Governed Cognitive Infrastructure

AI that does regulated work under human authority — with cryptographic proof of every decision and fail-closed control. The governed core that every TF Group product is built on.

Patent-pending across the stack AGEPI Applications 7671 · 7672 · 7689 · 7698 Built in the Republic of Moldova

The Problem

Regulated AI has a trust gap

Organizations are adopting AI faster than they can prove what those systems actually did.

In finance, energy, agriculture, healthcare, and public administration, after a decision is made, it is hard to demonstrate which model produced it, on what data, under which rule — and whether the record was altered afterward. When a regulator, an auditor, or a court later asks why a decision was made — and whether the record is intact — most AI deployments cannot answer with cryptographic certainty. They have logs — but logs can be edited, and a log is not proof.

The EU AI Act, DORA, and transparency mandates require traceability, version control, integrity guarantees, and human oversight. Most AI systems were never built with this at the infrastructure level. Governance is bolted on after the fact — a dashboard beside the work, not a gate on the path of the work. That gap is exactly where liability, regulatory exposure, and loss of trust accumulate.

SoulGCI is that infrastructure: a governance layer that lets AI act under human authority, proves every governed decision cryptographically, and fails closed by design. Instead of asking institutions to trust the AI, it lets them verify it — independently, after the fact, without access to our systems.

The Proof Plane

Cryptographic proof of every decision

At the core of SoulGCI is a proof plane: structured event recording, cryptographic signing, an append-only hash-chained ledger, and self-contained evidence. Every governed decision becomes independently verifiable — its provenance reconstructable and checkable by any third party, without access to our infrastructure.

Signed decision receipts

Every governed decision produces a cryptographic receipt — independently verifiable, carrying its own proof of authenticity and integrity with no exposure of private keys or personal data.

Tamper-evident ledger

An append-only, hash-chained journal with Merkle roots. Any single-byte alteration breaks the chain and is detected.

Self-contained audit packs

One shareable evidence bundle — signed receipt, public key, verification result, ledger excerpt, tamper proof — reproducible by a third party.

WORM-anchored storage

Write-once-read-many storage with KMS-signed Merkle roots (RSA-PSS-SHA256) anchors the record against retroactive change.

Architecture

Five layers, one governed system

SoulGCI is built as five integrated architectural layers. Together they take an AI decision from request to cryptographically provable, human-governed action — and refuse to act when governance cannot be satisfied.

01

Constitutional runtime

Decision governance

A constitution compiled into the executable evaluates every request before any autonomous action. An event validator, idempotency engine, quarantine path, contradiction-detection engine, and deterministic state compiler enforce it. A constitutional reflex engine classifies each action into three governance classes.

S — safe automatic execution D — prepared, not executed H — mandatory human approval
02

Cryptographic trust fabric

Proof & integrity

An append-only event journal forms a cryptographic hash chain, sealed by a Merkle tree whose roots are digitally signed via KMS (RSA-PSS-SHA256). Inclusion receipts and WORM storage make every governed event provably immutable and independently checkable.

Append-only journalMerkle inclusion proofsWORM storage
03

Policy-as-code engine

Versioned rules

Each event is evaluated against a versioned policy bundle (OPA/Rego), producing versioned decision logs. Rules are explicit, auditable, and reproducible — and every decision references the exact policy version that governed it.

OPA / RegoVersioned policy bundlesReproducible decision logs
04

Decision Proof Object

Independent verifiability

A cryptographic Decision Proof Object can be verified by third parties without access to our infrastructure. It contains references to input events, the policy version, a state hash, the approval chain, a determinism attestation, and a Merkle inclusion proof — the complete provenance of a decision in one object.

Input + policy + state hashApproval chainDeterminism attestation
05

Evidence, drift & trust budgeting

Self-regulation

An evidence-pack compiler with selective disclosure (SD-JWT, RFC 9901) shares only what is needed. A governance drift detector monitors degradation of governance discipline, and an operational trust-budgeting engine forces automatic de-escalation when a risk budget is exhausted — the system tightens its own autonomy under stress.

Selective disclosure (SD-JWT)Drift detectionTrust budgeting

How a governed decision flows

RequestEvaluated by the constitution first
ClassifyS / D / H governance class
GovernPolicy-as-code + human gate
ProveSigned, hash-chained, Merkle-anchored
VerifyDecision Proof Object, independently

The Control Plane

Constitutional governance of autonomous decisions

SentientROUTER is the control plane: it governs autonomous AI decisions before they act, evaluating a statically-compiled constitution ahead of any external query and gating execution fail-closed.

Constitution-first evaluation

A constitution compiled into the executable is checked before any autonomous action — and before any external source is queried. Class-H requests never reach external sources autonomously.

Multi-source consensus

Decisions are aggregated across at least three independent sources, with a Merkle hash per vote and an ArgMax decision function — no single source decides alone.

Governance drift detector

Router-specific drift detection watches S/D/H escalation frequency, divergence trend, and control-state variance to catch governance degradation early.

Offline-capable

A connectivity-loss mode keeps governance operating with guaranteed batch synchronization when links are unavailable.

SoulGCI Master

One governed architecture, eleven layers

SoulGCI Master is the umbrella architecture — a closed control loop that binds eleven architectural layers and four cross-cutting components into a single governed system.

A cognitive decision cannot produce a legal, economic, medical, or operational effect on a human subject without crossing a technical effectuation boundary. The proof plane (ProvableCORE), the control plane (SentientROUTER), and the medical vertical (T.E.H.N.O.F.A.R.M. OS) are preferred realizations of individual layers within this master architecture.

Layer 01Cryptographic proof

Merkle-chained, WORM-stored, offline-verifiable proof of every decision.

Layer 02Constitutional control & routing

Every request evaluated against a machine-versioned constitution before action.

Layer 03Governed execution

Execution under verified multi-field session and a controlled-phase engineering protocol.

Layer 04Human authority

An authority layer structurally independent of the cognitive layer.

Layer 05Planning

Structured planning of work ahead of governed execution.

Layer 06Judgment gate (CPE)

A judgment gate enforcing the Controlled Product Engineering protocol.

Layer 07Persistent memory

A durable memory layer feeding context into later decisions.

Layer 08Procedural skills

Reusable procedural skills available to the governed system.

Layer 09Edge inference

Inference at the edge with data-sovereignty preservation.

Layer 10Vertical workspaces

Domain workspaces carrying unified proof, control, and human-protection semantics.

Layer 11Authority control panel

A control panel for the human authority over the system.

+ Four cross-cutting components

Component 50

Human Protection Layer

A pre-flight gate between FINALIZED and EFFECTUATED states, a polarity engine, and a deterministic set of at least eighteen pre-flight rules.

Component 60

Anti-degradation core

A self-governance core with a default-DENY disposition and dual attestation against governance degradation.

Component 70

Evidence compiler

A selective-disclosure evidence-pack compiler using SD-JWT (RFC 9901).

Component 80

Durability gate

A durability gate with restore-tested parity.

The effectuation boundary

FINALIZED → EFFECTUATED

A central mechanism: the architectural separation between a decision being internally determined by the cognitive layer, and that decision being applied to a subject. The cognitive decision, by itself, is never sufficient to act.

FINALIZED

The decision is internally determined by the cognitive layer — but not yet applied to any subject or actuator.

Pre-flight gate
  • Pre-flight receipt
  • Human-authority artifact
  • Polarity class
  • Persistent proof object
EFFECTUATED

The decision is applied to the subject or consumed by an actuator — only after every gate check passes. The result feeds back into the trust budget and future governance.

The inventive step is not in any single component — a Merkle chain, a policy engine, a signature, a human-oversight mechanism can each be known on their own.

It is in binding them into a closed control loop where proof, authority, human protection, durability, and verification feed back into the system's future limits. Remove any layer, and the system collapses into known primitives without the synergistic effect. The system's future authority is mechanically limited by the verified quality of its past decisions — and cannot be unilaterally widened by the cognitive layer.

One family, four patents

How the patents fit together

The four applications are not separate products. SoulGCI Master (P4) is the umbrella architecture; the earlier three are preferred realizations of individual layers within it. Each can stand alone — together they form one governed system.

SoulGCI Master

AGEPI No. 7698 · 28 May 2026 · 40 claims

The umbrella — eleven layers + four cross-cutting components, bound into a closed control loop. Binds the layers below together with human authority, durability, memory, edge inference, and selective-disclosure evidence.

Layer 01 · Proof plane

ProvableCORE™

AGEPI No. 7671 · 14 Apr 2026

Preferred realization of the cryptographic proof layer — Merkle-chained, WORM-anchored, independently verifiable Decision Proof Objects.

Layer 02 · Control plane

SentientROUTER™

AGEPI No. 7672 · 17 Apr 2026

Preferred realization of the constitutional control & routing layer — multi-source consensus, drift detection, fail-closed, offline-capable.

Layer 10 · Vertical

T.E.H.N.O.F.A.R.M. OS™

AGEPI No. 7689 · 15 May 2026

Preferred realization of a regulated vertical — constitutionally-limited medical autonomy for isolated environments.

Each prior application is referenced for technical context as a preferred embodiment of a layer; its internal mechanisms are not re-claimed by the master application.

Vertical · Isolated environments

Constitutionally-limited autonomy

T.E.H.N.O.F.A.R.M. OS governs autonomy in isolated environments — where the human authority who would normally approve a decision is intermittently or temporarily unavailable. Its first and most demanding application is medicine.

Field and humanitarian medicine, space, maritime, polar, and rural settings, and secondary hospital decision support. It is organized as a closed loop of seven functional modules that dynamically limit autonomy by the verified quality of past decisions — the same principle applies wherever a system must act under uncertainty with delayed human review.

Axis 1 — Clinical urgency class

  • SSafe autonomous action.
  • DDraft for human review.
  • HMandatory human escalation.
  • PPalliative / expectant — no autonomous curative or invasive action; documentation, comfort, monitoring, and escalation only.

Axis 2 — Temporal availability mode

  • NORMALPhysician available within the stability window.
  • OFFLINERoutine offline operation.
  • BRIDGEPhysician exists but response time exceeds the stability window — stabilization only, no autonomy expansion.
  • NECESSITYDelay is more dangerous than action under uncertainty — temporary, auto-verified expansion only.
Module A

Two-axis classification

Every clinical request gets an urgency class (S/D/H/P) and a temporal mode — processed orthogonally, together setting the autonomy perimeter.

Module B

Mission Medical Twin

A cryptographically-linked state object — Patient, Operator, Resource, Environment — comparing the patient to population, personal, and environment-adjusted norms.

Module C

Degradation-sensitive perimeter

Recalculated every action from classification, operator capacity, sensor degradation, knowledge freshness, and resources. Cannot be widened unilaterally by the operator.

Module D

BRIDGE / NECESSITY transitions

Conditional autonomy expansion through two modes, enterable only via automatically-verifiable triggers. NECESSITY cannot be activated retroactively.

Module E

Probabilistic Medical Decision Object

Per inference: inputs, statistical model + version, probability with confidence interval, rejected hypotheses, cost-asymmetry, consent status, and resource limits — cryptographically linked.

Module F

Retrospective verification queue

Mandatory, non-self-closing. Two layers: independent automated re-analysis, then licensed-physician review. A case closes only after physician sign-off.

The system does not issue a final medical diagnosis and does not autonomously initiate prescriptions. It produces probabilistic decision objects, action drafts for operator co-signature, stabilization within the calculated perimeter, or structured physician-review packages. Cases generated in a physician's absence never close autonomously: the system signs the calculation, the operator signs the action, and a licensed physician signs the mandatory retrospective review. Accumulated verification debt mechanically contracts the system's permitted autonomy until cases are closed.

Application domains — each with its own constitution

Space

Orbital stations and long-duration missions. Orbital constitution, BRIDGE-to-Earth, mission medical officer integration.

Field & military

Field and humanitarian medicine. Field constitution, multi-patient processing, scarcity allocation by hierarchical rank.

Maritime

Cargo and passenger vessels. Maritime constitution, IMO Medical Guide, coast-guard transmission queue.

Polar

Extended-isolation stations. Polar constitution, psychological profile integrated into the operator component.

Rural

Remote clinics far from a physician. Non-action discipline, antibiotic-prescription limits, multilingual localization.

Where SoulGCI is going

From governed proof to enforced governance

The proof plane and the patent architecture are in place. The active research direction is to move governance from a verifiable record alongside the work to an enforced gate on the path of the work.

These are directions in active design and development — the next layers of the system, shown to make our trajectory clear.

In design

Conductor — the recognition gateway

A mutability gateway, not an agent: a mechanism through which any change to canonical state must pass a complete, witnessed path — owner intent → admission → lease → work zone → witness → evidence → independent verification → frontier transition → closeout — or the system does not recognize it as canonical. Human authority remains the only power over the irreversible.

In development

Enforced trust budgeting & drift

Moving the trust-budget and governance-drift mechanisms from specification onto the enforcement path — so that the system's future autonomy is mechanically, not advisorily, limited by the verified quality of its past decisions.

In design

Deliberative consensus (CDI)

An iterative deliberative-consensus track feeding admission decisions — structured multi-step deliberation before a change is admitted to the governed path.

Concept

Native context compression

An opt-in compression layer inside the control plane, governed by a hard denylist: never on commitment, evidence, legal, or enforcement context — only on volatile cost context, audit-mode first.

These items describe our development roadmap and architectural direction. They are stated as forward-looking work, distinct from the proof plane and patent claims described above.

Intellectual Property

A patent-pending stack

Four patent applications filed with AGEPI — the State Agency on Intellectual Property of the Republic of Moldova — establishing priority across the SoulGCI stack.

ComponentWhat it coversAGEPI Application
ProvableCORE™The proof plane — constitutional cognitive governance with cryptographic, independently verifiable proof of execution.No. 7671 · 14 Apr 2026
SentientROUTER™The control plane — constitutional governance of autonomous AI decisions with multi-source consensus and offline operation.No. 7672 · 17 Apr 2026
T.E.H.N.O.F.A.R.M. OS™Constitutionally-limited medical autonomy for isolated environments, with a dynamic clinical-autonomy perimeter and mandatory retrospective verification.No. 7689 · 15 May 2026
SoulGCI MasterThe umbrella — an eleven-layer governed cognitive infrastructure binding proof, constitutional control, human authority, durability, and verification into a closed control loop. 40 claims, 12 figures.No. 7698 · 28 May 2026

Patent-pending. AGEPI Applications No. 7671, 7672, 7689, 7698, filed by TF HOLDING S.R.L.

The Republic of Moldova became a contracting state of the European Patent Convention on June 1, 2026, opening the path to European patent protection. Trademark applications filed at AGEPI for the core marks.

Institutional Standing

Inside Moldova's AI governance agenda

The project contributed a formal advisory opinion to Moldova's Ministry of Economic Development, feeding the National AI and Data Governance Program 2026–2030.

The submission positions verifiability as a cross-cutting principle and resident, exportable intellectual property as a national asset — placing SoulGCI inside the formation of national AI policy, not observing it from outside.

Applications

Built for accountability-critical sectors

The proof plane is domain-agnostic. SoulGCI's verticals apply governed cognitive infrastructure where decisions must be defensible.

Agri-finance

ACS Bank OS

A governed credit-risk workspace for agricultural lending — the first instantiation of the proof plane, built on the Agro Capital Standard platform.

Land

TerraScore™

Land-intelligence scoring for financing and risk decisions, live at terrascore.eu.

Farmer

ACS FARMER™

A farmer-facing assistant for regulated agricultural workflows.

Medicine

T.E.H.N.O.F.A.R.M. OS™

Constitutionally-limited clinical decision support for isolated environments — field, space, maritime, polar, and rural medicine. The system signs the calculation, the operator signs the action, and a licensed physician signs the mandatory retrospective review.

Carbon & ESG

Provable sustainability

Provable traceability of sustainability data and reporting.

Critical infrastructure

Auditable operations

Auditable governance of decisions in energy and regulated infrastructure.

Available for design-partner pilots with regulated institutions.

The Ecosystem

One governed core, many verticals

SoulGCI is the governed core that every TF Group product is built on — the proof, control, and human-authority engine beneath the group's verticals.

The TF Group is a privately held group of companies in Dondușeni, Republic of Moldova. A parent holding owns the intellectual property and licenses it to operating companies; each vertical is an application of the same governed core.

The core

SoulGCI — Governed Cognitive Infrastructure

Cryptographic proof of every decision, constitutional control of autonomous action, and irreducible human authority — the engine on which every vertical below is built.

ProvableCORE™ · proof planeSentientROUTER™ · control planeHuman authority · effectuation gate

The verticals — built on the core

Agro Capital Standard

The institutional agricultural credit-risk platform — "Bloomberg/Moody's for agricultural lending." The first instantiation of the proof plane.

ACS Bank OSagrocapitalstandard.eu

TerraScore™

Land-intelligence scoring for financing and risk decisions.

Live · terrascore.eu

ACS FARMER™

The farmer-facing assistant for regulated agricultural workflows.

agrocapitalstandard.org

CORN PLATFORM

Corn-vertical structured financing.

cornplatform.capital

OILSEEDS PLATFORM

Oilseeds-vertical structured financing.

oilseedsplatform.capital

T.E.H.N.O.F.A.R.M. OS™

Constitutionally-limited autonomy for isolated environments — the medical vertical.

Patent-pending · AGEPI No. 7689

The group

Parent · IP holder

TF HOLDING S.R.L. IDNO 1025604010126

Parent holding. Owns and licenses the group's intellectual property, brand assets, domain portfolio, and trademark applications.

Technology operator

TF INTELLIGENCE PLATFORM S.R.L. IDNO 1026604000661

Develops and runs SoulGCI and the Agro Capital Standard platform.

Est. 1992 · tehnofarm.md

TEHNOFARM S.R.L. IDNO 1005600002358

Pharmaceutical, biotech, medical, and IT operations — active since 1992. The group's three-decade heritage behind the medical vertical.

Agricultural vertical

NORD NUC S.R.L. IDNO 1021604001777

Agricultural production, processing, forestry, and biotech R&D.

Construction vertical

TF ASSETS S.R.L. IDNO 1026604000041

Real estate, construction, and equipment-leasing operations.

Contact

Governed cognitive infrastructure, today

  • Proof plane
    Cryptographic decision receipts, independently verifiable, with tamper-evident audit packs.
  • Architecture
    Eleven-layer governed cognitive infrastructure bound into a closed control loop, with four cross-cutting components.
  • Patents
    Patent-pending across the stack — AGEPI Applications 7671, 7672, 7689, 7698.
  • Standing
    Contributing to Moldova's national AI governance program.

Let's talk

Built by TF INTELLIGENCE PLATFORM S.R.L. (Republic of Moldova) — part of the TF HOLDING group. EU-hosted infrastructure.

Addressstr. Independenței, 4, of. 40, MD-5101 Dondușeni, Republic of Moldova
EntityTF HOLDING S.R.L. · IDNO 1025604010126
AdminAlexandr Șcecaliuc