HEARTH, FORGE and ANVIL
A runtime that stops when its receipts fail to verify, a build doctrine that writes down every decision, and the bar both are measured against.
Why it exists
An autonomous system that acts without a record cannot be audited, corrected or trusted with anything that touches money, keys or people. UnyKorn's answer is not a policy document but a runtime whose first rule is receipt before act, and a build process whose first phase is classification.
HEARTH is the formal name of the runtime; Finn is its persona. FORGE is how every UnyKorn build is made. ANVIL is the engineering bar, drawn from primary sources rather than from any one practitioner, so that the techniques are owned at their origin.
Stop on integrity failure. If a chain fails to verify, all work stops and the failure is reported. That result outranks the task.
Global context
The WEF's long-term outlook is clouded by misinformation and adverse outcomes of AI; the BIS describes a system where operations execute only when their preconditions are met. HEARTH is an attempt to build the second idea into an AI runtime so that the first risk has a receipt trail: receipt before act, stop on integrity failure.
World Economic Forum · Global Risks Report 2025 (20th edition, 15 January 2025)
"Misinformation and disinformation remain top short-term risks for the second consecutive year, underlining their persistent threat to societal cohesion and governance by eroding trust." Other leading short-term risks include cyber-espionage and warfare. Drawn from "over 900 global risks experts, policy-makers and industry leaders surveyed in September and October 2024"; 64% of experts anticipate a fragmented global order.
BIS · Annual Economic Report 2025, Chapter III, "The next-generation monetary and financial system" (June 2025)
Sets three tests any monetary system must pass: singleness (money settles at par, no questions asked), elasticity (supply expands to meet payment needs), integrity (resistance to financial crime). Finds that stablecoins fall short on all three and that tokenisation of central bank reserves, commercial bank deposits and government bonds on a unified ledger can "enable the contingent performance of actions": operations that execute only when their preconditions are met.
What we built
The runtime is a Node.js kernel with no dependencies beyond Node itself: a coherence gate, a four-tier permission resolver, a quarantine layer for untrusted input, a hash-chained receipt log, an optional local language model, and a web interface. A unified smoke test proves every subsystem runs in one process.
Ten runtime rules
Receipt before act; no bulk edits without a dry run; never touch receipt logs or key material; assert nothing unsourced; label every subsystem's state; stop on integrity failure.
Seven build phases
Classify, brief, build, report, review, decide, ship. Two reviewers when secrets or money are involved. Founder flags for decisions the builder may not make.
Eleven principles
Least privilege and complete mediation (Saltzer and Schroeder), decision records (Nygard), test-first (Beck), Twelve-Factor, DORA, SRE, OWASP ASVS, NIST key hierarchy, one-way doors, idempotent money movement.
Versioned constitution
The three documents, standards, templates and bootstrap scripts, published for any team to adopt.
How it works
The review phase must exercise the denied path as the role, not read the policy. That rule came from a real miss elsewhere, where a metadata check passed while a missing grant would have exposed data.
What is real today
Every row was checked against a served response or a test run on the date in the source line, not read from code.
| Capability | Evidence | State |
|---|---|---|
| Unified smoke test | 10 of 10 subsystems pass in one process (2026-08-10) | MEASURED |
| Hardening suite after the chain-fork incident | 37 of 37 tests pass; writer lock added (2026-08-10) | MEASURED |
| Stop rule under a real fault | Two writers appended at the same sequence with the same previous hash; Rule 10 fired; segment sealed and a new segment opened with a parent link | MEASURED |
| Build constitution in use | Every 2026 product release in this report carries a FORGE receipt | MEASURED |
| Customer-facing surface | None; internal until a full quarter without a manual repair | ABSENT |
| Independent audit of the runtime | Not yet | TARGET |
Trust and safeguards
The runtime keeps no secrets in public artifacts: canary terms, detection patterns and thresholds never appear in a deck, a paper or a filing. Any proposed change to receipt logs or key material stops the task. Incidents are recorded blamelessly and each one changes a gate.
Economics
No product is sold from the runtime today. Its value shows up as fewer incidents and faster recoveries in the lines that do charge.
Next phase
Run the receipt log for a full quarter without manual repair; publish the property tests that enforce the loop rules; decide with counsel which parts of the doctrine become filed intellectual property.