OMEGA: A Kernel-Verified Hybrid LLM-Symbolic Substrate

Technical description

Warren Smith, WRKS Holdings Ltd  ·  Version 1.3  ·  May 2026  ·  omegaprotocol.org/substrate/

OMEGA is a hybrid LLM-symbolic substrate in which non-deterministic model output is translated into structured representations and resolved through symbolic reasoning, governance protocols, and a formally verified core.

1. WHAT OMEGA IS

Institutions already make consequential decisions that must later be explained, defended, and audited. Today, those decisions are recorded inconsistently across logs, notes, and disconnected systems, making reconstruction difficult and accountability fragile. As decisions become more distributed across humans and AI systems, this problem compounds.

When an AI agent acts, existing audit infrastructure records what happened. OMEGA records why it was valid.

OMEGA is infrastructure for producing inspectable, defensible decision records. It captures how a decision was made, what it depended on, and the authority under which it was taken. Technically, it is a kernel-verified hybrid LLM-symbolic substrate where symbolic systems do the load-bearing reasoning and large language models handle perception and translation. Lean 4 verifies the substrate's structural properties. Eight protocol libraries provide composable governance primitives.

The architecture exists to serve a single function: producing records that institutions can trust under scrutiny.

This is a form of decision provenance infrastructure. What follows describes the substrate that produces these records: the protocols, the verification, the runtime, and the systems that compose with it.

2. The Architecture

OMEGA is a layered system with strict role separation. Each layer has a defined function and does not substitute for adjacent layers.

Decision production Clinical, safeguarding, engineering, strategic Decision governance Runtime enforcement, audit bundles, integrity Substrate infrastructure Vector store, knowledge graph, lineage, queries Operator interfaces Decision briefs, consoles, applications

Core substrate components

OMEGA Protocol v1.4.1: Defines the primitive operations for representing decisions, assumptions, consent, disputes, and trust.

Eight protocol libraries: CAP, CLP, CNL, DSP, EGP, HTP, ARP, TSP. Each defines a distinct governance construct. Libraries are versioned and independent.

@omega-protocol/contracts: Defines interfaces for interacting with protocol primitives across systems.

Lean 4 verification layer: Formally verifies the structure and composition of the protocol bundle.

Decision API: Executes protocol operations, records traces, and provides runtime access.

Composing systems

OPLAS: Deterministic abstraction system. Converts inputs into structured representations. No learned models participate in the parse path.

Translation Trinity (SRFC, TSRFC, VRFC): Domain compilers mapping between natural language, structured forms, and domain schemas.

3. THE GOVERNED DECISION RECORD

OMEGA produces a single, canonical artefact: the Governed Decision Record. This is the unit of inspectable cognition the substrate generates.

Governed decision record Context Situation, prior state, constraints Decision What was decided, when, by whom Reasoning Inference chain, factors weighed Evidence and assumptions Inputs used, assumptions recorded Authority Who was authorised, basis Constraints checked Required checks performed Disputes Recorded disagreements Consent Stakeholder voice, sharing Harm trace Rejected paths and their risks Outcome Recorded after the decision Provenance Hash chain, schema version, prior record link

A Governed Decision Record contains:

The Record is implemented as the canonical OmegaRecord schema: schema-validated, deterministically hashed, and composable across systems. It is designed to survive audit, dispute, replay, and institutional memory.

Existing institutional object types (invoice, audit log, consent form, clinical note, board minute) crystallised when their domains needed inspectable evidence of specific kinds. OMEGA proposes the same pattern for decisions that need to be defensible under scrutiny: AI decisions, hybrid human-AI decisions, and increasingly, institutional decisions that span both.

Concrete examples of Governed Decision Records are published at /record/example/ across five domains:

The schema does not change across domains. The same record structure handles burns triage, school safeguarding, surgical device design review, institutional equity execution review, and autonomous laboratory governance. This is the substrate's central claim: decision provenance is domain-independent infrastructure, not a domain-specific tool.

Without a record like this, decisions must be reconstructed after the fact from partial evidence. The Governed Decision Record makes them inspectable at the point they are made.

The Record is what OMEGA produces. Everything else in this paper describes the substrate that produces this record.

4. What Flows Through OMEGA

OMEGA operates on explicit objects rather than implicit model state.

The primary units are:

LLM outputs are not used directly. They are translated into these objects, which are then processed through abstraction, symbolic reasoning, and governance layers.

All system behaviour is expressed as transformations over these objects.

5. Verification Properties

OMEGA Protocol v1.4.1 includes a Lean 4 verified bundle: 22 conjuncts, v1.4.1. The bundle is kernel-verified with zero sorry.

The verification establishes:

The verification does not establish:

Verification applies to the substrate structure. It does not extend to all behaviour built on top of it.

Kevros (TaskHawk Systems, March 2026) verifies an enforcement kernel: 20 Lean 4 theorems on top of a six-layer stack (TLA+ exhaustive checking with TLC, Kani bounded model checking, Verus SMT proofs, runtime assertion checks, golden-vector cross-language equivalence, and Lean 4 deductive proof). Its proofs say a DENY verdict produces zero actuation. OMEGA's 22 conjuncts say something different: they specify the structural composition of the protocol primitives that constitute a valid governed decision record. Kevros proves the gate is sound. OMEGA proves the record passing through the gate is well-formed. Different layers; both necessary.

6. Architectural Commitments

1. Separation of roles. LLMs translate and interface. Symbolic systems reason and constrain.

2. No model output is authoritative. All non-deterministic outputs must be translated into protocol-defined representations before use.

3. Symbolic systems are load-bearing. Constraint satisfaction, reasoning, and validation occur outside the model.

4. Deterministic abstraction precedes reasoning. Inputs are normalised before entering symbolic systems.

5. Governance is first-class. Decisions, assumptions, consent, disputes, and harm are represented explicitly.

6. Verification is embedded. Formal verification is applied at the protocol layer.

7. Traceability is required. All decisions can be recorded and inspected through runtime systems.

7. Why Hybrid LLM-Symbolic

LLMs and symbolic systems have complementary properties.

LLMs:

Symbolic systems:

Using LLMs alone leaves reasoning implicit and difficult to verify. Using symbolic systems alone limits interaction with unstructured inputs.

Hybrid systems separate these roles.

This pattern has been independently explored in multiple research contexts combining neural systems with formal reasoning engines. OMEGA is one implementation of this pattern, with an explicit governance layer and a formally verified protocol core.

FormalJudge (Zhou et al., arXiv:2602.11136, February 2026) takes a neuro-symbolic route to oversight: LLMs act as specification compilers that decompose human intent into Dafny constraints discharged by Z3, replacing probabilistic judging with mathematical guarantees.

Structured Cognitive Loop (Kim, arXiv:2511.17673, November 2025) separates agent cognition into five phases (Retrieval, Cognition, Control, Action, Memory) with a Soft Symbolic Control governance layer that reports zero policy violations across its evaluation set.

7.5 Independent evidence

Three independently authored research artefacts speak to OMEGA's design choices and the landscape it operates in.

Lipton and Steinhardt (arXiv:1807.03341, 2018) document the machine-learning scholarship failure modes (opaque empirical claims, unfalsifiable benchmarks, unattributed reasoning) that OMEGA's record discipline is designed to prevent at the point of decision.

MLAgentBench (Huang et al., arXiv:2310.03302, 2023) provides the missing baseline for autonomous research-agent governance: a benchmark suite whose tasks correspond directly to the agent-decision class OMEGA records are intended to make inspectable.

ResearchAgent (Baek et al., arXiv:2404.07738, 2024) closes the landscape gap in surveys of autonomous research systems, offering a concrete instance of the LLM-driven research-agent class whose decisions OMEGA is designed to govern.

8. What's Been Built With It

The substrate composes with systems across domains. Current categories of composing systems include:

DECISION PRODUCTION

Systems that make decisions and emit records of those decisions. Examples include:

DECISION GOVERNANCE

Systems that enforce decision contracts at runtime and produce audit bundles:

SUBSTRATE INFRASTRUCTURE

Systems that store, query, and reason over accumulated records:

OPERATOR INTERFACES

Systems through which humans interact with substrate-backed work:

Each category compounds with the others. Records produced by Decision Production systems flow through Decision Governance to Substrate Infrastructure where they accumulate as queryable provenance records. Operator Interfaces let humans inspect, query, and act on what the substrate has accumulated.

Cognitive Infrastructure

Foundational reasoning and synthesis systems composed with substrate primitives.

Substrate Runtime

Live infrastructure that holds canonical OmegaRecords and exposes substrate capabilities.

Decision Governance

Systems emitting canonical decision records with audit and replay.

Domain Reasoning

Domain-specific governance systems composing through the shared adapter pattern.

Translation Trinity

Domain compilers for structured translation between natural language and formal representations.

Formal Verification Composition

Symbolic reasoning systems with formal verification composed into canonical records.

Multi-Agent Governance

Multi-agent systems with per-agent and per-run canonical record composition.

Applied Interfaces

Operator and user interfaces composing with substrate.

These systems use different subsets of the substrate. They demonstrate composition rather than define the substrate.

9. THE OPERATOR LAYER

The substrate addresses how decisions become records. The operator layer addresses how governed records are produced consistently and enforced operationally.

Records are valuable only if systems consistently produce them and governance contracts are enforced reliably at runtime. The operator layer is the runtime that enables this.

GUARDIAN RUNTIME

Guardian Runtime is the architectural pattern for substrate's reference operator implementation: it wraps systems that produce decisions, enforces decision contracts at runtime, generates audit bundles, and routes records to substrate storage.

The first domain implementation, Omega Governed Runtime for safeguarding decisions, includes:

Additional domain implementations (compliance, clinical, financial) compose with the same architecture as deployments require.

Guardian Runtime is proprietary. The OMEGA protocols it implements are MIT licensed and freely available.

The runtime is not currently running in production NHS or commercial environments. Production deployment requires institutional engagement with proper information governance, security review, and clinical safety assessment. The runtime exists; it is ready for that pathway, not yet on it.

DEPLOYMENT MODEL

Example deployment patterns may separate:

This separation matters because consequential decisions in production environments often span machine boundaries. A clinical decision support system on one machine should produce records that flow to substrate storage on another, with audit bundles generated by the operator runtime in between. Development deployments may operate on a single machine, while regulated environments typically require clearer separation between governance, processing, and storage responsibilities.

Core runtime components and deployment patterns are implemented and documented. Activation across multiple machines for production deployment is pending institutional collaboration that requires it.

WHY THE OPERATOR LAYER MATTERS

Decision provenance without an operator layer is a schema, not infrastructure. The schema describes what records look like. The operator layer enables governed records to be produced consistently under operational conditions.

The substrate paper to this point has described the schema and the composing systems. The operator layer is what makes governed records produceable under operational conditions.

9.5 Standards Alignment

OMEGA's record schema is designed to compose with existing AI-provenance work, not to replace it.

VAP Framework (draft-kamimura-vap-framework-00, January 2026) is an architectural coordination layer for evidentiary-grade AI decision trails. OMEGA can serve as a VAP-compliant domain profile.

VAP-LAP (draft-ailex-vap-legal-ai-provenance-02, February 2026) extends VAP for the legal-AI domain and defines unified Bronze / Silver / Gold conformance levels. OMEGA's record structure is designed to map to the Gold tier: hash-chain integrity, digital signatures, a completeness invariant against selective logging, and the standardised Evidence Pack format for regulatory submission.

AIGA (draft-aylward-aiga-00, January 2026) defines an application-layer protocol for agent identity, authentication, and hardware-enforced termination via Trusted Execution Environments. AIGA answers who the agent is. OMEGA answers whether its decisions are valid. The two operate at adjacent layers and compose naturally.

AgDR (Atomic Genesis Decision Record, v0.2) is a kernel-boundary sealing standard with BLAKE3 hashing and Ed25519 signing. OMEGA operates above AgDR. It defines what the system commits to sealing (the Governed Decision Record) rather than the sealing mechanism itself. An AgDR seal can be referenced from an OMEGA record.

draft-sharif-agent-audit-trail-00 proposes a standard logging format for autonomous AI systems. OMEGA's hash chain implements per-record integrity compatible with the draft's tamper-evidence requirements.

EU AI Act Article 12 mandates record-keeping for high-risk AI systems, with high-risk obligations effective 2 August 2026. The OMEGA Governed Decision Record is designed to satisfy Article 12 logging requirements end-to-end: what data was used, which model version, what context was retrieved, whether a human reviewed the output, and an integrity chain that lets a third party verify the record was not altered after the fact.

10. Honest Limits

OMEGA is a substrate, not a complete system.

OMEGA does not resolve uncertainty or error. It makes them explicit and inspectable. Future protocol library expansion is planned for behavioral drift detection, C2PA-compliant provenance export, mechanistic interpretability primitives, and auto-formalization tooling for policy axioms.

11. Author

Warren Smith is a UK-based independent developer working under WRKS Holdings Ltd.

OMEGA combines protocol design, formal verification, symbolic reasoning, and runtime infrastructure to provide decision provenance infrastructure for consequential systems.

The system is an architectural implementation. Its usefulness depends on how it is composed and applied.