystem, treats DDaC as its authority, pinning its governed contracts by version rather than forking them. Its first real World was compiled from live mapping tasks in the Myanmar earthquake response, cross-referenced against open satellite imagery: 310 sourced observations, expanded into a 288-item training corpus (235 to train, 53 to grade), filtered by a teacher pass, demonstrated end-to-end on a real task, that throws out any claim it can't trace to a source. Real imagery, governed the way any World is: the seed of a model you'd own.
DaC's job is to define the allowed vocabulary and validate that it was honored — never to run it. It compiles a World's gate-passed terms into terms.gbnf (the actual grammar spec) and context.toon. DaC is never imported at runtime: it's a control plane, not a runtime.
A gated World sitting in dist/ hasn't finished being governed;
it also has to be served, and the serving has to inherit the same
trust rules as the gate. The inference-engine manifest
(dac.manifest/v2) is DDaC's answer: one governed contract names
which engine serves a request, and which sandbox it runs under, before a
single token comes back.
● available now the registry, the manifest contract, and its emit/contract-test tooling are built. → we aim to live request dispatch, routed automatically.
Runs under a disposable sandbox profile with no network path out (geoai calls its version secure-zero-egress-claw). The World never has to leave the machine it lives on to be useful.
A hosted engine you don't run yourself, for workloads that don't need to stay local. Same manifest, same contract, a different destination.
Point the manifest at a model you already run. DDaC's job doesn't change: name the destination, verify the contract, receipt the result.
Naming an engine and a sandbox is a promise; a receipt is proof it was kept. The consuming product runs the isolation (qukaizen-geoai's zero-egress sandbox is its own build, not DDaC's), but the contract DDaC names is what the receipt is checked against: bundle, model, and task digests, the engine that ran, the sandbox profile and its enforcement level, and whether an adversarial egress test actually passed on that run. Tamper-evident, not tamper-proof: a receipt proves what executed, never that the answer was correct.
Everything above governs what a model knows. This governs what it is asked(and what it is allowed to answer. Because the moment a prompt) is typed at runtime, reproducibility is gone: nobody can say afterwards which words produced which result. So the instructions travel the same road a fact does (authored in plain text, reviewed as a pull request, compiled to files,) and pinned by content hash inside the sealed bundle.
Static means it changes only by recompiling the task, never by a runtime string. The only dynamic input is the declared, hashed data itself.
The prompt guides the ranking. The grammar bounds the menu.
Not to save space (the words still reach the model in full. A hash is a) 64-character fingerprint stored beside the file. It buys four things nothing else does:
Prompts drift. Change "report only visible evidence" to "prefer visible evidence" and six months of results quietly change meaning. The digest gives every version an exact name, so a result can point at the words that produced it.
The instructions are the most powerful surface in the system (edit one line and every downstream answer shifts while nothing looks broken. The digest is checked before the run and echoed in the receipt, so an altered prompt cannot execute silently.
)Same data + same model + same prompt = same answer. Pin only the first two and you get irreproducible results that look reproducible (the classic failure. Hashing is how the prompt gets treated as the input it is.
)The control plane declares expected digests, the sealed bundle carries them, the receipt echoes what actually ran. All three must agree or the result is not accepted. Using the wrong data or the wrong question stops being a mistake to catch (it becomes a run that cannot be accepted.
)Because prompts are files, they inherit the pipeline that already governs facts. A wording change opens a PR; a human reviews the diff; the gate and determinism checks run; merge rewrites the compiled task and the git SHA is the record. The git diff becomes the changelog of how we ask. Roll back a prompt the way you roll back code (and because every past result) carries the digest of the prompt that made it, the entire history stays interpretable instead of becoming folklore.
A language model does not write sentences; it emits one token at a time, scoring every candidate in a ~150,000-token vocabulary before each pick. Instructions make good answers likely. A grammar makes wrong-shaped answers impossible(and the two are deliberately different mechanisms).
The allowed answers are compiled ahead of time into a formal grammar (GBNF) and pinned by hash, like everything else. At each generation step the engine works out which tokens could still spell a legal answer and drops every other token's probability to zero (before the choice is made. The model still decides) which legal answer; it simply cannot leave the page.
Unconstrained, a model can emit anything (an essay, an invented fourth category, an instruction it read in the input).
the raw spaceThe pinned role, constitution and exemplars reshape the model's ranking: blocked 78%, clear 9%, unclear 13%(and everything else small but not zero).
soft (a prior)Illegal tokens are zeroed before sampling. Pick "blo" and only "cked" can follow. The 78% winner is taken and kept as the raw score.
hard (a boundary)The run reports "constrained" only when it observed the grammar load and the answer parse. The receipt names the exact question, answer list, model and settings.
auditable per runWorth being precise about scope, because it is often misread: a grammar governs output only. It never organizes the prompt, and it cannot judge truth (it guarantees the answer is well-formed, not that it is right. Which is) exactly why the schema check sits behind it, and a human sits behind that.
The three answers are printed before any image is seen. A vision pass writes structured notes (water-like region overlapping the road corridor, ~40m span. A reasoning pass writes the case file in plain English, with alternatives: seasonal flooding, cloud shadow, image misalignment. Only then does the checker tick one box: blocked. Work first, boxed answer last) never the reverse.
reasoning → verdictSixty percent hidden. Ungoverned models either invent the hidden half or refuse outright. Here the schema gives partial evidence a legal home: draw only the visible roof edges, label the projected extent as inferred, record the occluder and how much is visible. If too little is visible, the correct answer is cannot assess(and it counts as success, because it routes a human to the tile instead of putting a guess on the map).
abstention as a first-class answerHonest status: the compiler, the gate, content-addressing and the sealed-bundle export are built. Grammar-bounded answering is proven on real hardware in a spike. The prompt stack as four pinned layers, and the receipt fields that carry its digests end-to-end, are designed and being built(described here as the direction, not as shipped behaviour).
A World is the first thing the press makes. Walk into one (and read the truth it printed).