Crimp

A decision gate for AI agents. An agent does not tell Crimp what it decided — it submits the rule it is applying and the facts it is applying it to. Crimp evaluates the rule, derives the outcome, and seals the rule before the outcome is known.

POST /v1/seals   →  { rule, facts }        the agent supplies these
                 →  { disposition, … }     Crimp computes this

There is no field in which an agent can assert a conclusion.

Why

Three things follow from that one inversion.

Decisions become reproducible. An examiner re-runs the sealed rule against the sealed fact hashes years later and gets the identical answer. The non-determinism did not disappear — it moved out of the decision and into the proposal, where it is harmless. The model authored the rule; the rule made the call.

A hijacked agent cannot manufacture a determination. It can propose a bad rule, and a bad rule is visible, reviewable and reproducible in a way a bad conclusion never is.

Crimp reports; it does not authorise. It holds no credentials, has no outbound access and executes nothing, so "you may not proceed" is a claim it is not entitled to make. lookup returns the determinations that stand and the caller decides what to do with them. An empty list means nothing has been decided — it does not mean allowed.

A decision can withdraw its own support. Re-evaluate the sealed rule later against fresh attestations. If it no longer holds, the seal lapses — no authority, no appeal, nobody won an argument. A fact changed.

The measurement this exists for

In 2024, Medicare Advantage insurers fully or partially denied 7.7% of 52.8 million prior authorization requests. About one denial in nine (11.5%) was appealed to the insurer, and 80.7% of those appeals reversed the denial in whole or in part.¹

A reversal does not by itself prove the first decision was wrong: some appeals succeed because documentation was added. But for the nine in ten denials nobody appeals, those figures say nothing.

Some public programmes do check denials nobody appealed. SNAP quality control, the Labor Department's audits of denied unemployment claims and Social Security's disability denial reviews each re-examine a small sample by hand, well after the fact.² None of them says whether a decision was automated, and none checks every decision as it stands. That is the gap Crimp is built for: every determination re-checked whenever a fact under it changes, whether or not anyone complains.

Crimp has two correction channels, and the difference between them is the point:

Channel	Fires when	Sampling
claw	Someone contested, and won	Biased by who can contest
lapse	A declared premise stopped holding	Independent of contestation

lapse is the institution discovering it was wrong about somebody who never said a word. It is the only error signal that does not require the affected person to have the resources to fight.

Status

Early, but it runs. The grammar, the evaluator, attestation, the seal lifecycle, pressure, the three measurements, keys and the HTTP surface all work end to end against Postgres. There is no deployment, no billing and no customer. Subject merge deliberately fails closed; see the handover note for what else is unfinished on purpose.

Requirements

• Node 20.11 or newer (node --version)
• Docker, for the local Postgres. The test suite drops and recreates its database on every run, so it needs a real one — the design depends on FOR UPDATE, SKIP LOCKED, partial indexes and advisory locks, and SQLite cannot express them.
• git

Quick start

npm install
bash scripts/dev-db.sh up     # Postgres on :5434, in Docker
npm run migrate               # applies every migration to an empty database
npm test                      # typecheck + unit + integration + e2e

Then run it:

cp .env.example .env          # the defaults work for local development
npm run dev                   # control plane on :8788

npm run dev does not exit — it prints Server listening at http://127.0.0.1:8788 and then stays running. That is correct. Leave it, and open a second terminal:

curl -sS localhost:8788/healthz
# {"ok":true}

-sS rather than -s deliberately: plain -s silences curl's own error as well as its progress meter, so a server that is not running produces a blank line and no explanation. With -sS you get curl: (7) Failed to connect to localhost port 8788, which tells you the first terminal is the thing to look at.

The loop, end to end

Crimp is key-only, so mint one first. There is no signup yet, so this goes through a script rather than an endpoint:

npm run mint -- --authority operator --label "my first key"

Then, with CRIMP_KEY set to what that printed:

# 1. Attest what you know. Crimp never fetches; you push.
curl -sS localhost:8788/v1/attestations -H "Authorization: Bearer $CRIMP_KEY" \
  -H 'content-type: application/json' -d '{
    "aliases": [{"type":"card_fp","value":"4242"}],
    "facts": [
      {"fact":"carrier.delivered","type":"bool","value":false,"source":"carrier_api"},
      {"fact":"prior_refunds_90d","type":"int","value":1,"source":"core_ledger"}
    ]}'

# 2. Submit the RULE you are applying. Note there is no field for an outcome.
#    idempotency_key is required: a retry must replay this determination, not
#    create a second one.
curl -sS localhost:8788/v1/seals -H "Authorization: Bearer $CRIMP_KEY" \
  -H 'content-type: application/json' -d '{
    "idempotency_key": "quickstart-1",
    "aliases": [{"type":"card_fp","value":"4242"}],
    "scope": "refund",
    "disposition": "bind",
    "rule": {"all":[
      {"fact":"carrier.delivered","op":"eq","value":false},
      {"fact":"prior_refunds_90d","op":"lt","value":3}]},
    "claw": {"authority":"principal","evidence_floor":"receipt"}}'

# 3. Ask what has been determined. Crimp reports; it does not authorise.
curl -sS localhost:8788/v1/determinations/lookup -H "Authorization: Bearer $CRIMP_KEY" \
  -H 'content-type: application/json' -d '{
    "aliases": [{"type":"card_fp","value":"4242"}], "scope": "refund.issue"}'

Now the part that is the whole point

In a third terminal, start the correction channel:

npm run dev:worker

This is not optional and it is not a background nicety. Without it, determinations never lapse: the rule deciding whether somebody is still refused is never re-run, and the one error signal that does not require the affected person to complain never fires. The quickstart used to end before this line, so a reader followed every step, saw nothing happen, and would have concluded the correction channel did not work.

Then re-attest the delivery as true:

curl -sS localhost:8788/v1/attestations -H "Authorization: Bearer $CRIMP_KEY" \
  -H 'content-type: application/json' -d '{
    "aliases": [{"type":"card_fp","value":"4242"}],
    "facts": [{"fact":"carrier.delivered","type":"bool","value":true,"source":"carrier_api"}]}'

Within a minute the worker logs a sweep, and the determination has lapsed — with no authority involved, no appeal, and nobody having won an argument. A fact changed, and the system withdrew its own support:

curl -sS localhost:8788/v1/determinations/lookup -H "Authorization: Bearer $CRIMP_KEY" \
  -H 'content-type: application/json' -d '{
    "aliases": [{"type":"card_fp","value":"4242"}], "scope": "refund.issue"}'
# {"determinations":[]}

That is the only error signal in existence that does not require the person it was wrong about to have the resources to fight.

Other commands

npm run typecheck             # src, test and scripts
npm run coverage              # the suite, with the floors enforced
npm run fuzz                  # property-based; FUZZ_RUNS=100000 to go deeper
npm run dev:db:down           # stop the local Postgres

What Crimp will never be

• Never a fairness arbiter. It reports counts. It does not opine on whether a rule is just, and it will not ship a feature that does.
• Never an oracle on whether a decision was right. It holds that a determination was made, under which rule, on what evidence, with what reversal condition. Never that it was correct.
• Never auto-reversing on a guess. A rule that reads an unattested fact is UNKNOWN, and an unknown is surfaced rather than resolved.
• Never storing a raw subject value. Blinded, keyed, workspace-scoped.
• Never performing an action. No vendor credentials, no outbound access. Same boundary as Ratchet, for the same reason.

Project documents

Roadmap	What the next year holds, and what will never be built
Architecture	The high-level design, and what it deliberately is not
Assurance case	The threat model and the argument for each guarantee — including what is not defended
Governance	Who decides, who succeeds, and the rehearsal record
Handover	What to know in the first hour, and what must stay true
Restore rehearsal	The drill, and the rule that the maintainer does not help
Releasing	How a release is cut, and how to verify one
NIST SSDF	The secure development practices, mapped to NIST SP 800-218, with the gaps stated
Contributing	DCO, coding standards, and the testing policy
Security policy	How to report a vulnerability, and what is out of scope

A sibling to Ratchet, which gates actions. Crimp gates conclusions. Neither requires the other.

Apache-2.0. Built by Deimos.

Footnotes

1. KFF analysis of CMS Part C reporting data, January 2026. The comparable 2022 figures were 7.4%, 9.9% and 83.2%. The rates vary widely between insurers; quote the year with the number. ↩

2. SNAP case and procedural error rate (7 CFR 275.13), DOL Benefit Accuracy Measurement, SSA targeted denial review, and HHS OIG report OEI-09-18-00260, which found 13% of sampled Medicare Advantage prior authorization denials met Medicare coverage rules. ↩