How AITS works

The model produces, the engine validates. In AITS 3 the specification of the method, the engine that enforces it and the adapters for each runtime live apart, so when you change model or environment the rules stay the same.

Four-layer architecture

The specification describes the method without naming vendors and the engine applies it without calling models, while the adapters bring everything into Claude Code, a skill or an MCP client. Which model serves each tier is set in the configuration, which stays yours.

spec/                 the method: agents, rules.yaml, graphs, schemas, references, playbooks (no vendor names)
packages/core/        aits-core: the engine (validator, rules and gates, log, memory, calibration, export)
packages/cli/         aits CLI, aits-mcp server, runtime hook, A2A endpoint, adapter builder, eval harness
plugins/aits/         Claude Code adapter (generated from spec/)
skills/aits/          Agent Skills adapter with the engine as scripts/aits.mjs (generated from spec/)
aits.config.yaml      yours: which model serves each tier, memory embedder, signing key

Inviolable rules

Declared in spec/rules.yaml and evaluated by the engine after every output, in every human oversight mode.

Rule	Condition	Effect
R1	An agent other than the Meta-Orchestrator carries a decision	Output rejected, blocking gate
R2	An agent reports a high-impact data gap	Analytical must run again, blocking gate
R2a	Analytical reports a high-impact data gap	Blocking gate
R3	Critical-Validator finds severity of 10 or more	Ethical-Governance or Predictive-Strategic must run, blocking gate
R4	Critical-Validator says stop and Optimizer says go	Ethical-Governance must arbitrate, blocking gate
R5	Creative-Generative proposes 4 or more options	Foresight must run, advisory gate
R6	Ethical-Governance finds a red line	Blocking gate
R7	The same agent fails schema validation twice	Blocking gate
R8	Any agent raises a blocking hitl_flag	Blocking gate

Human gates

At a gate the person can answer proceed, provide_context, override or abort, and an override needs a justification and caps the final confidence. Every answer is recorded with the channel it came through: the form the MCP client shows directly to the user (elicitation), the command line, an A2A system, or the person's words relayed by the model.

The last channel exists for sessions with nobody in front of the screen, such as scheduled runs or claude -p, where the form gets no answer. The engine accepts a relayed answer only when it contains the person's words and marks it as agent_relayed, while an explicit decline of the form keeps the gate open.

Oversight modes

supervised: the person reviews and can redirect after every agent.
autonomous: the system runs on its own and stops at mandatory gates.
review: the system completes the analysis and the person reviews everything at the end.

the inviolable rules apply the same way in all three.

Computed confidence

The confidence shown to the user starts from the weakest critical input, drops to low for an agent whose past forecasts do not beat the base rate, is capped at medium when all outputs come from one model family (or families are not declared) and is capped at medium after a human override. The report shows the confidence declared by the orchestrator next to the computed one, with the reasons.

Model diversity

A Cornell study presented at ICML 2025, Correlated Errors in Large Language Models (arxiv.org/abs/2506.07962), observed that on one of the leaderboards analysed two models that get the same question wrong pick the same wrong answer 60% of the time, with higher correlation between models from the same developer. This is why the agents that estimate risks and probabilities run several times independently, on different model families when configured, and their positions are aggregated without debate: median of numbers, count of positions and a minority report that keeps whoever disagrees.

Memory and calibration

Every closed decision stores its predictions, the ones declared by agents plus risks with severity 10 or more and scenario probabilities, and when the outcome arrives you record it with aits outcome. The engine computes the Brier score by agent, model family and tier, and from twenty resolved predictions per agent it starts recalibrating them on its own.

aits recall "<query>": finds similar past decisions by meaning, not by tag
aits outcome <decision> <prediction> 0|1: records what happened
aits calibrate: reports Brier score, skill over the base rate and reliability
aits patterns scan: proposes new archetypes from clusters of three or more similar decisions, which a person approves or rejects

Verifiable log

aits export writes report.md, envelopes.json, log.jsonl, verification.json and trace.otlp.json, an OpenTelemetry trace with structure and hashes but no content. With aits keys generate and a key in the configuration every log line is signed with Ed25519, and any later edit breaks the chain at a precise point.

Try tampering with a log in the demo