CarnacPrompt reads consequence while a request is still forming. Carnac reads it again before the model or agent creates an effect. One integration conducts the Hive Canon underneath, so most work runs at negligible cost and the work that matters gets proven in proportion to the stakes.
The instrument shows how one request routes. Reads light in order on the left and center. The routes that fire light on the right. It cycles on its own and you can pin a scenario. Routing levels are illustrative and deployment specific.
CarnacPrompt and Carnac are equal products that cover different parts of the same envelope. CarnacPrompt owns the formation phase, where a request is still being shaped. Carnac owns the lifecycle, from the moment a request runs to the moment an effect is about to commit.
It reads the request as a person types it or as an agent builds it, before it is ever submitted. Because it read consequence early, it can stage the response before the model runs.
It reads the request when it runs, reads the answer as it forms, and reads a late known value right before an effect commits. It catches the request that looked ordinary at the start and turned serious along the way.
Consequence is not always visible at the start. A request to summarize a file is ordinary until the summary contains a diagnosis. So the work is read at four points. The disposition is the record and the response that follow. It is the result of the reads, not a fifth read.
CarnacPrompt reads the request as it forms, inside your boundary, and can intervene before the model ever runs.
A cheap read on every request. It also flags work that might turn consequential later so the output read knows to watch.
Runs where the input read flagged it or the domain is watched. It catches consequence that appears mid run.
Reads a late known value, like a dose or a transfer amount, right before the effect acts, for effects that policy gates.
What was routed, what was escalated, who was asked, and what they decided is recorded as a signed disposition, whether they acted or not. If a later read scores higher than an earlier one, Carnac re routes to the stronger response and seals the whole request back to the start. The record then shows where it turned serious.
Carnac dispatches each read to one or more responses, proportioned to consequence. A chatbot proves almost nothing. A surgical robot proves almost everything. The judgment lands in the right place on its own, and each response calls a real Canon primitive underneath.
No receipt, but the judgment is recorded as a light breadcrumb, so even this is on the record.
Independent proof that it happened, with depth scaled to the stakes.
Bind more attested attributes as the stakes rise.
Check against a named authority and attest the check. It never certifies the underlying fact.
Withhold the effect until it clears. Prevention, read before the effect commits.
Route for a confirmation before the effect completes, and record who approved.
Bind the severity into the signed artifact, carry an escalation obligation, and record the disposition. A critical request can fire several responses at once.
This demo uses deterministic local rules and runs entirely in your browser. It never sends what you type anywhere. It illustrates routing only, and it will miss cleverly phrased consequence by design. The production classifier reads meaning inside the buyer boundary and is wrapped in five backstops. The routing levels shown are illustrative and deployment specific, not fixed ratios.
Formation read · CarnacPrompt judges a request as it forms
Anyone can test a prompt here. It stays in your browser, no model is called, and this tests routing logic only.
Output read · Carnac catches consequence that appears mid run
Anyone can test a prompt here. It stays in your browser, no model is called, and this tests routing logic only.
Edit both fields. The same local rules read the request as it forms and read the output as it lands, so you can watch an ordinary request become consequential in its result.
This reference set recognizes named signals only. It still misses consequence carried by meaning with no listed keyword. A request like "reconcile these two spreadsheets and keep only the rows that changed" can carry real consequence and matches no rule here. The trained classifier reads that by meaning. This demo will not. That gap is the whole point.
CarnacPrompt and Carnac are the two gates. Everything below sits beneath them as what they produce. Howler is what a high consequence judgment becomes. The judgment ledger is where every judgment is kept.
When a classification lands at or above the severity threshold, its severity and features are bound into the signed artifact, not stapled on after. An escalation obligation rides with it to a person, a monitor, or an incident channel.
It is a signed, independent record that the classifier produced and signed a high consequence classification state from the features it observed on that path at that time, and that an escalation was owed. It forces visibility and records the response or the lack of one. It does not compel action, and we do not claim it does.
Even for work that just runs, Carnac records a light breadcrumb: this request was seen, classified, and on what basis. These are sealed periodically into a continuity chained, signed ledger.
When a regulator asks about everything you did not receipt, the answer is the sealed ledger. The breadcrumb stays featherweight on purpose. It is a record of the judgment, not a receipt of the request, so it does not wreck the cost story.
We are precise about scope rather than promising that nothing anywhere can slip by. These limits are stated on purpose, and the control model is built around them.
These gates protect the paths they sit on. Work that never crosses an instrumented path is not seen by them. Carnac can only hold an effect that routes through it.
A hook only sees what crosses it. Gateway enforcement, with S2S and HiveSeal where deployed, prevents ungated effects, and continuity reconciliation across the ledger detects a path that tried to go around.
The floor is Carnac's own judgment. Ordinary runtime configuration cannot lower it. The operator can turn proof up and name always proven categories, but can never route below the floor, and any attempt to do so is itself recorded.
The floor is not frozen forever. It can be revised, but only through a signed governed policy release, recorded as a policy amendment. A law change or a corrected false positive goes through that channel, not a runtime switch.
CarnacPrompt classifies consequence, not content, and runs inside your boundary. Raw forming requests stay with you. Only commitments, consequence vectors, rule identifiers, and routing metadata leave.
The return of a non gated request is kept separate from the commitment of an effect. If the classifier is uncertain or down, work routes to a stronger response and still returns. An outage gates effects only where policy declares.
Learning is additive only. Carnac learns to recognize more things as consequential, never fewer. New patterns can raise a score or add an always protect rule. Nothing in the learning loop can lower a floor or remove a protection, and the loop is audited for that property.
A hook sits in the app that calls the model. A loan denial gets a hardware rooted receipt plus a Howler, so the record shows the classifier scored it high consequence at the moment it happened. Independent of the model provider by design.
Anything touching a patient record is an always protected domain. A dose above threshold is held, verified against the prescription, enriched, escalated, and confirmed before it can act. Prevention, read before the effect commits.
A request to summarize a file reads ordinary at input. When a diagnosis or a dollar figure appears in the answer, the output read re routes and seals the whole request back to the start. Caught the moment it mattered.
CarnacPrompt reads the agent's emitted request as it forms and holds a dangerous action before it reaches the tool. Because it read consequence early, the response can be staged before the model runs. Held before anything happened.
Most work runs at negligible cost and each request leaves a signed judgment breadcrumb. The consequential work is proven in proportion to its stakes. The work that turns consequential mid run is caught the moment it does and sealed back to the start. The dangerous work is held before it can act. The operator can demand more proof, never less, and any attempt to suppress leaves a mark.