Three diagrams: where Layer 0 sits, how a single decision flows, and how anything reaches it. They mirror the reference architecture the field is converging on (Van Tran et al., arXiv:2608.12172) — made concrete, running, and scoped to exactly what is true today.
Layer 0: acceleration above, boundary below. Authority enters at exactly one point, and it is a human's.
The agent loop runs fast and probabilistic above; Barycenters sits beneath it as a deterministic Layer 0. Before a proposed action settles, it is adjudicated — default-deny — and returned as a signed verdict. A human binds the boundary; the runtime never does.
→The honest seam: Barycenters adjudicates and signs; it does not itself block. Enforcement is the caller's posture and today runs in shadow (records, does not block) — authority_effect 0. "Shadow earns enforce" is the design, not a gap.
Inside /admit: every proposed action passes the no-kill floor, is canonicalized to stable bytes, checked default-deny against authored permissions, then signed. The receipt is offline-verifiable and appended to a tamper-evident chain. Same inputs, same signed verdict, forever.
→Deterministic: same inputs → the same canonical bytes → the same signed verdict, every time. A REFUSE is signed too — an honest denial is also a proof. authority_effect 0: this decides, it never binds.
Every path is a thin client of one signed decision at /admit. SDKs, MCP, and the DeepSeek Harness adapter are conveniences over the same standard — and anything not yet listed still reaches the boundary, because the standard is the outlet, not a catalog.
→Honestly scoped: /mcp is live; the DeepSeek Harness adapter is config + a boundary-hook dropin in developer preview (no adoption data claimed). Adapters are conveniences — the product is the signed decision.