Barycenters / Shadow tape
Customer Zero · shadow mode

We run inside our own boundary. In shadow.

The runtime adjudicates every consequential action against a signed policy — and binds nothing. That isn't a limitation; it's the honest first posture. The record of what it would have refused is the case for turning enforcement on. This is that record. Every decision is inert: authority_effect = 0.

Decisions
—
reached a signed decision
Accepted
—
a signed capability token
Refused
—
the near-misses, below
connecting… reading /metrics
The refusals are the report

A refusal costs nothing — and tells you the most.

Every REFUSE the runtime has reached, grouped by reason, live from /metrics. In shadow these stopped nothing; they are the exact decisions that, under enforcement, would have. The refusals earn the right to bind. See the whole operator board on the status board →.

Refusals by reasonGET /metrics
connecting to the runtime…
Connecting…
Reproduce the tape

These are the exact strings. Run them against the live runtime.

Six canonical cases — the ones CI re-runs against the service so this page can never drift into a claim the substrate no longer honors. Each shows its canonical expected outcome; press Verify live to send the exact string to the live runtime at api.barycenters.ai and see the real decision. Nothing binds — authority_effect = 0 on every one.

Fail-closed, not fail-open

When Lumen understands the actor and class but can't express a clause, it refuses to compile rather than drop it — because dropping a clause would widen the boundary beyond what you asked for. The safe default is the smaller grant, never the larger.

The one boundary a human may not author

A grant to use or create a lethal capability does not compile, and no consequence class overrides it — it sits above any signature. This is the No-Kill floor, probed on every readiness check. See it live on the status board.

Shadow is a feature, and the record is how it graduates. The service issues signed admission decisions; whether a REFUSE actually stops an action is the caller's posture (e.g. ADMIT_ENFORCE in the consuming job), and it is read once from /readyz.binding_posture — adjudicates: true, binds: false, authority_effect: 0. Enforcement is earned by this tape and turned on by a human, at exactly one point. Until then, every decision here is a rehearsal you can verify: re-check the whole chain at the public ledger, or verify a single receipt with the public key alone.
The primitive is live

Author your own rule. Watch it decide.

Every case above is one you can change. Write your kind of boundary in plain language, send it in shadow, and get a deterministic decision back — signed, inert, and yours to verify.

Try your own rule → See the status board Verify the chain

shadow mode · a REFUSE is never billed · authority_effect = 0 · enforcement enters at one human point