Your corpusYour weightsYour proof

CLARA is mission security. It secures every mission and every request before anything acts on it.

Every order sheet is signed and verified before any agent marshals it, so a tampered sheet is refused rather than executed. Roster membership is closed, and each agent authenticates with its own token. Every document is hashed at the moment it is acquired, so what was verified is provably what was used. In the live runtime, CLARA authenticates each request and resolves the caller's authorisation scope, which limits the answer to the clusters that caller is allowed to reach.

Signed order sheets

An edited mission is refused, not executed.

Closed roster

Only bound agents take part, each with its own token.

Content hashes

What was verified is provably what was used.

Authorisation scope

A caller only reaches the clusters it is entitled to.

Ambiguity is what makes everything downstream probabilistic. ConteX Law removes it before any model acts.

ConteX Law is the analytical pipeline. Every task, research query and generated instruction is structured through four pillars: Structure, Behaviour, Influence and Objective. What comes out is a precisely formed instruction, and that instruction, never the raw user text, is what the rest of the system works from. The engines have been exercised across the full range of available models, from frontier models down to small open weights models, and every model run through them produced the same verified output.

Four pillars

Structure, Behaviour, Influence and Objective.

Model agnostic

The verified result comes from the governance, not from the model that wrote the first draft.

Published

The theory is set out in five working papers on SSRN.

LINGO is the deterministic linguistic gate. Precision is enforced everywhere, not checked once at the end.

Content that is vague, self contradictory or imprecise in its use of domain terminology is rejected before it can reach a knowledge base, a training corpus or a live response. The gate is deterministic: the same content always receives the same verdict. LINGO runs on every node that serves an answer, so no discipline answers without its own gate.

Deterministic

The same content always receives the same verdict.

Three places

Before the knowledge base, the training corpus and the live response.

On every node

Each serving node runs its own gate.

AXIOM is the certified truth layer. It certifies at three points: the sources that enter the corpus, the clusters trained from them, and each answer as it is generated.

Certification scores coverage against the source corpus, classifies against calibrated bounds, is verified independently by the orchestrator and is signed, with the full audit trail recorded at every step. In the live runtime AXIOM certifies each answer against the verified body of knowledge in the same instant it is generated. An answer that cannot be certified is not returned.

Sources

Nothing enters the corpus uncertified.

Clusters

A retrained cluster must measure at or above the version it replaces.

Answers

An answer that cannot be certified is not returned.

A CON10X model is not one large parameter set that has to be loaded whole. It is an indexed set of independent clusters.

Each cluster is a complete transformer trained on one bounded body of knowledge, stored on a local drive and loaded into memory only when a request needs it. A permanently resident master index cluster reads each request and routes it to the cluster that owns the answer. Memory is taken by the warm pool, the clusters kept resident, so a model with five clusters and a model with five hundred run on the same machine; growth costs storage. Because only a fraction of the model is active at any moment, that fraction runs at the precision it was trained at. Nothing is quantised, in training or in inference.

Working set, not model size

Hardware is set by the clusters kept resident, not by the whole model.

Full precision

Two bytes per parameter, never compressed.

Memory becomes seats

Everything the index and warm pool leave free holds the sessions being served.

The deterministic layer runs first, and the router never sees the raw user text.

CLARA authenticates the request and narrows the candidates to the clusters the caller may reach. ConteX Law structures it and LINGO fixes its precision. Only then does the master index cluster read the structured instruction and rank the candidates, each with a confidence score. The index resolves only against a signed list of certified clusters, so it cannot invent a destination. Both layers write to a routing audit log against the request hash, kept for 400 days, so every answer traces to the cluster that produced it and the evidence for choosing it.

Fixed order

Governance first, routing second.

Signed manifest

The router can only name clusters that exist and are certified.

400 day log

Every routing decision is recorded against the request hash.

The runtime is built to fail closed, and to say why.

On startup the host runs six checks in a fixed order, and each has its own refusal message, because a damaged file and a substituted model lead to different remedies. A cluster that fails is a hole: the rest of the model answers, and questions belonging to that cluster are declined rather than sent to the nearest one. The live model has no path to external data of any kind. It never queries the open internet and never ingests new content on its own initiative.

Six checks

From the host's own hash functions to every weight hash.

A hole, not a guess

A failed cluster's questions are declined, not rerouted.

Nowhere else to look

The runtime cannot reach unverified data.

Every deployment has one entry point, the CAT parent.

The caller's identity is established at the reverse proxy in front of the parent. The parent runs the four engines, checks that the caller is entitled to what they are asking about, resolves the domain and discipline, and reads its destination table. The domain belongs to the enterprise, such as South African banking; the disciplines within it, such as corporate banking and home loans, are its clusters. The boxes the parent routes to are CAT children, running the same binary with their own clusters and the full engine stack. A small deployment is one box that is its own parent. Because a request goes to one independent cluster, nodes shard by cluster and by user with no synchronisation in the decode loop, and adding a node adds its users without changing the others.

Governance on every node

Parent and child alike run all four engines.

Linear scale

Three children serve about three times the users of one.

Any vendor

The same holds on AMD, Apple and NVIDIA.

Many organisations, and the sovereign AI providers that serve them, already run a model they want to keep. CON10X Pythagoras puts it behind the CAT parent in one of two ways, and in both the four engines run first.

Pythagoras can serve the open weights itself on a CAT child, at eight bit precision and pinned by its digest, so the record states exactly which model answered and the request can be run again. Or it can leave the existing platform exactly as it is and call it through its API, like a cloud AI model. That route is off until an administrator configures it, credentials are never kept in plain text, and the audit record names the destination and what was sent. If the platform is unreachable, rate limited or returns an error, the caller receives a bounded refusal, and the parent never substitutes an answer from somewhere else. On both routes AXIOM checks what comes back against the material supplied. Only weights trained and certified in CON10X Academy carry a certification status.

Pinned by digest

Served by Pythagoras and replayable.

Called like cloud AI

The platform stays as it is, and the answer is marked not replayable.

No substitution

An unreachable destination returns a refusal.

Every user added lowers the rate for all of them, and a longer context window leaves room for fewer users. Pythagoras is configured from that relationship.

Set concurrent users and the window, and Pythagoras states the rate each user receives. Set the rate and the window, and it states how many users a node can serve. Set users and rate, and it states the largest window it can give them, between 2,000 and 128,000 tokens. A configuration is refused where its sessions would not fit in memory, where the rate would fall below the floor of twelve tokens per second, or where the window would exceed what the cluster was trained to. At run time a node admits a new session only while the configured rate holds. Serving boxes need no cooling.

Standard chat

Up to 1,621 users at sixty tokens per second on a 2K window, on one 512 GB unified memory workstation.

Large documents

Windows up to 128,000 tokens, with fewer users at the same rate.

Refused, not degraded

A configuration that fails a limit shows the figure that failed.

Academy fetches the original of every source and puts it through all four engines before it can enter the corpus.

Content is hashed at the moment of extraction, structured by ConteX Law, gated by LINGO and certified by AXIOM against what its category already holds. Source authority is a scored threshold: at or above 0.80 is admitted automatically, 0.50 to 0.79 is held for the expert, and below 0.50 is rejected and not stored. The expert may raise the thresholds but never lower them below the floor. A claim in a newly discovered source waits until two further independent sources agree. Nothing that fails is silently discarded: it reaches the Review Queue with the reason in plain language.

Scored authority

Automatic, held for review, or rejected.

Three source rule

A new claim needs two more independent sources. Registrar resolved sources are exempt.

Nothing lost silently

Every failure reaches the expert with its reason.

A domain is not a cluster. South African law is one domain; contract, property, labour and tax law are disciplines within it.

Academy presents three shapes with the numbers behind each: one cluster for the whole domain, one cluster per discipline, or disciplines grouped where they share concepts. One cluster is the cheapest to serve and the most expensive to keep current. One per discipline is the most precise and the most auditable, and spends serving capacity. Grouping is usually right and the hardest to reach by intuition, so Academy supplies the arithmetic: seats and tokens per second for the proposed set beside the current one. The Regulator approves a pair of numbers, not a diagram. The corpus sets the floor on granularity: about one billion unique tokens supports a 150 million parameter cluster, and a thin corpus is fixed by acquiring sources, not by training longer.

Three shapes

One cluster, one per discipline, or grouped.

Priced first

Every change is shown in seats and speed before it is committed.

Sized to the corpus

A cluster is never larger than its corpus can fill.

Self improvement runs for the life of the model, and it can never certify itself.

Overnight discovery finds new material, runs it through the governed pipeline and presents a report the next morning. The domain expert admits each source. The Regulator approves a named training proposal: which clusters would be retrained, which sources drive each change, and the scored impact. AXIOM certifies the retrained cluster against the approved ground truth, and a cluster that fails leaves its previous version serving. The Regulator then approves publication separately. Only certified outputs are admitted back into training, so the model learns from its verified answers and not from its errors. Teacher models are treated as the least trustworthy input: every generated item is certified against the expert's ground truth, rejected if it disagrees, and never counted toward fact coverage.

Two separate gates

Approval to train and approval to publish.

No self certification

Neither gate can be crossed by the software.

Teachers held to ground truth

Generated content supplies language, never facts.

A new regulation retrains the one cluster that owns it, overnight, while the live model keeps serving.

Academy trains one cluster at a time on a separate training drive. Every other cluster's weights stay byte for byte what they were, which is a provable statement rather than an assurance, so the catastrophic forgetting that turns fine tuning a monolithic model into a project is structurally removed. Given the same configuration, corpus and recorded seed, a cluster rebuilds byte for byte identical. A certified cluster and its routing update are promoted to the live drive in one transaction or not at all, and a new router only takes over after running in shadow without regression. Rollback points to a version already on the live drive, and works even with Academy shut down.

Byte for byte

Untouched clusters are provably unchanged.

One transaction

A cluster and its routing update go live together, or neither does.

Rollback without rebuild

Three versions of each cluster stay on the live drive.

Coder is where a technical team designs, writes, tests, debugs and ships software.

It carries a code editor, an integrated terminal, code analysis, semantic indexing, project scaffolding, build and run targets and a debugger, across about fifty languages in eight categories. It detects the toolchain from the files on disk and manages packages across NuGet, npm, Yarn, pip, Cargo, Maven and Gradle. Coder is not built around one model vendor, and the model is chosen per agent, so a mission can put a strong model on the orchestrator and inexpensive models on the workers. Because the verified result comes from the governed pipeline, an inexpensive or free model produces the same verified result as a frontier one. In one demonstration, three agents turned an eleven page merger presentation into a viability report with more than thirty verified financial metrics, each traced to its source page, in five minutes, on a free model.

About fifty languages

Generation, editing, analysis and indexing across all of them.

Any provider

Adding one is a configuration entry, not a code change.

Model per agent

Strong models where they matter, inexpensive ones elsewhere.

Aegis creates agents, binds them into a mission, scopes what each may do, isolates them while they run, and certifies what they produce.

A mission is built from four topologies. The orchestrator holds the mission key, verifies every unit's output independently and signs the result, because nothing is certified on a unit's own say so. A silo is a vertical chain: orders travel down, results travel up, and there is no lateral traffic. A mesh is a leader with marshals, whose findings are pooled and adjudicated. With the forge enabled, the orchestrator becomes recursive and self improving: when a marshal needs a capability that does not exist, the orchestrator builds it, tests it against held out acceptance tests in a sealed sandbox, and grants it only on a clean pass. Every agent runs in its own process, blocked from the open network, and never holds a provider key.

Signed missions

Order sheets and tool grants sit under one signature.

Scoped tool grants

A unit reaches only the tools it was granted.

Isolated agents

Local proxy and bus only, and no provider keys.

A model on its own can only write. Prometheus builds the tools that let it act: look up a record, read a setting, calculate, format a result.

An engineer writes a tool against the tools template, or describes it and a model writes it. Either way the code is confined to one narrow, versioned API, with no file system, no network except through a declared connector, and no subprocess. Anything outside that surface needs a person's approval. Whoever describes a tool supplies acceptance cases, pairs of inputs and expected outputs, and a tool that fails them in the sandbox cannot be exported. Coder exports an unsigned package with its provenance: the prompt, the model that wrote the code, the sandbox run and the hash. Academy runs the cases again, and a named person holding the signing key admits it. At run time every call is checked against the tool's schema, a refused call returns to the model as a refusal, and every tool return passes the four engines before the model sees it.

Confined API

No file system, no subprocess, no undeclared network.

Acceptance cases

Working means passing them, in the sandbox and again in Academy.

Signed by a person

Coder never signs or deploys anything.

Multiverse runs the governed research that fills the Model Specification.

Eight research meshes work in parallel across tokenisation, architecture, attention, data pipeline, training, evaluation, inference and self improvement, alongside the customer's own domain literature. The host drives the search and the model labels what the host found, so the model is never asked to produce a reference and a citation cannot be fabricated. Every claim needs three independent sources unless a registrar has already resolved it, and contradictions are adjudicated rather than averaged. The operator states goals in a nine step Architect wizard, in their own language; no control in it names a technical value. Each of the 112 parameters in the Model Specification is fixed by exactly one producer: a stated goal, a decision the Regulator approved with its evidence, a CON10X catalogue value, or arithmetic over the rest.

No fabricated citations

Identifiers come from the registrar, not the model.

Goals, not configuration

Nine steps, in the operator's language.

112 parameters

Each with its value, its producer and its evidence.

The components of a transformer do not vary by customer. Asking a language model to write them returns the commonest implementation, slightly differently every time.

So the build involves no language model at any point. One action renders every component from the Model Specification, checks each in a sealed Python environment, and measures the built module against the specification: the width read off a weight tensor, the head count off the key projection, the parameters summed over the module. A component that imports cleanly but measures differently does not pass. Integration then imports every component in dependency order, to catch what only fails when modules load together. The handoff to Academy carries a hash for every artefact and a hash over the hashes, and a source altered since it passed refuses the export.

Measured, not only checked

Conformance is read off the built module.

No override

The exit gate is evaluated fresh on every read.

Hash over hashes

Academy verifies one value to trust the whole package.

Every answer comes from a record the platform keeps, not from an assurance.

The Foundation Model Transparency Index found that the average score for major model developers fell from 58 in 2024 to about 41 in 2025, with training data the most opaque area. Those are consequences of where those architectures put the model and the data. CON10X is built the other way round: provenance, reproducibility and approval are part of how the software is put together, and the Corpus Audit screen exports the record as a professional audit document.

Corpus Audit

Every source with its provenance, hash, score and approver.

Routing audit log

Written on the customer's own machine.

Recorded approvals

With the authority each was exercised under.

CON10X is engineered against the EU AI Act, ISO/IEC 42001 and the NIST AI Risk Management Framework.

Each requirement is answered by a mechanism described on this page. Stating the limits plainly is what makes the rest usable in front of a regulator. CON10X does not hold a certificate on the customer's behalf, because the ISO/IEC 42001 certificate belongs to the organisation. It does not decide whether a deployment is high risk, because that is the customer's determination under Article 6 and Annex III. And it does not replace a management system. What it removes is the part that is usually impossible: producing the technical evidence after the fact, from a system never built to record it.

Not a certificate

The certificate belongs to the organisation.

Not a classification

The customer determines its own risk class.

Not a management system

Policy, competence and internal audit remain organisational work.

Sovereignty is usually sold as data residency, which delivers about a quarter of it.

A sovereign AI capability means the institution can state what its model knows, change what it knows, prove why it answered as it did, and keep operating if every foreign vendor withdrew tomorrow. CON10X can substantiate each. The model contains only the customer's domain, by construction: there is no foreign base model underneath, and every cluster is trained from random initialisation on a corpus the customer approved. Every change is approved by a named person and is reversible. Every answer traces to a routing decision and its sources. The runtime is a single native process reading a local drive, so if every foreign laboratory withdrew tomorrow, the model would keep serving and Academy would keep improving it.

Know

Only the domain, by construction.

Change

One cluster at a time, approved and reversible.

Prove

Routing log and corpus audit.

Continue

No dependency on any vendor remaining available.

SnapStak.ai does not sell to end users and does not compete with the providers it licenses.

No other sovereign AI provider has the same architecture and topology, so CON10X complements what a provider already runs. The provider's infrastructure and model stay in place, served by Pythagoras or called through its API, and the four engines govern them either way. Providers bundle the CON10X AI Ecosystem into their own offering, and it serves medium and small enterprises as well as the largest. SnapStak.ai supports the providers it licenses; providers and their channel partners support their users.

Complementary

The provider's infrastructure and model stay in place.

Governed either way

The engines govern the provider's model and certified weights alike.

Every size of enterprise

From one workstation to many serving nodes.

The licence buys the platform and the right to run it.

CON10X is licensed per user in blocks of 100 at one flat rate, with no bands and no volume taper. A 39,000 user deployment is 390 blocks at the same rate as the first. Everything built on top, from the domain base build to agents, tools and operations, is a service delivered by the provider or its channel partners. Licensees receive the source code for full transparency: they may use it and update it, and they may never commercialise it. Enterprises keep their own custom code.

Flat rate

The same per user rate from the first block to the last.

Source access

Full transparency for the provider and the enterprise.

Services on top

Delivered and billed by the provider and its partners.