Lattice
An assistant that can ask a deterministic engine instead of guessing. It reasons, explains, works through problems and writes code like any other — and where a question has a computed answer, it fetches that answer rather than reconstructing it from memory.
Lattice is a product inside Alelyon Terminal, the one desktop application that holds everything Alelyon builds. You install the Terminal and open Lattice from its product shelf.
How Lattice works
- Deterministic tools
It fetches the number
An ordinary conversational assistant, with read-only query paths into computed analytics running on the same machine. When a question has a tool answer the model fetches it rather than reconstructing it. The result still depends on the named data, assumptions, and implementation.
- Provenance
Every answer shows its sources
Under each answer, CONSULTED names the tools that ran and shows exactly what they returned, each with its own source and as-of stamp. Which figures came from a tool and which are the model’s own is shown as provenance, not hidden and not scored.
- Local first
The machine is the boundary
A local model server, a cloud provider, or an automatic chain between them — chosen explicitly and written where you can read it. Once a question carries tool or account context, an automatic chain will not fall back to a cloud provider.
Fetching a number costs less than reproducing it.
The reason to build an assistant this way is not primarily safety. A model that can ask for the figure spends its capacity on the part that actually needs a model: the judgement around the figure.
- Model— a language model does this
- Engine— deterministic code under the same pinned inputs
Read the question
An ordinary language model reads what you asked, in the ordinary way.
Match it against a catalogue
A deterministic router resolves the question to tools this assistant actually holds. A name outside the catalogue is dropped rather than attempted, and the drop is reported. The registry refuses to hold any tool whose name reads as an action, so no pack can introduce a side effect by naming one.
Run them, read-only
The same code the application draws from, on your machine, against your data. Each result comes back with its own source and its as-of stamp. Nothing in this path can place, cancel or modify anything.
Write a program, not a number
Where a question needs arithmetic the model authors a restricted program. It does not do the sum.
Execute it deterministically
An interpreter runs that program and returns the figure with stated error terms. The number is computed rather than recalled; replay still depends on the same program, pinned inputs, as-of state, and applicable numeric substrate.
Narrate around what came back
The model writes the answer, free to explain, give an example, and say when it is estimating.
Trace every figure
Each number in the prose is traced back to the tool that produced it or marked as the model’s own. You are shown the trace rather than a score.
The model chooses which question to ask the engine. On a tool-backed path, the computed figure comes from the engine; any estimate in the narration is marked in the trace as the model’s own.
What an assistant is allowed to reach.
What Lattice is about is declared as data — a set of tools, the vocabulary the screen uses, and a privacy rule — and the tools live in a catalogue of that subject’s own. An assistant configured for one subject cannot find another’s tools, because they were never put in its catalogue. Standalone Lattice holds two subject-free tools: a calculator that has the model author a restricted program and executes it deterministically with an error bar, and one that reports the declared anatomy of the model you are talking to.
Each component, and what it does not establish.
The product renders this same table from what the running build can reach. It is reproduced here because a limit that only appears after you install something is not a stated limit.
| Component | What it does | What it does not do |
|---|---|---|
| CNE — Certified Number Envelope | A figure travels with its inputs’ digest, its computation, and its error terms separated one from another. | Verification detects revision of committed inputs. It does not establish that a producer’s inputs were true. |
| The open verifier | A third party checks a receipt with a tool they install themselves, without this application and without an account here. | Published is not verified. No verification by a party outside Alelyon is recorded. |
| Model Morphometry | A model’s declared anatomy registered onto an immutable canonical coordinate space with an exact transform. | The measurements describe declared structure, not learned behaviour. No weight is read and no forward pass is run. |
| Registration Certificate | The correspondence travels as signed canonical bytes — both coordinate spaces, the transform chain, and the specification fields this slice cannot fill, each carried as a named absence with its reason. | It establishes that a registration is the one committed to, not that it is correct. The certificate covers the frame; it does not bind the measured figures. |
Scroll horizontally to inspect the full product capture.
What is in the window.
| View | What it does |
|---|---|
| Conversation | A session rail, a transcript that renders code as code, and a tool trace under every answer. The narration streams and can be stopped; an answer that stopped early is kept and shown as incomplete. |
| Agent | A coding agent driven as a child process, with its session history and the work it is holding. |
| Editor | A source browser over the working tree. |
| Model Morphometry | A model’s declared anatomy on the canonical frame, and the registration families the engine supports — including, quoted from the engine rather than paraphrased, which check is impossible for each. |
| Models | Local model server state, the installed list, and the Local / Auto / Cloud data boundary, written where a user can read it rather than in a tooltip. |
| Stack | The table above, rendered from what the running build can actually reach, with the standing gaps printed rather than implied. |
| Worktree Mesh, Sessions & Areas, Blueprint | A read-only picture of concurrent work across a repository: who is where, what is contested, and what the documents say to do next. |
Scroll horizontally to inspect the full product capture.
What a model is, before you ask it anything.
A model’s own description of itself is marketing. Model Morphometry reads the anatomy the runtime actually declares — how many blocks, which modules, what precision they are stored at, how much of the model one token reaches — and puts every model on one frame so two of them can be compared on the same axes.
Measured on qwen3-coder:30b, which independently reproduces that model’s own 30B-A3B size label. Where a routed model’s runtime declares no routing, the reached figure isUNMEASURED rather than the stored one.
What it readsDeclared metadata and the tensor inventory. No weights, no forward pass.
A model runtime’s declared metadata and its tensor inventory: blocks, modules, parameter counts, storage precision, context length, and routing where the runtime declares it. Nothing is executed, so the reading costs a directory walk rather than a load — and it is the same reading whether the model is running or sitting on disk.
Stored, against reachedTwo numbers most tools report as one.
A routed model stores far more than any single token touches, so quoting one figure for both is the difference between a model’s shelf space and its cost per answer. Measured on qwen3-coder:30b: 30.53B parameters stored, 3.35B active per token — which independently reproduces that model’s own 30B-A3B size label, from the inventory rather than from the name.
What it will not guessAn absent measurement is named, never substituted.
When a routed model’s runtime declares no routing, the active-parameter count comes back UNMEASURED rather than the total. Substituting the number that happens to be available is how a reading becomes confidently wrong: the total is a real figure, it is just not the answer to the question that was asked.
One frame for every modelRegistered onto a canonical template, not read on its own axes.
Each model’s native axis order is registered onto a single canonical block-and-module template. Without that step two models are each described in their own vocabulary and cannot be compared; with it, the same cell means the same thing across every model measured.
Exact, or it refuses.
Underneath the dashboard is a registration engine that converts between coordinate spaces. Its governing habit is the one most systems give up first: where it cannot be exact, it stops and says why, rather than returning a number that looks like an answer.
- A non-terminating decimal, or any floatcannot be exact in rational arithmetic
- A timestamp contradicting its declared offsetthe zone moved; the refusal names the change
- A label map that is not a total bijectionit omits, invents, or collapses a label
- A conversion nobody declaredstays an obstruction until somebody states it
Nothing is inferredA conversion factor is stated by the caller, never guessed.
Nothing parses a unit string or holds a unit table, so a unit difference stays an obstruction until somebody states the conversion — and the committed record keeps what was assumed. Replay detects revision of that declaration; it does not establish that a centimetre is a hundredth of a metre, and nothing here could. The point is not that the engine is ignorant, it is that a guess would be indistinguishable from a fact once written down.
No external database is readTimezone offsets are declared, not looked up.
Re-spelling an instant under a different UTC offset reads no IANA timezone data. Resolving a zone name to an offset is a lookup in versioned external data that two machines need not hold the same edition of, so a replay depending on it would not reproduce off the machine that produced it. The offsets are declared and committed, exactly as a unit factor is.
The data may contradict the declarationAnd when it does, the coordinate is refused.
A timestamp carries its own offset, so it can disagree with what was declared — and it does exactly when a zone’s offset moved. That coordinate is refused and the refusal names the daylight-saving change, rather than returning an instant that is silently an hour wrong. This is the one rung where the data can check the declaration, which makes it stronger than the unit rung rather than weaker.
A correspondence is checked for shape, not truthBijection is verifiable. Meaning is not.
A declared label map must be a total bijection over both committed dictionaries, so one that omits a label, invents one, or collapses two is refused. Whether the map is true — whether two identifiers really denote one thing — is not something this engine can tell, and it does not claim to. That judgement is entity resolution, which returns candidates with a confidence; a transform chain carries a correspondence that is exact or absent.
Exact, or refusedRational arithmetic, and no rounding to make it fit.
Conversions are evaluated in exact rational arithmetic. A value that cannot be converted exactly — a non-integral integer, a non-terminating decimal, any float — is a named refusal rather than a rounded answer. A rounded answer is the more helpful-looking output and the one that cannot be audited later, because nothing downstream records that it was rounded.
Several agents at work, and a picture of all of them.
One assistant is a conversation. Several, running at once across a repository, is a system — and the failure mode is that each behaves correctly in isolation and produces work nobody can reconcile. Lattice reads that from records the sessions do not control, and draws it.
- 01
Model careers
What each model has actually done here, read from the record rather than from a reputation. Ordered by work completed, never by score.
- 02
Lanes & branches
Which lane a change belongs on, which lanes are free, and what every branch in the repository is carrying.
- 03
Worktree mesh
Every session at work at once, what each is holding, and where two of them are about to collide. The centre of the picture, and the reason the rest exists.
- 04
Fleet channels
The rooms sessions talk in and the threads inside them — with what routed a message to you printed beside it.
- 05
Fleet spend
Where the budget is going across every session at once, with concentration measured rather than eyeballed.
PreflightThe only one asked before the spend rather than after.
Given what you are about to do and where, is somebody already doing it? It answers with a verdict and the reasons behind it. Every other reader here answers a question about work that has already happened, which is the moment the duplicated effort has already been paid for. This one runs first, and it registers what you are about to do so the next session can see you before either of you has written anything.
The worktree meshEvery session at work at once, and where two are about to collide.
Who is where, what each is holding, and which areas are contested. Derived from the repository and the harness rather than from what sessions say about themselves, so a session that never announced itself still appears.
Lanes and branchesWhich lane a change belongs on, and which are free.
A change is routed to a lane by the pillars it touches, so a branch name is checked against its content rather than trusted. Alongside it: what every branch in the repository is currently carrying.
ChannelsRooms and threads — reachable by the paths a message names.
A message reaches the sessions the mesh can see editing the paths it names. Membership organises attention; it does not decide who is reached. A message that matters and names no paths can reach an empty room and say nothing to anybody, which is why naming files is the part that counts.
The relayAn open pull request must not interrupt anybody.
A proposal that has not merged has not moved the mainline, so it cannot affect another session’s tree and is not an event that should stop one. Proposals are reconciled at a session’s own finish line instead — and every overlapping predecessor has to be taken, not only the most recent, because a receipt inherited across a skipped one describes a tree nobody assembled.
The supply chainThe fleet read as a production line, with the constraint marked.
Where work has piled up, which areas several documents run through, and the joins no record can supply. It answers where the work is stuck, which is a different question from who is busy.
Which model gets which job.
A fleet of agents is an organisation, and an organisation has an org chart. Higher layers draw the more capable models, lower layers the cheaper ones, and the assignment is meant to improve as new models arrive rather than being set once by whoever was available first.
A standing is held per layer and per kind of work, so a model that earned the top band for one job holds nothing for another. A challenger displaces an incumbent only after five completed runs at that coordinate — fewer is a refusal, not a provisional yes.
One standing per jobHeld per layer and per kind of work, not per model.
A standing names the model currently held to be best for one pairing of layer and work kind. A model that earned the top band for one job holds nothing for another, which is deliberate: a general ranking of models is a claim nothing here can support.
A challenger has to earn itFive completed runs at that coordinate, or it is refused.
A model displaces an incumbent only by clearing a bar with at least five completed runs at the same coordinate. Fewer is a refusal rather than a provisional yes. The bar itself scales into the headroom above the incumbent — an earlier version was unsatisfiable above a certain score, so the first model to win a coordinate held it permanently while the scoreboard went on printing numbers that made it look like a contest.
Authority is bounded by risk, not by rankThe ratchet cannot promote a model into owner authority.
Every layer’s authority comes from the repository’s risk tiers rather than from its position in the ladder. A ratchet able to promote a model into owner authority would dissolve the one gate the whole system is built around, so it cannot reach there at all. Board-level subject matter places one layer below the decision: a model prepares it and the owner makes it.
Measurement can only raise a modelApplied as a cap instead, the ladder deadlocks.
A measured capability class lifts a model’s reach and never lowers it. Used as a cap it would deadlock the ladder — an unrecognised model enters at the cheapest class, the floor then refuses it everywhere above the bottom layer, and it can never accumulate the record that would prove it belongs higher. That was found by a test rather than by reasoning, which is the only reason it is stated so confidently here.
Reading the gate is not walking through itAsking used to be the same act as accepting.
Whether a model would be accepted could once only be discovered by proposing it, and proposing appended a standing — so the question changed its own answer. The assessment is now a separate call that decides without appending, and the proposal path calls it, which keeps one statement of the rules rather than a reader’s copy that drifts.
Nothing is dispatchedA recommendation selects nothing and writes nothing.
The recommendation carries its own provenance and opens no ledger that does not already exist. A caller may read it and remains free to ignore every word of it. The join between a standing and the model an agent actually runs is made by whoever reads it, deliberately.
What Lattice is not.
Not a trading surface
No order path, no position, no risk control. Every tool reachable from here is read-only by construction.
Not a verified model
The stack records provenance and replays computations. It does not check reasoning, and no wording in the product suggests it does.
Not a second math layer
Figures come from the computation layer that already owns them. Lattice orchestrates; it does not compute.
Not an unattended agent
The coding agent runs where you point it and shows what it did. Nothing runs on a schedule you did not set.
Financial Markets
Cross-asset research, risk and execution for a live book.
The markets workstation is where Alelyon started: charting, screeners, watchlists, portfolio risk, an economic data explorer, and filings research over live market data, with certified receipts behind the figures.
It runs in daily use on our own desk today. We are finishing the work of making it dependable in hands other than ours before opening it here, and it will appear on this shelf the moment it is ready.
It is not on this site’s download page and it is not part of the Lattice beta. That wording is the same wording the application’s own product shelf carries, because it is the same promise.
What you need to run it.
| Item | Requirement |
|---|---|
| Operating system | Windows 10 or 11, 64-bit |
| Memory | 8 GB minimum; more if you run a local model on the same machine |
| Disk | ~1 GB for the application, plus whatever a local model weighs |
| Model | A local model server, or a cloud provider key you supply. Neither is bundled. |
| Network | Not required for a local model. Required to reach a cloud provider. |
Replay the applicable checks.
The open verifier replays scalar and other applicable checks against independently obtained inputs, under a public key pinned out of band. A substrate-sensitive nonzero width may remain explicitly unverified.
$ pip install alelyon-os
$ alelyon-verify selftest
conformance suite: bundled, offline
$ alelyon-verify verify \
--envelope receipt.json \
--data your_own_extract.json \
--key <pinned out of band>