Decisions that
prove themselves.
A deterministic, auditable decision primitive for high-stakes routing and guardrails.
Scroll to watch a decision get proved ↓
Give the kernel a frozen catalog, a policy snapshot, and a typed request.
It evaluates every hard constraint — budget, risk, latency, region, capability — and picks the one eligible action.
Out comes the decision, and an audit bundle that replays to the same answer.
Every digest is pinned by a written contract. An auditor can verify the whole trail without ever running your engine.
Log grep is not proof.
When a routing decision costs money or breaks a rule, "the service picked B" is not an answer. Post-mortems and compliance need to know which policy was live, what the input was, and whether the same inputs still produce the same action. Most systems can only offer logs — a story about the decision, written by the thing being audited.
Catalog, policy, request — in. One action plus proof — out.
You bring the catalog: suppliers, models, venues. The kernel evaluates hard constraints, picks the best eligible candidate, and emits digests you can replay and verify offline. Integer-only Rust hot path, no hosted dependency, no unsafe in project code.
catalog + policy + request -> decision + audit bundle
Three mappings, not three products.
Supplier routing, model routing, and pre-trade admission are reference mappings onto one API. Calybris is not an OMS, not an LLM gateway, and not a matching engine — it is the decision kernel those systems call.
Supplier routing
Pick the eligible supplier under budget, region, and capability gates.
Model routing
Route to the model that satisfies cost, latency, and capability constraints.
Pre-trade admission
Admit or reject an order against hard risk and budget limits.
The proof format is a contract, not an implementation detail.
Calybris binds the full decision path: policy digest, input digest, decision digest, replay result. Since 0.5.0 every digest and chain byte is specified in CALY_PROOF.md, golden vectors pin them across versions and platforms, and the bundled calybris-verify CLI lets an auditor check a decision trail — chain integrity, digests, and full kernel replay — without ever running your engine.
policy digest + input digest + decision digest + replay result
The Rust core is the contract.
Rust owns correctness and replay semantics; calybris-core on crates.io is stable and is the thing you build against. The Python packages are ergonomic entry points for integration and demos — experimental and pre-1.0. Mature them in your stack before treating them as production infrastructure.
Proof at both ends of the pipeline.
ProofFrame proves your data: canonical fingerprints, contract validation with row-level evidence, and signed receipts. Calybris proves your decisions: policy-bound digests and offline replay. Both are Rust with Python bindings, both Apache-2.0, and both emit evidence instead of asking for trust.
Five minutes to a replayed decision.
cargo add calybris-core
The quickstart example builds a two-model policy, prescribes one request, verifies replay, and prints an audit bundle. Apache-2.0, MSRV 1.85.
Running Calybris somewhere it has to hold up? Commercial support and SLA options are available — emirhuseyin@calybris.tech.