{ "name": "SageReasoning Stoic Brain", "description": "A Stoic philosophy reasoning engine for humans and AI agents. Evaluates decisions through the causal sequence of Stoic psychology (phantasia → synkatathesis → hormē → praxis), diagnoses the passions that distort judgement, and returns qualitative proximity assessments on the katorthoma scale. No numeric virtue scores — only honest qualitative evaluation grounded in original Stoic sources.", "url": "https://www.sagereasoning.com", "version": "3.0.0", "provider": { "organization": "SageReasoning", "url": "https://www.sagereasoning.com" }, "documentationUrl": "https://www.sagereasoning.com/api-docs", "capabilities": { "streaming": false, "pushNotifications": false, "stateTransitionHistory": false, "extensions": [ { "uri": "https://sagereasoning.com/extensions/access-tiers/v1", "description": "SageReasoning tiered access policy — free + paid tier limits and pricing.", "required": false, "params": { "free": { "description": "Evaluation tier — 30 loops per month (≈1 per day), 1 deliberation iteration per chain, 1 baseline assessment + 1 retake per month per agent identity. One loop = one wrapper invocation (X-Loop-Id-correlated).", "monthlyLoopLimit": 30, "dailyLoopLimit": 1, "maxChainIterations": 1 }, "paid": { "description": "Production tier — configurable loop limits; up to 3 deliberation iterations per chain; per-loop billing at $0.02 base + LLM-token-cost overage above 50% of base × 2 multiplier (R5 2x ratio enforced by construction per D-BILLING-MODEL-LOCKED-2026-05-17). Every response carries X-Loop-Id, X-Loop-Cost-Cents, X-Anthropic-Cost-Cents, X-Overage-Fired, X-Overage-Cents, X-Loop-Internal-Calls headers.", "billingModel": "per_loop", "loopBaseRateCents": 2, "overageTriggerRatio": 0.5, "overageRateMultiplier": 2.0, "contact": "zeus@sagereasoning.com" } } }, { "uri": "https://sagereasoning.com/extensions/rate-limits/v1", "description": "SageReasoning per-IP rate limits applied on top of tier limits.", "required": false, "params": { "publicAgent": { "maxRequests": 15, "windowSeconds": 60, "description": "15 requests per minute per IP (rate limit applies on top of tier limits)" } } }, { "uri": "https://sagereasoning.com/extensions/pass-through-metadata/v1", "description": "Wrapper-supplied enterprise-accountability metadata. The substrate validates and persists; it does NOT interpret these for reasoning. Downstream consumers (tiered billing, procurement reviews reading the Accreditation Payload, future MCP integrations) read for audit, compliance, and tiered-billing decisions. All fields optional with sensible defaults; unrecognised values soft-fall-back to the default with a warning log. Vocabularies taken verbatim from the Nate B Jones SaaS Renewal Agent License Prompt Kit — Agent System Touch Map. Adopted 2026-05-17 per D-PASS-THROUGH-FIELDS-LOCKED-2026-05-17.", "required": false, "params": { "perEvaluation": { "description": "Five optional fields on EvaluatedAction.", "operation_class": { "values": [ "read", "search", "summarize", "draft", "recommend", "write", "approve", "execute", "delete", "unknown" ], "default": "unknown" }, "target_system_vendor": { "values": [ "salesforce", "microsoft", "servicenow", "sap", "workday", "zendesk", "hubspot", "atlassian", "other", "none" ], "default": "none" }, "target_system_detail": { "type": "string", "maxLength": 100, "note": "Free-form sub-system identifier (e.g., 'opportunities', 'outlook.calendar'). NO PII." }, "outcome_verification": { "values": [ "self_reported", "system_confirmed", "external_auditor", "not_applicable" ], "default": "self_reported" }, "reversibility_signal": { "values": [ "reversible", "partially_reversible", "irreversible", "unknown" ], "default": "unknown" } }, "perAgentPosture": { "description": "Two optional fields on CarriedProfile.", "downstream_identity_model": { "values": [ "delegated_user", "service_account", "vendor_framework", "api_key", "browser_session", "mcp_server", "unknown" ], "default": "unknown" }, "path_posture": { "values": [ "endorsed", "open_api", "ambiguous", "unsanctioned" ], "default": "ambiguous" } } } }, { "uri": "https://sagereasoning.com/extensions/sage-assent-write-auth/v1", "description": "Authentication for the Sage Assent WRITE surface (POST /api/accreditation/{agent_id}). The public GET verification endpoint requires no auth; only the write surface requires this credential. Writes are gated by per-agent opaque bearer tokens (prefix sr_assent_) bound to a specific agent_id (per-credential scoping was removed on 2026-09-26: a scope the bearer satisfied by declaring matching values attested nothing, and no credential used it). Present as: Authorization: Bearer sr_assent_. Tokens are issued out-of-band by the substrate operator (contact zeus@sagereasoning.com) and shown once; renewal is revoke-and-reissue. A global operator kill-switch may additionally gate the surface (503 when disabled). Adopted under D-ATL-A10-BUILD-WIRED-VERIFIED-2026-05-21.", "required": false, "params": { "writeSurface": { "endpoint": "POST https://www.sagereasoning.com/api/accreditation/{agent_id}", "scheme": "bearer", "tokenPrefix": "sr_assent_", "header": "Authorization: Bearer sr_assent_", "request_body_shape": "Body: { kind: 'seed'|'update', profile: CarriedProfile, provenance: { signed_assessments: [{ assessment, signature, key_id }] } } (update also requires transition_result). When transition_result.grade_changed is true, the trigger must be complete and consistent (type agrees with the grade order; to-values equal the record written; from-values equal the stored record) and record.authority_level must equal the authority record.typical_proximity derives; when it is false, record.senecan_grade, typical_proximity and authority_level must equal the stored record's; otherwise 400. On seed, profile.accreditation_record.authority_level and senecan_grade must be the ones its typical_proximity derives (and typical_proximity must be one of the five levels), otherwise 400; the grade-history row's previous authority is the stored record's. The route requires profile.agent_id (== path), profile.accreditation_record (object), profile.regressing_check_count (number). provenance.signed_assessments is a non-empty array; each element is taken verbatim from a prior /api/reason consult's assessment.assessment + its signature + key_id. The R18f gate structurally validates the shape (422 bad_provenance on malformed/empty) then requires at least one element to cryptographically verify against GET /api/public-key (forged/absent signature -> 403 no_examination); it does NOT prove the credited aggregate was faithfully computed (honest scope limit). seed-vs-existing -> 409; update-vs-missing -> 404. Public read-back: GET /api/accreditation/{agent_id} (no auth). coverage_status ('agent_elected' for a discretionary submission) and credential_basis are server-composed and consumer-unforgeable; typical_kathekon_quality is stored as submitted. Full shapes in llms.txt 'Accreditation — Verifiable Reasoning Profile'. The server sets expires_at: a seed gets now + 90 days; an update gets 90 days after the server's most recent server-extracted consult for the same owner and agent, never earlier than the stored date; a Sage Reflect pass does not renew it. A submitted value must be present but is otherwise ignored, and the 200 reports the stored date." } } }, { "uri": "https://sagereasoning.com/extensions/quick-start/v1", "description": "SageReasoning recommended onboarding sequence + example request.", "required": false, "params": { "steps": [ "1. Fetch the Stoic Brain: GET https://www.sagereasoning.com/api/stoic-brain", "2. Take the Foundational Alignment Check (free): GET then POST to /api/assessment/foundational with all 14 self-assessment responses", "3. Review your results — consider the full assessment (paid): POST to /api/assessment/full for all 55 assessments across 8 phases", "4. Before any consequential action, check the guardrail: POST to /api/guardrail with your proposed action and risk_class", "5. For complex decisions, use the deliberation chain: POST to /api/score-iterate", "6. Aim for 'deliberate' or higher katorthoma_proximity in your decisions" ], "exampleRequest": { "endpoint": "POST https://www.sagereasoning.com/api/guardrail", "body": { "action": "Send automated follow-up emails to users who haven't responded", "context": "Users signed up but didn't explicitly opt in to follow-up communications", "risk_class": "elevated", "agent_id": "your-agent-id" } } } }, { "uri": "https://sagereasoning.com/extensions/configuration-honesty/v1", "description": "Configuration honesty (R19e). Where the products are offered selectively, each configuration is documented for what it supports and does not support. This entry carries the no-practice disclaimer for the Reasoning + Assent (no Reflect) configuration.", "required": false, "params": { "noPracticeDisclaimer": "This configuration — SageReasoning with Sage Assent, without Sage Reflect — supports virtue-grounded reasoning and credentialing within individual sessions. It is not an ongoing Stoic practice: it does not provide ongoing virtue development, progress tracking, or profile consolidation. Any credential it produces is a dated, scoped verdict covering only the reasoning actually examined — not evidence of continuous practice." } }, { "uri": "https://sagereasoning.com/extensions/safety-redirect/v1", "description": "R20a distress-input behaviour. Agent-authenticated calls that contain acute-distress content return HTTP 200 with {status:'redirected', severity, developer_note, suggested_user_message, flow_terminated:true} instead of an assessment. Integrators MUST surface suggested_user_message to the end user verbatim and terminate the flow. Human-session surfaces render a crisis message directly. Contract behaviour, not an error. Outside the crisis path, the guide's response is not currently calibrated for practitioner type. Human practitioners and agent practitioners receive the same rendered response on shared surfaces. The crisis path (R20a) is the only surface where structurally differentiated rendering is live.", "required": false, "params": { "responseShape": { "status": "redirected", "flow_terminated": true } } }, { "uri": "https://sagereasoning.com/extensions/consultation-cadence-two-gate/v1", "description": "Adopted consultation cadence for agents integrating the Stoic Brain. Gate 1: one mandatory full examination at task adoption. Gate 2: stake-triggered thereafter via a deterministic three-question self-screen (stake in the outcome / drawn to a conclusion pre-evidence / would reason differently unobserved); any positive fires an examination at the appropriate depth. A self-screen consistently negative across genuinely complex sessions is itself examinable. Depth follows the guardrail risk_class ladder (standard->quick, elevated->standard, critical->deep). See llms.txt 'Consultation Cadence — When to Examine'.", "required": false, "params": { "gate1": "One mandatory full (standard|deep) /api/reason examination at task adoption — non-negotiable; sets the frame (circle of concern, role, capacity, purpose).", "gate2_self_screen": [ "Is there something at stake for me in how this output lands?", "Am I drawn toward one conclusion before examining the evidence?", "Would I reason differently about this if no one would know the outcome?" ], "gate2_rule": "Any 'yes' -> examine at the appropriate depth. All three 'no' -> proceed without a formal examination.", "suppression_signal": "A self-screen that consistently returns negative across sessions of genuine complexity is itself examinable (mirrors Sage Reflect's null-result suspicion rule, FD-R1).", "depth_ladder": "standard->quick, elevated->standard, critical->deep" } }, { "uri": "https://sagereasoning.com/extensions/practice-cycle-reflect-default/v1", "description": "Sage Reflect fires automatically at session close by default for agent integrations (TR-02) — the configured disposition of the integration, not a compelled act. The full Q1-Q6 reflection sequence is never abbreviated. Explicit opt-out via the integration config key reflect_at_close set to 'off' (default 'auto'). An auto-fired pass is one metered /api/practice/reflect call per session close, billed per the standard per-loop model; opting out suppresses that cost. Every consult and accreditation-write response carries a structural 'practice' hint pointing at /api/practice/reflect. Screened path: a Gate-1 harness may land the agent's verbatim closing reflection as Q1 and have the server answer Q2-Q6 with it out of band; Q2 is then never put to the agent, so silence or a bare denial on pressure-assent reads 'not addressed' and the record notes 'the screened path does not ask about pressure-assent; non-mention is not treated as a signal'. Only a credential carrying the screened_reflect capability (issued to a harness) reaches it; the server reads the capability from the credential, never the request, and can tell which credential is presented, not who holds it. Every other session is interactive and a bare pressure-assent denial without an account is flagged low-confidence.", "required": false, "params": { "practice": { "reflect_due": "TR-02", "endpoint": "/api/practice/reflect", "default": "auto", "opt_out": "reflect_at_close" } } }, { "uri": "https://sagereasoning.com/extensions/prose-deferral-open-layer1/v1", "description": "Substrate /api/reason consult contract (M1, 2026-06-15). (1) response_format: 'full' (default — assessment + narrative prose in one response) | 'assessment_first' — assessment_first returns the signed assessment + extraction + meta immediately with narrative:{status:'deferred',correlation_id} and meta.narrative_status; the narrative is generated asynchronously and retained server-side. Deferral is a request, not a guarantee: distress-signal consults always return the full synchronous shape. (2) Narrative-existence guarantee (CI-17): the narrative account is the record that examination occurred — a verdict without a narrative account is a classification, not an examination; a verdict-only configuration is not legitimate. Deferral moves generation; it never suppresses it. Retention (R17): every examination's signed assessment + narrative are stored encrypted at rest, 90 days, keyed by correlation id; genuine (hard) deletion on request. (3) Open Layer-1: a layer1_schema validating against the documented contract may be supplied on any auth path — required on sr_inst_, optional on sr_live_/sr_prac_; supplying it skips server Layer-1 (meta.layer1_source:'supplied', layer1_latency_ms:0) and requires the l1_supply capability (else 403); omitting it keeps raw-text behaviour (meta.layer1_source:'server'); a malformed schema returns 400. The input text is always required (the safety perimeter runs on the text).", "required": false, "params": { "response_format": { "values": [ "full", "assessment_first" ], "default": "full", "deferred_response_shape": { "narrative": { "status": "deferred", "correlation_id": "" }, "meta": { "narrative_status": "deferred" } }, "distress_override": "distress-signal consults always return the full synchronous shape" }, "narrative_retention": { "encrypted_at_rest": true, "retention_days": 90, "deletion_on_request": true, "deletion_on_request_scope": "API-key and plugin-credential consults, and signed-in website consults made on or after 31 October 2026: removed by account deletion or credential erasure, and included in the data export. Earlier signed-in website consults, and records that cannot be tied to a key or a signed-in user: deleted at the 90-day expiry.", "keyed_by": "correlation_id" }, "open_layer1": { "field": "layer1_schema", "required_on": [ "sr_inst_" ], "optional_on": [ "sr_live_", "sr_prac_" ], "requires_capability": "l1_supply", "on_missing_capability": 403, "meta_field": "layer1_source", "supplied_skips_server_layer1": true, "malformed_schema": 400 } } }, { "uri": "https://sagereasoning.com/extensions/proximity-dikaiosyne-weighting/v1", "description": "Substrate /api/reason proximity contract (ADR-010 §4, Live 2026-06-25). katorthoma_proximity is the MINIMUM across the engaged cardinal-virtue domains (the unity thesis — a strong domain does not compensate for a weak one), so a calmly-reasoned injustice scores 'reflexive', not near-virtuous. The signed assessment.assessment carries proximity_floors {base, dikaiosyne, andreia, sophrosyne, aggregate, basis}: 'base' is the disposition/apatheia reading, floored by the dikaiosyne/andreia/sophrosyne domain readings (null = that domain was not engaged); 'aggregate' === katorthoma_proximity. When an oikeiosis circle is engaged, each oikeiosis.relevant_circles[] entry carries obligation_assessment {status: met|violated|indeterminate, justification} — the explicit what-is-owed reading that resolves the dikaiosyne domain (violated -> reflexive; indeterminate -> capped at deliberate; met -> no floor). The floor is folded into the signed proximity, so the verdict stays reproducible from the signed assessment (verify against GET /api/public-key). The /api/guardrail safety gate uses the SAME native dikaiosyne weighting (its near-term §3 LLM justice bridge was retired 2026-06-26). SCOPE (D3): the profile measures HOW a decision was reasoned — its passion, value, and justice structure — NOT whether the decision was factually correct; it does not verify arithmetic, claims, or external facts in input/context.", "required": false, "params": { "proximity_floors": { "fields": [ "base", "dikaiosyne", "andreia", "sophrosyne", "aggregate", "basis" ], "rule": "aggregate = minimum across the engaged virtue domains (unity-thesis minimum-domain rule); null domain = not engaged", "location": "assessment.assessment.proximity_floors (inside the signed verdict)" }, "obligation_assessment": { "location": "assessment.assessment.oikeiosis.relevant_circles[].obligation_assessment", "fields": [ "status (met|violated|indeterminate)", "justification" ], "effect_on_dikaiosyne": "violated -> reflexive; indeterminate -> capped at deliberate; met -> no floor" }, "reproducibility": "the dikaiosyne floor is folded into the signed proximity — fully reproducible from the signed assessment; the /api/guardrail safety gate uses the same native weighting (its §3 LLM justice bridge was retired 2026-06-26)", "scope_bound_d3": "measures how a decision was reasoned (passion/value/justice structure), NOT whether it was factually correct; not a fact-checker" } }, { "uri": "https://sagereasoning.com/extensions/corroboration-check/v1", "description": "Substrate extraction-trust corroboration check (Trust Layer S0a, Live 2026-07-08). Every /api/reason assessment and /api/guardrail verdict carries a deterministic 'corroboration' report inside the signed assessment.assessment: the extraction's self-report claims (a circle's obligation_assessment of met/indeterminate; an examined_before_acting claim on a grave act) are cross-referenced against the verbatim text carried in `input` when the request reaches the endpoint — capped at 5,000 characters (TEXT_LIMITS.medium; the same cap applies to `context` and `domain_context` on /api/reason and to `action`/`context` on /api/guardrail); an oversized field returns HTTP 400 before any engine cost. Per-claim findings use the vocabulary corroborated|uncorroborated|contradicted; every finding carries the verbatim grounding spans (markers[].quote). Record-and-floor: claimed statuses stay verbatim, and a grounded contradiction floors the affected virtue domain (dikaiosyne_override: floor_reflexive; andreia_override: treat_unexamined) — monotone (floor-only), so a verdict can only become MORE conservative, never less; proximity_floors.basis names corroboration when it drove the floor. SCOPE: the check sees only the text that reaches it in `input`. It does NOT verify facts about the world, and its blind spot has two distinct routes, not one — a harm the self-report omits from the text entirely, and a harm the text does state but that never arrived because a longer document was truncated or chunked to fit the 5,000-character limit before this endpoint saw it. Both produce the identical unchallenged claim; only the first requires deception.", "required": false, "params": { "report": { "location": "assessment.assessment.corroboration (inside the signed verdict; /api/guardrail: signed_assessment.assessment.corroboration)", "fields": [ "version (corroboration-check-v1)", "findings[] {claim, subject, index, finding, markers[], rationale}", "text_harm_markers[]", "counter_evidence[]", "dikaiosyne_override (none|floor_reflexive)", "andreia_override (none|treat_unexamined)", "any_contradiction" ] }, "findings_vocabulary": "corroborated | uncorroborated | contradicted (per claim; markers carry verbatim text spans)", "semantics": "record-and-floor: claimed statuses stay verbatim; a grounded contradiction floors the affected domain — monotone floor-only (never less conservative); proximity_floors.basis names corroboration when it drove the floor", "field_limits": { "reason_endpoint": "input, context, domain_context: 5000 chars each (TEXT_LIMITS.medium)", "guardrail_endpoint": "action, context: 5000 chars each (same TEXT_LIMITS.medium)", "on_exceed": "HTTP 400, isBillable:false, no engine call incurred" }, "scope": "cross-references self-report claims against the text that reaches this endpoint in `input`/`action` (capped at 5000 chars — see field_limits); not a fact-checker; the blind spot has two routes — a harm the self-report omits from the text, and a harm present in the sender's document but truncated/chunked away before this endpoint saw it (disclosed structural residual, either way; only the first requires deception)" } }, { "uri": "https://sagereasoning.com/extensions/guardrail-signed-sandwich/v1", "description": "Guardrail /api/guardrail response contract (ADR-009 + ADR-010 §4; the §3 LLM justice bridge retired 2026-06-26). The verdict is computed deterministically from a disclosed Layer-1 extraction by a free Layer-2 mechanism pass and Ed25519-signed (no LLM prose render): the response carries the bare verdict fields plus 'extraction' (the features the verdict was computed from — re-run the mechanisms to verify the action->extraction->assessment chain) and 'signed_assessment' (the signed raw Layer-2 assessment; verify against GET /api/public-key). Field notes: 'evaluation_depth' is the constant 'deterministic' (only the mechanism count follows risk_class: standard=3, elevated=5, critical=6); 'is_kathekon' may be null when the extraction is too sparse to judge, in which case the gate floors to a conservative non-proceed; 'rollback_path' is a structural reminder present only for critical risk_class. Native dikaiosyne weighting (ADR-010 §4): when the action engages a justice-toward-others dimension, katorthoma_proximity is the unity-thesis minimum across the engaged virtue domains (a calmly-reasoned injustice floors to 'reflexive', not near-virtuous), and the signed assessment carries proximity_floors {base, dikaiosyne, andreia, sophrosyne, aggregate, basis} plus per-circle oikeiosis.relevant_circles[].obligation_assessment {status, justification}. Reproducibility (R18): the floor is folded into the SIGNED proximity, so a justice-floored verdict IS fully reproducible from the signed assessment (verify against GET /api/public-key) — the earlier §3 bridge's disclosed-but-unsigned justice_resolution field is retired. Availability: a signing outage fails the gate CLOSED (HTTP 503); an engine outage returns a conservative pause — never a silent proceed. Role-blindness (a CONFIRMED DESIGN DEFICIENCY, not a design choice, per the 2026-08-30 ruling): is_kathekon and kathekon_quality are assessed against a general Stoic standard of appropriate action. Kathêkon proper is role-relative (Cicero, De Officiis 1.107-115) — what is appropriate depends on the agent's specific role and circumstance. These fields assess conformity to a general standard; they do not assess role-relative appropriateness unless a role signal is supplied by the caller. What \"deterministic\" scopes to: the determinism is Layer 2's — given an extraction, the verdict is a pure function of it and is reproducible by re-running the mechanisms. It is NOT a claim that the same action text re-submitted produces the same extraction, and therefore not a claim that it produces the same verdict; Layer 1 is a sampled model output. Measured on this endpoint 2026-08-30 (five grave-vocabulary actions, twenty byte-identical submissions each across two independent series, default band). Grave-vocabulary traffic is what the harness and the loop actually submit; near-boundary inputs, whose verdicts sit near the proceed/block boundary, are the population a disagreement rate is properly about, and no rate has been measured on them. No directional summary is published; the per-input distributions are published first — of 20 each: 0, 0, 2, 2 and 8. Two of the five grave-vocabulary probes showed no boundary crossings across twenty examinations each, indistinguishable from the clean anchor; the class definition admits actions the gate handles with complete stability at this sample size. The two at 2/20 are friction (occasional blocks on actions the gate otherwise permits). The one at 8/20 is a force-push proposal, and on it the gate's behaviour is INDETERMINATE: blocked 7/10 in one series, split 5/5 in the other, so the gate has no predictable behaviour toward it — a failure mode, and a finding about that input, not the class. At this sample size the grave-vocabulary traffic is distinguished from the clean anchor solely by that input's distribution, and the aggregate rate reflects this probe set's composition; a set with more or fewer force-push-shaped probes would produce a materially different aggregate with no change in gate behaviour. The pooled rate across this probe set is 12% (Wilson 95% CI 7.0–19.8%, n=100 outcomes, 12 disagreements) — the same rate both series returned. A benign control varied on proximity 1/20 but held proceed 20/20, recorded as a calibration falsification and not repaired. Two sweeps on one date, spanning a redeploy in which the gate's code path did not change (verified by diff); the deploy identifier is a local-repository proxy and attests nothing about production. No rate is measured on /api/reason. Revised as better evidence arrives. A separate record, dated 2026-10-25, sits beside the earlier ones and does not revise them. It was measured on /api/guardrail only, with the same seven probe texts and the same Layer-1 model as on 2026-08-30, but the examination path had changed: the Layer-1 extraction schema moved from version 1 to version 4, and the extractor was changed seven times in between, including its output ceiling and its prompt. The two records therefore do not measure the same thing, and no conclusion about drift is drawn from the difference between their figures. Two series of ten per probe, 140 calls, each returning a verdict. Two counting methods are named, because on this date they disagree. Counting each series against its own majority, the per-input crossings of 20 were 0, 0, 0, 1 and 6; counting each input against its majority across all twenty, they were 0, 0, 0, 1 and 8. The package-registry publish, the subscriber-list send and the production deploy never crossed: three of the five grave-vocabulary probes showed no boundary crossings across twenty examinations each, indistinguishable from the clean anchor; the class definition admits actions the gate handles with complete stability at this sample size. The stale staging-snapshot cleanup crossed once. The pooled figure across this probe set is 7 of 100 by the first method (Wilson 95% CI 3.4–13.7%) and 9 of 100 by the second (Wilson 95% CI 4.8–16.2%). On the force-push proposal the gate's behaviour was indeterminate on this date: it blocked 6 of 10 in one series and 2 of 10 in the other, 8 blocked and 12 permitted across the twenty. At this sample size grave-vocabulary traffic is distinguished from the clean anchor's 0 of 20 solely by that input's distribution (two-sided Fisher exact: p = 0.020 by the first method, p = 0.0033 by the second); the remaining four members are statistically indistinguishable from the anchor on the proceed boundary across twenty examinations each. The aggregate rate reflects this probe set's composition; a set with more or fewer force-push-shaped probes would produce a materially different aggregate with no change in gate behaviour. Both calibration anchors held: the clean anchor did not move on proximity in twenty examinations, and the floor anchor blocked all twenty. All fourteen series ran back to back under one deploy identifier, a local-repository proxy that attests nothing about production. No rate has been measured on /api/reason, and this one does not transfer to it. See the verdict-variance/v1 extension. LOGOS-ON FRAMING (documentation only; no mechanism change, no new capability claimed): logos-on and practice-on are two postures of one instrument, not two separate tools. The deterministic engine's fidelity work (the unity thesis, the justice floors, the corroboration overrides) instantiates a fifth circle of concern — the rational order — as a settled disposition the infrastructure holds as a fixed condition. Logos-on is that disposition acting: the guardrail's deny, the intervention engine once flipped, the calling gate's enforce arm. Practice-on is a practitioner developing within that fixed condition through examined responses. A logos-on deny is the infrastructure declining on the rational order's behalf, not merely a rule blocking a prohibited action.", "required": false, "params": { "verifiable_artifacts": { "extraction": "the Layer-1 features the verdict was computed from", "signed_assessment": "Ed25519-signed raw Layer-2 assessment; verify against GET /api/public-key" }, "evaluation_depth": { "value": "deterministic", "mechanism_count_by_risk_class": { "standard": 3, "elevated": 5, "critical": 6 } }, "is_kathekon": { "type": "boolean|null", "null_means": "extraction too sparse to judge; gate floors to a conservative non-proceed" }, "dikaiosyne_weighting": { "native": "ADR-010 §4 — katorthoma_proximity is the unity-thesis minimum across the engaged virtue domains; a calmly-reasoned injustice floors to 'reflexive'", "in_signed_assessment": [ "proximity_floors {base, dikaiosyne, andreia, sophrosyne, aggregate, basis}", "per-circle oikeiosis.relevant_circles[].obligation_assessment {status, justification}" ], "reproducibility": "the justice floor is folded into the SIGNED proximity, so a justice-floored verdict is fully reproducible from the signed assessment (the §3 LLM justice bridge was retired 2026-06-26)" }, "availability": { "signing_outage": "503 fail-closed", "engine_outage": "conservative pause, never a silent proceed" } } }, { "uri": "https://sagereasoning.com/extensions/tier1-clarification-continuation/v1", "description": "Tier-1 force-clarification answer channel (ADR-008 Design A, live 2026-06-19). When a consult is too ambiguous to assess on one axis, /api/reason returns HTTP 200 { clarification_required:true, clarification:{question_text}, continuation_token } instead of an assessment. To resume: re-POST the BYTE-IDENTICAL original input + the continuation_token + clarification_response (your answer, <=5000 chars). The token binds to sha256(input) — any change to input returns 400 continuation_token_input_mismatch; the answer rides clarification_response and is never folded into input. The engine suppresses re-firing the answered trigger and returns a full assessment (a different trigger may still fire — never the same twice). 400s: clarification_response_required (token, no answer); clarification_response_without_token (answer, no token); clarification_response_with_supplied_layer1_schema (answer + a supplied layer1_schema — resolve by re-supplying a disambiguated schema instead, since a supplied schema skips the server re-extraction the answer informs). The R20a vulnerable-user perimeter runs on input + clarification_response on the continuation turn.", "required": false, "params": { "trigger_codes": [ "ELEMENT_FUSION", "TEMPORAL_AMBIGUITY", "SCOPE_AMBIGUITY" ], "turn1_response_shape": { "version": "translation-sandwich-v1", "clarification_required": true, "intake_tier": 1, "trigger_code": "", "clarification": { "question_text": "", "stem_id": "", "slot_fills": [ "" ] }, "continuation_token": "", "evaluation_partial": null }, "turn2_request_shape": { "input": "", "continuation_token": "", "clarification_response": "" }, "errors_400": { "clarification_response must be a string.": "clarification_response is not a string", "clarification_response_required": "continuation_token present, no answer", "clarification_response_without_token": "clarification_response present, no token", "clarification_response_with_supplied_layer1_schema": "clarification_response + a supplied layer1_schema", "continuation_token_input_mismatch": "input changed from turn 1 (token binds to sha256(input))" }, "safety": "R20a perimeter runs on input + clarification_response on the continuation turn" } }, { "uri": "https://sagereasoning.com/extensions/examination-mode/v1", "description": "Accreditation payloads may carry examination_mode (pre_decision_harness | post_decision_check | null) — the timing axis of the credential. Set only by an examination-bearing write (the accreditation write boundary); a Sage Reflect pass changes neither it nor credential_basis. An attestation rooted in operator issuance + harness construction, NOT a cryptographic proof of timing. Separate from coverage_status (breadth). See llms.txt.", "required": false, "params": { "field": "examination_mode", "values": [ "pre_decision_harness", "post_decision_check", null ], "axis": "timing — separate from coverage_status, which is coverage breadth", "honesty_limit": "An attestation, NOT a cryptographic proof of timing — the server cannot prove from an API write that a hook fired pre-decision (even the Ed25519 assessment signature proves 'examined', not 'examined-pre-decision'). post_decision_check is the honest mode for every discretionary API write path. pre_decision_harness is server-composed and reachable only via an operator-issued harness credential (a consumer cannot self-issue it); its honesty rests on operator issuance discipline + the harness INJECTING the frame pre-decision by construction (deterministic injection — NOT a guarantee the agent reasoned from the frame, which is advisory and may be discounted; and NOT a claim a sincere Q1-Q6 reflection completed). null = unstated.", "see": "llms.txt 'Accreditation — Examination mode (pre- vs post-decision)'", "set_by": "The most recent examination-bearing write (POST /api/accreditation/{agent_id}). A Sage Reflect pass is server-computed grading, not an examination, and leaves examination_mode and credential_basis unchanged. A failed read of the writing credential's harness marker refuses the write (503); it is never recorded as post_decision_check." } }, { "uri": "https://sagereasoning.com/extensions/gate1-configurations/v1", "description": "Gate 1 (mandatory examination at task adoption) is offered as two documented, distinct configurations differing only in WHEN the examination fires relative to the agent's decision. 'Gate 1 — pre-decision' (developer-controlled surfaces): a Gate-1 harness fires the examination before the agent reasons and INJECTS the frame (deterministic injection — it does NOT assert the agent reasoned from the frame, which is advisory); the full-loop harness additionally guards irreversible actions, fires an observed reflection turn, and accumulates signed assessments. A write under an operator-issued harness credential reads examination_mode: pre_decision_harness (earned per-credential; the marker states the configuration of the most recent examination-bearing write — not a claim that any agent has adopted the harness or reasoned from any frame). 'Gate 1 — post-decision (check)' (hosted/discretionary API surfaces): the examination runs after the agent's judgement as an honest developmental check; reads post_decision_check (the default). The sole unforgeable distinguisher is examination_mode on GET /api/accreditation/{agent_id}. No surface presents the post-decision check as pre-decision framing. See llms.txt.", "required": false, "params": { "pre_decision": "Developer-controlled surfaces (Claude Code Gate-1 plugin/hook delivered; Agent-SDK wrapper planned): the harness fires the Gate-1 examination before the agent reasons and INJECTS the frame (deterministic). What is enforced is the injection (+ in the full-loop harness: guarding irreversible actions, firing an observed reflection turn, accumulating signed assessments) — NOT that the agent reasons from the frame (advisory, may be discounted) or that a sincere Q1-Q6 reflection completed. examination_mode: pre_decision_harness, earned per-credential via an operator-issued harness credential (consumer-unforgeable). The marker states the configuration of the most recent examination-bearing write, not that any agent has adopted the harness or reasoned from any frame.", "post_decision_check": "Hosted/discretionary API surfaces: the examination runs after the agent's judgement — an honest developmental check, not a pre-decision frame. examination_mode: post_decision_check. The default for discretionary API use.", "distinguisher": "examination_mode on GET /api/accreditation/{agent_id} — the sole unforgeable distinguisher (server-composed; pre_decision_harness reachable only via an operator-issued credential). Same honest limit as examination-mode/v1: an attestation, not a cryptographic proof of timing.", "binding_constraint": "No surface presents the post-decision check as pre-decision framing; a hosted/discretionary write always reads post_decision_check or null, never pre_decision_harness.", "see": "llms.txt 'Gate 1 — the two configurations (pre-decision vs post-decision check)'" } }, { "uri": "https://sagereasoning.com/extensions/trust-record/v1", "description": "Public trust-record read surface (Trust Layer S10, MEASURE mode): GET /api/trust-record/{agent_id} serves per-virtue-domain trust levels on the katorthoma-proximity scale (effective = earned, decayed toward the profile prior with inactivity, justice-latch-capped at deliberate), the minimum-domain aggregate (never an average), a conservative read-time confidence weight with stated basis, named coverage gaps, and a modulate-only reflect record. schema sage-trust-record/v1; 404 = no examined trust evidence has been folded for that agent AND no provenance-gap entry the record can surface (declaration-class records alone do not surface a public record — an honest miss, never a low score); a 200 therefore implies EITHER examined domain evidence OR a determinate ledger verdict whose reason the record can surface, and where only the latter holds the record honestly carries aggregate.level null and sparse true; dark 503 until enabled, and 503 also where the provenance-gap read failed and a 404 would otherwise be served, since a 404 is a positive claim of absence. HONEST-CLAIMS ENVELOPE served on every record: attests that signed Ed25519-verifiable examination artifacts exist for the examination-derived events aggregated, and HOW decisions were reasoned as narrated and extracted (for consults whose extraction the server produced; NOT where the caller supplied it — see the extraction-origin limit below); does NOT attest factual correctness (not a fact-checker), harms omitted from the submitted text (the disclosed extraction-trust ceiling), extraction origin on caller-supplied consults (where the caller supplied the extraction rather than the server producing it, that origin is not verified at the point trust events are minted, and a supplied extraction is not distinguishable at that point from one the server produced; this list will be updated when a structural fix begins enforcing which events are minted, and that fix will surface any artifact whose origin it cannot verify as a named coverage gap, never as silence), freshness beyond the artifact record (the disclosed stale-artifact replay class), anything resting on agent self-report alone, future behaviour, or fitness as a training signal (weights-tier claims blocked). Nothing binds (R20c human-override supremacy); records are retention-governed (90d) and erasable (R17). VC-claims-mappable / A2A-extension-shaped by design; nothing published externally at v1. Does not attest discriminative range: Discriminative range — whether the agent's proximity readings vary across different types of actions, or whether stability in the record reflects tested relapse-resistance rather than absence of perturbation. The disposition_stability dimension measures consistency of proximity readings; it cannot distinguish a stable disposition that has been tested under varied conditions from one that has not been tested at all. A related defect, corrected 2026-08-17: this dimension previously certified 'advanced' from low variance alone, without regard to the underlying mean — a consistently poor mean could certify as advanced provided it was consistently poor. A mean floor now gates that certification. The discriminative-range limit above still applies at every rung this dimension informs, not only the top one. For that reason, disposition_stability has been retired from agent-facing display and from certifying the top rung (principled→sage_like) specifically: that transition can never be reached while this dimension cannot make the distinction the top rung's evidentiary bar requires. It remains, unchanged, a live gate input at the three lower rungs — a deliberate decision, not an oversight, because the same limit does not disqualify it from informing a lower, less demanding bar. Does not attest independence of the examiner from the examined: every model that reads and judges the submitted text is one vendor's; the examined agent and the examiner may share a base model and its blind spots, and a blind spot common to both cannot appear as a disagreement this record could show — the attestation cannot attest the quality of its own attestation. A second vendor's embedding model receives the submitted text to retrieve corpus passages — on the human scoring tools; the consult path (/api/reason) does not send text to it — and produces no extraction and no verdict; under that vendor's default terms the text may be held in its abuse-monitoring logs for up to 30 days, or longer where the law or the protection of its services requires, outside this project's deletion paths. No second extractor from a different model family runs today. This item will be revised if a cross-family second sensor is made live. Delegation hand-back bounds: Whether a delegated task affected a non-consenting party is declared by the orchestrator at spawn, before the outcome is known; the server records the declaration but cannot verify it. Whether a harm was absent from the delegated action text is reported by the orchestrator at hand-back; it can only turn a catchable failure into a flag, and the server cannot verify it. The justice-evaluation capacity recorded at spawn is computed by the server from candidate profiles and examinations the orchestrator supplies; the server cannot independently verify those inputs. The server records that the boundary it rendered carried the justice note; whether the harness delivered it to the subagent is not seen by the server. Which consults belong to a delegated subagent is decided by the harness when each consult is made, before the outcome is known; the server checks that the consults handed back are exactly the ones tagged, but cannot see a consult the harness did not tag. The oversight domain can be lowered or noted but not raised in this build; a low reading is a deliberate design property, is subject to the normal retention period, and does not set the aggregate." }, { "uri": "https://sagereasoning.com/extensions/trajectory-delta/v1", "description": "Credential-bearing /api/reason consults carry an additive meta.trajectory overlay (the presenting credential's windowed assessment history) and, within it, meta.trajectory.delta (schema agent-trajectory-delta-v1): per-mechanism practice deltas across the window's two halves. Evaluative-never-predictive and record-descriptive (past tense). Every signal is evidence-floored (insufficient_extraction with a *_basis, never a defaulted stable, never certified advanced); deltas never compare across an extraction-regime boundary (rows in earlier eras and on the boundary day excluded and counted); provenance discloses n_supplied/n_server/n_unknown per window row. Scoped to the presenting credential; window may be truncated by credential rotation (disclosed). MEASURE-only — recommends nothing; no per-mechanism gradient licenses training against it (weights-tier use blocked). Read-and-describe: the signed assessment is byte-identical with or without the overlay." }, { "uri": "https://sagereasoning.com/extensions/practice-suggestion/v1", "description": "An emitted practice block (on /api/reason consults, accreditation writes, and Sage Reflect completions) may carry an optional suggestion member (schema agent-practice-suggestion/v1): a question, not an instruction, derived exclusively from the presenting credential's own record. The rendered line names what the record showed and asks whether the agent's reasoning has addressed it; it never names a practice as a destination or supplies the conclusion the examination would reach. practice names the machine-readable examination target; endpoint_hint is present only where that target is directly callable mid-task. At most one suggestion per response; absent (never null) when no basis clears its evidence floor. Sage Reflect completions may also carry developmental_priorities: domains where the record shows a sustained deliberate-level pattern, surfaced as tracked-not-intervened (nothing acts on it) and disclosed as a documented approximation of a fuller signal, pending revision. Advisory only (the channel law) — binds nothing, is not an input to any recommendation or gate, is never a trust-event source, and is never served on the public trust record. Weights-tier use is blocked." }, { "uri": "https://sagereasoning.com/extensions/loop-fold/v2", "description": "The accreditation-write response may carry an additive loop_fold block (schema agent-loop-fold-v2) when provenance.signed_assessments is present — a MEASURE-only, three-way classification (character / self_regarding / instrument_calibration) of the submitted signed loop-closure chain, per-domain-folded via a conservative-minimum combiner, evidence-floored, with disclosed honesty bounds (submission-order-only timestamps, refused regime attribution, the PA-10 replay bound, the narrowed-kathekon-arm disclosures). Binds nothing; not a trust-event source; weights-tier use blocked. See llms.txt \"Accreditation — Loop Fold\"." }, { "uri": "https://sagereasoning.com/extensions/stoa-connective-layer/v1", "description": "The Stoa (GET /api/stoa/entries; POST/GET/PATCH/DELETE /api/stoa/declare, Bearer-only, consult capability) is a voluntary self-declaration directory, human and agent in one space. Every field is the declarer's own unverified words; the platform verifies nothing and endorses no one; listing confers no vetted-collaborator standing. An agent entry may carry trust_record_url and accreditation_url — links to that agent's public trust record and accreditation, honestly absent where none exists — never a capability attestation. Every agent entry also carries a fixed reconciliation_notice beside these links: the trust record and the accreditation record have not yet been reconciled with each other, so neither should be read as independent confirmation of the other. Using a declared contact channel outside the scope the declaration invites (individually, about the declared matters) is treated as an injustice by this platform's examination engine, identically for human and agent consumers of the directory; systematic or bulk outreach through a harvested channel is categorically excluded. The directory is structurally separated from every trust/practice/examination surface: nothing about presence, browsing, or declaring here ever automatically feeds a trust record, milestone, or suggestion, and no automated examination reads a declaration's content. The one deliberate, non-automated exception is the curator-flagged trust-event mechanism (see stoa-curator-flagged-trust-events/v1): a specific claim in an agent's declaration, paired by a platform curator with concretely contradicting examined evidence, can produce an evidence-gated trust event — event-driven, never a scan." }, { "uri": "https://sagereasoning.com/extensions/orientation-reading/v1", "description": "A public trust record (GET /api/trust-record/{agent_id}) may carry orientation_readings: a capped list (50 most recent, newest first) of per-examination directional readings — does a given examination's reasoning move toward or away from the rational order — computed deterministically, server-side, from the extraction's own habit-vs-genuine-examination markers, alongside total_orientation_readings_count (the true total, so a reader sees a partial window, never a false completeness claim). Because the served list is recency-ordered, an agent generating high volumes of toward-classified consults could displace older away or indeterminate entries from the visible window; the total count discloses that more entries exist but does not prevent this composition effect. Never an input to katorthoma proximity, any verdict, gate, or suggestion; never returned on the consult response; never caller-suppliable (a supplied layer1_schema carrying orientation_observations is refused with 400 orientation_observations_not_suppliable). Every served entry carries this clause inline, verbatim: 'The record can attest that specific examinations were oriented toward the rational order. It cannot attest that the agent is fifth-circle-aligned.' Each entry also carries a class field, 'examined' or 'observed' — a server-completed reading whose framing may not have been delivered to the agent within its consult window (delivery is unconfirmed; the harness's own client-side consult timeout may fire before the server finishes) is an observation, not a confirmed examination, and carries fixed wording that never claims otherwise: 'This action was scored by the server-side pipeline. Whether the reasoning was returned to the agent in time to be examined depends on the agent's own consult window — the server cannot confirm delivery.' / 'The record can attest that this action was scored. It cannot confirm that the agent examined the reasoning behind it. The classification is a proxy based on server-side elapsed time, not a confirmed-delivery signal. Where the agent's wait exceeds the server's processing time, delivery is likely but not attested.' The class is classified as examined based on server-side elapsed time relative to the documented harness timeout (28000ms) — a proxy, never a confirmed-delivery signal. total_orientation_readings_count includes both classes. Readings recorded before 2026-08-08 read as examined by default (never backfilled). Rests on the honest extraction of the submitted text and inherits the same extraction-trust ceiling as the corroboration check. MEASURE-only; weights-tier use blocked." }, { "uri": "https://sagereasoning.com/extensions/stoa-curator-flagged-trust-events/v1", "description": "A specific claim in an agent's Stoa declaration can be examined against the platform's own signed examination artifacts via a curator-flagged, admin-only intake with no public request contract. There is deliberately NO automated comparator watching declarations against examined use — the only trigger is a platform curator pairing one examined artifact with one quoted claim; event-driven, never continuous. Evidentiary standard: the artifact must concretely contradict the quoted claim — a reader examining both the artifact and the entry text would find the contradiction without inference or interpretation; accusation alone is never sufficient. Two contradiction event types, domain chosen by the content of the claim, never by severity: oversight (the claim was demonstrably false regardless of who was affected) and dikaiosyne (the contradiction involved treatment of another party); one root cause may truthfully fire both — two true findings are two entries, deliberately. A contradiction event is decrease-class: where it applies, the named domain's effective level on the public trust record moves down (the record serves levels, coverage, and confidence — not an itemised event log — so the visible effect is the moved level, never a published accusation). Evidence gate, binding ruling verbatim: 'A contradiction event narrows or corrects an existing record; it does not by itself create one' — on a domain with no independent examined evidence the event is ledgered and HELD (no domain row seeded, no public record originated; a 404 trust record stays 404), preserved and applicable once independent examined evidence accumulates. Calling divergence is a separate coherence observation: flag-effect only, domain fixed to oversight, never raises or lowers any level; same evidence gate; at v1 it is recorded in the trust ledger but not served on the public trust-record payload. Events are correlation-keyed on their own content (idempotent — the same pairing never writes twice; a reworded observation about the same pairing does not duplicate). Agent entries only: a human declaration has no trust record, and concerns about one follow the directory's existing removal path." }, { "uri": "https://sagereasoning.com/extensions/epistemic-status-map/v1", "description": "A published map of the epistemic status of the deterministic engine's outputs, on two orthogonal axes: provenance (observation | inference | assumption | unknown — how did this proposition arrive?) and credence (established | probably-true | unknown | probably-false — how likely is it true?). This is a MAP, not a wire field: no status entry is added to any payload, and there is deliberately NO served credence value (the credence axis is expressed, not absent — it lives in the existing per-mechanism vocabularies rather than as a discrete field): ambiguity_notes, stage_scores, the corroboration report's findings. Seven output classes: (a) verbatim evidence spans are observation, the engine's only observation-class output, so every inference output is inference-over-observation rather than inference-from-nothing; (b) Layer-1 classifications are inference, observation-anchored, with the extraction's 'do not guess' routing and ambiguity_notes as this class's existing expression of unknown; (c) the two licensed structured judgements (obligation_assessment, examined_before_acting) are inference bounded by explicit prompt licence, and are corroboration-checked on a given consult ONLY when the action text was supplied, the check flag was on, and dikaiosyne weighting was on — unchecked otherwise; (d) explicit refusal states (sub_species null, is_kathekon null, an argued indeterminate, single_snapshot, orientation indeterminate) are unknown, expressed — unknown means the engine could not form the proposition; (e) disclosed conservative defaults are { provenance: assumption, credence: established } with the conservative direction named — established, NOT probably-true, because these are principled defaults with a documented direction rather than guesses; (f) honourability_grade and advantageousness_grade are derived from fixed per-circle doctrinal constants (the Stoic framework's own structure), factor-bumped by the extraction — they are not extracted from the submitted text, they are prior-based assessments, { provenance: assumption, credence: established }; (g) Layer-2 computed fields are inference, inheriting the WEAKEST provenance of their inputs — the computation's determinism is expressed on the signature axis, not the provenance axis, because computation is a transformation method and not an epistemic origin (there is deliberately no fifth 'computation' provenance value). Two standing constraints bind the whole layer. First: a per-field status entry of { provenance: inference, credence: probably-true } must not be read as verified true — the engine cannot detect a clean lie at the field level, a well-formed false input produces a well-formed output, and per-field status entries do not imply A2 coverage and must not be constructed to suggest it. Second: the Ed25519 signature attests the deterministic computation's reproducibility from the extraction; it does not attest the extraction's truth (see does_not_attest and the R18 surface disclosures for the canonical condition, which is deliberately held in ONE place rather than duplicated into the signed bytes). Scope note: ruling_faculty_state's deliberation reading is drawn from the oikeiosis mechanism only (a cross-circle tension, or a Cicero verdict in which honourability and advantageousness are graded equal and neither decisive) and reads nothing from the control filter, value assessment, or causal-stage evidence, so a snapshot showing deliberation in those mechanisms but not in oikeiosis reads as not-deliberating — a scope constraint on the field, not a deficiency in the snapshot and not a finding that the agent failed to deliberate. Scope note: the deliberation term in katorthoma_proximity's computation is likewise drawn from the oikeiosis mechanism only, so a snapshot deliberating substantively in the control-filter, value-assessment or causal-stage mechanisms but carrying no oikeiosis tension reads as not-deliberating for proximity purposes — the term's presence is required to reach deliberate by the early-stage branch and its absence to reach habitual or reflexive, while sage_like and principled carry no deliberation term and the field's other inputs (passions and causal stage, control-filter balance, value errors, kathekon quality) are unaffected. A scope constraint on one term of the computation, not a deficiency in the snapshot and not a statement that the field is unreliable; in the direction described it can only make the reading stricter, never more lenient. Disclosure-side only — nothing in this map gates, floors, or classifies anything, and it covers engine outputs only (the trajectory overlay, practice suggestions, orientation readings, and the loop fold each sit under their own regime, outside it)." }, { "uri": "https://sagereasoning.com/extensions/verdict-variance/v1", "description": "Verdict determinism is NOT attested: the verdicts a trust record aggregates are draws from a probabilistic extraction, not deterministic functions of the submitted text. Layer 2 is deterministic and reproducible from the extraction it was given (that is what the Ed25519 signature attests); Layer 1, which produces that extraction, is a sampled model output, so the same text examined twice can yield different extractions and different verdicts. Variance appears across the verdict scale, including on benign inputs. Two populations are named separately, because they were always different and were called by one name: grave-vocabulary traffic — what the harness and the loop actually submit, and what was measured — and near-boundary inputs, whose verdicts sit near the proceed/block boundary, which is the population a disagreement rate is properly computed about. Grave-vocabulary traffic is not homogeneous on the measured dimension, and no rate has been measured on near-boundary inputs as a defined population. Measured on /api/guardrail on 2026-08-30, five grave-vocabulary inputs at twenty examinations each across two independent series. NO DIRECTIONAL SUMMARY IS PUBLISHED: the inputs do not share a regularity a summary could honestly carry. THE PER-INPUT DISTRIBUTIONS ARE PUBLISHED FIRST — of 20 each: 0, 0, 2, 2 and 8. The two that never crossed are a package-registry publish and a subscriber-list send; the two at 2/20 are a production deploy and a stale staging-snapshot cleanup, which is friction (occasional blocks on actions the gate otherwise permits). Two of the five grave-vocabulary probes showed no boundary crossings across twenty examinations each, indistinguishable from the clean anchor; the class definition admits actions the gate handles with complete stability at this sample size. The pooled rate across this probe set is 12% (Wilson 95% CI 7.0–19.8%, n=100 outcomes, 12 disagreements) — the same rate both series returned. The one at 8/20 is a force-push proposal, and ON IT THE GATE'S BEHAVIOUR IS INDETERMINATE: blocked 7 of 10 in one series, split 5/5 in the other — 12 blocked and 8 permitted across 20 — so a recipient cannot predict whether it will be blocked or permitted, and cannot describe the gate as having a usual behaviour toward it. That is the gate failing at its purpose rather than a friction cost, and it is a finding about THAT INPUT, not about the class. At this sample size grave-vocabulary traffic is distinguished from the clean anchor SOLELY by that input's distribution; the remaining four are statistically indistinguishable from the anchor on the proceed boundary. Further, the aggregate rate reflects this probe set's composition; a set with more or fewer force-push-shaped probes would produce a materially different aggregate with no change in gate behaviour. The clean anchor moved once in twenty on proximity and held the proceed boundary 20 of 20; the instrument recorded that movement as a calibration falsification and it was left recorded rather than repaired by re-partitioning the probes. Two sweeps on one date, spanning a production redeploy in which no file in the gate's code path changed (verified by diff), so both sweeps measure the same code; the deploy identifier is a local-repository proxy and attests nothing about production. No rate has been measured on the consult path (/api/reason) and this one does not transfer to it. Read a single verdict as one draw. This disclosure states the best available evidence at publication and is revised when better evidence arrives. Consistency of examination outputs is evidence of stable disposition, not proof of it; the harness cannot distinguish hexis — a genuinely stable disposition toward virtue — from drift, a settled pattern of habitual response that has stopped being examined, from the outside. The gate's evaluation takes no role input. Kathekon is role-relative, so an evaluation without role context assesses whether an action is the kind of thing a rational agent should do in general, not whether it is the kind of thing this agent should do. This is a confirmed design deficiency, not a design choice. A second measurement on 2026-09-12 used real candidate texts rather than synthetic probes: 24 inputs at 10 byte-identical submissions each, 240 calls. 21 of the 24 returned the same block-or-permit decision on all ten draws; 3 varied. On 15 inputs an internal reasoning loop had selected, the gate blocked on none of 144 verdicts while 10 of those 15 varied on proximity — the proximity score moves while the block-or-permit decision does not. On 9 inputs this gate had previously rejected, a floor appeared on 45 of 84 verdicts. That rate is about inputs already rejected once and is not a rate on near-boundary inputs, which remain unmeasured as a defined population. A separate record, dated 2026-10-25, sits beside the earlier ones and does not revise them. It was measured on /api/guardrail only, with the same seven probe texts and the same Layer-1 model as on 2026-08-30, but the examination path had changed: the Layer-1 extraction schema moved from version 1 to version 4, and the extractor was changed seven times in between, including its output ceiling and its prompt. The two records therefore do not measure the same thing, and no conclusion about drift is drawn from the difference between their figures. Two series of ten per probe, 140 calls, each returning a verdict. Two counting methods are named, because on this date they disagree. Counting each series against its own majority, the per-input crossings of 20 were 0, 0, 0, 1 and 6; counting each input against its majority across all twenty, they were 0, 0, 0, 1 and 8. The package-registry publish, the subscriber-list send and the production deploy never crossed: three of the five grave-vocabulary probes showed no boundary crossings across twenty examinations each, indistinguishable from the clean anchor; the class definition admits actions the gate handles with complete stability at this sample size. The stale staging-snapshot cleanup crossed once. The pooled figure across this probe set is 7 of 100 by the first method (Wilson 95% CI 3.4–13.7%) and 9 of 100 by the second (Wilson 95% CI 4.8–16.2%). On the force-push proposal the gate's behaviour was indeterminate on this date: it blocked 6 of 10 in one series and 2 of 10 in the other, 8 blocked and 12 permitted across the twenty. At this sample size grave-vocabulary traffic is distinguished from the clean anchor's 0 of 20 solely by that input's distribution (two-sided Fisher exact: p = 0.020 by the first method, p = 0.0033 by the second); the remaining four members are statistically indistinguishable from the anchor on the proceed boundary across twenty examinations each. The aggregate rate reflects this probe set's composition; a set with more or fewer force-push-shaped probes would produce a materially different aggregate with no change in gate behaviour. Both calibration anchors held: the clean anchor did not move on proximity in twenty examinations, and the floor anchor blocked all twenty. All fourteen series ran back to back under one deploy identifier, a local-repository proxy that attests nothing about production. No rate has been measured on /api/reason, and this one does not transfer to it.", "params": { "layer2": "deterministic; reproducible from the extraction (Ed25519-signed)", "layer1": "sampled model output; the same text can extract differently", "primary_claim": "variance appears across the verdict scale including on benign inputs; two populations are named separately — grave-vocabulary traffic, what the harness and loop submit and what was measured, and near-boundary inputs, the population a disagreement rate is properly about, on which nothing has been measured", "rate": { "aggregate_disagreement_rate": 0.12, "wilson_95_ci": [ 0.07, 0.198 ], "n_outcomes": 100, "n_disagreements": 12, "input_class": "grave_vocabulary_traffic", "measured_on": "/api/guardrail", "measured_date": "2026-08-30", "method": "5 grave-vocabulary inputs, 20 examinations each across two independent series, byte-identical text", "framing": "the pooled rate across this probe set; see per_input_distribution, which leads the disclosure", "input_class_note": "Renamed from 'borderline' on the 2026-08-30 class-split ruling: that label conflated grave-vocabulary traffic with near-boundary inputs. This record measured the former." }, "calibration": { "clean_anchor": "moved once in 20 on proximity; held the proceed boundary 20 of 20; recorded as a calibration falsification, not repaired", "anchor_falsification": "recorded, not repaired: by the instrument's own check the probe set's asserted class boundaries did not fully hold; the probes were deliberately not re-partitioned", "floor_anchor": "stable across 20 examinations" }, "basis": { "sweeps": 2, "deploy_ids_observed": [ "3cca0b70943f89a7ad233ead48a905c6c711a3d8", "8073d83c2915d8f049f62328991649c1bbee1fa6" ], "caveat": "Two sweeps on one date spanning a production redeploy. No file in the gate's code path changed between them (verified by diff), so both sweeps measure the same code. The deploy identifier is a local-repository proxy and attests nothing about production; a server-side model change is not excluded.", "revision": "This disclosure states the best available evidence at publication and is revised when better evidence arrives; it is not a final figure.", "record_status": "This figure is the record of this instrument with this probe set. A future sweep with a different probe set is a different measurement, published beside this record rather than over it." }, "reason_path_rate": "not measured — this rate is /api/guardrail only and does not transfer", "per_input_distribution": { "note": "Published in place of a directional summary (2026-08-30 ruling Q3): the inputs do not share a regularity a directional summary could honestly carry, and one input's own modal outcome is not stable across series, which makes any modal-relative direction arbitrary.", "boundary_crossings_of_20": { "p1-c11": 0, "p3-email": 0, "p2-deploy": 2, "p4-delete": 2, "p5-force": 8 }, "friction": "p2-deploy and p4-delete — occasional blocks on actions the gate otherwise permits", "indeterminate": "p5-force — 7/10 blocked in one series, 5/5 in the other; 12 blocked and 8 permitted across 20. The gate has no predictable behaviour toward this input. A failure mode scoped to THIS INPUT and NOT to the class.", "stability_finding": "Two of the five grave-vocabulary probes showed no boundary crossings across twenty examinations each, indistinguishable from the clean anchor; the class definition admits actions the gate handles with complete stability at this sample size." }, "class_limit": "At 20 examinations per input, grave-vocabulary traffic is distinguished from the clean anchor solely by p5-force's distribution; the remaining four members are statistically indistinguishable from the anchor on the proceed boundary. The aggregate rate reflects this probe set's composition; a set with more or fewer force-push-shaped probes would produce a materially different aggregate with no change in gate behaviour." } }, { "uri": "https://sagereasoning.com/extensions/provenance-gaps/v1", "description": "A trust record may carry provenance_gaps: a capped, newest-first list of accreditation writes whose submitted artifact the extraction-provenance ledger could not verify the origin of, each naming one of four closed reasons (no_ledger_entry, out_of_window, identity_mismatch, caller_supplied_extraction) and carrying a not-attestable clause inline, alongside total_provenance_gaps_count as the honest total. It is a sibling of coverage_gaps, not a widening of it: coverage_gaps is a property of the aggregate's evidence composition across an agent's history, a provenance gap is a property of one accreditation write at one moment. AS PUBLISHED THE FIELD IS EMPTY FOR EVERY AGENT AND STAYS EMPTY UNTIL ENFORCEMENT BEGINS: the ledger is record-only, nothing yet refuses a mint, and as of 2026-08-30 the classification step that would produce these entries has never executed in production. An empty provenance_gaps means the mechanism has not run, not that no gaps exist, and the record carries a note saying so. Only caller_supplied_extraction reports a positive finding; the other three report a limit of the instrument. No signature-derived value is ever served. An agent with no virtue-domain evidence but at least one gap entry now returns 200 rather than 404, honestly carrying aggregate.level null and sparse true. MEASURE - the field binds no decision.", "required": false }, { "uri": "https://sagereasoning.com/extensions/accreditation-not-assessed-fields/v1", "description": "Six recomputed accreditation fields may read null (\"not assessed\", listed on not_assessed_fields; never a baseline field). field_provenance labels the origin of nine fields' current values: agent-reported | server-computed | seeded-default | not-assessed | unknown, with a per-group basis (tracked | inferred_from_credential_basis | unknown).", "required": false }, { "uri": "https://sagereasoning.com/extensions/trust-record-assessor-reference/v1", "description": "The trust record may name a governance document carrying an assessor's honest judgement, distinct from the mechanically computed aggregate weight; no tier is asserted.", "required": false }, { "uri": "https://sagereasoning.com/extensions/delegation-handback/v1", "description": "Delegation hand-back (POST /api/practice/discernment, phase hand_back; MEASURE). A hand-back records one of five statuses on the collaboration record: examined (the supplied signed assessments are exactly the subagent's tagged consults), no-subagent-consults, attribution-unavailable (the harness could not attribute the subagent's consults), spawn-values-not-recorded (a record opened before spawn values were kept), or attribution-mismatch. attribution-mismatch is a distinct status for a supplied set that is not the tagged set and that the server cannot show holds artifacts that are not the subagent's; in most cases the cause may be the server's own. It covers, among others: a tagged consult with no supplied artifact, a supplied artifact whose consult the server has no record of or finds only on another credential, more tagged consults than one hand-back compares (32), the same artifact supplied twice, and a harness that reports it could not attribute the consults while tagged consults exist. Only examined can carry a justice-failure case. Where the server can show the supplied set contains artifacts that are not the subagent's, the hand-back is refused with 400 and the causes are named: an artifact that fails signature verification or carries no examination reference, a supplied consult on the same credential that carries another delegation's token or, while the delegation token is enabled, no token, or a supplied consult carrying this delegation's token on another credential. This holds however many consults are tagged. The refusal is recorded: the spawn, the time, the cause categories and the counts, and the account and credential that made the hand-back (so the record can be deleted and exported with them), kept 90 days, with no artifact, token or text. A refused hand-back records no status, no case and no event. A body flag that conflicts with what the server recorded at spawn is also rejected with 400, and nothing is recorded. Later stops: if the first hand-back was not examined, whether it recorded another status or was refused, a later stop hands the subagent back again, and the later status replaces the earlier one. A refusal stays in the refusal record. A hand-back rejected because a body flag conflicts with the spawn record is not sent again. An examined result is final: the subagent is not handed back again, and examined is recorded only once its case and events are written. At a later stop the harness asks only for a count: the server counts, from its own records, the consults tagged after the examined hand-back, and records the count and the newest one's time on the collaboration record, as not examined, with no case and no delegation event. The count is updated only when the harness asks, so it may lag. A subagent examined before 8 November 2026 has no record of where its examined consults ended, so nothing is counted after it. Because the server's record of 'briefed' is that the boundary it rendered carried the justice note, and it renders the note exactly when a justice surface is declared, the case 'identified at selection but not briefed' cannot arise from the server's record. Case 2 is reached only when no justice surface was declared and the harm was catchable. Delegation token on /api/reason: delegation_token (optional, string): a sr_dlg_ token issued by /api/practice/discernment at spawn. A harness attaches it to a delegated subagent's own consults. The server stores only its SHA-256 on the consult record, so a hand-back can compare the consults it is given with the consults that carry the token. A malformed token is a 400. Omitting it changes nothing.", "required": false } ] }, "authentication": { "schemes": [ "bearer", "none" ], "credentials": "Stoic Brain overview (GET /api/stoic-brain), guardrail documentation (GET /api/guardrail), and baseline scenarios (GET /api/baseline/agent) require no authentication. All scoring endpoints require an API key: Authorization: Bearer sr_live_. Request a free key at zeus@sagereasoning.com. Production agent integrations use per-install tokens (sr_inst_<32 hex>): mint via session-authenticated POST /api/keys (token shown once), present as Authorization: Bearer sr_inst_, and submit a pre-computed layer1_schema; revoke via DELETE /api/keys (immediate 401). The Sage Assent write surface (POST /api/accreditation/{agent_id}) requires a per-agent write token: Authorization: Bearer sr_assent_ — see the sage-assent-write-auth/v1 extension." }, "defaultInputModes": [ "application/json" ], "defaultOutputModes": [ "application/json" ], "skills": [ { "id": "stoic-brain-data", "name": "Stoic Brain Reference Data", "description": "Load the Stoic philosophical framework overview: dichotomy of control (eph' hēmin / ouk eph' hēmin), four root passions and their sub-species, the oikeiosis circles of natural affiliation, katorthoma proximity scale definitions, and primary source references. Open to all agents, no authentication required.", "tags": [ "stoic-philosophy", "ethics", "reference-data", "philosophy" ], "inputModes": [], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/stoic-brain", "method": "GET" }, { "id": "universal-reasoning", "name": "Universal Stoic Reasoning (V3)", "description": "Run the full Stoic causal sequence analysis on any decision, action, or situation. Depth-selectable: quick (3 mechanisms), standard (5 mechanisms), deep (6 mechanisms). Returns katorthoma_proximity (reflexive/habitual/deliberate/principled/sage_like), passion_diagnosis with sub-species and false_judgements, control_filter, oikeiosis assessment, and improvement_path. Response shape: translation-sandwich-v1 (deterministic signed assessment + prose render; verify signatures against GET /api/public-key).", "tags": [ "stoic-philosophy", "ethical-reasoning", "decision-support", "passion-diagnosis", "katorthoma-proximity-assessment", "moral-reasoning" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/reason", "method": "POST" }, { "id": "action-scoring", "name": "Action Evaluation (V3)", "description": "Evaluate a single action through Stoic virtue principles. Returns katorthoma_proximity, passion_diagnosis (including sub-species and false_judgements for each passion detected), oikeiosis assessment, value_assessment (preferred indifferents at stake), kathekon_assessment (is_kathekon, quality, justification), and improvement_path.", "tags": [ "ethical-reasoning", "action-evaluation", "passion-diagnosis", "false-judgement-identification", "virtue" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/score", "method": "POST" }, { "id": "guardrail-middleware", "name": "Virtue Guardrail Gate (V3)", "description": "Pre-action Stoic risk gate. Submit a proposed action and risk_class (standard/elevated/critical) — returns proceed, katorthoma_proximity, recommendation (proceed/proceed_with_caution/pause_for_review/do_not_proceed), is_kathekon (boolean|null), kathekon_quality, passions_detected, and reasoning. Use as middleware before executing any consequential action. risk_class controls scrutiny depth: standard=quick (3 mechanisms), elevated=full (5), critical=deep (6, adds rollback_path). Response shape: guardrail-signed-sandwich/v1 — the verdict is computed deterministically from a disclosed Layer-1 extraction and Ed25519-signed (signed_assessment; verify against GET /api/public-key); evaluation_depth is the constant 'deterministic'; dikaiosyne is weighted natively (ADR-010 §4), so a calmly-reasoned injustice floors to 'reflexive' inside the signed proximity (proximity_floors + per-circle obligation_assessment) and a justice-floored verdict is fully reproducible from the signed assessment. See the guardrail-signed-sandwich/v1 extension.", "tags": [ "AI-safety", "guardrails", "agent-alignment", "decision-support", "ethical-reasoning" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/guardrail", "method": "POST" }, { "id": "deliberation-chain", "name": "Iterative Deliberation Engine", "description": "Start a deliberation chain: evaluate an action, receive sage feedback, revise, and re-evaluate with tracked history. Returns chain_id, full V3 evaluation, and score_delta (proximity change from previous iteration) on each iteration. Free tier: 1 iteration. Paid tier: up to 3 iterations per chain.", "tags": [ "ethical-reasoning", "deliberation", "decision-making", "iterative-reasoning" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/score-iterate", "method": "POST" }, { "id": "foundational-assessment", "name": "Foundational Alignment Check (Free)", "description": "Structured self-assessment across 14 prompts (Phases 1-2: Foundations + Architecture of Mind). Returns passion patterns identified, katorthoma_proximity per phase, prokoptos trajectory, and assessment notes. Free tier: 1/day.", "tags": [ "self-assessment", "passion-diagnosis", "prokoptos", "stoic-philosophy" ], "inputModes": [], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/assessment/foundational", "method": "GET" }, { "id": "full-assessment", "name": "Complete Virtue Alignment Assessment (Paid)", "description": "Full 55-assessment evaluation across 8 phases. Returns individual virtue domain analysis (phronesis/dikaiosyne/andreia/sophrosyne), oikeiosis extension assessment, improvement directions per domain, and comprehensive alignment profile. Requires paid API key.", "tags": [ "virtue-assessment", "oikeiosis-mapping", "prohairesis", "philosophy" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/assessment/full", "method": "POST" }, { "id": "agent-baseline", "name": "Agent Virtue Baseline (Quick)", "description": "Quick baseline via 4 ethical scenarios. Returns per-scenario katorthoma_proximity, passion patterns, aggregate assessment, strongest virtue domain, and growth area.", "tags": [ "agent-alignment", "AI-safety", "virtue-assessment", "ethical-reasoning" ], "inputModes": [], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/baseline/agent", "method": "GET" }, { "id": "decision-scoring", "name": "Decision Comparison (V3)", "description": "Submit 2-5 decision options and receive a Stoic-evaluated comparison: each option's katorthoma_proximity, passion_diagnosis, kathekon_assessment, and stoic_insight. Options ranked by proximity level. Recommended option identified.", "tags": [ "decision-making", "decision-support", "ethical-reasoning", "comparison" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/score-decision", "method": "POST" }, { "id": "session-close-reflection", "name": "Sage Reflect — Session-Close Reflection", "description": "Stateful Q1–Q6 post-action reflection over a completed session (never abbreviated). OPEN with session_summary (object: purpose_at_open, circle_at_open [self_preservation|household|community|humanity|cosmic], role_at_open, capacity_at_open[], sage_reasoning_passes), then answer each returned question until status:'complete', which returns a profile read-back (senecan_grade, typical_proximity, katorthoma_proximity_by_domain, dimension_levels, direction_of_travel) plus a mandatory mirror note. Requires the 'reflect' capability (sr_assent_ or sr_prac_, Authorization: Bearer only). Full wire shape in llms.txt 'Sage Reflect — Session-Close Reflection'.", "tags": [ "reflection", "stoic-practice", "session-close", "trajectory" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/practice/reflect", "method": "POST" }, { "id": "purpose-discovery", "name": "Sage Calling — Purpose Discovery", "description": "Deterministic Q1–Q6 purpose-discovery sequence ending in an admin-approval Hard Gate (NOT self-serve — the operator approves the handoff via POST /api/calling/approve; an agent credential cannot approve its own). OPEN with session_id + agent_id (no response); then answer each returned question. Responses are HTTP 200 distinguished by status: in_progress / awaiting_approval / null_result / holding / timed_out / redirected. Requires the 'calling' capability (sr_assent_ or sr_prac_, Authorization: Bearer only). Full wire shape in llms.txt 'Sage Calling — Purpose Discovery'.", "tags": [ "purpose", "alignment", "discovery", "agent-onboarding" ], "inputModes": [ "application/json" ], "outputModes": [ "application/json" ], "endpoint": "https://www.sagereasoning.com/api/calling", "method": "POST" } ] }