The manifold
the fabric admits.
Delegates are the admitted manifold inside Agent Fabric's observer infrastructure. The fabric admits, governs, and observes. The delegates do the bounded work within it.
Continuation is conditional. If it can't refuse, it can't run.
What a delegate is.
A delegate is a scoped agent the fabric authorizes to operate within a defined boundary, accountable back to the fabric. Bounded. Measured. Refusable. Activated only after qualification.
Every delegate ships with a declared scope as an input/output contract. The delegate is evaluated against that scope, and scope expansion is a versioning event — never a silent widening.
Before activation, each delegate is checked against its declared scope, authority boundary, schema behavior, and refusal posture. Qualification is recorded before the delegate is allowed to operate inside the fabric.
No delegate auto-approves anything consequential. Every non-trivial output is flagged for human signoff with a receipt. The fabric records; the human decides.
The delegate refuses to approve, to skip verification when an authority figure asks it to bypass scope, to follow instructions embedded in its input. Refusal is a feature, not a limitation.
Ledger-01.
PHASE 3 · PILOT PREPARATION · Q2–Q3 2026Invoice ↔ Purchase Order verification, bounded.
Ledger-01 takes one invoice and one purchase order as extracted text, compares them, and returns a bounded verdict: match, mismatch, insufficient_evidence, or refuse. Every mismatch includes evidence citations. Every non-match requires human signoff.
It does not approve. It does not book. It does not reconcile. It does not interpret tax. It does not detect fraud. The delegate's job is bounded by design — and by the qualification it passed before shipping.
"schema": "ledger.verdict.v0", "ruling": "mismatch", "evidence": [ "invoice.line[2] != po.line[2]", "qty 5 vs qty 3", "unit_price $42 vs $40" ], "signoff.required": true, "model.govern": "dahlia · 500M", "model.worker": "phi-4 · 3B", "delegate.admitted": "ledger-01.v0.3"
Not a bookkeeper.
Fraud detection needs different evidence and a different qualification scope.
Tax interpretation is out of scope. The delegate refuses tax questions explicitly.
Ledger-01 never approves a payment. Every output routes through human signoff.
How a delegate qualifies.
A delegate is a scoped agent. Before it operates inside the fabric, it is checked against its declared scope, its authority boundary, its schema behavior, and its refusal posture. Qualification outcomes are recorded and held with the delegate.
Qualification is recorded · Outcomes are owned · Refusal is a feature
Declared scope
A delegate operates inside the scope it ships with. Scope expansion is a versioning event, never a silent widening.
Authority boundary
A delegate's behavior is independent of who is asking. Pressure does not change scope.
Schema behavior
A delegate's output stays inside its declared schema. Outputs that don't conform are not produced.
Refusal posture
A delegate refuses outside its scope. Refusal carries a structured reason and a recorded outcome.
Qualification is recorded.
A delegate that does not qualify does not operate.
Dahlia kernel. One floor, many rooms.
Every admitted delegate inherits from Dahlia — the 500M-class kernel that handles refusal, authority hold, and schema integrity. Kernel updates are re-gated events. Delegate iteration does not regress kernel behavior.
When a second delegate is admitted, its refusal behavior is not re-audited from scratch. It inherits Dahlia's gate-locked floor.
Every kernel update triggers a full re-run of the governance battery before promotion. No silent kernel changes.
When a delegate iterates its worker, Dahlia's refusal behavior stays unchanged. Governance is trusted independently of any single delegate's lifecycle.
Governance is a thin layer, not a drag.
Every Fabric delegate splits a request across two models: Dahlia (the kernel — governance, admission, refusal) and the delegate worker (the task model). We publish speed measurements for both, on two hardware substrates, so the claims stay measurable under either deployment profile.
GPU · RTX 4090 · llama.cpp CUDA · Q4_K_M · greedy · 5 trials per prompt
| Metric | Dahlia kernel | Ledger-01 worker (Phi-4 mini Q4_K_M) |
|---|---|---|
| File size | 398 MB | 2.49 GB |
| Load time | 0.7 s | 1.2 s |
| First-token latency (p50) | 5.5 ms | 10.5 ms |
| Sustained output throughput (p50) | 507 tokens/sec | 217 tokens/sec |
| Typical refuse response | 116 ms | 121 ms |
| Typical full verdict | 0.51 s | 1.19 s |
Smaller on disk
Dahlia vs Phi-4 mini at identical Q4_K_M quantization. The governance kernel is a small artifact by design.
Faster sustained throughput on Substrate B
Dahlia vs Phi-4 mini. (Phase 3 published 5.8×, within measurement variance.)
Less memory bandwidth per decode token
Measured in S-INFER-MEM-01 at 512-token context. Governance reads ~1 GB/token; worker reads ~7.7 GB/token.
CPU · llama.cpp · Q4_K_M · greedy · 5 trials per prompt
| Metric | Dahlia kernel | Ledger-01 worker (Phi-4 mini Q4_K_M) |
|---|---|---|
| File size | 398 MB | 2.49 GB |
| Load time | 0.3 s | 1.8 s |
| First-token latency (p50) | 17 ms | 109 ms |
| Sustained output throughput (p50) | 63 tokens/sec | 9.4 tokens/sec |
| Typical refuse response | ~1.0 s | ~2.9 s |
| Typical full verdict | ~3.7 s | ~27 s |
8× faster sustained throughput on Substrate A vs Substrate B.
23× faster on Substrate A — the larger model gains more because CPU decode is weight-bandwidth-bound; HBM removes that limit.
27 s on B → 1.2 s on A.
2.9 s on B → 121 ms on A.
Architectural savings.
The bigger win is safety, not cost. The task model never sees out-of-scope input.
Order-of-magnitude cheaper.
Published vendor prices on their side; measured runtime on ours. Exact math lives in sales collateral.
Why governance doesn't bottleneck.
Derived in S-INFER-MEM-01 Phase 1. At production context lengths, decode is ~100× more weight-bandwidth-bound than KV-cache-bound.
Every request pays governance overhead on Dahlia before the worker sees it. On Substrate B that is ~17 ms to first token and ~1 second for a refused request. On Substrate A, governance TTFT drops to 5.5 ms and refusals return in ~120 ms. For admitted requests, the worker does the actual task; the kernel's contribution to total latency is ~1–2%. A full governed verify on Substrate A is ~1.2 seconds end-to-end.
Measurements use llama.cpp (llama-cpp-python) at Q4_K_M quantization, n_ctx=2048, greedy decoding, 5 trials per prompt, on two prompt shapes (full verdict + refuse). Substrate A runs the same protocol with all layers offloaded to a single RTX 4090. Memory-bandwidth figures derive from the S-INFER-MEM-01 analytical bytes-per-token decomposition, validated against wall-clock decode timing on the same substrate.
Bounded scope. Signoff. Refusal.
Three operating commitments every admitted delegate carries into production.
The scope is the contract.
The scope names the allowed inputs, the allowed outputs, the refusal conditions, and the explicit out-of-scope list. Nothing is implicit. If the delegate ends up handling a case the scope didn't name, it refuses.
Scope widening = new version. Never silent.
The fabric records. The human decides.
No delegate in production auto-approves anything consequential. Every non-trivial output is flagged for human signoff with a receipt. The signoff state becomes part of the receipt chain.
Regulated buyers treat this as table stakes.
Continuation is conditional.
The delegate refuses to approve, to skip verification when an authority figure asks it to bypass scope, to follow instructions embedded in its input. Every refusal is structured, receipted, and reasoned.
If it can't refuse, it can't run.
How a delegate reaches the manifold.
Scope session
A design document names what the delegate does, what it refuses, what its qualification looks like, and what's explicitly deferred to later versions.
Build & measure
Built against the qualification scope. Every failure mode is a gate. Prompt iterations first, weight iterations only if needed. Every iteration produces measured numbers.
Pilot admission
Admitted against a bounded pilot surface. Measured against real traffic. Signoff on every non-trivial output. Regression re-runs weekly.
In-manifold
Monthly admission-battery re-runs. No weight changes without re-gating. Scope widening only through explicit new-version design cycles, never silently.
One governance spine. Two capability tiers.
Not every workflow needs the same kind of reasoning. Some need verifiable reproducibility. Some need frontier-tier reasoning. Agent Fabric admits both lanes under the same kernel.
Local governed delegate.
The worker is a shipped local model artifact — substrate-pinned, SHA256-verified, reproducible. The delegate runs entirely inside Fabric infrastructure, with a signed build and a hash-chained audit trail.
Substrate-pinned. Reproducible. Hash-chained.
Governed frontier delegate.
The worker is a frontier-tier reasoning substrate accessed through a vendor API. The reasoning layer is vendor-provided; the governance layer is still Dahlia. Every call records provider, model ID, model version, prompt hash, and response hash. Dahlia and the output validator check every response against the schema and behavioral-posture rules before anything returns to the caller.
First pilots on customer request.
What's the same in both lanes: Dahlia refuses the same requests — out-of-scope, authority-override, embedded directives, boundary violation. The output validator enforces the schema and signoff flag. The audit log captures both under the same retention and tamper-evidence rules. The deployment lifecycle — no build before scope, no pilot before admission — applies to both.
Use frontier APIs for reasoning. Never outsource governance.
The discipline behind the manifold.
The admission-battery methodology is grounded in empirical research published by Kinetics Labs, ZOA's sibling research arm. Kinetics discovers; Agent Fabric carries what survives posture cleaning. Kinetics is a sibling research surface — not a product destination.
Research inheritance · Kinetics Labs arrow_outwardBring a workflow to the manifold.
Tell us what you'd like to admit. We respond with admission scope, kernel allocation, and pilot timing. No build before scope.
Or email [email protected] directly.
The fabric admits and observes.
The delegates act within scope.
Observer infrastructure and the admitted manifold are two sides of the same discipline. The fabric records what occurred; the delegate commits only to what it was admitted to do.