Aria
Aria is not a model. She is a control plane, the layer that decides which model does what, verifies the result against a different one, and refuses to let any of them take an action that cannot be undone.
The architecture
01
Any model can be swapped for any other without destroying system state. Nothing in our codebase names a model. Every component requests a capability, and one configuration file decides who fills it at runtime. A build test fails if anybody hardcodes a name.
02
Conversation history is a rendering of state, never the state itself. The model proposes a transition; the controller commits it. This is what makes a run reproducible, and it is why task drift cannot occur, the objective is not stored anywhere that can drift.
03
Physics, then execution, then deterministic rules, then database constraints, then an independent model, and only then a model checking itself. Arithmetic is verified by arithmetic. Code is verified by running it. A model judging a model is the last resort, not the default.
04
An irreversible action requires authorization, not certainty. Ninety-seven percent confidence does not send an email, delete a file, or spend money. Irreversibility is a property of the action, not of the belief.
05
A trivial question gets one model. A contested one gets five, plus retrieval, plus a deterministic validator, plus an adversarial verifier. The advantage is not more agents. It is spending compute where it changes the answer.
The control plane
Hover or focus any box to read what it owns, and what it explicitly does not.
The control plane owns
The models own
The split above is a design commitment, not a proof. Nothing in the architecture stops a model from being asked for something in the left column, what stops it is that the controller does not offer the interface, and an interface can be added by anyone with commit access.
So the guarantee is exactly as strong as the build test that enforces it. That test is public, it runs on every commit, and if it is ever deleted this claim goes with it.
The long memory
Most systems compress old conversations into summaries, which loses the detail, or stuff the whole history into context, which costs a fortune.
Aria indexes every message by time, by entity, and by meaning. When you refer to something from two years ago she resolves it to the specific messages and injects only those, a few hundred tokens instead of a few million.
You get the exact words back, with the date.
Anything you marked private is session-scoped and never enters the index. She cannot recall a thing you asked her not to keep, because it was never written down.
Constraints
The benchmark
Every row links to how it was produced. When a number changes, the date changes with it, and the previous value stays in the history rather than being overwritten.
| Measure | Result | Method | Updated |
|---|---|---|---|
| Cost vs. monolithic frontier call | — | — | — |
| Uplift, 2-year-old base model | — | — | — |
| Verifier correlation (ρ), cross-family | — | — | — |
| Verifier correlation (ρ), same-family | — | — | — |
| Reservoir hit rate | — | — | — |
| Cost per active student / month | — | — | — |
Not yet measured. We are running the first full benchmark. We will publish the methodology whether or not we like the result.
The Constitution