The TypeScript substrate that connects live enterprise signals to human-confirmed decisions
with cryptographic proof at every transition.
9 packages · 17 test files · 248 doctrine assertions · DSSE-signed receipts · Lean-verified invariants.
a11oy (Alloy) is the governed agentic execution fabric of SZL Holdings. It ships the TypeScript
packages that the szl-holdings/platform monorepo consumes for policy enforcement,
signal measurement, knowledge-graph traversal, and cryptographic proof-chain integrity across
all SZL domain verticals.
Every action in the platform must pass through the policy engine before execution. No action proceeds without a DSSE-signed receipt. The Λ-invariant — a conjunctive Λ-axis gate across 13 doctrine axes — constrains every policy evaluation: recommendations below the configured threshold escalate; they do not silently proceed.
KnowledgeGraph, OntologyQuery, DomainNode.SignalScore and DriftReport consumed by the policy engine for threshold evaluation. Key types: SignalScore, PRISMFrame, DriftReport.ApprovalGate structs when human review is required. No action bypasses this check. Key types: CovenantPolicy, ApprovalGate, PolicyDecision.szl-holdings/lutar-lean (CSS-QEC). Verifies proof-chain cryptographic lineage. 24 of 24 tests pass via custom node:assert/strict runner. Key types: QECLineage, IntegrityProof, CSSVector.cosign verify-blob or raw jq.The standalone alignment packages live in packages/ and web/packages/.
The deployment surface is szl-holdings/platform (76 packages); a11oy supplies
the core governance kernel. The web/ directory contains the React SPA that cannot
run standalone — it depends on workspace packages from the platform monorepo.
Packages are organized into five functional lanes: ingress (input sequencing, sparsification, perception), knowledge (graph traversal, alignment schema), measurement (signal scoring), policy + QEC (approval gate enforcement, proof-chain verification), and receipt emission. Data flows left-to-right; every lane outputs a typed artifact consumed by the next.
The four packages/ packages — policy, measurement,
knowledge, qec-integrity — are the primary contracts consumed
by the platform. The five additional packages in web/packages/ and at the repo
root handle ingress, sparsification, ledger, connection, and alignment schema duties.
QEC-integrity lineage is formally verified in
szl-holdings/lutar-lean
(Lean 4 + Mathlib v4.13.0). The termination proof (Lutar.AgentLoop.terminates)
and Λ-monotonicity proof (Lutar.AgentLoop.preserves_lambda) are in the v18.0
milestone, DOI 10.5281/zenodo.20434276.
Every agent action traverses a seven-step chain. Each step produces a typed artifact that gates the next step. The chain cannot be short-circuited: the DSSE wrap in step 7 only fires after QEC integrity passes in step 6. The entire chain is captured in a receipt timeline.
sequence-pipeline. The sequencer
assigns deterministic ingestion order and injects a W3C traceparent header
that propagates through the entire chain. Every subsequent step reads this trace ID;
no step drops it.
policy package evaluates the incoming action against the Covenant Policy
ruleset before any further processing. If any rule requires human approval,
an ApprovalGate is created and the chain pauses. No soft failures; the gate
either passes or blocks.
measurement scores the signals against PRISM baselines and emits a
DriftReport. The drift score feeds back into the policy evaluation:
signals above the configured drift threshold trigger a re-evaluation at the Λ-gate.
knowledge and a11oy-knowledge traverse the domain ontology
graph to retrieve explanation context for the pending action. This context is attached
to the policy decision for audit purposes, not used to override the policy outcome.
qec-integrity verifies the CSS-QEC cryptographic lineage of the pending
action. The verification is anchored to the Lean 4 proofs in
szl-holdings/lutar-lean. 24 of 24 lineage tests pass. A failing lineage
check halts the chain unconditionally.
receipt-substrate produces a signed receipt in SLSA Provenance v1 format.
The receipt bundles: subjects array, predicate (policy decision + scores),
and a DSSE signature. It is independently verifiable via
cosign verify-blob or a raw jq pipeline documented in
the UDS README.
subjects[] + predicate + signature). A W3C TraceContext
traceparent header is embedded. The envelope is exported as an OTLP span
to the UDS mesh observability pipeline. The action is only released to the caller
after this final wrap succeeds.
Numbers below are grep'd from the repository at the time of this showcase. No rounding. Failures are disclosed, not hidden.
The 248 figure refers to doctrine test assertions in the a11oy Ouroboros runner run
(2026-05-28). These are not unit tests; they are runtime invariant checks exercised against
the live substrate. The 17 *.test.ts files in this repository contain a subset.
The anatomy Space cites "248 includes doctrine tests + assertions" — this is the combined count
from the runner, not from *.test.ts alone. Raw test-file assertion count
(grep of expect|assert.) is 282 across the 17 files in this repo.
packages/a11oy-knowledge tests (TH2 proof-sketch mismatch) — 26 of 27 pass.__tests__/ compliance suite — 106 of 110 pass.web/ SPA build cannot start standalone; requires parent monorepo workspace packages.
ci.yml — Docs CI: markdown, citation files, licensecodeql.yml — CodeQL static analysis on every push to maindco.yml — Developer Certificate of Origin enforcementsbom.yml — Software Bill of Materials generationscorecard.yml — OpenSSF Scorecard automated runslsa.yml — SLSA provenance attestation for releasespackages/a11oy-knowledge: Vitest — 26 / 27 pass__tests__/: Jest / ts-jest — 106 / 110 passpackages/qec-integrity: custom node:assert/strict — 24 / 24 passweb/packages/a11oy-core (vitest): lid-check — 15 testsweb/packages/a11oy-core (custom): 7 files, ~67 total testsweb/packages/a11oy-core (KS-18): 3 Kochen-Specker testsThe a11oy-receipts-playground Space demonstrates the Λ-axis gate in action: you can submit a governed prompt and receive back a DSSE-signed receipt with a traceparent header, showing the policy decision, measurement scores, and QEC integrity status inline.
traceparent W3C header embedded in the envelopeThe live platform Space at a11oy-platform demonstrates the governed execution fabric with 7 webp context images and the dark-theme UI. It runs the full policy evaluation chain, not a simplified mock.
The table below compares a11oy / SZL Holdings against three published AI governance frameworks across eight concrete criteria. Sources are cited directly; ratings are Y / Partial / N based on publicly available documentation as of 2026-05-28. No editorial dismissals.
| Criterion | SZL / a11oy | Anthropic RSP | OpenAI Preparedness | Google DeepMind |
|---|---|---|---|---|
| Lean-verified invariants | Y | N | N | N |
| Public theorem count | Y — 76 theorems | N | N | N |
| DSSE cryptographic receipts | Y | N | N | N |
| OTel-native observability | Y | N | N | Partial |
| EU AI Act alignment mapped | Y | Partial | Partial | Partial |
| NIST AI RMF mapped | Y | Partial | Partial | Partial |
| Open-source execution fabric | Y — BSL-1.1 | N | N | N |
| SBOM published | Y | N | N | N |
Sources consulted: Anthropic Responsible Scaling Policy (anthropic.com/responsible-scaling-policy); OpenAI Preparedness Framework (openai.com/preparedness); Google DeepMind Frontier Safety Framework (deepmind.google/frontiers/frontier-safety-framework/). Ratings are based on publicly available text in those documents as of 2026-05-28; internal or unpublished practices of those organizations are not assessed.
The three frameworks above represent published, peer-reviewed governance approaches by major AI laboratories. Each addresses model capability thresholds, deployment gates, and safety testing requirements. None publishes a machine-checkable formal proof of their invariants; none emits cryptographically signed execution receipts per action; none publishes a software bill of materials for the governance system itself. SZL / a11oy differs primarily in the cryptographic auditability layer: every action produces a verifiable DSSE receipt, and the termination and monotonicity invariants are proven in Lean 4 under Mathlib v4.13.0. The tradeoff is scope: a11oy does not define model training-time safety requirements or organizational governance structures — it covers the runtime execution fabric only. The comparison above reflects that scope boundary.
Explicit scope boundaries. Doctrine v6 requires stating what a system does not do or claim.
web/ React SPA in this repo cannot run independently. It depends
on workspace:* packages from the szl-holdings/platform
monorepo. The buildable surface is the standalone packages only.
Primary citable artifacts for a11oy and the SZL substrate. All DOIs resolve to Zenodo records.
github.com/szl-holdings/a11oy. Score: 7.0 (2026-05-28).
securityscorecards.dev — a11oy report