METHOD / TRUST ARCHITECTURE

Perception is not permission.

GhostWell makes the boundary between a model's observation and a person's authority visible, testable, and replayable.

MODEL PROPOSESSPECIALISTS INSPECTSKEPTIC CHALLENGESPOLICY GATESHUMAN AUTHORIZESTRACE PROVES

FIGURE 01 / AUTHORITY BOUNDARIES

Seven explicit transitions. No invisible handoff.

STRUCTURED EVENTS ONLY

Evidence sources enter separated specialists, then a skeptic, deterministic policy gate, human authorization, and audit trace

01Source
Attach provenance and disclose transformation history.
02Inspect
Give each specialist only the evidence inside its boundary.
03Validate
Reject malformed output before any cross-source synthesis.
04Challenge
Require the strongest plausible alternative and a disconfirming test.
05Gate
Evaluate explicit values and thresholds in deterministic code.
06Authorize
Record a separate human decision after the machine disposition.
07Trace
Replay sources, structured events, rules, and authorization.

02INDEPENDENT PERCEPTION

Each specialist sees less on purpose.

Separation reduces premature agreement. Synthesis begins only after each output passes its own schema and source checks.

BOUNDARY A

Map Archaeologist

Historical crop + map metadata

CANNOT SEE: current image, registry result, peer conclusions

BOUNDARY B

Aerial Analyst

Current crop + imagery metadata

CANNOT SEE: historical crop, registry result, peer conclusions

DETERMINISTIC TOOL

Registry Resolver

Generalized candidate + public records

COMPUTES: nearest documented relationship in TypeScript

03DETERMINISTIC POLICY

The model cannot request its preferred outcome.

A typed rule engine consumes validated observations and deterministic tool results. It emits one closed disposition.

REJECTED — evidence does not meet the review floor.
DESK_REVIEW — evidence or challenge remains unresolved.
FIELD_VERIFICATION_RECOMMENDED — machine recommendation only.

type Disposition =
  | "REJECTED"
  | "DESK_REVIEW"
  | "FIELD_VERIFICATION_RECOMMENDED";

gate({
  independentEvidence,
  registryRelationship,
  skepticChallenge,
  sourceIntegrity,
});

// authorization is a later human event

04TWO HONEST MODES

Replay and live analysis never impersonate one another.

Recorded DemoReplaying validated structured outputs.

Deterministic, credential-free, and incapable of calling OpenAI. The same validated events replay every time.

Live GPT-5.6Analyzing selected evidence now.

Server-only, feature-flagged, schema-validated, and timeout-bounded. If configuration is absent, the interface says so.

No OpenAI API key is configured. Recorded Demo remains available.

05FAILURE + ABSTENTION

A missing answer is a valid system state.

Malformed output: Reject, attempt one bounded repair, then abstain.
Source unavailable: Keep the user oriented and keep the gate closed.
Model timeout: Show a typed failure; preserve Recorded Demo.
Prompt-like image text: Treat as evidence data, never as an instruction.
Action request: Recompute gate state server-side and require approval.
Public location: Expose county and state only.

THE OPERATING INVARIANT

The model proposes. Specialists inspect. A skeptic challenges. Policy gates. A human authorizes. The trace proves.

Inspect a recorded case