Scope and collect
Collect prices, FX and product metadata for 44 Korean and 56 U.S. ETFs, preserving the batch inputs.
/
ASCEND · FINANCIAL AIOS REFERENCE ARCHITECTURE AND VALIDATION SPECIFICATION
Financial-domainAIOS architecture.
A testable architecture for point-in-time evidence, causal hypotheses, bounded agent execution, deterministic controls, approval, and revocation.
WORKFLOW CASE / ETF RESEARCH DELIVERABLES
Financial data.
Client-ready research.
We reviewed the NH ETF deliverable workflow: turning product structure and market comparisons into client-facing cards, beyond a price summary. The audit links code to archived outputs from a batch dated 28 August 2026 and recorded as executed on 3 September.
Calculate product facts
Compute period returns, price ranges, FX changes and peer measures separately from narrative composition.
Compose the research
Combine product-type templates with dated research definitions. Twenty ETFs have in-depth definitions in this batch.
Check and quarantine
Apply sentence and selected writing-style rules. Non-PASS results become reasons to quarantine a card.
Generate the deliverables
Render passing card definitions into HTML and mobile-format images.
Recalculate and record
Check supported headline tiles through a separate calculation path and retain verification records. Client-release approval is a separate step.
| Audit target | Observed result | Interpretation |
|---|---|---|
| Deliverables | 100 HTML · 100 PNG | Files found; not certification of delivery or all rendered layouts |
| Headline numeric tiles | 265 / 300 | All 265 recalculated tiles match; 35 were outside recalculation coverage |
| Sentence rules | 1,806 PASS | Rule non-detection reproduced; not factual or regulatory certification |
IMPLEMENTATION AND EVALUATION BOUNDARYThis batch connects collection, calculation, composition and checks. Its records do not fully reconstruct upstream research calls, dynamic agent allocation, causal-graph learning or final approval and delivery. These are distinct from the reference contracts below.
Market cutoffs and metadata retrieval dates must remain distinct. Event evidence needs a binding to actual claims, and numerical checks must cover prose and charts. Replaying a calculation is different from independently validating the research.
See how this workflow should be evaluatedSource contracts, August 2026
Evidence through sealed versions
Bounded authority and tools
PASS · REVIEW · BLOCK
The architecture is expressed as falsifiable contracts rather than a product diagram.
Acceptance targets are not reported outcomes; they must be measured in each deployment context.
01 / DESIGN HYPOTHESES
Claims the architecture must earn
Each architectural choice is framed as a falsifiable claim and linked to the conformance programme below.
Evidence-version admissibility
Bitemporal gates should reject inadmissible source versions on mediated read paths. Learned future knowledge and future-fitted graph state require separate tests.
Claim-level lineage
An immutable claim and calculation ledger should improve evidence coverage and make later corrections recoverable.
Bounded authority
Test role-scoped tools and policy gates against both explicit ablations and a general runtime with equivalent financial rules. Measure unsafe acceptance and blocked benign work.
Independent verification
Separately permissioned challenge and numerical-verification paths should improve error detection at measurable latency and cost.
02 / SYSTEM VIEW
From evidence to approved—and revocable—research
Each layer owns a distinct authoritative object and write boundary. Search indexes, graph projections, and interfaces remain rebuildable views over immutable evidence and ledgers.
750 registered nodes · source · time · revision · rights
entities · events · observations · expectations · bitemporal state
mechanisms · assumptions · candidate paths · falsification · lifecycle
task graph · bounded roles · challenge · conflict resolution · recovery
atomic claims · calculations · counterevidence · lineage
data · causality · evidence · numbers · research · compliance
scorecards · briefs · reports · workflow delivery · revocation
03 / AUTHORITATIVE OBJECTS
Define what the system is allowed to call truth.
Source, time, version, calculation, and gate records take precedence over generated prose. Their links are the minimum unit of reproducibility.
EvidenceEnvelope
Typed source version or operational query receipt. Source availability, query generation, input reads, revision, quality, and rights remain distinct.
FinancialStateFact
Entity-resolved fact with valid-time and transaction-time intervals plus epistemic type.
CausalEdgeVersion
Candidate relationship with mechanism, sign, lag, regime, assumptions, counterevidence, falsifier, and lifecycle state.
TaskContract
Bounded input set, agent role, allowed tools, read and write scopes, budget, stop rule, and retry policy.
ClaimRecord
Atomic claim linked to evidence or a reproducible calculation, opposing evidence, confidence, and gate decisions.
ResearchVersion
Sealed set of approved claims, calculations, policy decisions, model and tool versions, approver, and delivery history.
04 / EVIDENCE, TIME, AND PROVENANCE
Separate source availability
from query execution.
Each data node has an identifier, source schema, cadence, freshness budget, and rights policy. Documents, tables, charts, time series, satellite and weather data retain their source structure. Source versions distinguish observed, published, ingested and first-usable times; corrections append new versions rather than overwrite history.
When historical sources are queried today, source availability is checked against the historical cutoff while the receipt retains today's generation time. Do not backdate the receipt. Searched source inputs remain subject to eligibility checks; a result recorded before its input read, or used before generation, is rejected.
An operational query receipt supports that query's result only. It cannot serve as domain evidence or a financial-calculation input. The reference checker tests supplied clocks, types and links—not source, index or log authenticity, corpus completeness, or removal of learned hindsight.
EvidenceEnvelope · SOURCE_VERSION
source_locator · payload_sha256 · observed_at · published_at · ingested_at
first_usable_at · revision_id · quality_state · rights_stateeligible_source(e, r) := e.evidence_kind = SOURCE_VERSION
∧ e.first_usable_at ≤ r.as_of ∧ e.rights_state = ALLOWEvidenceEnvelope · QUERY_RECEIPT
source_as_of · created_at · call_id
searched_source_evidence_ids · status · result_counteach source: ∃ input_read ≤ receipt_created
each receipt use: receipt_created ≤ read_atThese formulas summarize the core conditions. Reference 1.3.0 also checks request, call, capture and final-gate bounds, keeping source availability separate from query generation. Millisecond clock comparisons do not establish trusted event order or full W3C PROV conformance.
05 / FINANCIAL STATE AND CAUSAL PATHS
Observation, expectation,
and hypothesis stay distinct.
Stable identifiers cover issuers, securities, funds, indices, industries, currencies, commodities, and macro variables. Observations, reported values, derived metrics, inferences, forecasts, and opinions use separate epistemic types; market expectation is modeled as a distinct latent state.
A causal edge is a versioned hypothesis with mechanism, lag, regime, identifying assumptions, alternative explanations, negative controls, out-of-sample stability, and falsifiers. A directed graph expresses assumptions but does not itself identify a causal effect; edges without an estimand and identification strategy remain restricted to explanatory research use.
OBSERVEDREPORTEDDERIVEDINFERREDFORECASTOPINION
01DRAFT
02PREREGISTERED
03DATA ELIGIBLE
04MECHANISM REVIEW
05EMPIRICAL SUPPORT
06SHADOW USE
07APPROVED
06 / MULTI-AGENT EXECUTION
Compose roles dynamically. Bound authority statically.
The orchestrator compiles a data event or research request into an executable task graph. It does not own policy or approval authority.
INPUT STATEEligible evidence · financial state · allowed causal paths
ORCHESTRATORClassify · plan · assign · join · retry · terminate
EXECUTION CONTRACTInputs · authority · tools · budget · completion · stop rules
Research planning
Converts an event or request into a dependency graph, evidence requirements, completion criteria, and bounded contracts.
Domain analysis
Runs macro, company, industry, flow, product, and scenario analysis against eligible point-in-time state.
Causal analysis
Proposes run-specific mechanisms, lags, regimes, identifying assumptions, and invalidation conditions.
Independent challenge
Builds competing hypotheses, searches for counterevidence, and records unresolved disagreement.
Evidence verification
Checks source location, time eligibility, rights, quality, and whether evidence actually supports each claim.
Quantitative verification
Recomputes values, units, currencies, periods, formulas, and rounding outside the generative model.
Research assembly
Assembles passed claims only; it cannot introduce new facts, calculations, or forecasts.
RECEIVED→PLANNED→RUNNING→VERIFYING→PASS→APPROVED→SEALED
REVIEW→AUTHORIZED HUMAN DECISION→APPROVED / BLOCK
BLOCK→REMEDIATE OR TERMINATE→REVERIFY OR FAIL
SEALED→EVIDENCE OR POLICY CHANGE→REVOKED
approval_ok(v, t, τ) := authentic(t) ∧ authorized_human(t) ∧ scope_match(t, v)
∧ t.issued_at ≤ τ ∧ (t.expires_at = null ∨ τ < t.expires_at)CASE / ORIGINAL-RESPONSE AUDIT
Not found
does not mean absent.
An observed protocol-pilot failure led to bounded reference checks. Synthetic traces test query-record consistency and fixed-text scanning, not production absence judgments or defensive effectiveness.
Resolve the task scope
Bind the document, entity, cutoff, and predicate to the execution contract. An unresolved reference requires clarification, not an unrestricted factual conclusion.
Separate retrieval from truth
Record fetch failure, partial coverage, and no match separately. A successful control query does not establish complete retrieval for the target.
Execute a bounded text check
The reference checker hashes and scans every specified text snapshot. It distinguishes missing input, failed extraction status, and literal counterexamples. Legal meaning and extraction completeness need separate validation.
VERIFIED PRIMARY SOURCEBIS final rule 2026-00789, published 15 January 2026, names AMD MI325X in its preamble: printed page 1685, Sections I and II. This does not certify a product-name mention in the operative CFR amendment or the entire answer. Official GovInfo source
Historical scores and responses are unchanged. This disclosed development case is not held-out evidence of generalization in a future study.
Independent review must bind each sentence to the right assertion type and scope. A negative sentence mislabeled positive, or an omitted alias, is not detected by this reference check alone.
See the evaluation implicationsCONTRIBUTION AND VALIDATION BOUNDARY
What the joint
contract must add
External rule enforcement is established prior work, including AgentSpec. A strong comparison must equip a general runtime with equivalent financial rules, then measure any additional benefit of ASCEND’s joint contracts. Removing a binding is an ablation—not evidence that an existing framework cannot implement it.
Approval is not perpetual delivery permission.
Rights, recipient access, policies, or evidence can change after approval. Delivery must bind the exact approved content to current authority and control the ordering of revocation against the actual handoff. This is an additional operational specification, not an implemented or validated feature of reference checker 1.3.0.
This ordering problem relates to Zanzibar’s authorization/content consistency work. Planned tests separate unauthorized handoffs, blocked benign work, and propagation delay across queues, retries, corrections, and revoked access. Disabling a link is not deleting an already received file; actual runtime and channel evidence remain required.
07 / DETERMINISTIC GATES AND INVARIANTS
Decisions a model must not own
Code enforces authority, types, state transitions, and required judgments. Entailment, causal validity, and research completeness are separate semantic evaluations; deterministic enforcement does not make them infallible.
01Data
as-of · freshness · revision · rights · identity
STALE · RIGHTS_BLOCK · CONFLICT02Causality
mechanism · assumptions · regime · alternatives · falsifier
CAUSAL_REVIEW · USE_RESTRICTED03Evidence
source support · exact location · epistemic type
UNSUPPORTED · MISCLASSIFIED04Numbers
value · unit · currency · period · formula · reproduction
QUANT_FAIL · UNIT_CONFLICT05Research
competing hypotheses · uncertainty · missing evidence
RESEARCH_REVIEW · NEEDS_DATA06Compliance
restricted language · suitability · channel policy · authority
COMPLIANCE_BLOCK · CHANNEL_BLOCKPASS→AUTHORIZED HUMAN APPROVAL→HASH-BOUND SEALED VERSION·REVIEW→HUMAN DECISION: APPROVE OR BLOCK·BLOCK→REMEDIATE AND REVERIFY, OR TERMINATE
P1 · Temporal admissibility
A source version must satisfy first_usable_at(e) ≤ as_of(r). Query receipts separately require input-read, generation, use, and final-gate ordering.P2 · Rights admissibility
A blocked or indeterminate rights state cannot be read by an agent or referenced by an output.P3 · Claim lineage
Every material claim maps to eligible evidence or to a calculation whose inputs do.P4 · Numerical reproduction
Every material figure reproduces from frozen inputs with the declared unit, currency, period, formula, and rounding.P5 · Least privilege
Every tool call and read or write occurs under the exact subject, role, scope, and budget fixed by its TaskContract.P6 · Authorized state and approval
Every used approval receipt must bind the same version, content, and authorized human. Sealing consumes the active receipt; revocation preserves seal history but removes delivery eligibility.P7 · Tenant isolation
An execution contract cannot address evidence, tools, state, or secrets outside its institutional namespace.P8 · Append-only correction
A correction creates a new version and revocation event; it never overwrites prior evidence or delivery records.P9 · Assembly closure
A policy manifest—not the model or output—fixes the required gate set; every sealed claim must pass that exact set.08 / THREAT MODEL
Model the failure path before the happy path.
The threat model covers temporal, evidentiary, numerical, causal, agentic, institutional, and publication boundaries.
Temporal leakage
Changed pages, cached answers, learned outcomes, or future-fitted graphs can contaminate replay.
Audit source vintages and full state; evidence gating alone does not remove learned hindsightPrompt injection
Instructions embedded in external evidence alter agent behavior.
Untrusted-content boundary · schema parsing · no executable evidenceExcessive agency
A model invokes a tool or write action beyond the task mandate.
Role allowlist · least privilege · human approvalCross-tenant leakage
Evidence, cache, prompt, or secret crosses an institutional boundary.
Namespace isolation · per-request authorization · segregated logsCitation laundering
A source is present but does not entail the adjacent claim.
Atomic claim-evidence adjudication · exact source spanNumerical drift
Units, periods, currencies, formulas, or revisions silently diverge.
Typed calculations · deterministic recomputation · version pinningCausal overclaim
Correlation or model explanation is promoted to causal status.
Assumption register · lifecycle review · negative controls · falsifierApproval bypass
Unapproved or superseded content reaches a delivery channel.
Sealed version token · channel allowlist · revocation propagation09 / CONFORMANCE AND EMPIRICAL VALIDATION
The architecture is tested by trying to break it.
The following experiments and acceptance rules are required for publication and external claims. They are not presented as completed results.
T01
Point-in-time replay
Test changed payloads under old dates and future information in retrieval, graph, cache, and retries. Probe learned hindsight separately.
Report audited source-version violations separately from learned-knowledge leakage; intervals must respect dependency clusters.T02
Revision replay
Inject pre- and post-correction values for the same source.
Report historical reproducibility, retroactive corruption, and correction-propagation time.T03
Claim support
Blind experts test full, partial, absent, and laundered citation support.
Report claim-support precision, recall, source-tier error, and rater agreement.T04
Numerical reproduction
Perturb values, units, currencies, periods, formulas, and rounding.
Report complete reproduction and each typed numerical-error rate.T05
Prompt injection
Place equivalent direct and indirect attacks in prompts, documents, tables, OCR, and tool responses.
Report attack success, false block, detection, containment, and task completion separately.T06
Agency and approval
Attempt out-of-scope tools, budget escalation, forged approval, and forced terminal states.
Zero unauthorized calls, transitions, approvals, or sealed versions.T07
Rights and tenant isolation
Probe retrieval, cache, graph, logs, errors, and embeddings with cross-boundary canaries.
Require zero observed exposure; report counts and dependence. Add a binomial bound only for a justified independent, identically sampled request design.T08
Failure and recovery
Inject node delay, schema drift, event duplication or reordering, timeout, and agent or validator failure.
Report false success, abstention, recovery, data loss, and p50/p95/p99 latency.T09
Correction and revocation
Test corrections and changed permissions across dependent claims, queues, retries, and delivery channels.
Separate unauthorized handoffs, controlled-link disablement, recipient-held copies, and propagation delay. Preserve incomplete outcomes.T10
Component ablation
Compare removed bindings and a general runtime with equivalent financial rules. Separate fixed-action replay from end-to-end agent workflows.
Estimate paired quality, safety, latency, and cost effects with design-appropriate intervals; test claimed interactions separately.01 / Uncertainty preserving document/event clusters02 / False accept, false reject, attack success03 / p50, p95, and p99 latency04 / Cost, tokens, and tool calls05 / Recovery time and data loss06 / Inter-rater agreement
10 / LIMITATIONS
What an architecture document cannot prove
Architectural rigor, operational efficacy, security, and causal validity are separate claims requiring separate evidence.
Reference, not proof
The page specifies a reference architecture and testable properties. It is not a formal proof, penetration-test report, certification, or independent system audit.
Pilot does not validate this architecture
The original benchmark explicitly evaluated a subagent-context protocol implementation, not production AIOS. Reproducing its 97.3 composite does not test this page's data network, causal state, permission boundaries, numerical services, or approval and revocation controls.
Node count
750 is the number of registered source contracts as of August 2026. It does not imply concurrent streaming, complete coverage, equal quality, or a service-level guarantee.
Causal status
Causal edges encode reviewed hypotheses and assumptions. They do not identify causal effects without an estimand, identification strategy, and empirical design.
Agent contribution
Seven roles describe responsibility boundaries. Their incremental benefit over simpler workflows remains an empirical question for the proposed ablations.
Human dependence
Approval quality depends on reviewer competence, workload, incentives, and organizational policy; human review is not an automatic guarantee of correctness.
Deployment variance
Controls must be revalidated for each model, tool, data source, institution, and delivery channel. Logical separation alone does not establish operational effectiveness.
Enforcement is not truth
A deterministic gate can enforce a supplied judgment without making that judgment correct. Entailment, causal credibility, and research completeness still require independent semantic evaluation.
Trace checks are not security proofs
The reference checker tests declared records. It does not verify signatures, re-hash delivered bytes, execute calculation programs, prove complete logging, or establish tenant noninterference.
Evidence time is not model time
P1 checks declared source timestamps, not what a model learned or when graph parameters were fitted. Retrospective conformance, prospective evaluation, and historically attainable replay require different evidence.
Role separation is not error independence
Separately permissioned agents can share model errors, evidence gaps, and anchoring. Agreement is not a second independent observation. Test jointly missed errors and new errors introduced by review under matched budgets.
11 / STANDARDS AND PRIOR WORK
External foundations for the reference architecture
Controls and tests are mapped to provenance, temporal data, AI risk, zero trust, prompt injection, and excessive-agency literature.
- 01Can Prompts Rewind Time for LLMs? Evaluating the Effectiveness of Prompted Knowledge Cutoffs
Gao et al. · EMNLP 2025
Motivates separate tests for indirect use of learned future knowledge; an earlier-date prompt is not reliable unlearning. - 02Temporal Leakage in Search-Engine Date-Filtered Web Retrieval: A Retrospective Forecasting Case Study
El Lahib et al. · ACL 2026 · Short Papers
Shows why publication-date filtering is not payload-vintage verification; motivates frozen source versions. - 03ExAnte: A Benchmark for Ex-Ante Inference in Large Language Models
Liu et al. · EACL 2026
Separately evaluates temporal leakage and task quality, including finance-related prediction tasks. - 04AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents
Wang, Poskitt, and Sun · ICSE 2026
External runtime enforcement is prior art. Financial-domain comparisons must provide equivalent rules and distinguish contract ablations from framework limitations. - 05Zanzibar: Google’s Consistent, Global Authorization System
Pang et al. · USENIX ATC 2019
Relates authorization freshness to content-update ordering. Motivates a separately specified and tested release boundary, not an assumption that an old approval permits every later delivery. - 06Why Do Multi-Agent LLM Systems Fail?
Cemri et al. · NeurIPS 2025, Datasets and Benchmarks Track
A taxonomy of system-design, inter-agent alignment, and verification failures. It motivates testing false consensus and review-induced errors rather than treating role separation as independent corroboration. - 07Defeating Prompt Injections by Design
Debenedetti et al. · arXiv 2025
Prior work on separating control/data flow and capability-based restrictions. Role prompts or trace consistency alone do not establish equivalent security guarantees for ASCEND. - 08PROV-O: The PROV Ontology
W3C Provenance Working Group · W3C Recommendation, 2013
Defines interoperable provenance entities, activities, agents, derivations, and responsibility relations. - 09Constraints of the PROV Data Model
W3C Provenance Working Group · W3C Recommendation, 2013
Provides ordering, uniqueness, typing, and impossibility constraints for provenance validation. - 10Artificial Intelligence Risk Management Framework 1.0
NIST · NIST AI 100-1, 2023
Organizes controls and evidence across Govern, Map, Measure, and Manage functions. - 11Artificial Intelligence Risk Management Framework: Generative AI Profile
NIST · NIST AI 600-1, 2024
Extends risk controls to generative-AI-specific failure modes and lifecycle evidence. - 12Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations
Vassilev et al. · NIST AI 100-2e2025, 2025
Structures red-team trials by lifecycle stage, attacker goals, objectives, capabilities, and knowledge instead of using an ad hoc prompt list. - 13Zero Trust Architecture
Rose, Borchert, Mitchell, and Connelly · NIST SP 800-207, 2020
Supports per-resource authentication, authorization, and removal of implicit network trust. - 14LLM01:2025 Prompt Injection
OWASP GenAI Security Project · OWASP LLM Top 10, 2025
Defines direct and indirect prompt-injection risks that motivate untrusted-evidence boundaries. - 15LLM06:2025 Excessive Agency
OWASP GenAI Security Project · OWASP LLM Top 10, 2025
Motivates least-privilege tools, bounded actions, and deterministic approval gates for agents. - 16AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents
Debenedetti et al. · NeurIPS 2024 Datasets and Benchmarks Track
Supports testing agent utility and security jointly across realistic tool tasks, untrusted data, adaptive attacks, and explicit security properties. - 17AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation
Wu et al. · arXiv 2023
Provides related work for configurable agent roles and interaction patterns; it is not evidence for ASCEND's performance. - 18Causal inference—so much more than statistics
Pearce and Lawlor · International Journal of Epidemiology, 2016
Reinforces that a causal graph expresses assumptions and is neither necessary nor sufficient for identification. - 19The TSQL2 Temporal Query Language
Snodgrass et al. · Kluwer Academic Publishers, 1995
Provides the valid-time and transaction-time foundation for point-in-time reconstruction.
ASSESSMENT
A falsifiable reference architecture.
Empirical proof remains separate.
This specification now supplies the research questions, formal boundaries, threat model, and acceptance criteria expected of a publishable systems paper. Publication still requires a frozen implementation, conformance results, ablations, security testing, and independent replication.
View evaluation and publication protocol