The long-form sections of the front page, each with the command that regenerates it.
Moved here on 2026-10-13 to shorten the front page. Every claim keeps the command that regenerates it; the proof ledger states what is CLOSED, BACKED, SCOPED and not validated.
Four design principles
CAPAS makes scientific claim evaluation auditable, repeatable and ready to integrate.
Deterministic verdicts
The same claim and evidence bundle always produces the same verdict, with no probabilistic outputs and no model drift. Schema v3 rules are the single source of truth.
No randomnessSchema-validated structure
Every payload is validated against CAPAS Schema v3 before the verdict. Field types, required keys and claim-type constraints are enforced at the gate boundary.
CAPAS Schema v3Full provenance trail
Every REJECT and HOLD verdict includes machine-readable provenance blockers, exportable as structured JSON: licensing flags, reproducibility gaps, attestation failures.
Audit-readyZero LLM dependency
CAPAS does not use language models for gate decisions. Deterministic rule functions, 26 cross-domain invariant gates plus per-claim-type evidence contracts, compute every verdict offline. Every decision carries a re-derivable audit_hash.
Generation systems answer “what can I say”. CAPAS answers “should this have been said”.
Frontier models and agents generate claims. Adjacent systems each cover one slice: LLM judges score truth stochastically and without replay, fact-checkers assess truth rather than the claim boundary, domain validators such as Pinnacle 21 cover one field. None decides, deterministically and replayably, whether declared evidence licenses a claim before reuse. The engine registers 14 claim types; any other type returns HOLD.
| System | Generates claims | Gates claims |
|---|---|---|
| GPT · Claude · Gemini | ✓ | ✗ |
| Deep-research agents | ✓ | ✗ |
| LLM-as-judge | ✗ | stochastic · no guarantee, not replayable |
| Fact-checkers | ✗ | truth, not boundary |
| CAPAS | ✗ | ✓ deterministic · replayable · fail-closed (test-proven) |
The contamination cascade
Without a claim-level gate, drift survives source review, metadata review and provenance review, because none of them evaluates the claim boundary itself.
One mechanism. 10 domains. 26 gates.
A fabricated claim still has to satisfy the conservation laws of its field, and those laws are re-derivable without an oracle. The same engine catches a balance sheet that does not close and an impossible survey mean (GRIM). It catches a 99%-sensitive test read as 99% PPV for a rare disease, an unbalanced reaction, a non-dimensional equation and a qubit with T2 > 2·T1. A number that breaks a domain law forces REJECT; the check is downgrade-only. The fail-closed invariant is test-locked: 18/18 structurally deficient claims kept out of ACCEPT.
The engine re-computes the claimed result from its raw inputs.
Above the schema gate, CAPAS re-computes the claimed result from its raw inputs. What it reproduces it marks GATE. What it cannot re-derive it marks ATTEST: signed and bound, never presented as verified. The boundary is explicit on every receipt.
GATE = re-derived and reproducible. ATTEST = signed, not verified. CAPAS certifies computational consistency of the re-derivable slice, not scientific truth or the authenticity of raw data (the GIGO residual).
Every claim carries the command that regenerates it.
CAPAS is a fail-closed gate: a verdict on the structure of the evidence you submit, with no language model in the decision path. Each line below names its command.
- Never returns ACCEPT for a structurally deficient claim (18/18 deficient cases held).
python3 benchmarks/verify_fail_closed.py - Never crashes on hostile or garbage input: fails closed and returns one of the four legal verdicts.
python3 benchmarks/test_dynamic_fuzz.py - Survives a 20-payload hostile battery (malformed, injection, oversize, SSRF) with no false-accept.
python3 benchmarks/verify_robustness.py - Every HOLD carries an actionable resolution (7/7 paths).
python3 benchmarks/verify_hold_has_resolution.py - Every verdict carries an audit hash a third party re-derives from the published recipe; altering any load-bearing field changes the hash.
python3 benchmarks/verify_audit_hash_reproduces.py - The engine's rules are published as data: 98 rules in
docs/rule_table.json. Every certificate names the rules that fired, and 3,018 recorded decisions replay from the table to the same verdict.python3 scripts/gen_rule_table.py --check - An independent checker,
capas_check.py, written fromCERTIFICATE_SPEC.mdby a session that never read the engine, accepts all 238 sealed certificates and rejects 1,190 of 1,190 mutated traces. The same model provider wrote it, in a separate session.python3 -m pytest benchmarks/test_capas_check_mutations.py
- Anytime-valid Type-I guarantee, in simulation: empirical false-reject ≤ α=0.05 under the null. This is a Monte Carlo run; it is not a test-locked invariant.
python3 benchmarks/demo_sequential_typeI.py - All 26 cross-domain invariant gates produce a live verdict.
python3 benchmarks/generate_capability_matrix.py - The Gate App decides with the Python engine via
/api/decide(single and batch); its served contract regenerates fromcapas.py. The in-browser JS replica is not the engine: it agrees on 130/233 sealed payloads and runs only offline, where it returns HOLD.python3 benchmarks/verify_gate_contracts_match.py - The 10 load-bearing invariants all hold, with a reproducible result hash.
python3 benchmarks/conformance.py - N=1238 decisions across the grid’s 12 claim families (12 of the 14 registered types) exercise the ACCEPT/REWRITE/REJECT/HOLD space. This is coverage of a synthetic grid, not a reject rate measured in the field.
python3 benchmarks/family_decision_mix.py - The pharma admissibility contract is fail-closed over a synthetic n=3024 corpus; this is not a measured market rate.
python3 benchmarks/generate_pharma_corpus.py - Inside the engine, downgrade-only: source-file re-hash, a guard band when uncertainty is declared, a retraction snapshot, field-level pre-registration adherence and an AI-use declaration.
python3 -m pytest benchmarks/test_plan3_rules.py - Pharma: a validator report's technical rejection precedes any statistic. Tested on synthetic Pinnacle 21-style reports only.
python3 -m pytest benchmarks/test_pharma_validator.py
- The n=28 retrospective separated retracted from replicated published claims by structure; the corpus is agent-coded from public retraction records, not blind-adjudicated.
python3 benchmarks/pilot_real.py - Signed provenance: a Sigstore signature binds the commit, the conformance result hash and a live verdict into one packet hash. A signature over a CI result is not a scientific validation.
python3 benchmarks/attest_conformance.py - Re-derivable by a third party from public redacted files. Blind self-gating corpus (research claims, 2026-10): 233 claims written by AI sessions in a sister project’s repository, file and commit recorded per claim, coded blind by a separate session. 50 were excluded as contaminated because the coder could see the outcome; 183 were scored. Engine frozen at a git tag before coding; verdicts sealed by sha256 before outcomes were opened; double-counted. Blind X1–3 (v1 seal): bad-not-ACCEPT 53/82, good-not-REJECT 51/63, Wilson 95% [0.54–0.74] and [0.70–0.89]. A v2 re-run four minutes later (one rule change, outcomes-opened flag not recorded) gave 52/63. Out-of-sample X4+X5: 17/21 and 16/17, Wilson 95% [0.60–0.92] and [0.73–0.99]. Outcomes are the project’s own later corrections, not an external oracle. These figures belong to the engine frozen at the sealed tag. Any re-score of X1–X5 with a later engine is in-sample and is never published as the blind rate; a new rule earns credit only on the next sealed batch (X6). The blind performance of the current engine is unknown until then. Verdicts, labels and evidence fields are public; each claim text is a sha256 hash. Replayed at each tag, the redacted payloads reproduce 232 of 233 verdicts; the one that does not, X4-014, depends on the wording and is excluded as contaminated. The sealing times were recorded by the author.
python3 research/ginibre_corpus/score_public.py --replay - Coder agreement:
steps_all_valid, coded twice blind on 22 X1–3 proof claims, agrees 13/22. Retroactive, in-sample and self-run; kappa is not informative because the 22 were selected on the first coder's value.python3 research/ginibre_corpus/coder_agreement_retro.py --public - Pre-registration of CAPAS against LLM judges on sealed batch X6: six pass/fail criteria fixed before any data, co-signed by a Google model after 8 rounds and 21 blocking objections. Not yet sealed; no data exist.
python3 research/x6_prereg/check_cosign.py
The GIGO ceiling. CAPAS decides on the structure of evidence, not ground truth: a self-consistent, well-formed, fabricated payload can pass the gate. The fuzz and pedagogy-governance tests report this residual as a disclosed false-admit. The gate raises the cost of lying and makes every verdict re-derivable; it does not detect a careful liar.
- CAPAS is not a fraud detector; the measurement follows. On 888 clean control papers versus 6,348 papers retracted for data, recomputable numeric inconsistencies did not separate the groups: 2.13% severe in clean, 1.58% in retracted. No oracle-adjudicated fraud-detection rate exists; the measured figure is the blind self-gating corpus above.
python3 research/retraction_audit/grade_severity.py - Cross-model adversarial review (GOVERNANCE §6, eight runs, 2026-10-13): a model of another family attacked 7 of 10 claims and refuted 3: a scope false-accept, an unsealed figure, an unversioned grading rule. Each was corrected and frozen as a test or a sealed file the same day. Transcripts in
research/section6_package/. Nothing is marked proved. - The cross-domain blind-adjudication study (Gap-1) has not been run. Its registry, receipts and gating are built and pass (
python3 benchmarks/study_assembly.py); the n≥500 human-adjudicated comparison is pre-registered, not yet executed. - No SOC 2 / ISO 27001 certification. Roadmap, not held.
- The head-to-head is retired as evidence. Against the real LLM judge the two tied on a 10-claim corpus; the UMA, BTS and EigenTrust baselines were Krenn·IQ models.
If a command above does not reproduce its stated result on your machine, that is a bug. Report it.
Illustrative retrospective on 28 retracted and replicated publications
28 claims, each peer-reviewed and published in Nature, Science or The Lancet. 14 were later retracted (Wakefield, Surgisphere, Schön, STAP…); 14 were independently replicated (LIGO, Higgs, RECOVERY dexamethasone…). An agent that knew the outcomes coded the corpus.
Each retracted claim was held for its structural deficiency: no controls, no independent reproduction, unauditable data. Scope: an illustrative retrospective coded from public retraction records; it validates the gate’s structural logic, not fraud detection from raw paper text. Partner pilots pending.
Where teams deploy CAPAS
One first market and one second surface. The site argues one market.
Regulatory compliance
Generate structured audit trails for claims in regulated industries. Every verdict is machine-readable, timestamped and exportable.
AI training pipelines
Validate claim-evidence pairs before they enter training datasets. Prevent inadmissible or unlicensed scientific claims from corrupting model training.
A verification layer around your LLM.
An installable verification layer: your model proposes, CAPAS disposes. It never returns ACCEPT for a claim whose required evidence fields are missing or contradicted (18/18 held). On blind claims, 4 of 21 bad out-of-sample claims were accepted.
The gain is reliability, not capability: the output becomes admissible or deferred. Scope: CAPAS grounds record↔text, not text↔reality; a source that misreports its methods and withholds its data passes (the GIGO ceiling).
CAPAS exposes one engine through three surfaces
The same deterministic engine, exposed three ways. CAPAS is never the language model; it is the fail-closed layer the model proposes into.
Library · pip
Wrap your LLM in code. gate · reward · certificate · invariants · gate_quantum.
live on PyPI
Skill · MCP server
A tool any agent calls: Claude Code, Desktop, Cursor. Zero dependencies. The agent proposes, CAPAS disposes.
API · signed certificate
Hosted, auth-gated issuance of a signed, persisted, tamper-evident admissibility certificate: the audit artifact a regulated buyer purchases.
IBM’s production calibration system runs the same pattern: invariant checks, threshold gates, a fail-closed verdict and a disclosed boundary.
A vendor’s headline figure under-states its own error budget, re-derived from its published fields and two declared assumptions.
IBM’s headline gate-error figure is an optimistic lower bound; for structured circuits it under-states by 3–10× (Proctor, Nat. Phys. 2022). From the same published calibration fields and two declared assumptions, CAPAS re-derives the complete error budget without hardware.
Scope: on one ibm_fez pair (q9–q10) the re-derived per-layer floor is 11.4× the vendor’s headline CZ error, about 2× on typical pairs. Idle time (300 ns) and residual ZZ (50 kHz) are declared assumptions, not published fields. The 3–10× band is a cited Proctor range. On a second device, ibm_kingston, CAPAS re-found the chip’s one anomalous qubit (Q121) and its bad-coupler cluster from calibration alone. It admitted a Bell measurement of 0.045 against a re-derived floor of 0.020 (≈2.2×). Both oracles read IBM’s public data: a consistency check, not an independent audit. Full method →
Audit of a submission-stage paper: the gate flagged one verified slip in a 13-row table.
CAPAS parses a paper’s tables from the PDF with deterministic text extraction; no language model re-types the numbers. It re-derives every closed-form claim from the paper’s stated formula and flags any tabulated value that conflicts with it. On an inverse-Ginibre random-matrix paper with a 13-row coefficient table, it re-derived all 13 rows. It flagged one whose tabulated prediction diverged from the closed form by 2.6%: a referee-relevant slip, invisible inside the self-consistent row.
Scope: an internal-consistency check of a tabulated number against the paper’s own closed form; it is not a correctness proof. The paper’s theorems and open conjecture are out of scope. The extraction is deterministic: the same parse on the same PDF gives the same row and the same flag.
The same gate pattern appears in a quantum vendor’s calibration stack. The parallel comes from public documents; it is not a validation of CAPAS.
IBM’s quantum stack checks every job against frozen, re-derived device invariants before it runs, fail-closed, with no model-of-the-day in the decision. CAPAS applies the same discipline to declared evidence across ten domains. The parallel was read from IBM’s public documentation. IBM does not run CAPAS, has not reviewed it and took no part; the comparison, the ibm_kingston audit and the Atlas run are Krenn·IQ work.
Scope: the identities are textbook and the engine is open (Apache-2.0); the parallel validates nothing by itself. On a calibration value that stays unchanged and is then reported as operational, CAPAS applies the more conservative, fail-closed disposition. Krenn·IQ is not affiliated with or endorsed by IBM.
Re-derive it: examples/kingston_live_audit.py audits the live device; benchmarks/kingston_real_bell_verdict.json checks a Bell measurement against IBM’s own calibrated noise model, both from IBM public data. The defensible asset is the self-run conformance mark and the signed certificate, under a governance charter that pre-commits the mark to neutral governance: binding in direction, not yet legally executed; the trustee is an open item.
The intended asset is a conformance mark and a signed certificate that a buyer re-runs rather than trusts. It requires an executed charter and third-party adjudication; neither has happened yet.
CAPAS is built so that trust rests on re-runs rather than assertions. Every verdict re-derives to a hash an independent party can reproduce. Every headline claim is CLOSED / BACKED / SCOPED in a public ledger that discloses which numbers are synthetic. The mark attests only that an artifact passed a suite you run yourself with the same verdict and hash, issued as a signed, content-addressed certificate. A competitor can copy a gate in a week; it cannot copy a self-run conformance mark, a signed-certificate audit trail and a relicensing posture renounced in writing. Whether this becomes the reference standard depends on an independent external audit, which has not been done.
Open engine, with a charter that pre-commits the mark to neutral governance.
CAPAS ships open-core under Apache-2.0: schema, calculus, reference gate, CLI, tests and benchmark corpus are free to run and fork. The defensible asset is the certification mark, and a mark earns trust only if it cannot be withdrawn. CAPAS is used as a project name; no trademark is registered. The charter pre-commits the mark to neutral governance before adoption. That commitment let Open Policy Agent survive its sponsor’s acquisition. Elastic, HashiCorp and Redis were forked after relicensing; MongoDB lost its OSI standing. Krenn·IQ renounces that option in writing. Governance charter →
Reproducible conformance: python3 benchmarks/conformance.py runs the certifier’s suite and returns the same verdict and hash. The mark attests that an artifact passed that suite. Certification & how to certify →
Open credentials, each one re-checkable.
Each badge links to a verifiable source: a passing workflow, a published score, a signed release or a re-derivable hash.
Quantum-calibration credential: CAPAS checks reported quantum-device claims against textbook invariants; on IBM’s 156-qubit ibm_kingston calibration it re-found only the known anomalies (Q121, the bad-coupler cluster) with 0 false flags. The parallel with IBM’s calibration gate comes from public documents, not from a partnership, an endorsement or an independent validation. The IBM parallel →
OpenSSF Best Practices Badge: passing (100%), self-certification plus static and dynamic-analysis criteria. The badge links to the live bestpractices.dev project and updates itself.
Statistical-claim admissibility for regulated submissions.
Pinnacle 21 checks whether a trial dataset is structurally well-formed (CDISC conformance), not whether the reported statistic is licensed by its evidence. CAPAS checks that: significance versus alpha, multiplicity, confidence interval excluding the null, effect direction, endpoint pre-specification, re-derivably and beside the submission. The pharma gate is a library function (capas_pharma.gate_pharma_stat_claim), not on the hosted API. On a 3,024-case synthetic admissibility corpus it accepted 0 deficient claims; this is contract coverage of the space P21 skips, not a false-accept rate on production submissions. Market validation →
- CAPAS returns verdicts on structured evidence supplied by users. It does not certify scientific truth or replace external review.
- The engine ships 26 deterministic gates across 10 domains; unsupported domains HOLD until a team defines a new evidence contract, admissibility policy, and audit artifact.
- CAPAS does not use language models at decision time; every gate decision is deterministic and traceable.