A runtime that sits between intent and consequence.
Otarx evaluates proposed state transitions before a protected system makes them real. The architecture separates proposal, proof, admission, and enforcement.
From S0 to S1 only by admission.
S0 represents the protected system’s current canonical state. A principal or delegate proposes an action. Otarx evaluates the claim that this action should produce a new state. If admitted, the signed reality decision gives the enforcement adapter the context needed to realize S1. If denied, S0 remains unchanged.
Action
Contract
Convergence
Decision
Adapter
Define what must be true before consequence.
A reality contract binds the target object, requested operation, consequence level, required authorities, evidence conditions, contradiction handling, and enforcement expectations into a decision context. Contracts make the admission requirement explicit instead of leaving it implicit across application code and policy fragments.
No single perspective has to define reality.
Otarx can combine independent evidence families such as identity, authority lineage, relationship, device context, declared intent, time, sequence, source reliability, contradiction, and anomaly signals. The runtime evaluates whether the evidence converges strongly enough for the specific consequence under review.
Compromise must survive the whole reality test.
Compromising one agent, credential, or application does not automatically establish the truth of a consequential claim. The requested state transition still has to satisfy the reality contract, survive contradictory evidence, receive a signed decision, and cross the enforcement boundary.
The adapter is where decisions become enforceable.
The enforcement adapter does not decide whether the claim is valid. Otarx has already produced that decision. The adapter verifies the signed result and exposes the approved operation to the protected system. A denied claim receives no authorized consequence path.