How it works
The gate is enforced in code, not hoped for
Every output Cortessa produces is provenance-gated — labelled Verified, Draft or Refused. The gate applies a deterministic, versioned containment policy before a claim can pass as Verified, and keeps the cited source open for inspection.
The provenance gate
Cortessa does not certify — the engineer signs off. What the gate guarantees is that nothing reaches Verified unless it is provably a near-verbatim span of a cited source.
Shown only when a claim is provably a near-verbatim span of a cited source, with the citation attached.
Claims that cannot be proven against a source are shown as Draft — never passed off as fact.
When the fact is not present in the approved corpus, the system refuses rather than guess.
Why deterministic matters Safety is not a prompt you hope the model obeys — it is enforced in code. In blind testing on real, public documents, all 16 fabrication attempts in that run were gated and no ungrounded value reached Verified — 0 fabrications across both blind evaluations.
Pure local retrieval by default
In its default mode, Cortessa answers by retrieving from your approved document set on the machine itself. Nothing leaves the machine to answer a question — no corpus, no query, no fragment of a document. It runs entirely on a dedicated sovereign workstation on the analyst's desk — a single executable: no server, no cloud, no internet dependency.
Because retrieval is local and the gate is deterministic, the same guarantee holds whether the machine is online or disconnected inside an accreditation boundary. The classification ribbon shows, live, which assurance mode is in force.
Three assurance tiers
The box answers on its own. The model and the ingestion pipeline live on it and run full time, and every mode is shown live on a classification ribbon so the operator always knows the boundary they are working within.
- On-device (standard) the model and the whole ingestion pipeline are resident on the box and run full time; nothing leaves the machine. In the separate 60-question blind exam this mode refused all 12 out-of-corpus questions with 0 fabrications.
- Retrieval only the floor beneath it — ranked source passages with their citations, no model in the loop. Always available; never a failure.
- In-region cloud — off by default a future option for a site whose policy later permits one. It ships switched off, and can be locked out entirely so it cannot be selected at all. Opt-in and logged if it is ever enabled (UK, London / eu-west-2).
Ask — a question, answered and cited
-
Point it at an approved corpus
You choose the document set. Cortessa retrieves only from that corpus — it has no other source of truth.
-
Ask in natural language
Every sentence in the answer is cited back to the source span it came from.
-
The gate labels each claim
Provable spans are Verified; anything unprovable is Draft; if the fact is not present, the answer is Refused rather than invented.
-
The engineer signs off
Cortessa never certifies. You trace each citation and make the call.
In the 480-question blind evaluation, retrieval was ~97%, strict factual accuracy was 76.9% in the shipped configuration, and all 16 model fabrication attempts were held back by the gate. A separate 60-question exam on a real 43-paper physics corpus returned 83% strict accuracy, with 12 / 12 out-of-corpus questions refused and 0 fabrications. Both were run internally with blind separations; external replication is a pilot objective.
Audit — the whole estate, cross-checked
-
Load the document estate
Cortessa cross-references the whole corpus rather than answering a single question.
-
Surface where documents disagree
Numeric conflicts, supersession, broken references and stale content are detected across the estate.
-
Return a cited findings list
Each finding points to the sources that disagree — for example a coupling rated to 30 bar where the current standard says 45.
-
An engineer adjudicates
The findings are adjudicable, not automatic. The engineer resolves each one; Cortessa hands over the evidence.
Recall 1.0 and precision 1.0 on the committed seeded regression set, across four error classes — a synthetic benchmark, scored within those classes. Separately, a blind run over a real NASA programme document family returned 15 / 15 genuine findings.
Author is in development A third capability, Author, turns the corpus into a cited, sign-off-ready briefing where the engineer accepts, revises or rejects each drafted claim. It is still in development — additional testing is underway — and is not yet shipped.
Effectivity: binding an answer to a configuration
Supersession and effectivity are different claims. Supersession is about time: Rev E replaced Rev D. Effectivity is about configuration: Rev D still applies to hulls 1–4 and Rev E from hull 5 — both are current at once, and quoting the wrong one for the variant in front of you is a safety event.
For S1000D technical publications, Cortessa evaluates each data module's declared applicability against the product configuration selected for the session. The evaluation is three-valued — applies, does not apply, or undecidable — and undecidable is flagged on the answer, never silently resolved. Modules withheld because they belong to a different variant are reported alongside the answer, so the engineer can see what was excluded and why. With no configuration selected, behaviour is unchanged: nothing is withheld.
Unfiltered retrieval answered 4 of 8 questions and leaked the wrong variant four times. With the effectivity filter active, all 8 were answered with 0 wrong-variant leaks, on a disclosed, purpose-authored S1000D corpus with a genuine pre-/post-modification module pair.
See the gate against your own documents
A scoped, paid pilot runs on your hardware, behind your firewall, against success criteria you set — led by Audit.