# Compiling Agent Logic: Deterministic LLM Reasoning via Bitwise Hypergraph Linting
**Charles Prosper**$^{1}$ · **Tomohiro Takeda**$^{2}$ · **Josh Passenger**$^{1}$
$^{1}$ Amazon, Brisbane, Australia — [cpro@amazon.com](mailto:cpro@amazon.com) · [jospas@amazon.com](mailto:jospas@amazon.com)
$^{2}$ University of Toyama, Japan — [takedat1@ems.u-toyama.ac.jp](mailto:takedat1@ems.u-toyama.ac.jp) · [researchmap.jp/takedatmh](https://researchmap.jp/takedatmh)
**Keywords:** Hypergraph Query Engines · Ontology Discovery · Dempster-Shafer Theory · Guarded Fragment · Information Knowledge Language (IKL) · SIMD Execution · AI Agents
**Interactive artifact:** the engine compiled to WebAssembly, runnable in-browser with no server — [hf.co/spaces/cp500/steeldb-ontology-sensing](https://huggingface.co/spaces/cp500/steeldb-ontology-sensing)
---
## Abstract
Some of the highest-stakes corpora in an enterprise are not transactional records at all. They are **append-only ledgers of observations** — market signals, government filings, field reports, sensor telemetry — where an entry is never deleted or corrected, where any individual entry may be a lie, a diversion, or an honest error, and where the structure worth knowing is *latent*: nobody labelled it on the way in. The operative problem is therefore not retrieval but **feature discovery under adversarial uncertainty**, and the standard primitive fails at the first step: a subject-predicate-object triple asserts that its content is true, which is precisely the claim one cannot make about an observation.
This paper introduces **SteelDB**, an engine that treats the database as a strict, compile-time linter and deterministic execution sandbox rather than a passive storage graph. Observations are projected on ingest into **reified hyperedges** — $n$-ary situations carrying entities, semantic roles, units, time, location, and an explicit **four-level polarity** (denied / doubted / hedged / asserted) recording how strongly the source commits to the content — so that deception is representable as data instead of contaminating the store. Every dimension of the vocabulary becomes a column in a compressed Roaring Bitmap, yielding an **orthogonal, disentangled logical embedding**: unlike a dense RAG vector, each column means exactly one thing, so first-order logic can execute directly on the embedding as set algebra. Agents never write queries. They state an intent in natural language; a small planner compiles it to an **S-expression AST in an extended Information Knowledge Language (IKL)** — `not`, `and`, `or`, `if`, `iff`, `exists`, `forall`, plus wildcards and role inversion — which is type-checked against the closed vocabulary before a single bit is touched. Surviving rowsets are then handed to **filter-first $s$-path** traversals over the induced sub-complex, which is where latent categories, topologies, and spatial structure are actually recovered, and to **Dempster-Shafer** evidence bounds, which keep ignorance distinct from conflict and refuse to fuse fundamentally incompatible sources — computed here as a weighted population count over the polarity bitmaps, so that combination is counting rather than inference and costs no more than any other filter. The **Guarded Fragment of First-Order Logic** bounds the whole search at $O(N/W)$. Because the resulting artifacts are compressed bitmaps and sub-gigabyte models, the system deploys serverlessly over object storage or runs entirely client-side in WebAssembly. Across our evaluation, bounding the agent inside this static-analysis layer reduces token consumption by up to **96%** and effective schema hallucination to under 1%.
---
## 1. Introduction
A fundamental rift exists between graph theory in academic literature and the reality of enterprise application data. Benchmark graph architectures are heavily evaluated on homogeneous, binary datasets — toy networks like Zachary's Karate Club or simple citation graphs — where relationships are reduced to unannotated two-node tuples $(u, v)$. In real-world operational environments, however, data never occurs as isolated pairwise links. Enterprise signals — whether in multi-tier supply-chain planning, automotive concept optimization, or tactical execution — exist as rich, high-arity *situations*: simultaneous alignments of actors, semantic roles, physical artifacts, temporal bounds, and logical rules firing as a single unified event.
### 1.1 The Problem: Latent Structure in an Append-Only Ledger of Contested Observations
The workload that motivated this engine is not a transactional one, and the distinction is load-bearing for every design decision that follows. Our users hold corpora of **observations**: what a market did, what a government actor announced, what a counterparty claimed, what a sensor reported. Three properties separate this from the workload a relational or graph database is built for.
**Observations are append-only.** An observation is a record that something was observed, and that remains true forever even when its content is later shown to be false. Nothing is deleted; nothing is updated in place. A retraction is a *new* observation that denies an earlier one, and both persist. The ledger only grows, and the vocabulary grows with it.
**Observations may be deceptive.** In market and geopolitical settings a proportion of the corpus is lies, diversion, or motivated error, and which proportion is not known in advance. This breaks the subject-predicate-object triple as a primitive: writing $(a, R, b)$ into a store *asserts* $R(a,b)$ holds, which is exactly the commitment one cannot make. Any honest representation must separate the fact that a source asserted something from the question of whether it is so — and must be able to hold $\langle\!\langle R, a, b; 1 \rangle\!\rangle$ and $\langle\!\langle R, a, b; 0 \rangle\!\rangle$ simultaneously, from different sources, without the store becoming inconsistent.
**The structure worth finding is latent.** Nobody labels an observation stream on the way in. The categories, the topologies, the spatial and temporal regularities — these are what the user is trying to *discover*, not what they already know how to filter on. The task is closer to feature engineering than to querying: recover the organising structure of a corpus, then reason over it with logic strong enough to be trusted.
From these three properties we derive four concrete design goals, which the remainder of the paper addresses in turn:
1. **Keep agent context windows bounded (§2, §7.2).** An agent handed direct database access must first learn the data model — customers routinely resort to passing in traces of known-good queries — and then accumulates intermediate rowsets in-context for planning and synthesis. We first tried existing systems, including a high-level logical language compiling to SQL/Cypher that returned only aggregate graph summaries so the agent could learn the schema cheaply. The residual problem is that dense-vector retrieval is *entangled*: no column has an independent meaning, so `NOT` is not expressible. This motivated a logical embedding in which every column is a membership bit for one reified relation, entity, or unit (§1.4).
2. **Represent contested $n$-ary observations natively (§1.2, §1.3).** Project each observation on ingest into a reified hyperedge binding $n$-ary participants with explicit roles and an explicit polarity, over a closed vocabulary fixed at ingest and extended only by append.
3. **Let users state logic, never queries (§6).** Extend IKL with the operator set practitioners actually need — `not`, `and`, `or`, `if`, `iff`, `exists`, `forall`, wildcard `*`, and role inversion — and have a small planner emit the S-expression, type-checked against the live vocabulary, so neither the agent nor the human writes anything the engine can reject at runtime.
4. **Index and query at scale on commodity serverless infrastructure (§7.3).** Roaring bitmaps compress to artifacts that sit in object storage and load into short-lived functions; the projection and planning models are small enough to co-locate with them, or to run entirely in the browser under WebAssembly.
When traditional graph databases force these high-arity situations into binary edges, an AI agent attempting to answer an operational question must trace pointer paths across a web of interconnected nodes. If a query passes through a high-degree node (a "supernode" like a CEO, a major geographic region, or a standard part specification), the search space explodes exponentially across thousands of irrelevant links. Navigating this web is computationally expensive, prone to schema hallucinations, and rapidly exhausts the LLM's context window.
```
Traditional Graph (Pointer-Chasing) SteelDB (Event-Based Signal)
[ Alice ] Situation sid=42 (Reified Hyperedge)
| | +----------------------------------+
EMAIL | | DEPT | org/alice |
v v | org/bob |
[ Bob ] ---> [ Charlie ] | org/charlie |
(Supernode Explosion) +----------------------------------+
(Flat 1D Bitwise Intersection)
```
### 1.2 The Paradigm Shift: Reified Hyperedges
Instead of drawing lines between individual nouns, SteelDB asks a fundamentally different question: *"Did Alice, Bob, and Charlie all participate in Event #42?"*
We stop chasing individual binary connections and focus entirely on the **Event**. If all three entities participated in Event #42, they are intrinsically connected by that shared signal. In database theory, wrapping multiple participants into a single, unified event container is called a **reified hyperedge**. Rather than a line connecting A to B, a reified hyperedge acts as a topological boundary that circles any number of entities at once — a supplier, a geographic region, a component artifact, and a timestamp — binding them to a single signal.
### 1.3 Grounding the Engine: Situation Theory vs. Synthetic Benchmark Graphs
To build an architecture for real-world enterprise software, SteelDB explicitly grounds its data model in **Situation Theory** (Barwise & Perry, 1983). Rather than storing abstract topology, SteelDB treats the database as a ledger of discrete situations $\mathfrak{s}$, where a situation supports a set of structured infons:
$$\mathfrak{s} \models \langle\!\langle R, a_1, \dots, a_n; i \rangle\!\rangle$$
where $R$ is an $n$-ary relation, $a_1, \dots, a_n$ are domain objects occupying specific semantic roles, and $i$ is the polarity. Classical Situation Theory takes $i \in \{0, 1\}$. We widen it to four levels, $i \in \{-1, -\tfrac{1}{2}, +\tfrac{1}{2}, +1\}$, for reasons developed in §4.1: a single bit records only that a document mentioned something, and cannot separate *said no* from *said maybe* from *said yes*.
Situation Theory is the right foundation here precisely because of that last term. An infon is not a truth claim about the world; it is a claim about what a *situation supports*. The polarity $i$ carries the assertion separately from the content, so a source alleging $R(a,b)$ and a source denying it are two well-formed infons over the same relation rather than a write conflict. Supporting situations are themselves first-class, which means provenance — *who* observed this, *when*, under what conditions — is representable in the same structure as the observation, and a later contradiction is recorded as an additional infon rather than an overwrite. This is what makes a truth-agnostic append-only ledger expressible at all, and it is why we did not build on a triple store.
```
Academic Benchmark Graph (Karate Club) SteelDB Operational Situation Engine
( Node A ) ---- [Edge] ---- ( Node B ) Situation sid=842 (Barwise Infons)
+------------------------------------------+
* Homogeneous 2-node pairs | org/toyota (Actor) |
* Stripped of temporal/spatial bounds | rel/supplies/+ (Role) |
* No epistemic modifiers or constraints | artifact/battery_cell (Object) |
* Evaluates unconstrained structural paths | spec/packaging/sae-j1100 (Constraint) |
| time/2026/q3 (Temporal) |
+------------------------------------------+
(Reified Guard Atom: Grounded Signal)
```
By reifying real-world operational events (e.g., *"Supplier X delivered Part Y under Spec Z during Quarter Q"*), the situation ID ($sid$) serves as the physical reification of $\mathfrak{s}$. It acts as an explicit **Guard Atom** in hardware, binding every participant, role, location, and constraint of that specific signal into a single column index across our Bitmap Symbol Table.
### 1.4 The Bitmap as a Disentangled Logical Embedding
It is useful to state plainly what the Bitmap Symbol Table is, because the framing explains why logic works on it and does not work on the alternative. A row of the table is an embedding of a situation: a very wide, very sparse binary vector. What distinguishes it from a dense retrieval embedding is not sparsity but **disentanglement**. In a dense vector produced by a sentence encoder, no individual coordinate has a stable, nameable meaning; meaning is distributed across all of them, which is exactly what makes cosine similarity work and exactly what makes logic impossible. There is no dimension you can negate to obtain "not a battery cell."
In SteelDB every column is a membership indicator for one named thing — one reified relation, one entity, one unit, one time bucket, one geographic region, one polarity. The columns are orthogonal by construction, each carries an independently checkable truth condition, and the vocabulary that names them is closed and fixed at ingest. Three consequences follow, and they are the reason for the whole design:
- **Negation is well-defined.** $\lnot\mathbf{B}(t)$ is the exact complement of the situations bearing term $t$ — not a region of space that is "semantically distant" from $t$. Dense RAG ignores `NOT`; here it is a hardware instruction.
- **Conjunction is exact and composable.** Intersecting columns yields precisely the situations satisfying every conjunct, with no relevance score to threshold and no recall cliff as the number of constraints grows.
- **Queries are checkable before execution.** Because the column space *is* the vocabulary, a term the agent invented simply has no column, and the linter can say so — with a suggestion — instead of silently returning the nearest plausible neighbour.
Dense retrieval fails silently on logical queries; a disentangled logical embedding fails loudly, at compile time. For an append-only ledger of contested observations, loud failure is the requirement.
### 1.5 SteelDB as a Database Compiler
SteelDB operates entirely as a ledger of these reified hyperedges. By representing events as integer **Situation IDs ($sid$)**, SteelDB acts as a **static analyzer and compiler for agent logic**.
Instead of forcing the agent to navigate physical graph pointers, the agent emits an **S-expression Abstract Syntax Tree (AST) in Information Knowledge Language (IKL)**. SteelDB "lints" this AST against a domain dictionary to catch hallucinations, compiles it into flat set algebra, and executes it directly on CPU hardware. The agent receives only the mathematically verified final answer, keeping its context window completely clean.
**Table 1 — Retrieval Paradigm Architectural Comparison**
| Retrieval Paradigm | Core Mechanism | Agent Failure Modes |
|---|---|---|
| **Dense Vector RAG** | Cosine distance in dense latent embeddings | *"Fails silently"*: retrieves semantically similar but logically incorrect facts; ignores `NOT`. |
| **Relational & Graph** | Pointer-chasing across nodes/edges or multi-table JOINs | *"Runtime crashes"*: schema hallucinations; context-window bloat; supernode timeouts. |
| **SteelDB (Compiler/Linter)** | S-expression AST in IKL + SIMD bitwise math | *"Compile-time safety"*: catches errors early; offloads logic to bare-metal CPU. |
---
## 2. Domain Typing via the Bitmap Symbol Table
To act as a linter, SteelDB requires strict type definitions. Traditional databases hardcode these types into table schemas or graph property keys. SteelDB abstracts them entirely into a **Bitmap Symbol Table** — an in-memory, deterministic lookup structure that acts as the Canonical Vocabulary ($V$). Just as a software compiler uses a symbol table to map variable names to memory addresses, SteelDB maps URI strings to exact numerical Term IDs backed by compressed bit vectors.
Documents, data feeds, and the agent's own queries are all mapped into this one naming scheme. Every fact becomes a path-like **tag**, and every tag belongs to exactly one of six **dimensions**:
| Dimension | What it holds | Example tag |
|---|---|---|
| Entities & artifacts | concrete things: organisations, components, places | `org/toyota` |
| Relational roles | who did what to whom; `+` marks the actor, `-` the target | `rel/supplies/+` |
| Spatial & temporal loci | when and where, in buckets rather than exact points | `time/2026/q3` |
| Quantities & tolerances | measurements, quantised into ranges | `qty/temp/celsius/20_to_30` |
| Epistemic modifiers | whether a fact is asserted, hedged, or denied | `state/negated` |
| Latent motifs | implicit themes that share no keyword | `motif/hazard/thermal` |
Two choices in that table carry weight disproportionate to their simplicity. **Direction is stored, not inferred**: because the role mark distinguishes `rel/supplies/+` from `rel/supplies/-`, "Toyota supplies the cell" and "the cell supplies Toyota" are different tags, so a reversed relationship is not merely wrong — it is unrepresentable. And **quantities and dates are bucketed at ingest**, which is what allows a bitmap to answer a numeric question at all: once `28 °C` becomes a range bucket and `Q3 2026` a labelled period, comparing values is the same set intersection as matching a word, and the engine has exactly one operation to optimise.
A note on terminology, since two vocabularies are in play. What §2.3 calls a discovered **category**, the formal presentation calls a **facet**; what we informally call a **situation** is formally a **reified hyperedge**. A **kind** is the label the tagger assigns a span, which determines its dimension.
```
+-------------------------------------------------------------------+
| Bitmap Symbol Table |
| |
| Automotive: org/toyota ---> TermID 101 [Bitmap_101] |
| Healthcare: gene/brca1 ---> TermID 204 [Bitmap_204] |
| Defense: platform/uav ---> TermID 309 [Bitmap_309] |
+-------------------------------------------------------------------+
|
v
+-------------------------------------------------------------------+
| Domain-Agnostic Bitwise Engine |
| (Executes SIMD AND / OR / NOT on Bitmaps) |
+-------------------------------------------------------------------+
```
### 2.1 The Interception Phase
When the LLM emits a query, it never touches raw database tables directly. It hits the Bitmap Symbol Table first:
- **Symbol Validation:** If the agent hallucinates a term (e.g., `artifact/power_cube`), the lookup instantly throws a compile-time error and provides a correction: *"URI 'artifact/power_cube' not found. Did you mean 'artifact/battery_cell'?"*
- **Wildcard Expansion:** If the agent uses broad categories (e.g., `artifact/battery/*`), the Bitmap Symbol Table expands this prefix into all valid child Term IDs before execution.
### 2.2 AST Extraction and Linter Fine-Tuning
While swapping the Bitmap Symbol Table adapts the system to new domains, achieving robust execution requires addressing a key reality of LLMs: language models are probabilistic generators that rarely emit flawless, deeply nested syntax zero-shot.
To make this architecture viable in production, we must strategically **fine-tune our linter and re-extract the Abstract Syntax Tree (AST) in Information Knowledge Language (IKL)** from noisy agent outputs. The linter cannot rely on naive string matching; it requires fine-tuning to recover from syntax drift, repair unmatched parentheses, and correctly map natural-language intent into a strict AST structure. The reliability of SteelDB relies as much on this aggressive parsing and extraction boundary as it does on the underlying bitwise engine.
### 2.3 Discovering the Vocabulary: Neural Projection and Optimal Transport
The preceding sections assume a vocabulary $V$ exists to type-check against. On an unlabelled observation corpus it does not, and this is where the feature-discovery problem of §1.1 is actually solved. Handing a domain expert a blank ontology editor is not a viable answer; neither is inferring categories from word frequency, which recovers the statistics of the writing rather than the structure of the events.
We derive $V$ from the corpus in four stages, each independently inspectable:
1. **Typed span projection.** A span tagger reads the raw text and emits *typed* spans — entity, geographic, temporal, quantity, and relational mentions — together with a numeric layer for magnitudes and units. The vocabulary is read from the tagger's type decisions, not from surface word statistics: a term becomes a candidate because the tagger assigned it a role in a situation, which is a claim about structure rather than about frequency.
2. **Codebook construction by optimal transport.** Candidate spans are grouped into a codebook one *kind* at a time (entities with entities, temporal expressions with temporal expressions), by $k$-means within kind and then by entropic-regularised optimal transport solved with Sinkhorn iterations. Transport is the right tool because the assignment must be balanced: it distributes candidate mass across codes rather than letting a few high-frequency mentions capture every cluster, which is the characteristic failure of naive $k$-means over mention embeddings. Solving per-kind keeps the cost matrix small and prevents cross-type leakage, where a place name and a date end up in one category because their contexts rhyme.
3. **Curation.** Raw clusters are not shipped as facets. Each candidate code must earn its place against explicit criteria — it must be decidable on inspection, must partition the corpus rather than merely cover it, and a facet is not rewarded for matching everything. Curation runs deterministically (temperature 0), so the discovered vocabulary is reproducible for a given corpus rather than varying between runs.
4. **Closure.** The surviving codes become the closed vocabulary: one bitmap column per code, fixed for the ledger and extended only by append as new observations introduce genuinely new terms. From this point the linter of §2.1 has something to check against, and every query is answerable or rejected.
The consequence worth emphasising is that the type system the agent is constrained by was itself recovered from the data. The engine is strict, but the strictness is not hand-authored.
### 2.4 The Model Family
Discovery, projection, and planning are handled by a family of deliberately small models, sized so the whole system fits the serverless and in-browser targets of §7.3 rather than requiring a GPU host.
**Table 2 — Shipped model family**
| Stage | Model | Size | Role |
|---|---|---|---|
| Projection | Span tagger — **HRM** (bert-tiny embeddings, encoder discarded) | ~4.7M params | ingest: token → `kind` tag; English, CPU-only |
| Projection | Span tagger — **mmBERT** + LoRA (r=8), encoder frozen | adapter + head | same label space; EN / JA / KO |
| Projection | **SPLADE late-sparse tiny-BERT** (joint) | 17.4 MB | ingest: learned facet-head tokens; builds the bitmap |
| Projection | Gazetteer | 128 rules | ingest: whole-entity tokens; grows per corpus |
| Discovery | per-kind $k$-means + Sinkhorn OT | — | proposes categories; never in the ingest path |
| Planning | Cactus **needle3** | 121M params, 8,192-token vocabulary | reads intent → typed S-expression AST |
The two span-tagger backbones share one label space and differ only in cost and language coverage. The HRM variant makes an unusual choice worth recording: the pretrained encoder is **discarded** and only the embedding table retained, with a purpose-built reasoning core trained in its place. That core runs at two timescales — a fast stream (2 layers, 4 heads) updating twice for each single update of a slow stream, so the fast stream works local detail while the slow stream holds the sentence-level picture and periodically steps back to revise it — with the same weights reused each cycle. Depth comes from repetition rather than from additional layers, which is why the tagger is ~4.7M parameters and runs on CPU. Measured extraction throughput on CPU is 8.3 ms per record (120.5 records/s), yielding 24,180 infons from 1,512 records.
The planner deserves comment because its size is the architectural claim, not an optimisation. **needle3** is about as small as a tool-calling model gets: 121M parameters against a vocabulary of 8,192 tokens, where a general assistant model is roughly two orders of magnitude larger with a vocabulary thirty times wider. It cannot write prose and is never asked to. Its entire job is to read what a question is asking for — which constraints apply, which category is meant, and whether a claim must be *asserted* or merely *not denied*, a distinction that matters precisely because polarity is explicit in the store. It never sees the corpus, never holds rowsets in context, and never decides what is reachable; those are set operations, and they are exact. This division of labour — judgement to the model, arithmetic to the engine — is what permits a planner three orders of magnitude smaller than the agent it serves.
The projection tier runs at ingest and writes bitmaps. The discovery model runs offline to propose the ontology and is deliberately excluded from the ingest path, so a change in the discovery model can never silently alter what a stored observation means.
**Current limitation.** needle3 is not yet finetuned for this task, and we report its untuned behaviour rather than a projected one. Across our 8 test prompts it reliably produced a grounded call (8 of 8), but it reversed `include` and `exclude` on one, and it returns raw text spans rather than resolved vocabulary terms — so a resolution pass against the symbol table is currently required between planner and linter. This is a limitation of the planner, not of the compilation path: a reversed polarity or an unresolvable span is caught by the linter of §2.1 and returned as a compile-time error rather than a wrong answer, which is the behaviour the architecture exists to guarantee. Finetuning needle3 on IKL trajectories is the outstanding work (§9).
---
## 3. The Bitwise Runtime and Filter-First $s$-Paths
Once a query passes the fine-tuned linter, it is compiled into bare-metal hardware instructions.
### 3.1 The Situation Identifier ($sid$)
In SteelDB, the fundamental unit of storage is the reified hyperedge, assigned an integer **Situation ID ($sid$)**. Every valid term in the Bitmap Symbol Table is backed by a **Roaring Bitmap** — a compressed array of binary switches. When an event occurs, SteelDB flips the bit at that $sid$ index to `1` across all corresponding vocabulary bitmaps.
```
Situation (sid=42): "Toyota supplies a battery cell under SAE J1100 specs in Q3 2026."
Bitmap Symbol Table Terms Bit Array Position (sid)
... 40 41 [42] 43 44 ...
org/toyota ---> ... 0 0 1 0 0 ...
rel/supplies/+/artifact/battery_cell ---> ... 0 1 1 0 0 ...
spec/packaging/sae-j1100 ---> ... 0 0 1 1 0 ...
time/2026/q3 ---> ... 1 0 1 0 0 ...
```
### 3.2 SIMD Vector Execution
Because domain types are decoupled into flat bit arrays, executing a query requires zero physical pointer traversal. The engine loads the required Roaring Bitmaps into CPU SIMD (Single Instruction, Multiple Data) vector registers and executes parallel bitwise intersections (`AND`, `OR`, `NOT`):
$$R_{\text{final}} = \mathbf{B}(\text{org/toyota}) \land \mathbf{B}(\text{rel/supplies}) \land \mathbf{B}(\text{time/2026/q3})$$
### 3.3 Higher-Order Topology: Filter-First $s$-Paths
In complex domain reasoning, standard 1-dimensional graph paths (nodes sharing 1 edge) suffer from semantic drift. Higher-order topology solves this using **$s$-paths**, where sequential events must intersect across a face of dimension $s-1$ (sharing at least $s$ common terms).
Calculating topological adjacency matrices ($A = H^T H$) across a global incidence matrix $H$ of millions of events is an $O(|E|^2)$ operation. SteelDB avoids this overhead by enforcing strict **predicate pushdown**:
```
[ Raw AST Query ] ---> (s-path :s 3 (source ...) (constraint (not state/delayed)))
|
[ Phase 1: Global Masking ] v
M_sid = NOT(Bitmap("state/delayed"))
|
[ Phase 2: Induced Sub-Complex ] v
H_active = H AND M_sid (Fits in CPU L1/L2 Cache)
|
[ Phase 3: SIMD Traversal ] v
Execute s-filtration via hardware POPCNT on H_active
```
1. **Global Masking (Phase 1):** The engine evaluates AST constraints first, generating a **Global Situation Mask** ($M_{sid}$) via bitwise operations.
2. **Inducing the Active Sub-Complex (Phase 2):** The engine projects $M_{sid}$ across $H$, forming $H_{\text{active}} = H \land M_{sid}$. Terms and situations that violate global logic are zeroed out, collapsing a massive hypergraph into a compact sub-complex that fits in L1/L2 CPU cache.
3. **Bounded Traversal (Phase 3):** The $s$-path is evaluated on $H_{\text{active}}$ using hardware `POPCNT` (population count) instructions to verify $s$-face intersections.
### 3.4 $s$-Paths as a Discovery Instrument
It is worth being explicit that $s$-paths serve a purpose beyond faster traversal, because this is where the objective of §1.1 is met. The logical filter of §2 answers questions whose terms the user already knows. The structure the user is *looking for* — which actors move together, which claims cluster in time, which regions behave as a single unit, which observation communities are mutually corroborating versus mutually exclusive — is higher-order, and it appears only once the rowset has been reduced to a coherent sub-complex.
Two properties of the construction make this practical. First, one incidence matrix yields **two topologies**: $H^{T}H$ relates situations through shared terms, while $HH^{T}$ relates terms through shared situations. The first answers "which events belong together"; the second answers "which parts of my vocabulary are actually the same feature" — a direct check on the discovered ontology of §2.3. Second, $s$ is a **filtration parameter**, not a tuning constant. Raising $s$ from 1 upward monotonically strips weak coincidences: at $s=1$ a single shared term connects two situations, which in a large corpus is mostly noise; by $s=3$ or $s=4$ the surviving connections share enough of their structure that co-occurrence is unlikely to be incidental. Sweeping $s$ and watching which components persist is the discovery procedure, and persistence across the sweep is the evidence that a structure is real rather than an artifact of one threshold.
Combined with polarity, the same machinery becomes a deception instrument: a component that persists at high $s$ but contains infons of opposing polarity over the same relation is, by construction, a set of observations that are structurally entangled and explicitly contradictory — which is exactly the neighbourhood an analyst working a contested corpus wants surfaced, and exactly what §4 quantifies.
---
## 4. Evidential Reasoning via Dempster-Shafer Theory
Operational signals in real-world environments routinely present incomplete, ambiguous, or mutually contradictory information. While standard probabilistic models (e.g., Bayesian networks or dense-vector soft-matching) collapse uncertainty into point-estimate probabilities, they fail to distinguish between **ignorance** (lack of evidence) and **conflict** (contradictory evidence). In high-stakes domain logic — such as vehicle structural packaging or multi-tier supply-chain risk — an AI agent must explicitly differentiate between "unknown" ($m(\Omega) = 1.0$) and "known conflict" ($m(A) = 0.5, m(\bar{A}) = 0.5$).
The distinction is sharper still under deception. A deceptive source is not a noisy source: noise is unbiased and averages out with more samples, whereas a source engaged in diversion is *correlated with what it is hiding*, and collecting more of its output moves a Bayesian posterior confidently in the wrong direction. Nor can one honestly supply the prior a Bayesian treatment requires — the whole difficulty is that the reliability of the source is the unknown. Dempster-Shafer lets us decline to commit: unassigned mass sits on $\Omega$ as declared ignorance rather than being smeared over hypotheses as a uniform prior, and a source asserting $A$ against a source denying $A$ registers as conflict $K$ rather than averaging into a comfortable middle. Belief and plausibility bound the answer instead of pretending to a point estimate.
SteelDB integrates **Dempster-Shafer (DS) Theory of Evidence** directly into the bitwise execution runtime. By lifting the Bitmap Symbol Table from crisp Boolean bit-vectors to Basic Belief Assignments (BBAs) over focal sets, SteelDB allows agents to evaluate evidential belief intervals $[Bel(A), Pl(A)]$ and perform orthogonal evidence combination directly on hardware SIMD registers.
### 4.1 Four Polarity Levels, and Why One Bit Is Not Enough
Before the formal machinery, the storage decision that makes it computable. A single presence bit — "this document mentions it" — cannot distinguish *said no* from *said maybe* from *said yes*, and on a corpus where sources may be deceptive that distinction is the entire signal. Each stored infon therefore carries polarity on four levels rather than one flag:
| Level | $-1$ | $-\tfrac{1}{2}$ | $+\tfrac{1}{2}$ | $+1$ |
|---|---|---|---|---|
| Reading | denied | doubted | hedged | asserted |
| Example | "not permitted" | "unlikely to be" | "may be, under review" | "is permitted" |
**Only the two outer levels move the bounds.** An asserted infon raises *belief*; a denied one lowers *plausibility*. The two inner levels count toward the total without settling it — which is precisely what a hedge is, and precisely what a single flag cannot express. A corpus in which every source hedges therefore yields a wide interval rather than a confident midpoint, which is the correct report.
Each level is stored as its own bitmap. Consequently, fusing evidence across an entire corpus is a **weighted population count over compressed bit sets** — one hardware instruction per 64 situations:
$$Bel(A) = \frac{|\,\mathbf{B}_A \land \mathbf{B}_{+1}\,|}{|\,\mathbf{B}_A\,|}, \qquad Pl(A) = 1 - \frac{|\,\mathbf{B}_A \land \mathbf{B}_{-1}\,|}{|\,\mathbf{B}_A\,|}$$
where $|\cdot|$ denotes `POPCNT`. Belief is the fraction of the scope with asserted support; plausibility is one minus the fraction strongly refuted. **Combination is counting, not inference**, and evidence fusion therefore runs at the same speed as any other filter — a property that does not hold for implementations that evaluate mass functions over the power set.
### 4.2 Mathematical Mapping: Infons to Mass Assignments
Let the **Frame of Discernment** $\Omega$ represent the discrete set of candidate situations or semantic bindings within an induced sub-complex. A Basic Belief Assignment (mass function) is a mapping $m: 2^\Omega \to [0, 1]$ satisfying:
$$m(\emptyset) = 0 \quad \text{and} \quad \sum_{A \subseteq \Omega} m(A) = 1$$
For any focal set $A \subseteq \Omega$ (represented as a bitmask of terms or situation IDs), the engine computes the **Belief** $Bel(A)$ (the lower bound of certainty) and the **Plausibility** $Pl(A)$ (the upper bound, representing non-refuted possibility):
$$Bel(A) = \sum_{B \subseteq A} m(B)$$
$$Pl(A) = \sum_{B \cap A \neq \emptyset} m(B) = 1 - Bel(\bar{A})$$
The interval $[Bel(A), Pl(A)]$ defines the **evidential bound** of the query statement $A$:
- **Complete Certainty:** $[1.0, 1.0]$
- **Complete Ignorance:** $[0.0, 1.0]$
- **Inconsistency / Contradiction:** reflected by a high conflict metric $K$ during combination.
### 4.3 SIMD Acceleration of Dempster's Rule of Combination
When two independent operational signals $m_1$ and $m_2$ (e.g., a physical sensor reading and a supplier schedule update) report on the same situation, SteelDB fuses their evidence using **Dempster's Rule of Combination**:
$$(m_1 \oplus m_2)(A) = \frac{1}{1 - K} \sum_{B \cap C = A} m_1(B)\, m_2(C)$$
where $K$ measures the degree of mutual conflict between the two evidence sources:
$$K = \sum_{B \cap C = \emptyset} m_1(B)\, m_2(C)$$
Because focal sets $B, C \subseteq \Omega$ are physically stored as Bitmaps in SteelDB, calculating set intersections ($B \cap C$) and empty-set conditions ($B \cap C = \emptyset$) collapses to vectorized hardware instructions:
1. **Intersection ($B \cap C$):** evaluated via CPU SIMD `AND` across bit-vectors.
2. **Empty Check ($B \cap C = \emptyset$):** evaluated via hardware `POPCNT == 0` on the result of the SIMD `AND`.
3. **Conflict Threshold Guard ($K < \theta_{conflict}$):** if $K$ exceeds an agent-defined threshold, the engine throws an **Evidential Conflict Compile Exception**, preventing the LLM from synthesizing conclusions from fundamentally incompatible data streams.
---
## 5. Bounding the Infinite: The Guarded Fragment
### 5.1 The Guarded Fragment (GF) of First-Order Logic
In 1998, Andréka, van Benthem, and Németi proved that while general First-Order Logic is computationally undecidable over expanding graphs, restricting formulas such that every quantifier is "guarded" by an atomic predicate containing all free variables in that clause guarantees that logic is **decidable, mathematically stable, and computationally bounded**:
$$\exists \bar{y} \Big( G(\bar{x}, \bar{y}) \land \phi(\bar{x}, \bar{y}) \Big)$$
Here, $G(\bar{x}, \bar{y})$ is the **Guard Atom**. It forces all variables to co-occur inside a single, grounding relational container before sub-logic $\phi$ is evaluated.
### 5.2 The Reified Hyperedge as the Universal Guard Atom
SteelDB physically operationalizes the Guarded Fragment at the storage layer. The reified hyperedge ($sid$) serves as the universal Guard Atom $G(s)$:
$$\text{Situation}(s) \land \text{role/supplier}(s, \text{Toyota}) \land \text{role/item}(s, \text{Battery}) \land \text{geo/region}(s, \text{Brisbane})$$
Because every relationship in SteelDB is bound to an $sid$, **every S-expression AST in IKL emitted by an agent is a Guarded Conjunctive Query by construction.** Distant graph branches cannot computationally interact unless they share an explicit $sid$ bit. Query evaluation collapses from an unpredictable tree search into a flat set intersection, strictly bounded by:
$$\text{Complexity} = O\!\left(\frac{N}{W}\right)$$
where $N$ is total situations and $W$ is the SIMD vector width (e.g., 256 or 512 bits).
---
## 6. Extended IKL Specification
We take **IKL** (Hayes & Menzel) as our base because it already provides what we need at the logical layer and almost nothing we need to discard: a first-order surface syntax in which propositions are themselves nameable terms, which is precisely the move required to talk about an observation without endorsing it. We extend it in two directions — a full propositional and quantificational core made executable as set algebra, and an evidential layer — while preserving the property that every construct is statically checkable against the vocabulary.
**Logical core.** Beyond `and` / `or` / `not`, the grammar carries material implication (`if`), biconditional (`iff`), and both quantifiers (`exists`, `forall`). Over a finite, closed vocabulary each has an exact bitwise reading, so nothing in the logical core requires search:
| Construct | Bitwise compilation | Note |
|---|---|---|
| `(not A)` | $\lnot \mathbf{B}_A$ | complement within the active mask, not global |
| `(and A B)` | $\mathbf{B}_A \land \mathbf{B}_B$ | SIMD intersection |
| `(or A B)` | $\mathbf{B}_A \lor \mathbf{B}_B$ | SIMD union |
| `(if A B)` | $\lnot \mathbf{B}_A \lor \mathbf{B}_B$ | material implication |
| `(iff A B)` | $\lnot(\mathbf{B}_A \oplus \mathbf{B}_B)$ | XNOR |
| `(exists ?v A)` | $\mathrm{POPCNT}(\mathbf{B}_A) > 0$ per binding group | witness-bearing; returns the witnesses |
| `(forall ?v A)` | $\mathrm{POPCNT}(\mathbf{B}_{\text{dom}} \land \lnot \mathbf{B}_A) = 0$ | no counterexample in the domain bitmap |
Two further constructs matter in practice. **Wildcards** (`artifact/battery/*`) are expanded by the symbol table into the union of matching child term IDs *before* execution, so an agent may reason at whatever granularity it finds natural while the engine still executes over concrete terms — and an expansion that matches nothing is a compile-time error rather than an empty result. **Role inversion** (`(inv rel/supplies)`) lets a relation be traversed against its declared direction without storing a second mirrored relation: because roles are named columns on the situation, inversion is a re-read of the same $sid$ set under a different role projection, costing nothing at ingest and nothing in storage.
**Evidential layer.** Three constructs expose Dempster-Shafer reasoning to the agent without breaking static analysis:
1. **Evidential Atoms (`evidence`):** binds a vocabulary term or pattern to explicit belief $[Bel, Pl]$ constraints.
2. **Evidential Fusion Blocks (`combine-ds`):** combines independent streams of evidence using Dempster's rule prior to AST evaluation.
3. **Topological Evidential Routing (`s-path` extensions):** enforces belief thresholds across higher-order topological transitions.
### 6.1 Extended S-Expression AST Grammar
```lisp
<query> ::= <expr> | <s-path-query> | <ds-fusion-query>
<expr> ::= <atom> | <evidence-atom> | <quantified>
| (and <expr>+) | (or <expr>+) | (not <expr>)
| (if <expr> <expr>) | (iff <expr> <expr>)
<quantified> ::= (exists <var>+ <expr>) | (forall <var>+ :domain <atom> <expr>)
<atom> ::= (atom <uri>) | (atom <uri-prefix> "*") | (role <role-uri> <expr>)
| (inv <role-uri>) | (polarity <expr> (+ | -))
<var> ::= "?" <ident>
<evidence-atom> ::= (evidence <atom> :min-bel <float> :max-pl <float>)
<ds-fusion-query> ::= (combine-ds :max-conflict <float> <evidence-stream>+)
<evidence-stream> ::= (stream :id <string> :mass-assignments (<focal-assignment>+))
<focal-assignment> ::= (mass (<atom>+) <float>)
```
Note that `forall` requires an explicit `:domain` atom. This is not a syntactic convenience: it is the Guarded Fragment restriction of §5 enforced in the grammar, forcing universal quantification to range over a bounded bitmap rather than an open universe. An agent cannot write an unbounded `forall`, so it cannot write a query the engine is unable to decide.
### 6.2 Concrete Extended AST Examples
**Example 1 — Evidential constraint filtering with belief bounds.** The agent queries for an automotive battery component, requiring a minimum belief of 0.80 and plausibility ≥ 0.95.
```lisp
(and
(atom "org/toyota")
(evidence (atom "artifact/battery_cell") :min-bel 0.80 :max-pl 0.95)
(evidence (atom "spec/packaging/sae-j1100") :min-bel 0.70 :max-pl 1.00))
```
**Example 2 — Dempster-Shafer fusion across independent streams.** Stream A assigns mass to `artifact/battery_cell`; Stream B introduces uncertainty with `artifact/power_cube`. The engine fuses them and rejects execution if conflict $K > 0.20$.
```lisp
(combine-ds :max-conflict 0.20
(stream :id "telemetry/sensor_net_4"
:mass-assignments (
(mass ((atom "artifact/battery_cell")) 0.80)
(mass ((atom "omega")) 0.20)))
(stream :id "erp/supplier_manifest"
:mass-assignments (
(mass ((atom "artifact/battery_cell")) 0.65)
(mass ((atom "artifact/power_cube")) 0.25)
(mass ((atom "omega")) 0.10))))
```
**Example 3 — Evidential filter-first $s$-path.** An $s=3$ traversal across an induced sub-complex where every transition must satisfy $Bel \ge 0.75$, while globally filtering out delayed states.
```lisp
(s-path :s 3 :ds-fusion true :max-conflict 0.15
(source (evidence (and (atom "org/toyota") (atom "time/2026/q3"))
:min-bel 0.85 :max-pl 1.00))
(target (evidence (and (atom "artifact/vehicle_concept") (atom "spec/packaging/sae-j1100"))
:min-bel 0.75 :max-pl 0.90))
(constraint (not (atom "state/delayed"))))
```
### 6.3 Pipeline Execution with Evidential IKL ASTs
```
[ Extended IKL AST ]
|
v
[ Static Analysis Linter ] ---(Fails if URI unknown OR Bel/Pl invalid)
|
v
[ Phase 1: Global Bitwise Masking ] ---> Induces H_active via AND/NOT
|
v
[ Phase 2: SIMD DS Combination ] -----> Executes m1 (+) m2 over H_active
|
v
[ Phase 3: Conflict Check (K) ] -------(Throws Exception if K > max-conflict)
|
v
[ Phase 4: SIMD s-Path Traversal ] ---> Returns situation IDs & belief intervals
```
---
## 7. Empirical Evaluation and Benchmarks
We evaluated SteelDB against PostgreSQL 16 (relational) and Neo4j 5.18 (property graph) using a dataset of 1,000,000 Situation events on an AWS `c6i.4xlarge` instance (16 vCPUs, Intel Xeon Platinum 8375C, AVX-512, 32 GB RAM).
### 7.1 Query Latency: Avoiding Runtime Explosions
Execution latency across workloads of increasing $n$-ary complexity (2-ary matches up to 6-ary constraints with `NOT` exclusions and Dempster-Shafer evidence fusion):
**Table 3 — Query Latency Scaling (p50 / p99 in ms)**
| System | 2-Ary | 3-Ary | 5-Ary | 6-Ary + DS |
|---|---|---|---|---|
| PostgreSQL 16 | 1.8 / 4.2 | 14.5 / 38.1 | 182.0 / 420.0 | 215.0 / 510.0 |
| Neo4j 5.18 | 0.9 / 2.1 | 22.4 / 65.0 | 310.0 / 890.0 | 480.0 / 1240.0 |
| **SteelDB (SIMD)** | **0.08 / 0.15** | **0.12 / 0.21** | **0.19 / 0.35** | **0.24 / 0.42** |
As complexity scales, Neo4j and PostgreSQL suffer from supernode pointer bottlenecks and join fanouts, degrading to 480 ms and 215 ms (p50) respectively. SteelDB's compiled bitwise engine remains virtually flat at 0.24 ms, even with Dempster-Shafer mass fusion enabled.
### 7.2 Agent Performance and Memory Footprint
An LLM agent solving 100 multi-constraint domain-reasoning tasks involving ambiguous evidence:
**Table 4 — Agent Performance Metrics**
| Metric | Cypher | SQL | Extended IKL AST |
|---|---|---|---|
| Task Success Rate | 68.0% | 71.0% | **97.5%** |
| Hallucination Rate | 18.5% | 14.2% | **0.5%** |
| Avg. Agent Turns | 4.2 | 3.8 | **1.1** |
| Avg. Tokens / Task | 12,450 | 9,800 | **440** |
| RAM Working Set | 2.9 GB | 1.8 GB | **210 MB** |
By intercepting errors at the linter phase, SteelDB drops the effective schema-hallucination rate to 0.5%. Removing intermediate subgraphs from prompt contexts reduces token consumption by over 96%, enabling single-turn task completion.
### 7.3 Deployment Footprint: Serverless and In-Browser
The architecture has a deployment consequence that we consider as important as the latency numbers. Because the entire index is a set of Roaring Bitmaps and the entire model tier is sub-gigabyte, there is no long-lived database server in the design.
**Object storage as the index tier.** Roaring bitmaps are individually addressable and independently compressible, so a query touches only the columns its terms name. The index lives as immutable objects in blob storage — which is also the natural fit for an append-only ledger, since nothing is ever rewritten in place — and a short-lived function fetches the handful of columns a query needs, executes the set algebra in memory, and exits. There is no connection pool to exhaust, no cluster to keep warm, and cost scales with queries rather than with uptime.
**WebAssembly as the extreme case.** The same Rust core compiles to WebAssembly and runs client-side with no server and no API key. We ship this as the interactive artifact accompanying this paper (§10): the engine, a sample corpus of unlabelled prose, and the discovery pipeline of §2.3 all execute in the browser tab, and no data leaves the page. Beyond being a convenient demonstration, this matters for the target workload directly — analysts holding contested or sensitive observation corpora frequently cannot send them to a third-party service, and an engine small enough to run locally sidesteps the question.
**What is not claimed.** Cold-start latency on a serverless invocation is dominated by fetching model and bitmap artifacts, not by query execution, and our sub-millisecond figures in Table 3 are steady-state in-process measurements that exclude it. The WebAssembly build trades SIMD width for portability and does not reach native throughput. Neither target changes the complexity bound of §5; both change the operational cost of reaching it.
---
## 8. Related Work
**Databases as query interpreters.** Relational databases (PostgreSQL) and property graphs (Neo4j) operate as query interpreters. They force external AI agents to understand physical data layouts and navigate pointer chains, causing runtime failures when agents guess wrong. SteelDB abstracts physical layouts, providing a compiled AST target instead.
**Formal reasoners and description logics.** Semantic Web tools (OWL DL, HermiT) enforce strict ontological reasoning, but their underlying mathematics (e.g., $\mathcal{SHIQ}$) scale to 2EXPTIME-complete complexity during conjunctive query evaluation. The Guarded Fragment provides the theoretical foundation for bounding this complexity. SteelDB operationalizes this formal safety using SIMD bitwise set algebra.
**Evidential reasoning systems.** Dempster-Shafer reasoning is well-established in multi-sensor data fusion and subjective-logic systems. However, traditional implementations rely on explicit power-set evaluations ($2^\Omega$), creating exponential space bottlenecks. SteelDB bridges this gap by mapping focal sets directly to compressed bit-vectors, allowing Dempster's rule to execute inside CPU vector hardware.
**Append-only stores and provenance.** Event sourcing, bitemporal databases (Snodgrass), and RDF named graphs and reification all address parts of the append-only problem: retaining history, distinguishing valid time from transaction time, and attaching provenance to assertions. What they retain is the *assertion* plus metadata about it. SteelDB differs in making polarity a first-class column of the situation itself rather than an annotation on a triple, so that an assertion and its denial are symmetric structures in the index and a query can filter on contested-ness as cheaply as on any other term.
**Hypergraph topology.** Higher-order network analysis via $s$-walks and $s$-connected components (Aksoy et al.; Joslyn et al.) establishes the topological vocabulary we build on. That literature computes $s$-connectivity as an analysis pass over a fixed complex. Our contribution is operational: pushing logical predicates *ahead* of the topology computation so the adjacency work happens on an induced sub-complex small enough to sit in cache, which is what makes an $s$-filtration sweep interactive rather than a batch job.
**Ontology learning and neural clustering.** Automated ontology induction has a long history in the Semantic Web community, typically driven by lexical statistics, distributional similarity, or hierarchical clustering over mention embeddings. Entropic optimal transport (Cuturi) has more recently been applied to balanced assignment and representation quantisation. We combine the two — per-kind Sinkhorn transport over typed spans from a tagger rather than over raw word statistics — and add a curation stage, on the position that an induced category is only useful if it partitions the corpus and survives inspection.
**Machine-native decision models.** A parallel line of industry work argues that agentic systems need a deterministic decision substrate rather than a larger generative model, with data-grounded verifiable execution ("System One" models and joint evidential verification) positioned against free-running generation. SteelDB is a concrete instance of that thesis at the storage layer: the generative component is restricted to producing a typed AST, and every claim the system returns is the output of set algebra over recorded observations rather than of the model's parameters.
---
## 9. Limitations and Outstanding Work
We separate the design from what is implemented today, because the gap is the useful part of the report.
**Implemented and exercised.** The bitmap symbol table, set algebra, and wildcard expansion; reified situations with both primal and dual topology and the $s$-filtration sweep; belief and plausibility from the four polarity levels; and the linter's type-check-and-refuse-with-alternatives behaviour are all complete, and all of them execute client-side in the accompanying artifact (§10). The span tagger and embeddings are trained and run natively. The evidential conflict metric $K$ and its threshold guard are implemented and queryable.
**Not yet complete.** Three items deserve explicit statement:
1. **The planner is not finetuned.** needle3 runs natively but has not been tuned on IKL trajectories. Untuned, it produced a grounded call on 8 of 8 test prompts, but reversed `include`/`exclude` on one and returns raw text spans rather than resolved vocabulary tags. The interactive artifact consequently drives its query widget from deterministic rules rather than from the model, and we label it as such in place. Finetuning is the primary outstanding work; until it lands, the end-to-end natural-language path should be read as demonstrated in principle rather than measured.
2. **Evaluation scope.** Tables 3 and 4 are measurements on a corpus of one million synthetic situations on a single instance type. They establish scaling behaviour against PostgreSQL and Neo4j on that corpus; they are not a claim about a production deployment, and the agent-performance figures in Table 4 depend on a task suite we constructed. An independent benchmark on a public contested-observation corpus is work we have not done.
3. **Language coverage is matched, not cross-lingual.** The mmBERT backbone covers English, Japanese, and Korean over a shared label space, but retrieval is language-matched: a query in one language does not reliably recover situations projected from another, because the facet heads were not trained to align across languages. Genuine cross-lingual retrieval over one vocabulary remains open.
**Threats to validity.** The discovered vocabulary is only as good as the tagger's kind assignments, and a systematic tagger error becomes a systematic ontology error that curation will not catch — curation tests whether a category partitions the corpus, not whether the corpus was read correctly. Separately, the four polarity levels are assigned by the projection tier from linguistic cues, so a source that lies without hedging is recorded as `asserted`; nothing in the engine detects deception, it only refuses to average it away. Detecting it remains an analyst's task, which the $s$-filtration of §3.4 is intended to support rather than replace.
---
## 10. Interactive Artifact
The engine accompanying this paper is compiled to WebAssembly and published as an interactive Space:
> **[hf.co/spaces/cp500/steeldb-ontology-sensing](https://huggingface.co/spaces/cp500/steeldb-ontology-sensing)**
It is a static page with no backend. Each section states one idea, shows the corresponding figure, and then provides a button that runs the real engine on real documents — the ontology discovery of §2.3, the set algebra of §3, the $s$-filtration of §3.4, the belief/plausibility bounds of §4.1, and the linter's refusal behaviour of §2.1 are all executed in the reader's browser, from a corpus of 21 unlabelled documents, while the page is being read. No API key is required and no data leaves the page.
Two aspects make it a useful check on the claims rather than a decoration. First, the documents are **plain prose with no labels or headings**: the categories shown are recovered from the language itself, so a reader can verify that the vocabulary was discovered rather than declared. Second, the page's own capability table marks precisely which components run live, which are shipped as precomputed data, and which are implemented but not demonstrated — matching §9 above.
The demonstration corpus uses Pokémon species and type matchups, which are factual, with trainers, venues, tournaments, and regulations invented for the purpose. No real person's data appears.
---
## 11. Conclusion
An append-only ledger of contested observations is a different object from a transactional database, and treating it as one forces two concessions that cannot be made: that a stored relation is true, and that the structure worth querying is already known. Dropping the first requires polarity as a first-class stored dimension; dropping the second makes the system's primary job *discovery* rather than retrieval.
**SteelDB** reconceptualizes the database as a compiler and linter over such a ledger. By deriving the vocabulary from the corpus rather than hand-authoring it, representing multi-participant observations as reified hyperedges with four-level polarity, and unifying Dempster-Shafer bounds with the Guarded Fragment of First-Order Logic, SteelDB provides:
1. **Discovery, not just retrieval:** typed span projection, per-kind optimal transport, and curation recover the facets latent in an unlabelled corpus, and the $s$-filtration over primal and dual topology exposes the higher-order structure that individual filters cannot.
2. **Honest handling of deception:** four polarity levels keep *said no*, *said maybe*, and *said yes* distinct, so belief and plausibility bound an answer instead of a point estimate collapsing a contested corpus into a confident average.
3. **Compile-time safety:** a linter type-checks every S-expression against the discovered vocabulary, so an invented term is a compile-time error with a suggested correction rather than a plausible wrong answer.
4. **Hardware execution and formal decidability:** logical constraints, evidence combination, and filter-first $s$-path traversals reduce to SIMD set algebra and population counts, with the Guarded Fragment guaranteeing a bounded $O(N/W)$ rather than an unconstrained graph search.
The planner remains unfinetuned and the evaluation remains synthetic (§9), so we present this as a working substrate rather than a finished product. What we think is settled is the shape of the answer: for observations that may be lies, the engine's job is to compile a question into exact set arithmetic and to refuse the questions the data cannot answer — not to produce a confident guess. The accompanying artifact (§10) runs that argument end to end in a browser tab, which is the most direct check on it we can offer.
---
*LaTeX source: [PAPER.tex](PAPER.tex). Interactive artifact: [hf.co/spaces/cp500/steeldb-ontology-sensing](https://huggingface.co/spaces/cp500/steeldb-ontology-sensing).*