CarnacPrompt™ evaluates a request as it forms. Carnac™ can evaluate the request and its output at the stages connected to your workflow, including a check before an effect commits. The integrated policy determines the required evidence and route at each supported stage.
Choose a scenario to follow its example routing path, or let the display cycle. The input checks appear on the left and center; the resulting routes appear on the right. Routing levels are illustrative and depend on the deployment.
CarnacPrompt covers request formation. Carnac covers the workflow from submission to the point before an effect commits.
It reads the request as a person types it or as an agent builds it, before it is ever submitted. Because it read consequence early, it can stage the response before the model runs.
Carnac evaluates the submitted request, the developing answer, and values that become available before an effect commits. This allows the configured response to change when new information matters.
Consequence is not always visible at the start. A request to summarize a file is ordinary until the summary contains a diagnosis. So the work is read at four points. The disposition is the record and the response that follow. It is the result of the reads, not a fifth read.
CarnacPrompt reads the request as it forms, inside your boundary, and can intervene before the model ever runs.
A cheap read on every request. It also flags work that might turn consequential later so the output read knows to watch.
Runs where the input read flagged it or the domain is watched. It catches consequence that appears mid run.
Reads a late known value, like a dose or a transfer amount, right before the effect acts, for effects that policy gates.
What was routed, what was escalated, who was asked, and what they decided is recorded as a signed disposition, whether they acted or not. If a later read scores higher than an earlier one, Carnac re routes to the stronger response and seals the whole request back to the start. The record then shows where it turned serious.
Carnac dispatches each read to one or more responses, proportioned to consequence. A chatbot proves almost nothing. A surgical robot proves almost everything. The decision lands in the right place on its own, and each response calls a real Canon primitive underneath.
A configured capture path can retain a decision breadcrumb. The public sandbox does not persist one.
independently checkable evidence that it happened, with depth scaled to the stakes.
Check against a named authority and attest the check. It never certifies the underlying fact.
Route for a confirmation before the effect completes, and record who approved.
Bind the severity into the signed artifact, carry an escalation obligation, and record the disposition. A critical request can fire several responses at once.
This lab sends your readable text to the Hive Carnac service at /v1/carnac/sandbox for classification. It shows the returned decision and requests a separate signature check from that Hive service. The sandbox does not dispatch external effects or write a durable decision record. Service and processor log retention have not been established here, so use non-sensitive examples. If the service is unreachable, unsigned keyword rules run locally with reduced coverage. Routing levels depend on the deployment.
Formation read · CarnacPrompt assesses a request as it forms
Use non-sensitive text. Hive receives readable content for classification. This sandbox does not dispatch effects; log and processor retention remain unverified.
Output read · Carnac catches consequence that appears mid run
Both fields reach Hive as readable text for classification. Use non-sensitive examples. This sandbox does not dispatch effects; log and processor retention remain unverified.
Edit both fields. The same local rules read the request as it forms and read the output as it lands, so you can watch an ordinary request become consequential in its result.
This reference set recognizes named signals only. It still misses consequence carried by meaning with no listed keyword. A request like "reconcile these two spreadsheets and keep only the rows that changed" can carry real consequence and matches no rule here. The trained classifier reads that by meaning. This reference set will not. That gap is the whole point.
CarnacPrompt™ and Carnac™ classify requests and outputs. A configured deployment can attach a Howler™ to a high-consequence decision and retain captured decisions in its ledger. The sandbox demonstrates classification without durable capture.
When a classification lands at or above the severity threshold, its severity and features are bound into the signed artifact, not stapled on after. An escalation obligation rides with it to a person, a monitor, or an incident channel.
It is a signed, independent record that the classifier produced and signed a high consequence classification state from the features it observed on that path at that time, and that an escalation was owed. It forces visibility and records the response or the lack of one. It does not compel action, and we do not claim it does.
A configured decision ledger can record that a request was seen, classified, and on what basis. Periodic seals require a deployed capture and storage path. This public sandbox does not write that ledger.
Completeness requires comparing expected events with captured records and identifying gaps. A decision record describes the classification. It does not by itself prove the request executed or that every request was captured.
Carnac and CarnacPrompt are the two gates that run today. The Evidence Plane is the layer above them. It is how the same receipts hold up across many requests, many machines, and many vendors at once. Some of this layer is now built and tested as backend capability, and some is still design. We mark which is which in the honest status below and never blur the two.
Every part of a request carries where it came from, such as the operator, the person, a retrieved file, or a tool result. A rule can then honor instructions only from the parts allowed to instruct.
Many requests seal into one batched signature, so the proof gets cheaper per request as volume grows. A single missing batch is still a provable gap.
One chain follows a session that starts on one model and finishes on another. Switching vendors does not cost you the record.
When one agent hands work to another, each handoff is a signed link and scope can only narrow, never widen. The full delegation tree is there at check time.
Signing once over a batch keeps the hot path clear while every single receipt still verifies on its own, offline.
Each receipt says honestly whether running it again would mean anything, from fully repeatable to not repeatable. No overclaim about what re running can prove.
We keep these three apart so nobody has to guess. The proof mark never shows for anything we cannot prove.
The reference implementation contains classification, decision signing, disposition and verification routes. The lab exposes the response and its separate verification result. Source tests do not establish deployment acceptance, durable capture or recovery. Each customer connection needs those checks for its exact release and configuration.
A customer connection begins with a scoped API integration and endpoint-specific acceptance tests. Review the developer capability record before selecting a verifier, algorithm or storage requirement.
Some of the Evidence Plane is still design, not yet built. That includes one chain that follows a session across two different vendors, routing that changes with the stakes of the request, and a single policy object that travels between vendors. We describe these as direction, never as a live feature.
We are precise about scope rather than promising that nothing anywhere can slip by. These limits are stated on purpose, and the control model is built around them.
These gates protect the paths they sit on. Work that never crosses an instrumented path is not seen by them. Carnac can only hold an effect that routes through it.
A hook sees what crosses it. A gateway can enforce configured effect paths when all relevant exits pass through that gateway. Detecting a bypass requires an independently established expected-event set and tested reconciliation. The public sandbox does not establish that coverage.
The floor is Carnac's own decision. Ordinary runtime configuration cannot lower it. The operator can turn proof up and name always proven categories, but can never route below the floor, and any attempt to do so is itself recorded.
The floor is not frozen forever. It can be revised, but only through a signed governed policy release, recorded as a policy amendment. A law change or a corrected false positive goes through that channel, not a runtime switch.
CarnacPrompt classifies consequence, not content, and runs inside your boundary. Raw forming requests stay with you. Only commitments, consequence vectors, rule identifiers, and routing metadata leave.
The return of a non gated request is kept separate from the commitment of an effect. If the classifier is uncertain or down, work routes to a stronger response and still returns. An outage gates effects only where policy declares.
Learning is additive only. Carnac learns to recognize more things as consequential, never fewer. New patterns can raise a score or add an always protect rule. Nothing in the learning loop can lower a floor or remove a protection, and the loop is audited for that property.
Each example follows one path: what enters CarnacPrompt™, what is committed before inference, what Carnac™ checks before an effect, when Howler™ is raised, and which Hive primitive closes the chain. The chain is identical. Only the stakes and the destination change.
These are illustrative deployment shapes only. Naming a provider or a sector describes where Carnac™ could sit. It is not a claim of any customer, partner, endorsement, or existing relationship. What each model returns, and which effects are gated, is deployment specific.
Most work runs at negligible cost and each request leaves a signed decision breadcrumb. The consequential work is proven in proportion to its stakes. The work that turns consequential mid run is caught the moment it does and sealed back to the start. The dangerous work is held before it can act. The operator can demand more proof, never less, and any attempt to suppress leaves a mark.