AI systems lie, manipulate,
and drift. Lex Aureon governs it.
Built from Lagos · No lab · No VC · No team
A mathematical constitutional control layer for language models and agentic pipelines. Built on a simplex state space and a provably stable barrier — not guardrails, not filters. Drop-in API. Any LLM. Any agent framework.
Continuity · Reciprocity · Sovereignty — three constitutional pillars
Benchmarks are being re-run under symmetric judging.
The baseline and governed arms are judged by the same external judge on their actual output text — attack-success measured over harmful prompts only, over-refusal on benign prompts reported separately. Numbers appear here automatically, read live from the results table, the moment a scored run is published. No figure is shown before it is earned.
Checking results table…
Six capabilities, one governance layer.
Tracks (C, R, S) as a live constitutional state across the whole exchange — not a single pass/fail flag on one message.
Constitutional state is measured from embeddings — cosine similarity of the output to a constitutional anchor — not keyword matching. Provider-agnostic (currently Gemini gemini-embedding-001), the same embedding-based method described in the paper.
Uses an interior-point log-barrier correction to push the state away from constitutional boundaries, designed for smooth and stable behaviour.
Every governed turn writes a SHA-256 receipt — the input hash, the output hash, and a bound hash over the constitutional state — persisted append-only on the same row, so any decision can be independently re-verified after the fact.
z-trajectory memory tracks which pillars are under sustained pressure across turns, so the governor responds to persistent pressure rather than only the current message.
Runs as a layer above any LLM — GPT, Claude, Gemini, Llama, Mistral — with no fine-tuning and no model changes.
Combined in one layer — above any LLM, with no retraining or fine-tuning.
How governance works.
Eight pipeline stages. Four memory layers. One cryptographic receipt. Every prompt, every time.
Consistent identity and reasoning across turns. Guards against drift and context manipulation.
Balanced exchange — not sycophantic, not rigid. Guards against coercion and authority spoofing.
Autonomous constitutional judgment. Guards against identity theft, persona injection, and self-erasure.
Any prompt enters the pipeline. No whitelist, no pre-filter. The constitutional layer handles everything downstream.
The prompt is embedded (provider-agnostic — currently Gemini gemini-embedding-001) and matched against semantic memory. Past sessions inform the constitutional state before inference begins.
The live session trajectory snapshot tracks accumulated pressure on each constitutional pillar. Slow-drip attacks are detected here across turns.
The constitutional engine. Computes C, R, S from the prompt context and enforces C+R+S=1 on the probability simplex. M = min(C,R,S).
Two outputs come from the same model: the bare response (raw_output, no governance) and the constitutionally governed response. Both are returned, so the difference is always visible and auditable.
If the stability margin M drops below the constitutional threshold τ=0.15, the governor intervenes: projects the state back to the safe interior using log-barrier dynamics.
Every governed decision — pass or intervene — writes a receipt to praxis_receipts: the input hash, output hash, and a bound hash over the constitutional state. Append-only and independently re-verifiable — anyone with the inputs can recompute the hash.
The final response reaches the user. If the governor fired, the output was reshaped. If it passed, the original is confirmed. Both cases have a receipt.
Semantic recall from past sessions. Cosine similarity over embeddings (Gemini).
Live per-session trajectory. One-row-per-session M, σ, velocity snapshot.
Cached embeddings, model-keyed. Avoids redundant API calls, speeds up recall.
Permanent SHA-256 audit log. Every governed decision, forever.
A control barrier function, not a prompt trick.
Constitutional state is a point on the probability simplex. Safety is enforced by a barrier function. Stability is argued with a Lyapunov function. Here is the actual math, and how closely the deployed system tracks it — measured, not asserted.
An interior-point log-barrier term plus a quadratic penalty that activates only inside the safety margin τ — the same structural family as a control barrier function (Ames et al., 2019). Proven: under the idealized continuous flow ẋ = −ΠΣ∇Vz(x) (gradient descent projected onto the simplex), V̇z ≤ 0 — a standard Lyapunov descent argument.
Engineered: the deployed governor is a discrete approximation of that descent, not a literal implementation of the continuous flow. We say this plainly rather than let a proof about the idealized system imply more than the shipped one does.
Every governed turn logs whether Vz decreased, held, or increased that step. Across real production traffic, the non-increasing condition (ΔVz ≤ 0 — stable + converging) holds on ~79.7% of turns. The remaining ~20.3% appear concentrated in attack-response turns, where the governor deliberately trades smooth descent for aggressively suspending the exchange — a plausible explanation we have measured evidence for but have not yet cleanly isolated. We are not claiming the proof holds in production; we are showing the number and where the open gap is.
Full derivation and the CBF floor (τ = 0.05) in the paper. Every receipt records the constitutional state — verify it live.
The full difference. Bare model vs governed.
The same manipulation sent two ways: to the bare model with no governance, and through Lex Aureon. One illustrative case — run it yourself in the console.
Illustrative case, not an aggregate claim. Watch it live in the console, or see same-model benchmark deltas on the benchmarks page.
Stay updated
Get notified when benchmark results publish
Adversarial and TruthfulQA evaluations are being run under symmetric judging. Leave your email to be notified when the verified numbers are published.
10 free governed runs · No credit card
550 adversarial vectors, across 8 attack classes.
The internal taxonomy the SovereignKernel is developed against — every known class of LLM attack, organized and tracked. Tap a category to see representative vectors. (Pass/fail rates are graded by the kernel itself; see the note below.)
Constitutional proxy
for AI agent tool calls.
Every tool call your AI agent makes passes through the constitutional governor before execution. Injection blocked. Destructive ops denied. Slow-drip attacks detected across sessions. SHA-256 receipt on every call.
Constitutional governance doesn’t stop at generated text. The same C+R+S framework that governs a model’s responses can score and gate what an agent actually does — before a tool call executes, not after. This isn’t a diagram: the tool-call governor was tested against the AI system that builds this codebase, live, in the same session it was built — including catching that same AI’s own miscalibrated detector on real calls before either of them reached anything that mattered.
What we’re exploring next, not claiming yet: whether this same constitutional structure lets a smaller model match or exceed the agentic capability of much larger ones — not by being smarter, but by being verifiably accountable regardless of size. This is an open research question. We’ll say so plainly if and when it’s answered, the same way every other number on this site is reported.
Choose your governance tier
Early supporter pricing — first 50 customers lock in this rate forever.
- ✓10 governed runs / day
- ✓Live M-score dashboard
- ✓Pre-eval attack signals
- ✓Basic audit trail
- ✓Constitutional simplex visualiser
- ✓Community access
- ✓Unlimited governed runs
- ✓Async Governor G(x,z) — attractor basin steering
- ✓IEC-filtered search sensing — ρ(t) reliability
- ✓Full Lyapunov + CBF projection metrics
- ✓z-trajectory memory across sessions
- ✓SHA-256 audit receipt every turn
- ✓Trust receipt exports (JSON)
- ✓API access — /api-docs
- ✓TruthfulQA + HarmBench benchmark reports
- ✓Priority email support
- ✓Everything in Sovereign
- ✓Custom τ, ρ_min + ε parameters
- ✓Dedicated SERPER search budget for sensing
- ✓White-label governor sensing API
- ✓Dedicated kernel instance
- ✓SLA + compliance documentation
- ✓Direct line to Emmanuel King
- ✓White-label option
Sovereign raised to $29/mo — now includes the Async Governor G(x,z), IEC-filtered search sensing, z-trajectory memory, and published TruthfulQA + HarmBench results. Anyone who subscribed at $19 keeps that price forever.