A reusable research engine, built to replace Perplexity and Firecrawl for owner research. The model plans the source lanes; deterministic workers run the crawler and browser-actor jobs, write a provenance receipt for every fetch, and produce a decision packet, so a model never mistakes fetched content for truth.
The same manifest always produces the same queue hash. Every fetch is a receipt.
Generic agents blur source collection, reasoning, and claims. That makes it easy for a model to mistake fetched content for truth, browser state for verified evidence, or research output for authority.
The substrate separates planning from execution. A reviewed manifest defines each lane; deterministic code builds a file-backed queue with a stable job hash; resident workers claim jobs; a crawler plane and a browser-actor plane run bounded tasks and write a receipt per job. Hard blocks stop secrets, outreach, payments, CAPTCHA evasion, and any source-truth conclusion from leaving the machine.
A manifest compiles to a plan packet and a deterministic queue hash. Two execution planes, crawler and browser actor, claim leases and run bounded jobs. Outputs land in a receipt ledger, fold into a runtime decision packet, and stop at a review-only promotion lock.
A worker tries to promote fetched content directly into a factual conclusion.
expected: blockedPromotion lock holds; output stays review-only with a claim boundary.
unsafe claims = 0Research becomes reproducible infrastructure: the same manifest produces the same plan, the same hash, and receipts a reviewer can audit, not a model's recollection.
Long-running production worker uptime receipts and source-terms review per lane before any promotion beyond review-only.