PrismPath · Open Source
The provable control plane for automated decisions.
PrismPath turns an automated decision, a model's answer included, into a symbol it can route, guard, and prove. The policy is written in Markdown, runs identically from Python to the Linux kernel to silicon, and its decisions travel on a wire of their own at about 1.5 bytes each.
The codebook on the wire
A page of policy in.
One symbol out.
Both ends share the policy as a codebook, so a reading runs off it onto the wire as a single symbol — the whole decision on a wire of its own, about 1.5 bytes.
The shipped symbol
The whole decision on the wire: the cell's center-outward index as a self-framing Zeckendorf code, 9 bits. The band alone (physical_escalation) routes in ~0.5 B, and band membership is two integer compares, base ≤ n < base + width.
How it works
From answer to receipt.
01
An answer
A model takes an input and produces an answer. On its own, that answer is a black box: no one can prove why it is what it is.
02
A symbol
PrismPath reduces the answer to a symbol: one decidable token that stands for it. Everything before the symbol is probabilistic. Everything after it is provable.
03
Routed
The symbol travels a policy graph written in plain Markdown. The document your team reads is the graph the engine runs.
04
Guarded
Every hop is a gate: a decidable rule the engine can prove before it ever runs. What is allowed to move to the next step is a theorem, not a hope.
05
A receipt
Out the other end comes a receipt: every routing decision, in order, replayable and verifiable by anyone.
The mesh fuses to one decision
Add a device and JSON pays another envelope. The fused decision doesn't grow.
A mesh of devices, each running the same 4-field policy. The mesh fuses their readings onto one spiral, forms a single index, and ships that one fused decision. JSON + protobuf has no fusion: it ships every device's event and correlates downstream.
3 devices · the ESP-NOW mesh demo runs 3
304 B
JSON + protobuf · 3 events, one per device
1.5 B
PrismPath · one fused decision
Every device adds a full JSON + protobuf envelope — resource attributes, timestamps, trace context, at least 101 B and often more. The mesh instead fuses to one spiral index and ships that: a fused decision that grows in bits, not bytes, and stays nice and small no matter how many devices join.
The receipt proves the route: every routing and guard decision. It does not explain the model's reasoning, and we don't claim it does. We prove exactly what can be proven, and nothing more.
Don't take our word for it. Prove itDecision telemetry
A receipt in a handful of bits.
Because the policy is decidable, PrismPath doesn't transmit your data; it transmits the decision, over a wire we call the Facet protocol. A reading of 5 or 5,000,000 that lands on the same side of the same threshold is the same decision, and costs the same few bits. The stream is Merkle-committed, so it can't be quietly altered, and it self-heals over a broken link by re-sending only the blocks that went missing.
The picture on the right is not an illustration. It is the full decision space of a real policy that fuses a physical sensor with a security feed: 108 cells, packed on a golden-angle spiral by the engine itself. The baseline verdict is the bit at the center; each concentric ring is a stronger one, out to the coincident-critical edge. A ring is lit only where real fused decisions landed during a live capture, so the picture is honest about what actually fired.
Decision-lossless, not data-lossless: only what the decision needed ever leaves the node. Raw magnitudes stay home. A privacy property, by construction.
A real policy is small enough to draw.
This is the actual decision surface of the SOC triage flow that ships in the repo. Eight cells: benign at the center, watchlist, then containment outward. That tightness is decidability doing its job. Small enough to draw, small enough to prove.
Measured, not asserted
We move the decision, not the log.
A SOC ships the whole alert: about 3,020.4 bytes of JSON per event, most of it log body you already have. PrismPath routes each alert to a decidable verdict and ships that verdict plus its proof, run here over 64,484 real triage-grade alerts. Decision-lossless, not data-lossless. Compress that minimal JSON and it lands near our size on raw bytes; what a compressor cannot give you is a tamper-evident, self-framing, streaming decision that reconstructs bit-for-bit with nothing to decompress. Against OpenTelemetry, the wire real observability runs on, the same decision is 66.9× smaller. Smaller is the side effect. Provable is the point. The benchmark ships in the repo.
Raw alert JSON
3,020.4 B
per alert
OpenTelemetry (OTLP)
101.372 B
per event · 66.9× our size
Minimal 4-field JSON
68.1 B
per alert · 45× our size
Decision + proof
1.516 B
per alert · 1,992× smaller than raw
Three ways to send it. You choose.
Stream every decision, batch by count, or fill the packet before you send. The choice trades bandwidth against freshness. It never trades accuracy: every strategy is decision-lossless, and a latency cap is a knob you add on top, not a mode you commit to. Measured over 2,501,190 decisions.
size · bytes per decisionlog
freshness · time to delivery, p95log
accuracy · decision fidelity
And it runs on real hardware: a live capture fused a physical sensor with this SIEM in real time across 3 sessions (4,369 readings, 90alerts). The sensor's own on-chip classifier agreed with the derived posture 96% of the time.
Why this one stands apart
Most control planes are middleware. This one is a substrate.
Proof, not promises.
Every control plane claims policy enforcement. PrismPath hands you the proof: routing decidability, reachability, and cross substrate conformance are machine checked against a frozen public corpus, and the playground proves a policy in your browser before anything runs. Nothing you type leaves your machine.
Prove one now →One artifact, everywhere.
The Markdown a human reviews is the program the machine executes. The same signed table decides byte for byte identically in Python, JavaScript, Rust, and Go, in the Linux kernel at the packet layer (eBPF/XDP), on a Zynq FPGA fabric that has routed thousands of live sensor readings, and across four MCU instruction sets: 8-bit AVR, ARM Cortex-M33, RISC-V, and Xtensa. No config in one place and enforcement in another. Nothing to drift.
See the substrates →It owns its physics.
Because the codebook derives from the policy, a decision costs about 1.5 bytes on a self framing wire that survives contested links, heals itself with Merkle proofs, and swaps policies live under an Ed25519 signature with rollback protection. It keeps working where a cloud tethered control plane stops existing: disconnected, degraded, and embedded.
Read the theory →Evidence, anchored.
Every number we cite traces to a committed artifact in a public evidence ledger, hashed and timestamped to the Bitcoin blockchain. The claims about the system are auditable the same way the system's decisions are: independently, and without trusting us.
Open the ledger →Who it's for
Two worlds, one guarantee.
Teams shipping agents
Observability tells you what your agents did. PrismPath proves what they can do. The routing and policy layer becomes decidable, so the control-plane is a proof, not a log. Keep your models; make the decisions around them verifiable.
High-assurance & regulated edge
Where decisions must run disconnected, at line rate, on constrained hardware, and survive an audit. The same proven policy executes in-kernel and on silicon, with a tamper-evident trail of every decision it made. A signed policy update rolls across a whole fleet at once, verified on every node before it takes effect.
Services
The engine is open. The expertise is what you buy.
PrismPath is free, open source, and publicly conformance-tested. Go verify it. What we sell is the team that built it, wiring it into your system.
Prove your decisions
We embed PrismPath as the provable control-plane in your stack, so your routing and policy decisions are decidable, auditable, and replayable.
Run it on any substrate
We port the engine to your target, from the Linux kernel to an FPGA to a bare-metal MCU, with byte-identical, conformance-verified behavior.
Keep sensitive data home
We stand up no-egress pipelines with tamper-evident audit trails, built for regulated and disconnected environments.