The QuKaiZen Dictionary.

The unit of the knowledge lifecycle — a versioned, sourced knowledge graph and its metadata, in a fixed on-disk layout.

A World is the package the engine operates on, laid out under data/worlds/<slug>/. It holds spec.json (the WorldContentSpec declaring slug, display name, categories, and knowledge sources), a verified/ directory of sourced shards and a raw/ directory of drafts, an optional roster.json declaring desired scope, and the compiled terms.json that is its single source of truth. Assembly reads every shard, normalizes and sorts the terms, runs the gate, and writes terms.json deterministically. This World — the one you are reading — is itself a World: data/worlds/qukaizen/, the company compiled in the same format as every domain it serves. BUILT: the layout and conventions are stable, and several Worlds follow them. The point of the structure is that a new World is assembly, not invention — declare the spec, author sourced shards, run the assembler, gate — which is exactly how a brand-new domain reached a gate-passed corpus in a single session.

The create-and-intake organ — a shareable AI Lab with a local Buddy agent that gathers raw knowledge and observations into the pipeline.

ARAIL is the mouth of the system: where raw material enters. It is a shareable AI Lab built for friends and family, fronted by a local Buddy agent — the user's research partner — and it feeds the RAW tier on two streams. The knowledge stream pulls research (papers, docs, expert drafts) toward sourced terms; the observation stream takes sensor and camera data toward grounded evidence (see two-raw-streams). ARAIL spawns ephemeral, sandboxed agents — a per-branch researcher, an adversarial skeptic-verify crew — to curate candidate knowledge before the gate ever sees it. DaC is designed to ship as a marketplace plugin that drops into ARAIL's existing component catalog: give away the factory, do not hoard it. BUILT: the autoresearch intake pattern that produced today's compiled Worlds; ARAIL as a sibling repo with its component catalog. ROADMAP: the observation stream as a live camera integration (plant-vision Phase 4) and the Buddy-driven loop running end to end.

Building a new World is assembling sourced knowledge through a standard pipeline, not inventing a new system — proven by a domain that compiled in one session.

Because the engine components already exist — the provenance gate, the World-factory and curation port, the canonical serializer, the source-shard convention — a brand-new domain is no longer an invention; it is an assembly. The recipe is fixed: declare a WorldContentSpec, author sourced shards, run the assembler, gate. No new code, no new contracts, no new gate. This is the company's central thesis, and it was proven on QuKaiZen itself: the Horticulture World for the plant-vision product compiled to a gate-passed terms.json in a single session, and this self-World was authored the same way. The lesson is to invest in reusable components and collect the compounding interest later: every new World is cheaper than the last because the factory is already built. BUILT: the pattern is real and repeated. The principle is why a research stack, not a single product, is the right shape — each domain reuses the same press.

The script and hash that turn a compiled World into a training corpus + manifest, pinned to the exact source bytes by corpus_sha256.

bake-corpus (scripts/bake-corpus.mts) is the CD half of knowledge CI/CD: it reads a gated terms.json, re-runs the gate (it refuses to bake an ungated World), hashes the raw bytes to compute corpus_sha256, expands each term through a pluggable expander into train and eval items split deterministically, and writes a manifest stamping corpus_sha256, the source closure, term and item counts, and the declared teacher job. corpus_sha256 is the lockfile — sha256 of the exact terms.json bytes — and it is the immutable pin that binds three things into one join: a local re-hash, the manifest, and the BakeResult Nucleus echoes back; the same role a Docker digest or a package lockfile plays. Every training item traces its source string and source slugs, so the corpus is auditable end to end. BUILT: the script, the deterministic expander, the lockfile, and seal verification, with tests asserting the hash equals sha256(terms.json) on every run. ROADMAP: the actual training run that consumes the corpus — that lives on the M5 in Nucleus.

Knowledge distilled into owned specialist model weights — recalled by heart, no retrieval — and the value-add of the whole business.

BAKED is the durable asset: a compiled World carved into the weights of a small, owned, sealed specialist model. Where COMPILED is shared truth you look up, BAKED is internalized memory the model simply knows — distilled by Nucleus via SFT and symbolic chain-of-thought distillation. Once a domain is baked, the live RAG layer for that knowledge compacts toward zero (the RAG-to-MEMORY transition); retained state and metadata persist, but the facts now live in the model. The weights are sealed with an Ed25519 provenance chain that ties them back to the exact source terms.json via corpus_sha256, so the model stays auditable. BUILT: the engine-side bake hand-off and seal verification; the Horticulture chain runs end to end up to the BakeRequest. ROADMAP: the training run itself on the M5 — real weights, the measured efficiency, live compaction. This is the one unproven bet, and it is the moat: a compiled World is table stakes; the owned specialist is the differentiator.

The single source of truth — closed-graph, every term sourced, every category declared — emitted by the gate as terms.json.

COMPILED is the only tier that earns the word 'truth'. It is the output of the assembler after the gate passes: no unsourced fact, no dangling edge, no undeclared category survives. The result is terms.json — an immutable, git-versioned, hashable artifact that every consumer reads and none imports from another. Drift is detected and reconciled, never silent: roster-drift reports gaps and the Fact Steward re-grounds. BUILT: live compiled Worlds across multiple domains, all gate-passed; the gate (src/gate.ts) is pure, total, and deterministic, byte-locked by tests against the mainline so it cannot be quietly re-implemented. The convention is load-bearing — only COMPILED is truth, and the boundary between the press and every reader is this portable file. COMPILED is also where humans and agents converge: it is the one thing both are required to treat as authoritative, which is what makes the workforce safe to automate.

The serve organ — the press that compiles sourced knowledge into one gated artifact, and the open read API that serves it two ways: human dictionary and machine corpus.

DaC is Documentation as Code — and because the documentation is the data, it doubles as Data as Code: one compiled artifact (terms.json) is both a readable dictionary and a machine corpus. DaC is the offline press (this engine repo, which assembles and gates Worlds) and the runtime reading room (the open read API). Its product spine is 'humans learn, machines do': one gated artifact read two ways. The decided runtime stack is FastAPI to serve (/dac, /what, /context, /health, /metrics), a two-tier store (gated terms.json as COMPILED truth plus LanceDB for the live semantic layer), and a NATS JetStream bus whose KV bucket is the Fact Steward's worklist. BUILT: the gate, the Fact Steward verify port, the context router, the taxonomy, and the live open /what read API over compiled Worlds. ROADMAP: most of the broader serve/store/bus stack (bulk /dac, /context ContextPacks, the LanceDB live tier). The load-bearing rule: every consumer sources the same portable terms.json; none import each other — the boundary is the file.

Any serializer or expander that claims reproducible output must have a test that proves it byte-for-byte.

The fourth standing rule keeps determinism honest: a function that claims byte-identical re-runs must prove it with a test, or it is not allowed to claim it. Re-running the assembler on the same World yields the same terms.json bytes or fails a --check; re-running bake-corpus yields the same train and eval items; the expander splits deterministically from a hash of the slug; the gate returns the same verdict for the same input. This is load-bearing precisely because the corpus_sha256 lockfile, the bake hand-off, and cache invalidation all depend on it — if the bytes wobbled, the hash would lie. BUILT: determinism is tested, not asserted, with real non-zero exits when output would change. The discipline is the reason a hash can stand in for a corpus: when the same inputs always produce the same bytes, a single sha256 is a faithful, falsifiable name for the whole truth a model learned from.

The five-stage pipeline that treats a knowledge change like a software change: declare, reconcile, gate (CI), version (git), release (CD).

Knowledge here moves like software. Declare: a spec.json and roster.json define desired state, and sourced shards are authored. Reconcile: the assembler reconciles shards to the spec and reports gaps. Gate (CI): assertClosedSourcedGraph checks closure, provenance, and declared categories, and a determinism --check guarantees byte-identical re-runs — a failure is a real non-zero exit, exactly like a failing test. Version (git): on green, terms.json is rewritten and committed, and the git SHA is the merge record. Release (CD): bake-corpus reads the compiled World and stamps corpus_sha256, the lockfile that binds the released corpus — and any model baked from it — to the exact source bytes; it refuses to release an ungated World. The whole loop is 'a pull request for a fact'. BUILT: all five stages, with real exit codes and the corpus_sha256 lockfile proven equal to sha256(terms.json) on every run. ROADMAP: the scheduler that runs the loop continuously; today it is run by hand.

The three-state maturation through which sourced knowledge becomes an owned asset: raw working memory, compiled shared truth, baked internalized weights.

The lifecycle is QuKaiZen's spine: knowledge matures through states the way memory does — scratch, then shared, then internalized. RAW is working memory, allowed to be wrong; COMPILED is the gated, sourced source of truth; BAKED is knowledge carved into owned model weights, recalled without retrieval. Between COMPILED and BAKED a live RAG tier serves current facts on-box while knowledge matures; once a domain is baked, RAG of that knowledge compacts toward zero. The verbs are kaizen — test, record, compile, retain — a loop that never stops and that yields a durable asset each turn. BUILT: the RAW and COMPILED tiers (live compiled Worlds, all gated) and on-box RAG serving. ROADMAP: BAKED as a live operation — today the event is recorded; when the real bake runs, RAG-of-it resets. The lifecycle is the reason knowledge here behaves like software: it is declared, reviewed, tested at a gate, versioned, and released.

Latent world models learn implicit representations of environment dynamics; our Worlds are the opposite — explicit, symbolic, sourced — so the relation is DIFFER.

Latent world models — Dreamer-style latent environment models, Genie-style video prediction, JEPA-style joint-embedding predictive architectures — learn compressed, implicit representations of how an environment behaves, optimized for prediction and control. QuKaiZen's relation is DIFFER: our compiled Worlds are symbolic and provenance-gated, every term a human-readable concept with an explicit source, every edge declared rather than learned, every category named. The trade is deliberate — we choose interpretability, auditability, and unlearnability over emergent latent structure. This is not a claim that one is universally better; they are tools for different jobs. Latent models are powerful for discovery and dynamics; symbolic sourced Worlds are necessary for safe, auditable, domain-bound autonomy and for a corpus a human can read and contest. SPECULATIVE as a positioning claim, BUILT as a design choice: the symbolic, gated architecture is what we ship. The seam to weight-space models is not absent, though — it is the bake (see bake-as-bridge), where a symbolic World is distilled into owned weights while staying pinned to its source.

Every artifact — compiled World, baked model, raw observations — can live on the owner's own hardware, which makes cutting the cord a choice rather than a requirement.

Local-first is a property the stack keeps available, not a position it takes against anything else. The compiled World, the baked specialist, and the raw observations can all live on the user's own hardware, and the dataset stays sovereign — the owner controls it, reuses it, and can delete it. Frontier models in the cloud remain the right tool for frontier work, and QuKaiZen uses them deliberately as build-time teachers; the question is never cloud or local but which one earns a given job. What local-first adds is the option to run the finished thing where the data already sits, which matters most where records cannot leave the building and where a learner wants to work without an account. If you can cut the cord, you are good to go; if you cannot, the same World and the same model still work with one attached. BUILT: the engine and the compiled Worlds run local-first, and the measured local-serving numbers are real. ROADMAP: the fully owned bake running on the M5 that completes the picture.

Every capability is labeled honestly — BUILT, ROADMAP, or SPECULATIVE — and a planned capability is never rendered as live.

No snake oil is the first standing rule: in docs and in code comments, BUILT means implemented, tested, in use; ROADMAP means designed but not built; SPECULATIVE means exploratory and undecided. A reader never mistakes a planned feature for a shipped one. The discipline is structural, not just stylistic — declared seams are deliberately left unregistered so they cannot accidentally ship as features, and a bake manifest stamps its teacher job 'declared', not 'ran', so even the model knows what has not happened yet. This World obeys the rule term by term: each definition states its status seam plainly. BUILT: the discipline itself, enforced across the charter, the code, and this dictionary. Note the one place it is held differently — public, visitor-facing copy expresses the same honesty affirmatively ('available now' versus 'we aim to') rather than with internal BUILT/ROADMAP stamps; the engineering rule stays exactly this strict, the public voice just states it as a feature, not a defense.

The bake organ — the company hub and distillation pipeline that turns a compiled World into owned, sealed specialist model weights.

Nucleus is the bake: the most product-shaped organ, a pipeline that consumes a compiled World (train/eval corpus plus a manifest pinned by corpus_sha256) over a file-only hand-off and carves the knowledge into a small model's weights via SFT and symbolic chain-of-thought distillation. It owns the seven-stage Super Skill Distillation Pipeline — ingest, KICE+TICE extraction, SCoTD synthesis, SFT+RAFT training, the adversarial swarm, three-gate certification, and an Ed25519 Nucleus Seal — and has its own compiled World (data/worlds/nucleus/) describing those stages. A baked model knows its domain by heart, so RAG of that knowledge compacts toward zero; this is the RAG-to-MEMORY transition. BUILT here on the engine side: the bake hand-off contract, the corpus expander, and pure seal verification (verifySeal). BUILT in the Nucleus repo: the pipeline plumbing, agents, and three-gate framework. ROADMAP: the training run itself — real weights on the M5 — which is the one bet. The bake is the moat.

There is exactly one source of truth per World — the gate-passed terms.json — and nothing promotes into it without a source.

The second standing rule names the one authoritative tier: only COMPILED is truth. RAW shards are available for reading and drafting but never authoritative; a term becomes truth only by passing the gate, which demands a source. The provenance law is non-negotiable — no term, no matter the domain or the pressure, promotes without a non-empty source — and the gate is the single implementation of that law, called everywhere and never re-implemented. This is what disallows drift into hallucination: a claim is truth only when sourced, and there is exactly one file, content-addressed by its hash, that holds the truth for a World. BUILT: the rule is enforced in code and byte-locked so it cannot be quietly forked. It is also the alignment mechanism for the workforce — humans and agents converge because COMPILED is the only thing either is permitted to treat as authoritative, which is precisely what makes automating the company safe.

The automation engine — a declarative, gated substrate of ephemeral agents that TEAM's plans compile down to, and that runs the knowledge lifecycle as desired-state work.

PaperAgents is the substrate the company's work runs on, and the engine beneath TEAM: a declarative, manifest-driven system that spawns short-lived, sandboxed agents to curate Worlds, verify facts, and drive the curation and bake pipeline. It is gated by construction — every agent's output must pass the provenance gate before it can become truth, so the workforce cannot promote what it cannot source. The agents are simple, inspectable, and portable: least-privilege, nothing persistent, secure by default, no heavy framework. The Librarian is one such agent (proposing RAW-to-COMPILED promotions); the Fact Steward is another (re-grounding terms against their sources). This very World was authored by a persona company in exactly this shape — visionary, architect, builder, qa. BUILT: the working agent abstraction and the persona pipeline that builds the products, plus individual workflows (researcher, skeptic, Librarian, Fact Steward). ROADMAP: the full declarative manifest-to-execution refresh scheduler that re-gathers and re-compiles continuously; today that loop is run by hand.

Every new capability is a port with a stable interface and a registry; a new adapter slots in with one register call and no edits to the port, gate, or types.

The fifth standing rule is how the system grows without coupling: a new capability is a port — a stable interface plus a registry with register, get, and known functions — not a fork of the core. The curation, bake, and verify seams all follow it, three independent port/registry pairs that throw on a duplicate or unknown id rather than fall back silently. Adding a backend — a new curation source, a new corpus expander, a new fact verifier — is one register call in an init module, with no change to the port, the gate, the types, or the scripts, and a conformance test parameterized by the registry proves the newcomer conforms. BUILT: the three port pairs and their conformance harnesses are live and tested. This is the architectural expression of assembly-not-invention at the code layer: capabilities compose like adapters into a socket, so the engine can absorb new ways of doing a thing without the old ways noticing.

The requirement that every term carry a citable source and every baked item trace its origin — the law that makes the corpus auditable and unlearnable.

Provenance is the discipline that every claim names where it came from. At the gate, a term promotes only with a non-empty source; at bake time, every training item carries its source string, its source slugs, and an origin marking it human-derived or synthetic. The 2026-06-11 work added optional license and holder fields to each source, so a World carries not just where a fact came from but the rights to use it — necessary for safe donation and open sharing. Provenance is what makes the system auditable and, crucially, unlearnable: if a source is corrupted or mis-licensed, filter it from the source closure, re-assemble (the gate catches the now-dangling edges), and re-bake (corpus_sha256 changes) — and the taint is provably gone. BUILT: gate enforcement, bake-time tracing, and a corpus-closure test asserting no item cites a source outside the World's closure. ROADMAP: the full unlearning workflow and indexed source retrieval. Provenance is the reason an autonomous loop here cannot drift into believing its own unsourced output.

The run organ — an OSS inference engine for running LLMs and baked SLMs on consumer hardware without full GPU residency.

QueueLLM is the runtime executor: the open-source inference engine, a sibling of ARAIL, designed to run large models — and the small specialists Nucleus bakes — without requiring the whole model to be resident in GPU memory. The motivation is hardware economics rather than ideology: memory is the scarce, expensive resource — and the one you cannot always buy at a sensible price — while disk is the cheap, abundant one, so the engine streams weights off SSD a layer at a time instead of demanding enough RAM to hold the model whole. Its thesis is a single binary with a deterministic lifecycle, real prefetch, sharded KV cache, and first-class speculative decoding — the properties that matter for a multi-day distillation run and for low-latency local inference. Pair model size with speed: a 7B specialist is measured at 43 tokens per second on the M5, the kind of number that makes a local-first loop livable. The standing rule is that the owned SLM runs the loop at runtime; the frontier model is only the build-time teacher, never the runtime. BUILT: the measured 7B@43 tok/s local-serving reality (today via Ollama for on-box serving and vLLM for teacher inference). ROADMAP: QueueLLM itself as the inference backend — it is a proof of concept whose HTTP bindings (Phase 2) must land before the pipeline adopts it.

A fully codified, local-first business that runs a knowledge lifecycle and turns sourced knowledge into owned model weights on consumer hardware.

QuKaiZen is not a single product; it is an operating model — a business of running knowledge pipelines whose every part is declared, versioned, gated, and owned. The name carries kaizen, continuous improvement: a loop that never stops — test, record, compile, retain, and around again. The thesis is that sourced knowledge can be matured through three states — RAW to COMPILED to BAKED — until it becomes the durable asset: owned, sealed specialist model weights that run locally. Five organs do the work: ARAIL creates and intakes, DaC serves, Nucleus bakes, QueueLLM runs, and PaperAgents is the workforce. The baked specialist SLM is the value add; everything else is the factory that makes it. BUILT today: the factory and its five organs as engine-side plumbing and live compiled Worlds. ROADMAP: 'the one bet' — the measured bake proving a small specialist beats the frontier in-domain on consumer hardware. The framework is proven on ourselves; this World is the proof of that — QuKaiZen describing QuKaiZen in its own compiled-World format.

The unverified working tier — drafts, hypotheses, sensor data — available for reading but never authoritative until sourced.

RAW is the scratch layer: arXiv claims, agent drafts, camera frames, candidate terms. It is allowed to be wrong. RAW knowledge is available and traceable but never carries the name 'truth'; it lives in raw/ shards and the inbox, and it promotes only by passing the gate, which demands a non-empty, citable source. This is the rule that keeps an autonomous loop honest: a hypothesis stays RAW until sourced evidence supports it (see gate-reality-anchor). The two RAW streams — knowledge and observations — both land here, the first as term candidates, the second as grounded evidence. BUILT: the RAW tier and the gate that adjudicates promotion; the rule 'no promotion without provenance' is enforced in code. ROADMAP: the observation stream as a live sensor feed (plant-vision integration). RAW is where the system is permitted to be uncertain — and the gate is why that uncertainty never silently becomes belief.

The deliberate stance that our knowledge is symbolic, sourced, and gated — chosen for interpretability, auditability, and unlearnability over learned latent structure.

This is the design decision that situates QuKaiZen among world-model approaches: our representation is symbolic (human terms, explicit edges, declared categories), provenance-gated (every claim sourced), and never latent. The payoffs are concrete. Interpretability: a term in terms.json can be read and contested by a human; a latent embedding cannot. Auditability: a corrupted source is found by inspecting the source closure and re-running the gate. Unlearnability: filter a tainted source, re-assemble, re-bake, and corpus_sha256 changes — the taint is provably gone, which is far harder to do from inside learned weights. Safety: the gate is a standing defense against hallucination and self-delusion in autonomous loops. BUILT: this is a committed choice, demonstrated by live symbolic Worlds at scale. It is the through-line that connects the gate, provenance, and the reality-anchor — and it is what makes the bake honest, because the weights it produces can always be traced back to a readable, sourced World.

The orchestration organ — a local crew of agents that teaches, explains, answers and maintains, turning a compiled World into work you can hand off.

TEAM is where a compiled World becomes work. It is a crew of local agents organised around four verbs — teach, explain, answer, maintain — of which teaching is the load-bearing one: correcting the crew once turns that correction into a rule it keeps, which is the difference between getting an answer and acquiring the ability to get that answer. The crew reasons from a World's gate-checked terms and cites them by hash, so its answers carry the same provenance the corpus does, and it escalates rather than guesses — an anomaly it cannot resolve becomes an open question awaiting a human verdict, not a confident fabrication. Sharing moves rules, never data: a categorizer travels to someone else's machine while the records behind it stay home. PaperAgents is the automation engine underneath — a plan TEAM forms is validated by pactl before it runs. BUILT: the four verbs and the local crew, running on the developer's own machine. ROADMAP: having PaperAgents drive those plans on a schedule rather than on request.

The single compiled file per World — { version: 1, terms: [...] }, A–Z sorted, deterministically serialized — read as both dictionary and corpus.

terms.json is the artifact at the center of everything: the gated, sourced corpus for a World, shaped as { version: 1, terms: [...] } with the terms sorted A-to-Z by display name and serialized by one canonical formatter (serializeCorpus in src/curation/port.ts) so the bytes are reproducible. Each term carries slug, term, category, short, definition, example, related, and source, plus optional aka. It is the portable boundary: every consumer — the site, the agents, Nucleus — reads this file and none imports another, so the file is the interface and the file is the truth. Because the same bytes read two ways, it is at once a human-readable dictionary and a machine corpus. BUILT: compiled Worlds ship terms.json in git; determinism is tested, not claimed — re-running the assembler produces byte-identical output or fails the --check. It is also content-addressed in practice: corpus_sha256 is the hash of these exact bytes, which is how a baked model is pinned to the knowledge it learned.

Nucleus's bake is the seam between symbolic provenance-gated Worlds and weight-space models — distilling a readable World into owned weights that stay pinned to their source.

The bake is where the symbolic and the weight-space worlds meet honestly. A compiled World is symbolic and sourced; the bake (Nucleus) distills it into a small owned model via SFT and symbolic chain-of-thought distillation, producing weight-space capability. Crucially, this is not a latent world model: it is a symbolic World compressed into weights while remaining auditable, because corpus_sha256 pins the model to the exact source bytes and the source closure records what it was trained on. So the bake is the bridge the research radar names — the place where our interpretable, gated knowledge becomes the fast, internalized recall that weight-space models are good at, without surrendering provenance. BUILT: the engine-side hand-off and seal verification that make the bridge auditable. ROADMAP: the training run itself, which crosses the bridge for real. The reason this matters: it lets the company keep the auditability of symbols and gain the wisdom-per-watt of weights, instead of having to choose one.

A compiled World is table stakes; the owned, sealed specialist SLM is the differentiator — and the single bet the company is making.

Anyone can compile sourced knowledge into a World — that is table stakes. The moat is the bake: an owned, sealed, local specialist model that knows its domain by heart and answers without a cloud round-trip. It is called the one bet because everything else — the gate, the assembler, the curation and verify ports, the corpus export — is reusable, commoditizable infrastructure, while the baked model's in-domain recall and reasoning are the actual customer value. The threshold for shipping a baked specialist is proven on-device performance, measured and labeled honestly, not claimed. BUILT: the thesis and all the engine-side plumbing up to the bake. ROADMAP: the bake itself — the measured training run on consumer hardware that demonstrates a small specialist beating the frontier in-domain. This is deliberately the thinnest, riskiest part: the whole business is structured so that if the bake works, the moat is real, and if it does not, the failure is honest and visible.

The interface between the engine and every consumer is a file on disk — hand over compiled artifacts, not runtime imports.

The third standing rule fixes the seam: the engine (the press) never imports a consumer (the reading room) at runtime, and vice versa. The press writes terms.json; the site, the agents, and Nucleus read terms.json; no runtime import crosses the line. This keeps the engine independent of any reader, keeps readers able to run offline, and makes the artifact portable — a user can download a World and load it without the engine running. The same shape governs the bake seam: DaC writes a request and corpus into a hand-off directory, Nucleus reads them and writes a result back, with no shared code or runtime coupling. The honest phrasing of the benefit, for visitors, is affirmative — 'each World keeps the lines its owner draws.' BUILT: the boundary holds across the live system; consumers source the same file and none import each other. The lesson is that a file is a stronger, more durable interface than an import — it cannot break when the other side changes.

The registry that lets any curation backend build a World through one stable interface — a new adapter slots in via a single register call.

The curation port (src/curation/port.ts) is the seam that makes the World-factory pluggable. It defines a CurationAdapter interface — given a WorldContentSpec and a shard root, produce { terms, gate, serialized } — and a registry with register, get, and known functions that throw on a duplicate or unknown id rather than fall back silently. The canonical serializer is exported so no adapter can drift in its byte output, and a conformance harness checks that adapters produce byte-identical corpora for the same World. The shipped local-claude adapter reads verified/ and raw/ shards from disk, validates required fields, closes the graph, sorts, and gates. The same pattern repeats for the bake and verify ports — three independent capability seams. BUILT: the port, the registry, the local-claude adapter, and the conformance tests. A new backend — a Markdown reader, a database importer — registers itself in one call with no edit to the port, the gate, or the types: this is the ports-and-adapters principle made concrete.

The validator that re-grounds a term's claim against its cited source — the loop that turns a fix into 'a pull request for a fact'.

The Fact Steward is DaC's quality conscience, backed by the verify port (src/verify/). The port defines two swappable seams — a Retriever that searches a World's source spans and a Verifier that decides whether those spans entail a term's claim — with the same throw-on-unknown registries as curation and bake. Its worklist is a bus topic: spelling and syntax fixes flow on an auto-deterministic lane (applied and logged, no human), while semantic changes flow on a proposed lane (queued for approval) — the loop the team calls 'a pull request for a fact'. The Steward is propose-only by design: it never silently rewrites truth. BUILT: the verify port, a heuristic-entailment verifier, and a BM25 retriever. ROADMAP: the standing always-on service, an LLM-judge verifier, and a vector retriever — and the Librarian SLM as the model that runs it. It is how drift stays detected and reconciled rather than silent: facts are re-checked against their sources, and proposals — not edits — are what reach a human.

The single owned law that promotes RAW to COMPILED only when three invariants hold: closed graph, sourced, declared category.

The gate is the reality-anchor in code: a pure, total function (src/gate.ts) that takes a terms array and the declared category set and returns a structured GateResult — never throwing, never exiting — so each caller maps the verdict to its own exit code. It enforces three laws at once. Closed graph: every related edge must resolve to an existing slug (dangling edges are reported). Provenance: every term must carry a non-empty source (unsourced slugs are reported). Declared category: every term's category must be in the spec's set (undeclared categories are reported). All three must pass for ok to be true; that is the boundary between RAW and COMPILED. The standing rule is absolute — never re-implement the gate, call it — and tests byte-lock it against the mainline so it cannot be silently forked. BUILT: the gate runs on every assemble and bake; multiple Worlds have passed it. It is the law the whole business is built to obey, and the one component no organ is allowed to route around.

An agentic loop is safe only because hypotheses stay RAW until sourced evidence supports them — the gate is what keeps autonomy tethered to reality.

An autonomous agent that proposes hypotheses, explores out of curiosity, and updates its own beliefs can drift into self-reinforcing delusion if it learns from its own unverified conclusions. The gate is the tether: a hypothesis is RAW — available, not truth — until sourced evidence supports it, and only a merge through the gate promotes it to COMPILED. For plant-vision the plant itself is the oracle, so the sovereign dataset is self-sourcing: a timestamped observation is grounded evidence, and a hypothesis stays RAW until the plant's observed history correlates with conditions sourced in the compiled World. This is the safety property that lets the company run a WorldLLM-style theorist loop on an owned SLM without it hallucinating itself into confidence. BUILT: the gate and the RAW tier. ROADMAP: the closed autonomous loop and the Theorist running on the owned model. The principle is the difference between an agent that discovers and one that deludes — the gate is why ours can be trusted to keep learning.

A planned Nucleus-distilled 1–3B specialist that bakes the SKILL of DaC's operations — classify, propose a sourced edge, catch the unsourced, route, serialize — and ships on the edge.

The Librarian is the model DaC plans to ship with: a Nucleus-distilled small specialist that internalizes the skill of running the engine, not the contents of the Worlds. It is a cartographer, not an encyclopedia — it classifies a term into the taxonomy, proposes a sourced subclass-of or part-of edge, catches a dangling or unsourced claim, routes a query to the smallest sufficient World, and serializes to spec — while the world contents stay gated and retrieved at runtime. That split dissolves two worries: bloat (a skills SLM is one-to-two gigabytes, not memorize-everything) and licensing (it redistributes taxonomic competence over a permissive base, never weights that absorbed proprietary source content). Its curriculum writes itself: every gate decision is a labeled example — sourced edges are positives, refused promotions are negatives, Fact Steward accept/reject pairs are preferences. STATUS: all ROADMAP. The falsifiable thesis — that a 1–3B Librarian beats a frontier generalist at its niche — is a graduation gate, proven or killed by Nucleus's three-gate certification, never rendered as live. Today, larger models do the world-builds.

The two distinct sources of raw material — sourced knowledge and grounded observations — that follow different paths; photos never become World terms.

Raw material enters on two streams that must not be confused. The knowledge stream is research — papers, docs, expert drafts — flowing toward sourced terms in a compiled World. The observation stream is sensor data — camera frames, time-series, VLM-derived captions — flowing toward grounded evidence, not terms. The load-bearing rule: photos never become World terms. An observation is matched against compiled sourced knowledge to emit a derived reading; it is evidence that supports or refutes a hypothesis, feeding the autonomous loop, but it never enters the dictionary as a fact in its own right. For plant-vision the plant itself is the oracle: its observed history is self-sourcing evidence, which is why the sovereign dataset can ground an agentic loop safely. BUILT: the knowledge stream (live sourced Worlds). ROADMAP: the observation stream as a live camera/sensor feed and its grounding pattern. Keeping the streams separate is what lets the system learn from pixels without ever letting pixels masquerade as sourced truth.

The yield metric — durable, owned capability minted per unit of energy — and, at the sensor, a design where sampling rate tracks information rate.

Wisdom per Watt is how the business measures its yield: permanent, deployable capability sharpened per unit of compute and energy invested, as knowledge flows RAW to COMPILED to BAKED. A baked term that costs nothing to recall is infinitely wiser per watt than one that needs a network round-trip, which is why the cost curve bends downward as knowledge internalizes into weights. At the sensor it has a concrete name — 'the camera breathes': sampling rate is proportional to information rate, so a calm plant earns about one frame a minute or slower while a deviating trend earns faster breaths. Battery efficiency is therefore not an optimization detail but the product itself, and a named design principle. BUILT: the framing and the measured local-serving numbers that ground it (a 7B specialist at 43 tok/s). ROADMAP: the adaptive-sampling hardware loop for plant-vision. The principle pairs model size with speed and energy with permanence — capability you keep, paid for once.

The content contract that declares a World: slug, display name, the closed set of categories, and the knowledge sources.

WorldContentSpec (src/types.ts) is the minimal contract the engine owns for declaring a World. It carries the slug, the display_name, an ordered list of categories (each an id the gate will check against and a human label), and knowledge_sources (each with a kind, a citation ref, a trust level, and optional license and holder for safe attribution). It is plain JSON — importable without a framework, side effects, or filesystem access — which keeps the declaration portable and lets both the assembler and bake-corpus read the same spec. The categories list is load-bearing: it is the declared set against which the gate enforces the category law, so a term in an undeclared category is refused. BUILT: specs drive every live World; the type is stable and the license/holder fields make donation and open sharing safe. Declaring a spec is the first move of assembly-not-invention — you say what the World is and what it draws on, then author the sourced shards that fill it.

We adopt WorldLLM's theorist-curiosity-update loop and add the gate as the reality-anchor the framework lacks.

WorldLLM (arXiv:2506.06725) frames an agent that proposes hypotheses with a Theorist, runs curiosity-driven exploration to test them, and refines via Bayesian update. QuKaiZen's relation is ADOPT-AND-EXTEND: the causal loop is taken on directly in DAC_ENGINE.md, but where the framework leaves the loop free to update on its own conclusions, we insert the gate — a hypothesis stays RAW until sourced evidence supports it, and only a gated merge makes it COMPILED truth. That is the seam: our addition is the reality-anchor (see gate-reality-anchor) that keeps autonomy tethered. We also differ in objective — WorldLLM optimizes for discovering novel theories of an environment, while we optimize for reliable, sourced, auditable reasoning inside a bounded domain. BUILT: the gate, our half of the bridge. ROADMAP: the closed loop and the Theorist running on an owned SLM. The honest summary: we borrow the loop's shape and supply the safety it does not, then run it on a small owned model rather than a frontier one.