1. Executive Model Overview and Reading Guide

ATLAS measures the macro-financial state as four continuous cross-asset scores and summarises it as a persistent regime label. A faster tactical layer watches one-day changes in confidence and transition pressure, disagreement across the score axes and the freshness of the inputs, and raises an abstention gate when the evidence is unstable. A permission resolver orders freshness, abstention, tactical state, bear context, exposure policy and baseline most-restrictive-first and returns a permission level with its reasons. A rules-based allocation baseline, gated and constrained, emits per-symbol targets that are decision support, not instructions. Governed and production artifacts are written through one sanctioned writer and shadow research artifacts through a separate writer that refuses the governance lane; outputs are hashed per run, labelled for freshness and served with a state class and a reason code. Caution is evaluated after the fact at pre-registered horizons. Shadow optimisers, risk analytics, forecasting and research programs run beside the governed lane and carry no authority until an operator records a promotion.

Each section states what an object measures, its inputs and units, how it is computed, where it runs, who consumes it, what happens when it fails and where it is limited. The status map that follows lists, per capability, the implementation lane, whether it is enabled and for whom.

Status vocabulary

Each equation carries one chip from the set below; a chip describes the equation it follows, not the section around it. Evidence posture per layer uses the implementation's own registry: three evidence classes (decision_grade, decision_relevant_but_unproven, mechanically_valid) and three dispositions (promoted, diagnostic_only, not_promoted).

Availability in the status map uses four levels: implemented (code exists and is tested); registered (a pipeline stage, application route or view exists); enabled (not behind a disabled flag or a cohort gate in the named environment); exercised (dated runtime evidence exists). “Canary” means enabled for a named group of operators on the beta environment. Production enablement that could not be read from the repository is marked unverified.

2. Capability and Status Map

Production served the revision of 20 August 2026 until 7 October 2026, when the current revision was deployed. Capabilities merged between those dates are present in production but have no production activation record; "exercised" refers to dated evidence on the named environment.

3. Decision Objective and Standing Assumptions

The system is built from nine kinds of object, each specified in its own section: the observable inputs (standardised cross-asset and macro features); the governed artifacts, written through the sanctioned writer and hashed per run; the data-quality state of those artifacts (freshness, requirement, enforcement); the structural regime, a finite label set over continuous coordinates \(Z_t \in \mathbb{R}^4\); the tactical states Stable, Transitional and Unstable; the confidence and flip-risk objects, several of each; the posture map and the permission resolver; and the validation machinery, most of which runs in the shadow and research lanes.

The operative posture on day \(t\) is a function of structural label, tactical state, portfolio state, data-quality state and any active human override:

The posture is an allocator intent, not a trade and not an exposure stance; the exposure stance and the permission level are derived from it and from the lanes described under decision authority.

Standing assumptions

• A1 (Finite label, declared rule). The regime label takes values in a finite set and is produced by a declared rule over the continuous coordinates, not by an estimated latent-state model. No Markov assumption on the label is made in production.
• A2 (Information at \(t\)). Every decision-time object is computed from artifacts available at run time \(t\). Because inputs are latest-revised series and eligibility is re-evaluated each run, the information sets are not nested across time (see information timing).
• A3 (Fail-closed tactical and authority layers). A missing or inadmissible input cannot resolve to a Stable tactical state, a risk-on exposure stance or a normal permission level. The raw abstention flag itself treats a missing trigger input as not triggered; the fail-closed behaviour lives one layer up.
• A4 (Deterministic gates). Write-time contracts, freshness enforcement and the landing-coherence guard are deterministic functions of the artifacts.
• A5 (Closed-set authorisation). Authorisation of an operator for a sleeve is two-valued and is evaluated before any data read.

4. Abstention

Measures

Whether the tactical evidence on a day is unstable enough that no new exposure commitment should be supported.

Inputs and units

One confidence series and its flip-risk transform, declared on a 0–1 or 0–100 scale by column name and rescaled to the unit interval; the four structural scores for cross-axis disagreement; the freshness tier of the anchor row.

Output

A daily abstain flag with reason tokens and a strength; an abstention episode (a maximal run of abstaining days) with its start date; an effective gate that carries persistence, cooldown and dwell rules.

Status and consumer

Governed stage, required in both environments; consumed by the exposure policy, the portfolio target gate and the permission resolver. Evidence class decision_grade, disposition promoted.

The abstention engine has exactly three reactive triggers plus a fatal data-integrity check on the current row:

with shock and acceleration as defined under confidence and flip risk. Because the flip-risk series the engine consumes is \(100\) minus its confidence series, the acceleration trigger is the negative second difference of the same series that the shock trigger differences; the trigger set is therefore two upstream quantities, not three independent signals. Strength is a maximum, not a vote count. Confidence decay is an exit condition in one scenario lane and a reason code in the permission resolver, not a trigger; a data-staleness trigger exists in a diagnostics builder that is disabled by default.

Effective abstention. The raw flag is not the gate. The governed ledger applies, in order: an entry-confirmation requirement over a protected number of days; an initiation rule under which a lone flip-risk acceleration cannot start an episode and, in named regimes, a lone disagreement cannot either; a regime-conditioned corroboration requirement for entry; persistence carry-over; a cooldown exit that requires a minimum active duration, a Stable tactical state and no fresh trigger; and a dwell gate that imposes a protected number of days on both engagement and release to prevent churn. A separate resolution specification (confidence recovery, flip-risk cooldown, disagreement resolution, each with regime-specific persistence) is served as an expected-resolution view. Two enumerations of abstention therefore coexist by recorded adjudication: a day-grain ledger and an episode-carried effective state.

What abstention does. On the portfolio side the effective gate holds: every gated target is set to its current weight, deltas are zeroed, and the pre-gate delta is retained on the moves view for inspection. Abstention never sells. On the macro ledger the posture may be graded Reduce with a protected exposure multiplier, which feeds the exposure stance and the outcome economics. Advisory playbooks map reason tokens and strength to gross, net and cash multipliers labelled optionality retention, gross reduction and capital preservation; they are advisory only. A policy-accrual ledger records which playbook applied on each day without comparing it to outcomes; it is a record, not a calibrated response policy.

Human override. An operator may force or lift abstention through a governed override that carries an actor inferred from the authenticated session, one of six closed reason codes, a mandatory expiry bounded by a ceiling, and a confirmation step; writes are behind two flags and a readiness key. Overrides can target only the abstention state; a request to override the structural regime or the tactical state is rejected as not human-overridable. Override lifecycle events are audit-logged before the write, and a counterfactual realisation computes the modelled exposure-multiplier consequence at three horizons.

5. Decision Authority

The permission resolver (ANDURIL) is a pure function of six lanes. It reads no portfolio targets and emits no weights; it returns a permission level, the dominant lane, the allowed and blocked guidance classes and a reason stack:

The most restrictive lane wins; the lane order freshness, abstention, tactical instability, bear context, exposure policy, baseline names the dominant lane on ties and orders the reasons. Every lane except bear context fails closed to no allocation advice when its input is missing; bear context can only cap. NORMAL requires an affirmative all-clear from every lane, otherwise an INDETERMINATE pseudo-lane applies. One level, DE_RISK_ONLY, is declared but unreachable in the current reason mapping and has never appeared in the materialised history. Guidance classes are a closed set (maintain baseline, reduce gross, capital preservation, optionality retention, defensive tilt only, shadow only, no new allocation, no allocation advice).

The exposure stance is a separate closed set (INDETERMINATE, HARD_ABSTAIN, CAPITAL_PRESERVATION, GROSS_REDUCTION_OPTIONALITY, CAPPED_EXPOSURE, RISK_ON), derived by the governed exposure resolver from the posture, the tactical state and the meta-regime; missing regime, tactical or abstention input yields INDETERMINATE and an unrecognised token stays in the active stance. An allocator registry records which allocator is active, shadow, candidate or blocked; that four-value set is the only authority vocabulary in the implementation.

Layer separations. Measurement is not policy: confidence, flip risk and disagreement are inputs to the gate, not actions. Policy is not execution: a posture and a permission are labelled classes; nothing executes. Reporting is not authorisation: a report being readable does not authorise an action. Research is not live governance: shadow artifacts are readable but never enter the gate. Summary is not decision: generated narrative is a read-only projection with no authority.

6. Abstention Accountability and Outcomes

Measures

Whether caution, once taken, was warranted, and what it cost, at pre-registered horizons.

Populations

Days are the grain, not episodes. Days are partitioned into not abstaining, abstaining without exposure consequence (effective multiplier at or above one) and abstaining with exposure consequence. Two denominators are reported: all abstention days and consequential abstention days.

Maturity

Each day is current, current-day incomplete or maturity-indeterminate with respect to its horizon; immature observations are counted as such and never as outcomes.

Status

Governed finalise stage served on the abstention view to a canary operator cohort; evidence class of the rows LIVE_GOVERNANCE.

The verdict spine is a closed set, \(\{\text{justified}, \text{false_caution}, \text{unclear}, \text{insufficient_horizon}\}\). The exposure consequence and avoided drawdown of a day with effective multiplier \(m\) over horizon \(h\) are

A false-caution verdict requires missed upside above a materiality threshold; a forward drawdown merely staying within tolerance yields unclear, not false caution. A later drawdown does not by itself establish that a loss was avoided, because \(\delta_h\) is a modelled consequence of the multiplier, not a realised trade; a later rally does not by itself establish that caution was irrational. Economics on the funnel are carried as a status, with a closed value for unavailable-by-construction; they are never zero-filled. The portfolio-linked replay that would attach realised sleeve economics to these verdicts is implemented and tested but its artifacts are not materialised, so it is not live. False-caution economics run in the shadow lane. A regime decomposition exists as abstention-quality by regime-quality quadrants and as drawdown-stratified bins; there is no false-caution-by-regime-label surface.

Four outcome vocabularies coexist across the ledger, the episode mapping, the attribution summary and a helpful-harmful classification; they are reconciled by recorded adjudication rather than unified, and a development-only reconciler reports divergence. Maximum adverse and favourable excursion exist only in a path-geometry research stage that is not served. Expected resolution dates come from a trading-calendar state machine; episode duration is reported, not a resolution time.

Caution state machine (LANTERN). A five-state caution state machine with seven reason codes runs as a required governance stage and is served to a canary group. It is advisory: it is not a trade signal and it does not control permissions. Its candidate-policy calibration lane runs in the shadow lane.

7. Structural State and Regime Label

Measures

Slow, persistent macro-financial conditions as four continuous scores and one categorical regime label.

Inputs and units

Rolling z-scores of medium-horizon momentum in broad equity, credit, commodity, gold and long-Treasury instruments; an equity volatility index; a high-yield credit spread; a financial-conditions index; Treasury yield changes, curve slope and breakeven inflation. Macro series come from a public statistical data service; prices from exchange-traded funds. All inputs are dimensionless after standardisation.

Timing

Daily, on the latest revised series available at run time. Observation date and availability date are not distinguished for macro inputs (information timing).

Status and consumer

Governed pipeline stage; served to the signed-in application as regime history and current state. Evidence class decision_grade, disposition promoted.

The continuous structural coordinates are a four-vector of governed scores

for growth, inflation, liquidity and risk, where \(z_{j,t}\) are the standardised features and \(w_{kj}\) are configured, fixed weights. The weights are not estimated by a fitting procedure; they are declared parameters and are protected. The categorical regime label is a projection of the growth and inflation coordinates, with a risk overlay and a persistence rule:

\(q(\cdot,\cdot)\) maps the two signs to one of four quadrant labels; the stress indicator prefixes a risk-off variant, giving a finite label set \(\mathcal{R}\) of eight labels. \(\mathrm{persist}(\cdot)\) accepts a change of label only when the standing label has run for at least a configured minimum number of trading days. The thresholds \(\theta, \theta_r, \theta_j\), the stress input set \(J_s\) and the minimum run are protected.

Estimation. The label is not the output of a fitted latent-state model. No parameter of the classifier is estimated on a calibration window, so there is no held-out evaluation window for the classifier itself; held-out evaluation applies to the forecast and research programs in validation and research programs. The full four-dimensional state \(Z_t\) is kept alongside the label; the label is a summary of it, and the two are never collapsed into one object.

Failure behaviour. A missing feature yields a missing score for that day; the structural layer carries the gap forward as a labelled missing value, and the tactical layer treats it as fail-closed input (tactical state). The first observation has no prior day: its one-day change is set to zero rather than labelled, which is a known limitation.

8. Embeddings and Metric

Geometric diagnostics operate on declared embeddings of the structural coordinates. Each embedding has a declared status and no embedding carries decision authority on its own.

Distances in every live producer are Euclidean on the raw score coordinates:

Scaled, whitened and Mahalanobis metrics are declared in the geometry kernel and are available to research code, but no served quantity is computed under them. Because the scores are already standardised, Euclidean distance treats a one-standard-deviation move on each axis as equal; that equivalence is an assumption, not a measured property, and it is the reason geometric quantities are diagnostic rather than policy-bearing.

9. Kinematics and Geometry

Time is the trading-day index \(t\); there is no separate visual time parameter. The one-day speed used in production is the Euclidean norm of the one-step change in the four scores, with no smoothing:

The trailing mean \(\bar{v}_t\) over a protected window \(k\) is the speed term inside the layered flip-risk object (flip risk). Units are standard-deviation units per trading day.

Acceleration and curvature are computed in the three-dimensional embedding as causal first differences:

The cross-product form of curvature is the Euclidean formula; it is valid here only because the live metric is Euclidean (embeddings and metric). It would not transfer unchanged to a scaled or Mahalanobis metric. Torsion, \(\det(\mathbf{v},\mathbf{a},\mathbf{j})/\|\mathbf{v}\times\mathbf{a}\|^{2}\) with \(\mathbf{j}\) the third difference, exists in the research kernel and in a feature-gated snapshot script that is not part of the governed pipeline; it is RESEARCH_MEASUREMENT. A causal local-polynomial derivative estimator exists in the kernel but every live adapter passes raw differences.

Singular and low-speed cases. Curvature is undefined when \(\|\mathbf{v}_t\| = 0\) and numerically unstable when the speed is small relative to the day-to-day noise of the scores; the producers return a missing value below a protected floor rather than a large number. Quantities that need a minimum history are missing, not zero, until that history exists. These limitations are the reason none of the geometric quantities enter the admissibility map.

Path-length ratios over a window are research descriptors and are not produced by any registered stage.

10. Regime Centroids and Boundaries

For each label \(r\), the centroid in the three-dimensional embedding is the full-sample mean of the coordinates on days carrying that label:

Frozen, expanding and rolling centroid modes are declared in the kernel vocabulary but only the full-sample mode is implemented; a full-sample centroid uses future days to describe a past day and is therefore unsuitable for causal evaluation. A “basin” in the diagnostics is the identifier of a contiguous run of one label, not an attractor of a dynamical system.

The served boundary quantity is the margin to the nearest quadrant threshold in the growth–inflation plane:

A signed closing velocity toward the nearest boundary exists as a tested research helper and is invoked only by diagnostic scripts. Normal acceleration is not implemented. Boundary proximity is necessary but not sufficient for an imminent label change: the persistence rule and the direction of travel both matter, so a small margin does not by itself predict a flip.

11. Transitions and Entropy

Transition probabilities between labels are empirical row-normalised counts over the observed label sequence, either on a trailing window or on the full history:

Rows whose transition count falls below a protected support floor are returned as missing rather than estimated. No pseudocount or shrinkage is applied. The estimate is a description of the realised label sequence under an implicit stationarity assumption over the chosen window; it is not a parameter of a latent Markov model, and no latent-state model drives the production label. A hidden Markov overlay runs as a non-promoted comparator (mechanically_valid, not_promoted) whose outputs are written to the shadow lane and are not read by the abstention model.

Four entropy-type quantities are computed in a diagnostics stage, in nats, with zero cells omitted:

\(\hat{\pi}\) is the occupancy frequency and \(\hat{q}\) the frequency of ordered label pairs. The quantity labelled “entropy rate” in the artifact, \(\eta_W\), is the pair entropy divided by the window length; it is not the Markov entropy rate \(-\sum_i \pi_i \sum_j p_{ij}\log p_{ij}\). These are descriptive statistics of a label sequence. They carry no thermodynamic meaning and no demonstrated predictive power, and only a trailing change in one of them reaches a served surface.

12. Confidence

Five distinct objects in ATLAS are called “confidence”. They are on different scales, they are not interchangeable, and none of them is a calibrated probability. An audit of the governed artifacts in August 2026 found two of them to be near-duplicates and one to be nearly constant, so each is listed here with its definition and its consumer.

Two properties deserve emphasis. First, \(c^{(2)}\) is normalised by a whole-sample maximum, so its value on a given day depends on days after it; it is explicitly documented in the code as a heuristic proxy, not a probability. Second, the object shown to operators on the regime views (\(c^{(4)}, c^{(5)}\), kept as separate structural and tactical series and never averaged) is not the object that drives abstention (\(c^{(2)}\)). Reconciling the vocabulary is an open operator decision.

Confidence shock and confidence decay are defined on raw one-day changes, not on a standardised score:

with \(c = c^{(2)}\) rescaled to the unit interval, protected thresholds \(a, b, \varepsilon\), and \(\text{disagree}_t\) from disagreement. No standardised (z-scored) shock exists in the implementation.

13. Flip Risk

Flip risk is a transition-pressure measure, not a directional market forecast. Four objects carry the name:

Here \(\rho^{\text{abst}}_t\) is the abstention-boundary proximity and \(s^{\text{abst}}_t\) the abstention strength, so the tactical-layer object measures pressure toward abstention rather than toward a label change; \(\bar{v}_t\) and the trailing mean of \(|\Delta s^{\text{abst}}|\) use the same protected window. The first identity is exact: the flip-risk series consumed by the abstention model is a deterministic transform of the same confidence series, which was confirmed on every row of the governed artifact in a dated audit. Consequently the two abstention triggers built on them, confidence shock and flip-risk acceleration, are functions of one upstream series, not two independent signals.

Flip-risk acceleration is the second difference

with a protected threshold \(\gamma\); a regime-dependent volatility multiplier exists in the code but is disabled, its hypothesis having been falsified. A level exceedance of flip risk does not by itself start an abstention episode, but it does set the tactical state to Unstable when no earlier trigger fires; the second difference can raise Transitional before any static level is crossed. Days whose inputs are missing, or whose history is shorter than the window a quantity needs, are labelled as insufficient-horizon or fail-closed Transitional; they are never labelled Stable.

14. Disagreement

ATLAS has one structural model, not an ensemble, so there is no cross-model dispersion. Disagreement is measured across the score axes of that model and across independent surfaces:

The range \(D^{\text{range}}_t\) exceeding a protected threshold is the score-disagreement trigger of the abstention model. The cross-axis standard deviation is the basis of \(c^{(2)}\), not a separate trigger. \(D^{\text{vote}}_t\) is a daily minority count among \(n = 5\) binary signals (structural label change, tactical state, abstention state, low confidence, rising flip risk); it is a governance-lane descriptor served on the driver-history view. Surface disagreement between two classification surfaces on locked stress windows is a research track whose findings to date are indeterminate (validation and research programs).

15. Tactical State and Meta-Regime

Three separate closed vocabularies describe the fast layer; they are not one state machine.

Transitional and INDETERMINATE are explicit states with recorded reasons, not error conditions. Escalation reasons that are persisted include persistent low confidence, flip-risk acceleration and disagreement-with-decay. A day on which evidence cannot be evaluated is recorded as unevaluable: absence of evidence is not treated as a determinate state.

16. Portfolio Risk Analytics

Measures

Forward loss quantiles, factor risk contributions and drift statistics for a sleeve's current holdings.

Inputs and units

Holdings by sleeve in base currency; daily instrument returns; a factor model; the current regime label. Weights are fractions of sleeve market value; losses are fractions of sleeve value over the horizon.

Status and consumer

Diagnostics-lane stage, served to entitled operators on a flagged view. Evidence class mechanically_valid, disposition not_promoted: the outputs are inspectable but carry no decision authority.

Portfolio return and variance under a covariance estimate \(\Sigma\) are the standard forms, and factor contributions to risk follow the Euler decomposition:

Value at risk and expected shortfall are produced. They are not parametric and not historical-simulation estimates: forward paths over a protected horizon are generated by a regime-conditioned block bootstrap of historical returns, and the loss distribution \(L\) is the empirical distribution of those simulated path losses:

Two validity conditions apply. The expected-shortfall estimator above is the mean of simulated losses at or beyond the empirical quantile; on a discrete simulated distribution it is a tail conditional expectation, which equals the coherent expected shortfall only when no probability mass sits exactly at the quantile and is otherwise at most the expected shortfall: the atom at the threshold biases it downward, so the served figure can understate the tail expectation. And both estimates inherit the bootstrap's assumptions: block resampling within the current regime, a fixed block length, a finite number of paths, and a history that may not contain the losses that matter. The estimates are reported with their regime conditioning and are diagnostics, not limits. Maximum drawdown is reported as a quantile of the simulated path drawdowns.

Covariance-based tracking error against a benchmark, \((w - w_b)^{\top}\Sigma(w - w_b)\), is not implemented in the portfolio layer; the quantity the product calls tracking error is the absolute weight drift between the pre-gate target and the current weight. A return-based tracking error exists only in shadow benchmark comparisons.

17. Sleeve Health

Sleeve health is a state machine, not a constraint-headroom vector. For each broker and sleeve it decomposes signals that already exist in the portfolio-health, artifact-freshness and upload-manifest artifacts into one row:

plus the last upload time, counts of missing and stale inputs, a primary reason code, the source artifacts and run identifiers, and a next-action code from a closed set. There is no cosmetic OK: a sleeve with any missing or stale required input cannot report OK. Coverage is projected from the optionality state. Concentration risk is a separate served artifact conditioned on regime. The view is advisory and served on a flagged surface; at the last dated measurement on the beta environment, every sleeve reported degraded with a named reason, which is the intended behaviour when inputs are stale.

18. Allocation Baseline and Shadow Optimisers

The governed allocation baseline (TILT) is a rules-based target, not an optimiser. For each regime label and holdings bucket a configured policy table gives a tilt stance (over, under, neutral) and a target. The pipeline joins the current label to that table, allocates bucket targets to symbols pro rata, applies gates and constraints, and emits per-symbol, per-sleeve current weight, pre-gate target, post-gate target and their deltas with a reason code and the binding constraint:

\(\mathcal{G}\) applies the gates (abstention state; a hold on the options bucket unless the overlay tilts it explicitly) and \(\mathcal{K}\) applies the constraints in order: liquidity-tier delta scalers, per-symbol and per-bucket maximum weights including a cash-like cap, then renormalisation of the free positions within each date, sleeve and currency with cash absorbing the residual. There is no sleeve-level weight limit. A missing or invalid constraints configuration does not stop the stage: the target is emitted without the caps and scalers and carries an unavailable-constraints reason code, which is fail-soft and disclosed rather than fail-closed. Targets are decision support: they are not trade instructions and nothing executes them. Evidence class decision_grade, disposition promoted; the confidence-scaled tilt amplitude is a shadow overlay only.

Shadow optimisers. Mean–variance, Black–Litterman and equal-weight candidates are computed in a diagnostics stage and written to the shadow lane. The only solver is a long-only bounded quadratic programme per bucket:

solved on an eligibility-filtered universe (the options bucket is excluded before solving). The solver status is a closed set, SOLVED, FALLBACK_EQUAL_WEIGHT or DEGENERATE_WEIGHTS, with fallback reasons for an infeasible constraint set, a non-positive-definite covariance, a solver error or a degenerate zero weight sum. No turnover, concentration or optionality penalty and no group, gross, turnover, risk-contribution or tracking-error constraint is implemented. SHELOB, in code, is the registry of optimiser model families and the read-only comparison surfaces over their pre-computed weights; nothing in it executes a model, mutates a portfolio or changes a target.

The Black–Litterman candidate uses the closed-form posterior

with an identity view matrix (one absolute view per bucket), views \(q\) taken from the regime-overlay return tilt, an equilibrium prior from an equal-weight portfolio, a diagonal view-uncertainty matrix scaled by an ambiguity tier \(s\), and ridge regularisation recorded on the artifact when a matrix is ill-conditioned. \(\tau, \delta, \omega\) and the tier scalings are protected. A walk-forward shadow replay and a realised-economics evaluation of the three candidates against the governed current weights exist as shadow stages; the durable prospective record is an append-only history of shadow candidate weights. None of the candidates is a live instruction.

Allocation permission (ANDURIL). A pure resolver maps the current lanes to a permission level and a reason stack; it emits no weights (see decision authority).

19. Optionality and Protection Planning

Measures

How much put protection a sleeve's plan calls for, what the sleeve actually holds, and the gap between them under a grid of drawdown scenarios.

Inputs and units

Sleeve net asset value and insurable base in base currency; broker option positions normalised to contracts with a multiplier (per broker row, default 100); a proxy underlying spot; configured premium rates by moneyness tranche; budget levels and tenor buckets. Coverage ratios are dimensionless.

Status and consumer

Governed stages served to entitled operators on sleeve-scoped views. Evidence class decision_grade, disposition promoted, with the limitation that missing broker positions degrade the result rather than fail it. Authority is diagnostic: no optionality artifact feeds the exposure policy and nothing places an order.

Targeting sizes a protection notional from an insurance-requirement score and converts it to contracts at the proxy spot, not at the strike:

A premium budget \(B_t = \beta\,\mathrm{NAV}^{\text{ins}}_t\) at several budget levels can only scale the required contracts down, never up. The premium estimate is \(N^{\text{hedge}}_t\) times a blended configured rate by moneyness and tranche weight; it is labelled ESTIMATE_PROXY because it is a rate table, not a quote. Real option-chain pricing is DEFERRED: no options market-data source exists and the only market input is the proxy spot. The annual protection plan carries the same proxy label.

Three coverage quantities exist and are not interchangeable: the insurable share of the gross long base, \(\mathrm{NAV}^{\text{ins}} / (\mathrm{MV} + \text{margin debt}) \in [0,1]\); the structural reconciliation of broker option positions against target ladders, read together with a paired reconciliation-health artifact so that an empty gap table is never mistaken for full coverage; and the economic coverage ratio per sleeve and drawdown scenario,

Payoffs are gross intrinsic value at the scenario spot, with no pricing model and no haircut. Net payoff is not reconciled: there is no premium-paid field on the live side, so a premium subtraction applies only to the target-side estimate. Unmatched or unmodelled positions are listed explicitly. A sleeve-level beta-to-proxy hedge fit and modelled offset by budget and scenario exist as diagnostic estimates consumed only by the AI briefing context; they are not protection guarantees and not a tail-risk model.

20. Scenario Evaluation, Decision History and Change Records

The scenario workspace (GitPortfolio) lets an operator define alternative portfolio compositions as branches of a baseline, evaluate one pinned revision against a pinned baseline snapshot over an explicit window, and compare two such evaluations when, and only when, they are provably comparable.

Inputs

A baseline holdings snapshot; a scenario revision expressed as a closed set of actions (adjust weight, remove position, add position, replace security); an evaluation window and mode.

Definition

Daily baseline, scenario and delta paths with the market path held fixed, constant scenario weights, daily rebalancing and a one-day decision lag. Transaction costs are not applied. Only weight adjustments and removals are evaluable today; additions and replacements are deferred because tradability of a new security is unproven in the data.

Output

An evaluation envelope carrying evaluability, data tier (REAL, RECONSTRUCTED, MIXED, PROXY, UNAVAILABLE), a temporal-integrity class (HISTORICALLY_CAUSAL, REPLAY_APPROXIMATION, CURRENT_STATE_PROJECTED_BACKWARD, INDETERMINATE) and provenance. The contract structurally forbids winner, score or recommendation fields.

Comparability

Two evaluations are compared only if they share the sleeve, the baseline snapshot with a row-identical baseline path, pinned revisions, window, mode, convention, cost state and evidence frame; a cross-scenario delta is published only on an identical observation set. No ranking is produced.

Authority

Read-only for operators. Scenario writes and the approve-then-promote mechanism exist in code but are held behind a default-off write flag and an unpromoted route; a promotion decision would record a decision row consumed exactly once, with operator identity and reason.

Status

Read surface served to a canary cohort of operators on the beta environment, with dated proof of use; production serving is unverified from the repository. One evaluation has been executed on real data outside the served route. Audience-tiered PDF reports of a scenario comparison are wired and tested but cannot publish on the deployed environment at the time of writing.

The scenario result is identified by a pinned revision, an evaluation identifier and a content hash of the result, so a later commit never changes a displayed number and a report request is bound to exactly what was displayed. The workspace is not a backtest and is not a replay of live decisions under alternative regime paths: no component varies the regime path, and the one replay helper reconstructs a single snapshot and applies mutations without computing exposures. A separate served history compares what the model intended with what the governed target was and with what actually happened, point in time and without look-ahead; model intent is kept distinct from the governed target and is never collapsed under an abstention.

Decision history and audit. Every read through a protected route of the application programming interface writes an append-only audit row (route, principal, operator, tenant scope, authorisation outcome, response class, reason code, request identity). Override lifecycle events, entitlement grants and revocations, scenario governance decisions and promotion decisions have governance-audit row contracts with actor, action, outcome and state class; the writer is wired for scenario governance and overrides and capable but not yet wired for several other sources. A governance-audit view is served to administrators on the beta environment. “Append-only” is a writer convention enforced in code and tests, not a storage-level guarantee.

Change records. The implemented records are: a day-over-day state difference (increased, decreased, unchanged) consumed by the AI briefing; promotion tiers LAB_EVIDENCE, PAPER_PROMOTION, PRODUCTION_CANDIDATE, LIVE_POLICY; a promotion-manifest status set (SHADOW, CANDIDATE, EVIDENCE_ACCUMULATING, PROMOTION_READY, PROMOTED, ACTIVE, BLOCKED, INDETERMINATE, REJECTED, EXPIRED, ROLLED_BACK) with decisions propose, promote, reject, hold, roll back and expire; and the evidence-posture registry of status map. A deterministic gate aggregator that returns promote, reject or hold exists for laboratory scripts; there is no committee process, and promotion in practice is a disposition memo plus an operator decision recorded in a hand-maintained ledger.

Institutional reports. A daily library of governance, portfolio and optionality reports in three audience editions, plus committee pages and a trust-evidence summary, is rendered by the governed pipeline and served to entitled operators with a content hash and a provenance sidecar. The serving edge recomputes the hash and refuses a mismatch. The hash establishes that the bytes served are the bytes rendered; it is not a digital signing of the report and no certificate infrastructure exists. Audience editions are rendering choices, not authorisation tiers: any entitled operator can retrieve every edition, and no redaction step exists. On-demand and by-key rendering lanes are present in code but disabled at the time of writing.

21. Pipeline, Artifact Contracts and Attribution

The governed pipeline is a registry-ordered sequence of stages. Each stage declares its inputs, outputs, optional outputs, configuration files, phase, run class and requirement; dependencies are derived from the declared inputs and outputs, and an unregistered stage cannot execute. The transformation chain is

Artifact contracts are not universal. Every registered artifact (several hundred) carries a criticality, a requirement per environment, a freshness cadence, a category and a tenant class. A subset of roughly a hundred carries a column, type and key contract that the sanctioned writer asserts before writing: required columns, column types, no non-finite numerics, key uniqueness, strict date types. A contract failure aborts the run and leaves the prior artifact untouched; there is no quarantine lane, and a schema failure is a run outcome, not a label written onto an artifact. Governed and production artifacts are written only through that writer; shadow learning artifacts go through a separate writer that refuses a governance run class, which is how research findings are kept out of governed output.

Attribution, not reproducibility. Four records identify what produced a run's outputs:

The run manifest \(\mathcal{M}\) is observational and declared non-authoritative; per-artifact hashes, the environment row and the validation outcomes live in three other ledgers. Together they make a run attributable (which code, which image, which registry, which outputs) and make re-execution drift detectable by comparing hashes. They do not make a run bit-reproducible: no random seed is recorded, external data series are fetched unpinned and may be revised, and the code's own reproducibility vocabulary (REPRODUCIBLE, PARTIALLY_REPRODUCIBLE, NOT_REPRODUCIBLE, INDETERMINATE) states that partial reproducibility is the current ceiling.

Pre-run and post-run gates. Before expensive computation a startup preflight checks run identity and format, run mode, run-class and directory isolation, and duplicate publication of a run identifier; a portfolio preflight fails fast before the macro stages; zero-byte outputs are refused. After the final stage a landing-coherence guard checks a canonical fingerprint over the core artifacts, cross-artifact fingerprint agreement, snapshot membership and freshness, and run-identifier coherence between the abstention series and the governance summary; in governance mode a failure stops the run, in development mode it warns. A scoped partial run without a run identifier is predicted non-coherent and labelled as partial in the manifest. A required stage failure aborts the run; an optional stage with a missing input is skipped with a reason; prior artifacts remain on disk, which is why the run-state machine distinguishes the served run, the latest attempted run and the latest successful run and reports mixed lineage and partial writes as first-class states. The deploy tooling additionally refuses a governed run whose image revision does not match the checkout.

22. Freshness and Observability

Freshness is evaluated per artifact on every run from wall-clock age against the artifact's cadence and from the latest content date, with a market-calendar grace so that a weekend or holiday is labelled rather than treated as staleness. The artifact-level closed set is

with an enforcement decision (pass-or-warn, fail, skip) that is mandatory only for the core artifacts and a run-level status of OK, WARN or FAIL. The serving layer labels what a reader sees with a second closed set: complete-current, complete-previous-close, incomplete-intraday, complete-stale, unknown, calendar-error-fail-closed, unavailable. Every response envelope carries a state class (available, stale, insufficient, degraded, unavailable) and a reason code; the truthfulness helper that surfaces consume normalises to available, degraded, stale, unavailable or unknown. When several sources feed one view the worst state wins. Cadence thresholds and grace windows are protected.

A served pipeline-observability strip reports the run state and the next action; the run-health artifact is forced to re-run so that its last-run identifier is never stale. A stale health artifact is not proof that the latest attempt succeeded; the run log index, an append-only ledger with duplicate-event rejection, is the authority for what was attempted.

23. Information Timing, Vintages and Eligibility

Observation date and availability date are different things. Macro series are fetched as the latest revised history available at run time and forward-filled to a daily grid; there is one vintage per series, so a value for period \(t\) is \(x_{t\mid v_{\text{now}}}\), not \(x_{t\mid v}\) for an arbitrary past vintage. No publication-lag alignment is applied to macro series, and the one lag-adjustment helper is a diagnostic that does not touch the governed path. The vintage notation

is therefore conceptual: the system stores no vintage index and cannot reconstruct a past information set for revised series. Historical evaluations of structural quantities are consequently exposed to revision bias and say so in their findings. Guards that do exist are narrow: portfolio targets apply a one-day implementation lag, model-versus-actual history applies a one-day decision lag, and the serving layer distinguishes a complete day from an incomplete current day.

Eligibility of an artifact for use at run time is a time-indexed predicate, not a filtration:

Because freshness is recomputed from wall-clock age on every run, an artifact eligible at \(s\) can be ineligible at \(t > s\), so the information sets are not nested in time. A stricter decision-grade gate additionally blocks stale, content-stale, missing and errored inputs from decision-grade surfaces. Eligibility for inspection on a diagnostic surface is not eligibility for policy; the admissibility map consumes only governed-lane inputs that pass the gate. Generation time, source as-of date, producing run and served revision are four separate fields: the response envelope carries the as-of date and run identifier, the manifest carries the code revision and image digest, and the health endpoint reports the served source revision with the basis on which it knows it, or reports that it does not.

24. Tenancy, Roles and Portfolio Ingestion

Identity and roles. A request carries a principal, resolved to an active operator membership and then to a tenant. Three role sets exist: a platform administrator (a role on the principal record), a tenant administrator or user (a role on the operator membership), and sleeve permissions ordered view, upload, manage, assign. There is no separate viewer role; a viewer is a user holding a view grant. Platform and tenant administration use disjoint capability namespaces asserted at source time, so a tenant administrator cannot acquire a platform capability through a tenant route.

Scope. Authorisation is sleeve-level: every application read maps to the view permission, and a producer serves only sleeves the operator is entitled to. Tenant identity derives from the operator unless the deployment declares a tenant explicitly, and the provenance of that resolution is stamped on the request. Isolation between tenants and sleeves is enforced in application code with fail-closed readers and is tested with two-tenant fixtures that use identical sleeve identifiers. An enforced tenancy routing mode exists, under which tenant-class artifacts are read only from sanctioned per-tenant mirrors; the beta environment serves in a mixed mode in which those artifacts take the legacy global path, and the per-tenant materialisation stage is registered but optional. A tenant-bound request for a fact that has no mirror fails closed naming the missing prerequisite. All of this runs on one host and in shared processes; it is process-level isolation, not separate infrastructure.

Portfolio ingestion and the customer journey. Holdings enter as exported statements from five named brokers (Questrade, TD, National Bank, BMO, Wealthsimple) in CSV, XLSX or ZIP form, with bounded workbook, size and row limits, plus one broker (Interactive Brokers) through its reporting API; an unrecognised layout is refused with a reason rather than guessed. A multi-file preview validates and shows deltas before anything is committed. Commit is a governed, default-closed write: the serving application is read-only for governed data, so a commit either queues for a processing job or is blocked with a reason. The processing job and the scoped re-analysis runner are implemented and tested but are run by an operator; neither is activated as a host service at the time of writing. Source switching between brokers is a tested command with no application route. A scoped status read model reports currentness (no data, current, stale, blocked, degraded, indeterminate), the generation identifiers in use and the actions the backend will allow, with an anti-stale token. Scoped refreshes pin the shared upstream artifacts they consumed and refuse to run if a pinned artifact changed; each scope has exactly one current generation with an append-only history and an atomic publish step that re-checks authority.

Today a signed-in user can read the global and own-sleeve surfaces; on the beta environment a canary operator can preview an upload; commit and processing involve an operator; and tenant provisioning is an operator-performed procedure using a confirm-token command, with first-login membership created just in time only for approved identities within a pre-provisioned operator. There is no self-service onboarding, no self-service analysis run and no self-service broker switch. The upload workflow, the guided tour, the tenant-administration views and several other surfaces are feature-flagged and are enabled per environment by the operator; the repository records what exists, not what is switched on.

Exports and administrative views. Institutional reports are a global library readable by any member with a view grant; there is no per-tenant report partition and no separate export entitlement. Administrative views (governance status, governance audit, provenance, platform administration, tenant registry and others) require an administrator role at render time. Tenant-administration read and mutation views exist at the served revision with their own flags and a server-side write gate that is off by default.

25. Security and Operational Controls

Each control is described at the boundary where it acts, with what happens when it fails. There is no third-party certification and no availability commitment. Internal topology is not published.

Not implemented or not evidenced, and therefore not claimed: rate limiting on the application edge, external availability monitoring that alerts anyone, a full-system restore test, a second host or site, write-once or tamper-evident log storage, and any third-party security certification.

26. AI Briefings

Measures

Nothing. A briefing is an on-demand natural-language narration of facts that governed artifacts already contain.

Inputs

A briefing type selected from a closed catalog, optionally a sleeve and a broker scope. There is no free-text question interface.

Output

A facts envelope (structured, inspectable) and, when generation is enabled, a prose explanation that is labelled ungoverned, descriptive only and not stored.

Authority

None. Every briefing route is read-only; the payload carries governed = false and not_a_recommendation = true; no briefing path invokes a governed writer.

Status

Catalog and facts routes served to entitled operators behind feature flags; live generation measured on the beta environment at earlier revisions; production generation and the October 2026 tenant-scope binding unmeasured at deployment.

Request resolution, context assembly and narration are three separate functions:

\(P\) is a dispatcher over a registry of briefing identifiers; entries are catalogued for operators unless they are administrator-only, are generatable only when a context adapter exists, and an unregistered identifier is refused before any read. \(C\) runs one adapter per source artifact \(A_i\) and returns a fixed envelope in which every fact carries a unit from a closed vocabulary, a provenance reference to the producing artifact and field, an evidence class (GOVERNED, SHADOW, SYSTEM_AUDIT, GLOBAL_REFERENCE, MIXED or INDETERMINATE), a freshness state and, where known, the producing run identity. Facts are admitted only through an allow-list contract derived from producing code; a value that violates its contract is withheld and named. \(L\) renders a versioned prompt template \(T_b\) and makes one server-side call to an external language-model provider.

Availability status is separate from freshness and lineage. The context status reports only whether the required adapters returned their required fields: AVAILABLE_CONTEXT_ONLY, PARTIAL_UNAVAILABLE_INPUTS or BLOCKED_MISSING_SURFACE, plus refusal statuses for unsupported identifiers, invalid scope and failed authorisation. A briefing can be AVAILABLE on a stale or mixed-lineage source; the freshness and evidence-class fields say so, and the prompt template is required to carry them. A template missing any of its mandatory slots (unavailable inputs, evidence class, freshness, run identity, mixed lineage among them) is refused as incomplete.

Controls before generation. In order: scope validation, entitlement check (before any artifact read; a refusal performs no private reads and names no sleeve), registration check, secret-pattern scan of the rendered prompt, unresolved-token scan, template completeness. An audit row is written for every request.

Controls after generation. The returned text is scanned for a configured list of forbidden phrases (the base list is buy, sell, trade now, target weight should be, execute, override gate, guaranteed, prediction and alpha signal, with per-briefing extensions); a hit withholds the whole text and reports only the matched tokens. A minimum-length check and a check against optimiser-recommendation language also apply. These controls are limited: the scan is a substring match, a narrow list of caution phrases is excused, and no check compares the prose against the facts. Text that avoids the listed phrases passes. Generated prose can therefore be wrong, incomplete or misleading even when every input was governed. It cannot establish a fact that is missing from the envelope, it confers no allocation authority, and it always requires human review.

External processing. Generation sends the rendered prompt, which contains fact values, artifact names, run identifiers and the selected sleeve and broker scope, to a third-party model provider over an authenticated connection. The provider, model and runtime parameters are configured server-side and are not published here. The credential never reaches the browser; a missing credential or a disabled kill switch reports generation unavailable rather than failing silently. Narratives are not persisted, so two requests for the same briefing can differ; the deterministic facts envelope above the prose is the reproducible object.

What a reader can inspect. The facts envelope, the list of sources read, the inputs that were unavailable, the semantic boundaries and forbidden inferences declared for the briefing type, and per-fact value, unit and provenance. The rendered prompt text itself is not served. The inspection view is a separately flagged surface and is documented as not enabled on the beta environment at the last dated measurement.

27. Validation Machinery and Research Programs

Experiments in the research registry carry a hypothesis, an expected failure mode, a baseline and a status from a closed set in which falsified is terminal; many registry records still carry no recorded status, and the programs below are recorded in disposition memos with their own vocabularies. For each program below, four things are kept apart: a named method; implemented evaluation machinery; a completed evaluation with a recorded result; and a conclusion that the result supports at a credible sample size. A literature citation establishes only the first.

Metrics implemented. For a binary event with forecast probability \(p_t\) and outcome \(y_t\):

These are implemented in a laboratory evaluation harness together with a Brier decomposition, reliability bins and a skill score against the base rate; precision and recall are also computed in a required governance stage over abstention episode outcomes. Miss rate is not implemented. Westfall–Young permutation p-values are registered as a shadow stage whose permutation source is not registered, so every row reports inconclusive. Multiple-testing corrections for strategy families (a reality check, a test for superior predictive ability, probability of backtest overfitting and the deflated Sharpe ratio) are registered shadow stages. Sensitivity analysis sweeps derivative method, metric and calibration window for the geometry diagnostics; embedding is frozen by the measurement contract, data vintage cannot be swept because no vintages exist, and event definition is descriptive only.

Transition forecasting (SENTINEL). A smoothed empirical hazard \(\hat{h}_t\) of label change, with a geometry multiplier, gives a flip probability under an exponential-survival assumption over horizon \(T\):

evaluated by Brier and log loss on a declared set of horizons with overlapping forward windows, which inflate effective sample size and are reported as such. Evidence class decision_relevant_but_unproven, disposition diagnostic_only. Completed evaluations to date record that the raw forecast is not calibrated, that heterogeneity across regimes is indeterminate, and that a dwell-hazard adjustment was falsified and disabled; one component, an entropy-based transitional trigger, recorded an accept at credible sample size in March 2026 with a promotion memo, while the layer as a whole stays diagnostic-only and the observatory remains governance-blocked. No forecast is read by the exposure policy; a forecast-derived abstention advisory is consumed by the permission resolver only as an annotation that fails closed to indeterminate until an approved persistence source exists. A prospective accrual ledger records forecasts as they are made so that future evaluation does not rely on reconstruction.

Measurement quality (HEDGEHOG). Governance-lane stages measure precision of the abstention episodes, horizon sensitivity, a separation audit and latency-persistence of the labels, feeding an integrity-health route. It is a measurement program, diagnostic only; it promotes nothing.

Stress-window labelling and surface disagreement (TICM, WS7). A locked table of historical stress windows supports a shadow replay of tactical behaviour in those windows; it is shadow, not live labelling. Surface disagreement between two classification surfaces on those windows is a research track whose recorded findings are all indeterminate.

Hidden Markov comparator. A hidden Markov overlay runs as an advisory stage, is write-gated to the shadow lane and is registered mechanically_valid, not_promoted, with a disposition memo recording a null result at credible sample size. It is an anchor for what a non-promoted diagnostic looks like, not a candidate for the production label.

Strategy-family evaluation. A candidate trend and momentum context was tracked through a pre-registered forward track, reconstructed historical evidence (labelled as replay, never as forward evidence) and live-portfolio context. The forward track closed on 26 July 2026 as inconclusive and not evaluable after seven forward trading days, when an upstream change in return basis broke comparability; a continuation contract exists and no continuation artifact has been produced. The multiple-testing stages have run on the abstention-overlay family, not on that context, and recorded no promotion: the family was not found superior under the test for superior predictive ability, and the backtest-overfitting disposition likewise recorded no promotion; the deflated Sharpe stage has not emitted. The alpha-evaluation layer is mechanically_valid, diagnostic_only, and its recorded verdicts on every active overlay are negative.

What the results establish. Three kinds of outcome are kept distinct. A hypothesis contradicted by a valid test: the dwell-hazard adjustment to the transition forecast was falsified in a dated laboratory evaluation on historical data and was disabled. A result that establishes no advantage: the hidden Markov overlay returned a null at credible sample size, and the abstention-overlay family was not found superior under the test for superior predictive ability. An experiment that cannot support a conclusion: the momentum forward track closed after an upstream change in return basis broke comparability, so it neither confirms nor rejects its hypothesis. None of these results, and none of the engineering controls described elsewhere in this specification, establishes that ATLAS improves investment outcomes; that claim is not made.

Promotion. A layer moves between evidence classes or dispositions only through a disposition memo and an operator decision recorded in a hand-maintained ledger (two entries to date, both from February 2026 and both past their outcome-review date); promotion tiers (laboratory evidence, paper promotion, production candidate, live policy) and a manifest status set record where a candidate stands, and the allocator promotion machinery is frozen with no live promotion recorded. No model receives decision authority by default. The evidence-posture registry is read by a served trust route, but the operator view currently renders only a layer count behind a feature flag. Inconclusive and falsified results stay in the repository's research record and are not rendered on a customer-facing surface.

28. Estimation, Calibration and Uncertainty

The structural classifier has no estimated parameters: its weights and thresholds are declared (see structural state). Estimation in ATLAS happens in the research and shadow lanes, where a parameter \(\theta\) is fitted on a declared calibration window and judged on a disjoint evaluation window:

Minimum-sample guardrails are set per helper rather than by one global constant: an out-of-sample surface, a calibration-impact assessment, a conformal coverage check and a structural calibration ledger each return an insufficient-history or insufficient-evidence verdict below their own floor, and one of those floors counts realised regime flips rather than days. Parametric confidence intervals, bootstrap interval estimation and spline smoothing are not part of the live estimation stack; a block bootstrap is used only for the forward loss simulation in the risk analytics. Where a research finding reports a holdout, the finding also reports any contamination it detected between the calibration and evaluation windows.

29. Limitations and Model Risk

• The regime label is a declared rule over standardised scores; it is not estimated, not validated on a holdout, and can be wrong for extended periods when the relationships that motivated the weights change.
• Macro inputs are latest-revised series without vintage history; every historical evaluation of structural quantities is exposed to revision bias.
• Confidence objects are normalised scores, not calibrated probabilities; the one that drives abstention depends on a whole-sample normaliser and is documented as a heuristic.
• Two of the three abstention triggers derive from one upstream series; the trigger set is less diverse than its names suggest.
• Geometric quantities depend on an assumed Euclidean metric over standardised axes, on finite differences without smoothing and on windows that need history; they are diagnostics and are unstable at low speed.
• Transition estimates describe the observed label sequence under an implicit stationarity assumption; they are not a predictive model and the forecast program's dated results are negative or indeterminate.
• Value at risk and expected shortfall are bootstrap simulations conditioned on the current regime; they cannot contain losses that history does not contain.
• Allocation targets are rules-based decision support; the shadow optimisers are long-only bounded quadratic programmes on a filtered universe and carry no authority.
• Protection planning prices premia from a rate table and values payoffs at gross intrinsic value at a proxy spot; it is not executable, not insurance and not a guarantee of protection.
• Abstention is evaluated after the fact at pre-registered horizons; a favourable outcome label does not establish that a loss was avoided, an unfavourable one does not establish that caution was irrational, and immature or unavailable economics are reported as such rather than as zero.
• Runs are attributable, not bit-reproducible; drift is detectable, not prevented.
• Tenant and sleeve isolation is application-level on shared infrastructure; audit logs are append-only by convention, not tamper-evident by storage.
• Generated narratives can be wrong even with governed inputs and always require human review.
• Stale data, missing inputs and governance latency restrict what the system will support; that restriction has a cost, and the cost is not measured in every case.
• Several served surfaces are available only to a canary cohort or behind feature flags; what is implemented and what is enabled are recorded separately in the status map.

30. Non-Claims

ATLAS does not assert a positive expected return conditional on its information, \(\mathbb{E}[\,r_{t+1} \mid \text{information at } t\,] > 0\), and it does not define its action as an unconstrained maximisation of expected utility, \(a_t = \arg\max_a \mathbb{E}[U(W_{t+1})]\). It defines an admissible action set

and reports when that set is empty. The objective is exposure governance under uncertainty, subject to validation, operator scope and layer separation; it is not return maximisation and not a prediction of the next regime. ATLAS has not been independently audited, certified or assessed against an external standard, and no performance record, assets figure or customer reference is published.

31. Notation

Symbols used in this specification. Status is the implementation lane of the object the symbol denotes: LIVE (governed lane), SHADOW (diagnostics or shadow lane), RESEARCH (research code only), CONCEPTUAL (explanatory definition, not produced), DEFERRED (planned, not implemented).