The logical backend, end to end
An immutable observation log, a bounded logic engine, a contract layer humans approve, and a Studio that debugs by provenance instead of print statements.
Production feeds development. Deterministically.
When a contained agent misbehaves in production, the misbehavior becomes a checked artifact — not a war-room story. One artifact chain, both directions.
- 01
Provenance pins the cause
Follow the line backward from the bad intent to the exact observations that produced it — without reading generated logic.
- 02
The counterexample becomes a fixture
Promote the pinned timeline into a deterministic Scenario. It now fails, permanently and reproducibly, until the behavior is fixed.
- 03
An authoring agent iterates
Your coding agent regenerates rules until the fixture passes — against the real evaluator, with a deterministic oracle instead of vibes.
- 04
Verification confirms the fix
tarski verifyre-checks the whole corpus and every invariant. You approve evidence, not a diff of internals.
Nothing is forgotten. And it costs S3 prices.
The observation log is the canonical truth, so it is kept forever: sealed, content-addressed segments on object storage, laid out by the ontology itself. Semantic indexes let queries skip what they can't reach.
Provenance chains, replay, and audits reach into cold history through the same indexes. The hot set is bounded by what the semantics can touch — not by how much history exists.
o#1039 chat.msg "any wiggle room on price?" o#1040 proposal.offer tahoe · $31,400 ← llm o#1041 policy.floor tahoe · $33,900 o#1042 mgr.confirmed discount_request ✗ no ───────────────────────────────────────────── intent send_offer($31,400) refused · violates no_offer_below_floor ⊨ model consistent · log sealed · replay exact
The walls are not guidelines
You declare the states the business must never reach. The engine evaluates every proposed transition against them — at every fixpoint, before anything touches the world. A violating transition isn't flagged for review. It doesn't happen.
This is why it doesn't matter how a stochastic model arrived at a decision. Tarski evaluates whether the output is logically sound — and refuses it if it isn't, with a receipt naming the invariant.
Free inside the sandbox
Runtime LLMs work behind two relay surfaces. Fallible sensors write candidate.* facts; fallible deciders write proposal.* actions. Neither becomes truth or effect until a rule you wrote — and can inspect — promotes it.
No rule may derive an accepted fact or executable intent directly from a fallible tool's output. That is a property of the logic fragment Tarski accepts — not a prompt, not a policy model.
The zero-code debugger
Every derived fact carries explicit edges to the observations that caused it. In Studio, debugging an agent is following a visual line backward — from effect, to intent, to facts, to observations. The generated rules never need to be read.
rule r14 read the confirmation's presence, not its value — promote this timeline to a fixture and hand it back to the agent.
Effortless for the agent you already use
Tarski doesn't ship a coding agent. It ships the docs, skills, and machine-checkable feedback that let Claude Code, Codex, Devin, or any capable agent scaffold, author, verify, and ship — without Tarski needing to be the agent.
Pattern-aware starts
Chat, sensor, and decision patterns land as minimal real apps whose first verify is green.
A deterministic oracle
Tactical feedback for every generated rule: scenario results, invariant checks, and load-time gates the agent iterates against.
Strategy, checked too
Module maps, composition verdicts, and coverage reports give agents machine-checkable answers to "how should this system be split?" — boundaries computed from the ontology, not negotiated.