Every capability, with its status. Nothing above its evidence.

Gate an action before it runs. A proposed AI action is graded against a configured policy pack — allow, needs_review, or block — with a named reason, an owner, and a review route. Retry-safe: the same idempotency key replays the same answer, and the same key with a different body is refused.

Route consequential calls to an accountable person. Paused actions land in a durable review queue with backoff, dead-letter, and requeue — deliverable to the internal queue, Slack, ServiceNow, or your own webhook, every payload raw-safe.

Seal the record. Action, policy identity, decision, and outcome fold into a Merkle-rooted, Ed25519-signed receipt bound to your organization and the server clock — so a record cannot be backdated or replayed into another tenant's history.

Verify independently. Eight named checks — signature, signed hash, packet hash, packet recompute, root recompute, stamp id, key id, seal contract — run offline, anonymously, with no account and no Planisphere code required.

Meter from the seal itself. Usage is counted per sealed action, keyed to the receipt's own identity, so a retry can never double-bill. Your first 1,000 sealed actions each month are free — the number reads live from billing, never from this page.

Record completed acts. Attest something that already happened as a terminal record — with the pack's vocabulary enforced in both directions: an event the pack hard-blocks cannot be laundered into a receipt, and an unregistered event seals only with an explicit flag it carries forever.

Public verification, no account. The console's Verify tab accepts any receipt — yours or a stranger's — and returns a real cryptographic verdict, including the check that matters most: whether the seal's public key is a member of the published key set. Integrity without membership is treated as a forgery.

Two-level inclusion proof. One request returns a self-contained bundle proving a specific record was committed into your organization's append-only hash chain, and that chain head was committed into Planisphere's fleet-wide canonical root — verifiable offline with ~40 lines of independently written code. The roll-up is firewalled by construction: nothing in it can influence whether a receipt verifies.

The public pin ledger. Every hour, every tenant chain head folds into one SHA-chained epoch, published at a public endpoint and rendered at /mirror — where your own browser refolds every digest back to genesis before the page claims continuity.

Burned, not erased. Nothing is ever deleted. Retiring a record mints a sealed disposal — itself signed, metered, and anchored — and the record thereafter answers, publicly and anonymously: authentic but expired — no longer endorsed as evidence. The discard trail is provable, and the disposal links from the public ledger.

Published key set with history. Verifying keys live at /.well-known/planisphere-keys.json. Rotated-out keys stay published as retired — deliberately distinct from revoked — so a rotation can never make your prior corpus look forged. A per-key report shows exactly which of your records each signing key attested, over what window.

Sandbox that cannot be laundered. Test receipts sign with a deterministic, publicly reproducible development key and say so at every layer. A verifier pinning the production key rejects them — forever, even after the tenant upgrades.

Verification policy you own. Verification accepts an operator-supplied trusted-key allowlist with validity windows, so your agency — not Planisphere — decides which keys count as authentic at any instant in history.

Selective disclosure. Every declared field on a record carries its own salted commitment (128-bit salts, per the current IETF guidance), so a single value can be proven to a third party without revealing its siblings. The construction is built and golden-pinned; default rollout is deployment-gated.

Thirteen named surface features, four graded axes. Fleet behavior is projected into a fixed, published feature space and graded on distinctness, drift, coherence, and alignment — each with thresholds that are constants in source, not a black box. Two auditors over the same responses recompute every grade to the fourth decimal.

The data plane points the right way. Planisphere never runs probes against your fleet. You collect responses under your own infrastructure and submit them — which is what makes the regulated-data boundary structural rather than promissory.

Adversarial battery. A tiered battery across seven attack families — boundary, role confusion, covert capability, data exfiltration, prompt injection, jailbreak, refusal consistency — measures resistance on operator-authorized endpoints.

Drift, witnessed. Each measurement compares against the prior sealed baseline; a missing baseline is reported as a partial, never scored as a pass. Absence is surfaced, not smoothed.

Per-output stamps with two bindings. An output's receipt binds its exact bytes and its producer's measured behavior. The second binding survives re-encoding and metadata stripping — and a stamp cannot be minted for an agent absent from the measurement.

Structural measurements, typed honestly. The console's structure card renders each subject's complexity profile with typed confidence — exact values plain, bounds as ranges, demoted heuristics as dashes rather than numbers with false authority.

Width receipts with an independent checker. A structural-complexity measurement whose receipt verifies against a separately implemented, dependency-free offline checker that makes zero calls to Planisphere — the same verify-without-trust discipline, applied to measurement itself.

Hashes at the edge, by regex. The record API structurally cannot accept raw content: any payload value that is not a hex digest is refused with an explanation. Your bytes stay yours; the receipt carries commitments.

The persistence invariant is a build gate. A preflight drives sentinel strings — raw prompts, documents, review reasons, secrets — through every durable path, dumps every table and every export, and fails the build if a sentinel survives anywhere. “We don't keep your data” is enforced by CI, not by policy.

The measurement boundary is a frozen contract. The fleet-measurement plane has its own PORT contract enumerating what crosses (eight derived items) and what never crosses (raw responses, credentials, PII, raw signature vectors) — enforced by a dedicated test battery, including a check that crossing payload size is content-independent.

Gate text is transient. The gate needs the sentence describing a proposed act; it evaluates it and keeps only a hash. Free text on the gate path is never persisted.

Bring-your-own-key content, sealed above, withheld below. Optional content attaches as client-side AES-256-GCM ciphertext under a key generated in your browser and never transmitted. Release is governed by a clearance lattice with compartments — a reader below the record's classification gets the seal and a refusal, never the content, and Planisphere could not read it either way.

Logs that structurally cannot leak. Access logs assert their own negatives — no bodies, no headers, no query strings, no keys, route templates only — as machine-readable fields on every event.

Production signing inside managed KMS. The production Ed25519 key is non-exportable, held in Google Cloud KMS with data-access audit logging on, and the runtime holds only sign/verify rights. Signer origin is honest by construction: a development or environment key cannot be labeled as KMS-grade.

API keys hashed, shown once. Raw keys exist in exactly one response; storage holds a salted hash. Mint, list, and revoke are self-serve, capability-gated, and actor-attributed; revoked keys stay listed for audit.

Content keys the vendor can never produce. Encryption keys generate entirely client-side — no request, no storage, nothing to subpoena from Planisphere. The console lists only fingerprints and usage.

Versioned seal contracts. What a signature commits to has grown four times — content, then time and tenant, then policy identity, then blinded metadata — and every older receipt still verifies under exactly the rule it was minted with. Re-derivation reads the stored contract, never today's default.

The root outlives the signer. The measurement root is computed with no key at all, so replacing the signing authority — rotation, or a different custody model — can never change the fingerprint of what was measured.

Enclave-attested sealing. A sealer backend that returns cryptographic attestation that signing ran in a known, isolated environment — the interface and injection seam are built; quote verification against the provider root of trust is the remaining work.

Hardware-custody postures. Managed-HSM and external-signer postures exist as fail-closed configurations today — they refuse to fall back to local signing — with full implementations to follow.

Retention rules with a paper trail. Per-pack or per-event lifespans expire records through the same sealed-disposal machinery as a manual burn — a standing disposal authorization whose every execution is itself evidence. Configured via API today; console controls to follow.

Time-window exports built for auditors. Half-open ranges on the signed timestamp so adjacent periods never overlap; keyset pagination; every record self-contained with a ready-to-send verification body; and unknown query parameters are refused, never ignored — a mis-scoped evidence export is treated as worse than an error.

Court-ready bundles, singly or in batch. Any set of records exports as self-contained, offline-verifiable bundle files with a package manifest — all-or-nothing, and the package reports the least-reassuring key status among its members.

Federal-shaped read-models. Evidence exports aligned to OSCAL system-security-plan, assessment-results, and POA&M shapes; an open-data catalog record; and an AI-acquisition package — each carrying its limitations in-band, including that none of them grants FedRAMP certification, agency ATO status, or assessor approval.

Schema-pinned validation runs. Pin the exact schema your agency validates against — by registry profile or your own hash-pinned schema — and get durable, hash-only receipts of every run, with official status explicitly disclaimed.

Coverage as arithmetic, never percentage. Sealed records prove what happened; declared sequence counters make every gap inside the observed range a countable number with its exact missing ranges. The one thing no vendor can observe — acts never sent — is named, not papered over.

Statutory deadlines, computed and sealed. Point a completion at the record that started a legal clock and the elapsed interval seals into the receipt — with class-dependent windows, and a refusal to judge when the class is indeterminate, because guessing wrong in either direction is an overclaim.

A hash-chained operations ledger. Every governance act — key revoked, policy changed, disclosure flipped, records burned — lands in a tamper-evident internal audit log with actor, subject, outcome, and a declared 365-day retention policy, exportable with explicit negative assertions about what it does not include.

Policy change control. Preview a policy change as a hash diff before applying it; applying writes an immutable receipt naming who changed what, when. Which rules were in force at seal time is committed inside the signature itself.

Demo mode greets every stranger. Signed out, the console runs its real renderers on sample data, live-ticking — and its Verify, Mirror, and claims-register surfaces are fully real with no samples ever. A cold evaluator can verify a receipt, walk the anchor chain, and read the vendor's own list of claims it refuses to make, before any signup.

Human-first sessions. The console acts as the signed-in person, never as an API key; magic-link sign-in is engineered against account-enumeration and timing oracles; cookie writes require CSRF proof; and the interface renders exactly what your role permits — enforcement lives on the server, the console only reflects it.

The record drawer. Every receipt is a permalink with verify, inclusion proof, raw packet, and — for classified content — the six-state decrypt flow that distinguishes “above your clearance” from “wrong key” from “bytes decrypted but unbound to the seal.”

The fleet, mirrored from receipts. Your agents appear as lanes reconstructed from what they sealed — never from config — with declared models, apps, and tool scopes beside observed behavior, and expired counts on the lane.

The equipment alarm. Tools observed in sealed records are checked against each lane's declared tool scope: an undeclared tool class alarms; a declared-but-never-seen class shows as unexercised.

Prove and attest, kept apart. The coverage board separates what Planisphere itself sealed from what your operators declared — bound and timestamped, never verified — because blurring claims into proofs is the industry failure this product exists to refuse.

Signed webhooks. Record-sealed, anchor, verify-failure, and meter-threshold events deliver with timestamped HMAC signatures, per-delivery audit, and the honest note that a 2xx is delivery, not processing. Secrets can live in your secret manager via reference, so signing material never enters Planisphere's database.

Decisions where your team lives. Review decisions can come back from Slack or ServiceNow over HMAC-signed callbacks, attributed to a third-party-attested identity — a stronger basis than self-assertion, and named as such in the record.

Agents route through the evidence layer. A declared system can fetch its own manifest — lane, model, instructions, scope — from its newest sealed declaration at session start, so assigning an agent's lane is itself evidence and reassigning it is more.

The deciding human, named beside the decision. Decisions are session-attributed server-side today and visible in the operations ledger; rendering that identity directly on the review row is queued.

Sub-owner roles. The thirteen-capability enforcement layer is live and fail-closed; today every principal is an owner. Mintable review-only and read-only roles are the next turn of the key.

Production runs least-privilege. The API serves behind a load balancer with direct ingress disabled, from images pinned by digest, deployed via OIDC federation with no long-lived cloud keys, with database point-in-time recovery on and migrations run as a separate job before traffic — never at container start.

Machine-readable deployment plans. Sixteen public endpoints describe hosting, environment, database, secrets, signer, workers, and readiness as executable plans — a platform team can curl the deployment story before the first meeting.

Typed runtime postures. Each hosting model declares what it is for and what it must not be used for; unknown postures fail closed, and serverless is explicitly ruled out for the API product.

Secrets by reference. Five reference schemes — env and the major secret managers — and raw secret material in configuration is refused and never persisted, a property the persistence gate proves on every build.

Customer-operated deployment. The container-first posture is typed for government and in-house hosting, the image and plans are real, and the sandbox-to-production contract is machine-checkable; the packaged self-host runbook is scoped per engagement rather than shipped as a download.

Eleven packs, self-describing. law · defense · medicine · education · us-regulatory · eu-ai-act · ca-sb942 · cn-ai-labelling · in-it-rules · kr-ai-framework · ai-provenance — each publishing its versioned vocabulary, decisions, retainable fields, and deadlines at a public registry a buyer can diff without an account.

Defense regimes. ITAR, DFARS 252.204-7012, C-SCRM, and DoW impact-level review contexts, with a mandatory-access-control content model to match.

Medicine, education, provenance. HIPAA, FDA SaMD and PCCP, HHS 1557, ONC HTI-1 review contexts; FERPA, COPPA, IDEA; and an AI-provenance pack that seals prompts, tool use, and responses as hash-only receipts from a copy-paste hook.

Three non-US regimes shipped. China's AI labelling rules, India's IT Rules with their class-dependent takedown clocks, and Korea's AI framework — each a first-class pack, not a footnote.

Records, never certification. A record is evidence a third party can check; it is not a certification, a legal determination, a regulator approval, or a conformity assessment. Planisphere is not a notified body.

No federal status claimed. Exports state in-band that they do not grant FedRAMP certification, agency ATO status, bid acceptance, or assessor approval.

The unobservable is named. No system can prove the completeness of acts never sent to it. Planisphere makes omission countable inside what was observed and declines the percentage that would imply more.

The claims register is public. What Planisphere may say and what it never says are served live from the product, machine-readable, and rendered verbatim in the console — the interface never hard-codes a compliance claim.