TL;DR
- 01The deepest design decision in the capsule engine: models propose, they never write. Every model output is a typed proposal; only a named human decision promotes it into the capsule.
- 02This is not caution theater. It is what makes the resulting object warrantable — and it produces, as a side effect, a complete record of machine suggestion versus human judgment.
- 03Rejections are kept. What was considered and declined is part of the knowledge, and the next analyst inherits it.
- 04The boundary is enforced architecturally (separate artifact types, schema-validated, with review gates between them), not by prompt instructions.
The capsule engine’s deepest design decision: no code path from model output to capsule content that does not pass through a named human decision. Why this beats autonomous memory for institutional work — and why rejections are kept.
The boundary, concretely
In the DIALECTICA pipeline a model reads a content-addressed source pack and emits extraction proposals: candidate claims, episodes, graph edges, ontology terms, reasoning devices — each a typed record with confidence and source spans, in its own artifact. A human reviewer then issues decisions: approve, approve with caveats, reject — per record, with role and reasoning recorded. Only promotion, a deterministic step that consumes decisions, may move content into the canonical ledgers. There is no code path from model output to capsule content that does not pass through a decision record.
Why not autonomous memory?
The competing pattern — agents that write their own long-term memory — optimizes for a different problem. It is the right call when the cost of a wrong memory is low and volume is everything. In institutional knowledge work the cost structure is inverted: one ungated wrong claim in a brief that reaches a principal can cost more than all the time the automation saved. Self-written memory also compounds: systems consuming their own unvetted outputs drift in ways that stay fluent while becoming false.
The proposal boundary buys the best of both. Machine breadth — models read everything and miss little. Human warrant — nothing is promoted without a name attached. And honest provenance: the capsule can always answer “did a person check this?” because the answer is a record, not a recollection.
Review as the product, not the tax
- ▸Each decision enriches the object: caveats become standing warnings; rejections document the considered-and-declined.
- ▸Trust tiers emerge from review, and runtime rules act on them: assert T1, attribute T2, hedge T3.
- ▸Open questions left by the reviewer travel with the capsule — the next analyst starts where judgment paused, not from zero.
- ▸The review ledger is the audit institutions keep asking AI vendors for, produced as a byproduct of normal work.
SOURCES
- [1]TACITUS (2026). DIALECTICA — the capsule engine.
- [2]Shumailov, I. et al. (2024). AI models collapse when trained on recursively generated data. Nature 631.The self-consumption failure mode, at training scale; the same logic applies to self-written memory.
