Assurance & coverage
What we don't prove.
Every honest graphic shows where the data stops. This page is the equivalent for a trust product: the boundary of what the Crux Daemon can and cannot establish, written down before a buyer, an auditor or a sceptic asks for it.
We publish it because a claim is only worth what its limits are worth. If you find a statement anywhere else on this site that contradicts this page, this page is the one that is true. Tell us and we will fix the other one.
01 · the matrix
Per event class: captured, bypassable, unproven.
The first question a serious reviewer asks is never what do you capture. It is what can bypass capture. So that column is here, in the middle of the table, in the same weight as everything else.
| Event | What is captured | What can bypass capture | What the receipt does not prove |
|---|---|---|---|
| A fact written to local memory | The value, the writer's passport, the time, the hash chain position, and an Ed25519 signature. | Nothing. The write goes through the daemon or it does not happen. | That the fact is true. A mistaken or compromised writer can put a false fact into a perfectly valid chain. |
| A retrieval an agent performed | The query, the evidence returned, the token budget it ran under, and the coverage score. | Anything the agent read outside the daemon: a file it opened directly, a page it fetched. | That the retrieved evidence was the only evidence the agent used. |
| A tool call or file write by a cloud agent | What the agent reported through MCP, and any action it routed through the daemon. | Direct calls to the model vendor's API, and any shell the agent ran outside a governed path. | That the agent did what the record says. Today's receipts are self-signed and local: they are a verifiable record of what was stored and retrieved, not third-party attestation of conduct. |
| A capability grant or revocation | The token minted, its scope, its expiry, and the revocation event with its time. | Credentials the agent holds that were never minted as RCX capabilities. | That every holder has stopped using it. Local revocation is immediate; fleet-wide propagation across machines is roadmap. |
| The cost of a session | Per-agent and per-verb cost, priced at the moment it happened and signed so it cannot drift. | Spend on vendor surfaces the daemon never sees. | A complete bill. It reconciles what passed through the daemon, and says so. |
The gap we will not paper over
The receipt we have not built yet
The honest bar for evidence is a receipt an external party captures, so a compromised agent cannot write its own history. Today CueCrux mediates only local models. An Anthropic and OpenAI capture path is the largest single build on our roadmap, and until it ships we will not use flight-recorder language.
02 · the sentences we will not write
Five claims we have banned ourselves from making.
These are held as content rules on our own marketing. Each one is a thing we could plausibly say, that a careful reader would eventually catch, and that would cost more in credibility than it could ever earn in signups.
neverReceipts prove what your agents did.
insteadReceipts are a verifiable record of what was stored and retrieved.
A self-signed local chain is tamper-evidence, not attestation of conduct. A mistaken or compromised writer can put a false fact into a perfectly valid chain. The forgery-resistant version needs an external capture path, and that is a build, not a claim.
neverSemantic search, out of the box.
insteadBM25 and graph retrieval out of the box. Dense retrieval is free, uncapped, and off by default.
The local dense lane needs an embedder you supply, and Ollama will do. We are not going to describe an opt-in as a default.
neverA state-of-the-art memory benchmark score.
insteadNumbers carry their corpus and their commit, or they do not appear.
Our best LongMemEval-S figure was banked through a gated-tail splice and has never been run end-to-end on the live backend. Quoting it bare would be exactly the confident-synthesis-from-stale-evidence failure this product exists to prevent.
neverEU AI Act compliance today.
insteadThe Article 9/10/12/13/14/15/50 mapping exists and the mechanisms are shipped. The packaged compliance product is a 2027 track.
The matrices are real and you can read them. The SKU is not, and pretending otherwise would be the one lie a compliance buyer is professionally equipped to catch.
neverIt captures everything automatically.
insteadWrites are deliberate today. Gated auto-extraction, with candidates surfaced for review and never blind-written, is roadmap.
The field's largest memory vendor audited its own auto-capture and found 97.8% junk in 10,134 entries. Automatic capture without a review gate does not help you; it poisons you slowly and confidently.
03 · check it yourself
None of this requires trusting us.
The verifier is offline and ships in the box. The custody audit scores a running daemon against the exit test using its actual runtime flag state, not its documentation. Both will happily tell you something is wrong.
corecruxctl receipt verify --all --strictcorecruxctl context-custody-audit