The formal specification for Layer 1 of the Continuity Architecture.
Three architectural primitives. Eight implementation phases. Six shipped existence proofs.
Don't correct drift. Prevent it.
These five commitments are the ground from which the three architectural primitives grow. They are not derived — they are chosen. Every phase, every gate, every deliverable in this specification is a logical consequence of holding all five simultaneously.
Every calculation, threshold, scoring formula, classification, and business rule is expressed as a pure function. Same inputs → same outputs on every platform, every invocation, with or without AI, online or offline. The computation layer is the real application. SRC: DCA Paper §III; Builder's Guide §Phases 1–3
The LLM enriches, contextualizes, and communicates. It never computes, decides, or mutates state. The model receives truth — structured data from the deterministic core — and annotates it. The core is complete before the first LLM call is made. SRC: DCA Paper §III; Builder's Guide §Phase 4
Data flows: core → model → annotation layer. Model output never flows back into the computation pipeline. This single structural guarantee prevents drift from propagating. The model can hallucinate in its narrative, and the computation layer is structurally unaffected. SRC: DCA Paper §III; Builder's Guide §Phase 5
The application is complete at the moment of download. Zero external dependencies. Zero installation. Client-owned. The artifact may take different physical forms — single HTML file, PyPI package, portable binary — but the principle is invariant: the user possesses a complete, self-contained artifact that runs without phoning home. SRC: DCA Paper §III; Builder's Guide §Phase 8
Every AI-enhanced feature has a deterministic fallback that produces complete, coherent output. AI unavailability does not degrade core function. The user is never presented with a loading state on a core feature. The system is designed to function completely without AI, without network, without external services. SRC: DCA Paper §III; Builder's Guide §Phase 6
This is a formal, verifiable architecture specification. It defines the Deterministic Core Architecture as an implementable, auditable, certifiable layer within the Continuity Architecture. It specifies the three architectural primitives in terms that can be verified against a build artifact. It defines the green gates that every DCA-compliant artifact must pass. It maps to the eight-phase Builder's Guide methodology.
This is not the paper. The paper (The Deterministic Core: A Fixed Foundation for AI Collaboration) names the primitives, documents the diagnosis, and establishes the intellectual framework. This specification is the implementation contract. The paper argues why. This specification defines how.
This is not the Builder's Guide. The guide is a methodology document — narrative, instructive, phase-by-phase. This specification is a conformance document — structural, verifiable, gate-by-gate. The guide tells you how to build. This specification tells you what "built correctly" means.
DCA is Layer 1 of the Continuity Architecture — the foundation layer. Every other layer depends on it:
| Layer | What It Adds | Depends on DCA How? |
|---|---|---|
| Layer 1 — DCA | Deterministic computation + AI enrichment + sovereign artifact | — (foundation) |
| Layer 2 — ASB | Architectural Standards Baseline — 46-category quality benchmark | DCA provides the sovereign artifact that ASB measures |
| Layer 3 — MCR | Cryptographic consent between deterministic cores | DCA provides the deterministic core that MCR certifies convergence between |
| Layer 4 — GABOS | Governed autonomous business operating system | DCA provides the fixed organizational identity and deterministic governance layer |
The architectural primitive that separates computation from annotation. The boundary is one-directional. Data flows from core to model to annotation layer. Model output never flows back into the computation pipeline. This is the single structural guarantee that prevents drift from propagating.
The Enhancement Boundary has exactly three zones. No zone may be bypassed. No zone may communicate backward across the boundary.
What it contains: Every calculation, threshold, scoring formula, classification, business rule, and data transformation. Every function in Zone 1 is a pure function — same inputs, same outputs, every platform, every invocation.
What it never contains: LLM calls. Network requests. Random number generation (unless seeded and deterministic). Date/time calls that depend on system clock (use injected timestamps). Any operation whose output cannot be predicted from its inputs alone.
Verification: Zone 1 can be executed in its entirety without network access, without AI API keys, and without any external service. The output must be bit-identical across all supported platforms for the same inputs.
What it contains: LLM calls that receive structured data from Zone 1 and produce enriched narrative, contextualization, summarization, or communication. Zone 2 fires in parallel with Zone 3's deterministic path.
What it never does: Mutate Zone 1 state. Produce output that Zone 1 depends on. Execute before Zone 1 completes. Block the user. Produce the only output path.
Verification: Zone 2 can be disabled entirely (AI off, network off, keys removed) and the application must produce complete, coherent output from Zone 3's deterministic path.
What it contains: The rendering surface — DOM, PDF, API response, file export. Zone 3 always receives Zone 1's deterministic output. If Zone 2's enriched output arrives, Zone 3 crossfades to it. If Zone 2 never responds, Zone 3 displays Zone 1's output as the final output.
The crossfade: The transition from deterministic output to enriched output must be imperceptible to the user. No flash. No replace. No loading state. The deterministic output is already visible. The enriched version replaces it smoothly — opacity transition, content swap, or progressive enhancement. The user may never know whether AI was involved.
At no point does Zone 1 depend on Zone 2 for correctness. Zone 1 must produce complete, correct output before Zone 2 is invoked. Zone 2 enriches. Zone 2 never computes. If Zone 2 is removed from the architecture, the application remains fully functional. The Enhancement Boundary is not a design pattern. It is a structural constraint enforced by the architecture itself.
The architectural primitive that guarantees user ownership. The artifact is complete at the moment of download. Zero external dependencies. Zero installation. The user owns the artifact and it runs without phoning home.
The sovereign artifact principle is not a file-format constraint. It is an ownership and independence guarantee. The artifact may take different physical forms:
| Format | Deployment Context | Example | Constraint Level |
|---|---|---|---|
| Single HTML File | Browser deployment — zero install, opens in any browser, works offline | CSI Pro, ASB, Design Systems Blueprint | Maximum — browser sandbox enforces all constraints |
| PyPI Package | Developer tooling — standard package manager, bundled dependencies, no runtime fetch | Archeo CLI | Standard — package manager resolves dependencies |
| Portable Binary | Local execution — self-contained executable, no installer, no registry mutations | FlakeCapsule | Standard — OS provides runtime |
Single-file HTML is the most constrained instantiation. The browser sandbox cannot access the filesystem, install packages, or run native code — forcing every architectural decision toward portability, determinism, and independence. If the architecture holds under that constraint, it holds under all less-constrained formats.
| Property | Requirement | Verification |
|---|---|---|
| Zero External Dependencies | No runtime CDN fetches. No external font loads. No npm install at runtime. No external script sources. | Network tab audit — zero requests beyond the artifact itself |
| Offline-Complete | All core functionality works without internet. AI enrichment degrades gracefully. | Offline test — disable network, verify all core features |
| User-Owned Data | Data stored locally. Encrypted at rest (AES-256-GCM where applicable). Export in open formats. | Storage inspection + export round-trip test |
| No Phone-Home | No analytics. No telemetry. No license check requiring network. No usage tracking. | Network tab audit across full feature exercise |
| Portable | Emailable. USB-shareable. Hostable on any static server. Opens in any modern browser. | Cross-browser test + file transfer test |
When the sovereign artifact is delivered as a single HTML file, additional constraints apply due to the browser sandbox:
| Constraint | Requirement |
|---|---|
| Inline Everything | CSS in <style>. JS in <script>. SVGs inline. No external resource loads. |
| Content Security Policy | default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests |
| Web Crypto for Encryption | AES-256-GCM via SubtleCrypto. PBKDF2 key derivation (100K iterations). Salt in localStorage. Ciphertext includes IV. |
| IndexedDB for Persistence | Primary data store. localStorage for configuration only. Auto-save on mutation. Save on visibility change. |
| WCAG 2.1 AA | Keyboard navigation. Screen reader. Focus management. Color contrast. Reduced motion. Skip links. ARIA landmarks. |
The user downloads a file. They open it. It works. No registration. No configuration file. No dependency installation. No internet required for core function. The artifact is complete. The user owns it. This is not a feature. It is the architecture.
The architectural primitive that guarantees AI unavailability never degrades core function. Degradation is not a failure mode. It is the default operating assumption — designed into the architecture rather than patched around it.
Every AI-enhanced feature in a DCA-compliant artifact must have a documented degradation path. The path is not "show an error message." The path is "produce complete, coherent output using only the deterministic core."
| Degradation Trigger | Required Behavior | Forbidden Behavior |
|---|---|---|
| AI API Unavailable | Deterministic fallback produces complete output. Feature remains functional. | Loading spinner on core feature. Grayed-out feature. "AI required" message. |
| AI API Timeout | Deterministic output rendered immediately. AI response crossfades if it arrives late. | User waits for AI. Feature blocked until timeout resolves. |
| AI API Error | Deterministic output stands. Error logged. User optionally notified that enrichment is unavailable. | Error propagated to user. Feature fails. |
| Network Offline | Entire application functions identically. Only AI enrichment and external fetch features are unavailable. | Application shows "offline" and blocks usage. Core features require network. |
| AI Key Missing | Application functions with deterministic output only. No prompt to enter key to unlock core features. | Core features gated behind AI key entry. |
| User Cancels AI | Deterministic output stands. No disruption. No partial output. | Half-rendered AI output. Corrupted display. |
Every deterministic fallback must meet these criteria. A fallback that produces incomplete output is not a fallback — it is a degradation of the degradation path.
| Requirement | Specification | Verification |
|---|---|---|
| Complete Output | The fallback produces output that is structurally complete — all sections present, all data rendered, all conclusions stated. | Compare AI output structure vs. fallback output structure. Same sections. Same data. |
| Coherent Output | The fallback output is logically coherent — no contradictions, no gaps, no "AI could not be reached" placeholders. | Read the fallback output. Would a user accept it as the intended output? |
| Deterministic Output | Same inputs → same fallback output every time. No randomness. No variation. | Run fallback 3 times with same inputs. Bit-identical output. |
| Sub-50ms Generation | The fallback produces output in under 50ms. The user perceives it as instant. | performance.now() measurement. Must be under 50ms. |
| No AI Dependency | The fallback code path contains zero LLM calls, zero network requests, zero external service calls. | Code review — verify no fetch, no API call, no import of AI module. |
When the AI enrichment pipeline produces output after the deterministic fallback is already rendered, the transition must follow this protocol:
The user may never know whether AI was involved. The deterministic output is the output. The AI-enriched version is the same output, rendered with better prose. The difference is experiential, not functional. The application is complete at the moment of download. Everything else is enhancement.
The computation layer is the real application. It must be built, tested, and verified before any AI integration begins. This is not a sequencing preference. It is a structural requirement.
Every function in the computation layer must satisfy these properties:
| Property | Requirement | Test |
|---|---|---|
| Deterministic | Same inputs → same outputs, every invocation, every platform | Run 100 times with same inputs. All outputs identical. |
| No Side Effects | Does not mutate global state, DOM, or external systems | Code review — no assignment to non-local variables |
| No I/O | No network calls. No file system access. No localStorage reads. | Code review — no fetch, no import of I/O modules |
| No Randomness | No Math.random(). No Date.now(). No crypto.getRandomValues(). | Code review — no calls to randomness sources |
| Time-Injected | If computation depends on time, timestamp is passed as parameter | Code review — Date.now() only in calling code, not in pure function |
| Bounded Output | Output range is documented and clamped. No unbounded results. | Test with extreme inputs — output stays within documented bounds |
The 40-line health scoring engine from CSI Pro is the canonical reference implementation of a DCA-compliant computation layer. It is reproduced here as the specification's baseline example:
Why this qualifies: Pure function. No I/O. No randomness. No AI. No network. Same inputs → same score on any platform, in any browser, with or without AI. The coefficients are domain-informed defaults — calibration points, not empirical constants. The methodology transfers; the thresholds are tuned per domain. The structure (baseline + weighted signals + clamping range) is the invariant.
Every DCA-compliant computation layer must include a self-test suite. The suite is embedded in the artifact — not external, not optional.
| Requirement | Specification |
|---|---|
| Activation | URL-triggered (?test=true) or CLI flag (--test). No external test runner. |
| Assertions | Exact-value assertions. Not ranges. Not "reasonable." Exact numbers. |
| Coverage | Every pure function. Every edge case. Every boundary condition. Every degradation path. |
| Output | Visual overlay (browser) or terminal output (CLI). Pass/fail count. Expected vs. actual on failure. |
| Offline | Test suite runs fully offline. No network dependency for test execution. |
The AI layer is an annotation engine. It receives computed truth from the core and contextualizes it. It does not compute. It does not decide. It does not mutate state. It fires in parallel with the deterministic output path.
| Requirement | Specification |
|---|---|
| Non-Blocking | AI call fires after deterministic output renders. User never waits for AI. |
| Cancellable | Every AI call uses AbortController. User can cancel mid-request. |
| Timeout | 15-second default timeout. Configurable. On timeout, deterministic output stands. |
| Retry with Backoff | Automatic retry on 429/5xx. Exponential backoff: 1s, 2s, 4s. Max 3 retries. |
| Provider Abstraction | Unified interface. Multi-provider support. Failover between providers. |
| API Key Encryption | Keys stored encrypted at rest (AES-256-GCM). Never in plain localStorage. |
| Streaming Support | Token-by-token render for long completions. User sees output as it arrives. |
Between Zone 2 and Zone 3 sits a validation gate. Its job is not to verify correctness — the computation layer already guarantees that. Its job is to verify coherence. Does the AI output contradict the deterministic data it was given?
| Check | Condition | Action on Failure |
|---|---|---|
| Empty Response | AI returned empty string, null, or undefined | Deterministic output stands. Log event. |
| Error Response | AI returned error object or HTTP error | Deterministic output stands. Log error code. |
| Structure Mismatch | AI output structure differs from deterministic output structure | Deterministic output stands. Log discrepancy. |
| Data Contradiction | AI output contains data that contradicts deterministic core data | Deterministic output stands. Flag for review. |
| Valid Output | All checks pass | Crossfade to AI output. |
At no point does the application loop pause waiting for an AI response. The deterministic core runs continuously at full speed. The AI layer is a parallel enhancement pipeline. Between AI cycles, deterministic functions maintain complete functionality. The user should never be able to tell whether AI is active — only that the enriched version feels better.
The DCA is not theoretical. It is not projected. It is shipped. Six artifacts demonstrate the pattern across domains, platforms, and languages. Each artifact is a complete, auditable existence proof.
The reference implementation. 40-line deterministic health scoring engine. AES-256-GCM encryption at rest. Multi-provider AI integration (6 providers). IndexedDB document vault. WCAG 2.1 AA. License management. Zero dependencies. Complete offline operation.
Scans codebases for technical debt (TODO/FIXME/HACK). Links Git blame context. Runs cyclomatic complexity analysis. Generates AI remediation plans — after deterministic analysis completes. 30+ tests. Bandit scan. mypy type-check. CI/CD (Python 3.9–3.12).
Detects non-deterministic test failures. Packages deterministic replay capsules with SHA-256 integrity verification. Reduced mean time to diagnose from hours to under 30 minutes. MIT license.
Deterministic compliance checking. Accessibility validation. localStorage persistence. Responsive design. Zero dependencies.
Deterministic prompt template libraries. localStorage persistence. Business development workflow automation. Zero dependencies.
WCAG 2.1 AA. Token-first design system. GPU-compositor-aware. Dark/light parity. Sovereign single-file deployment. The visual proof that the architecture works at the presentation layer.
Every artifact embeds the same architecture: a computation layer that never delegates to AI, and an AI layer that enriches from above. The Enhancement Boundary is present in all six. The Sovereign Artifact principle is present in all six — each is a complete, self-contained deliverable with zero external dependencies. Graceful Degradation by Design is present in all six — every AI-enhanced feature has a deterministic fallback producing complete output.
The pattern is consistent across domains (customer success, developer tools, engineering, business development, design systems), platforms (browser, CLI), and languages (JavaScript, Python). It is not tied to any framework or provider. It is a methodology that transfers.
The Builder's Guide defines the methodology. This section maps each phase to the DCA primitives and defines the verifiable deliverable for each phase. The phases are sequential. Each depends on the one before it.
What decision, if it were wrong, would break trust in the entire system? Name it. Describe what breaks if it isn't deterministic.
Deliverable: One sentence naming the decision. One sentence describing the consequence of drift.
Express the computation as a pure function. Every coefficient documented. Every edge case handled. Reviewable by someone who never built the system.
Deliverable: Pure function in code or pseudocode with documented coefficients and edge cases.
Build and verify the computation layer before any AI integration begins. Self-test suite with exact-value assertions. Tests pass before Phase 4.
Deliverable: Working computation layer. Self-test suite passing with exact-value assertions.
For every AI-enhanced feature, a deterministic fallback producing complete output. AI pipeline fires in parallel. Both paths produce complete results.
Deliverable: Deterministic fallback + AI pipeline for every enhanced feature. Neither blocks the user.
Gate between AI output and user-facing output. Verifies coherence — does AI output contradict the deterministic data it was given?
Deliverable: Validation gate intercepting all AI output. Verifying structure and data before rendering.
Documented degradation path for every AI-enhanced feature. Each path produces complete output. Tested by disabling AI and verifying.
Deliverable: Degradation path document. All paths tested with AI disabled.
WCAG 2.1 AA. OWASP baseline. CSP. Crypto audit. Offline. Mobile. Storage quota. AI timeout. AI error. Rapid input. Every edge case handled.
Deliverable: Audit report with pass/fail for every applicable standard. All failures corrected.
Deliverable the user can download, open, and use. No registration. No configuration. No dependency installation. The artifact is complete. The user owns it.
Deliverable: Sovereign artifact in the format appropriate to the deployment context.
Phases 1–3 produce the deterministic core. Phase 4 depends on Phase 3. Phase 5 depends on Phase 4. Phase 6 depends on Phase 5. Phase 7 can run in parallel with Phases 4–6. Phase 8 depends on Phase 7. The order is structural — each phase produces the prerequisite for the next.
No artifact is DCA-compliant until every applicable gate is passed. Gates are verified with evidence — not claims. The LLM self-validates against these gates. The architect verifies at key checkpoints.
The Deterministic Core Architecture is Layer 1 of the Continuity Architecture. Every layer above it depends on the primitives it establishes.
"Don't correct drift. Prevent it."
The Deterministic Core Architecture is the foundation. It is not a constraint on the LLM. It is an identity the LLM operates from. The core is fixed. The computation is deterministic. The AI enriches from above. The user owns the artifact. Degradation is the default, not the failure mode. This is what trust looks like when it is built into the architecture rather than promised by a platform.