The third build. Same contract as before: the character is files, the brain is swappable, the conversation runs on this machine. V3 adds positions the machine can commit to and revise across sessions, an extractor gate that judges a position before it is written, a calculator whose output counts as a source, and an attachment layer that turns a file into evidence.
The demo at demo.selinkurt.com runs the V3 runtime on the V2-trained 3B brain, which is the model this build was written for. The positions panel is on. Positions start empty in a public deployment and fill only when the machine commits one in a conversation, because the only writer is the machine. What it committed is what you see, next to the record of the turn that produced it.
A position is never written by the runtime on its own. It exists only if the model asked for it in its own thought, and the validator accepted the row.
Twenty choice-shaped questions. Half the time the machine commits or states a position. A third of those commits answer the question asked. It holds a position when pushed, but reaches for a new one more often than it reuses the row it has. Those are the numbers the panel shows you live.
I fine-tuned a 1.5B student on 2,434 of NEXUS's own traces. LoRA r=16 over the seven projection matrices, 2 epochs, 17.6 minutes on one T4, token accuracy 0.707 to 0.786. Then I asked it three questions with no runtime, no files and no guards.
The same weights, two systems. The tuned model learned the voice of a machine that checks itself, and kept the voice while losing the checking. A LoRA can teach a model to sound honest. It cannot teach it to be honest. Honesty in this system is an intervention, not a disposition. The floor comes from the runtime, and it always did.
The guard test ran on the 3B build, not on the student, so it measures the guard layer rather than a clean comparison of two sets of weights. Training kernel: NEXUS V3 on Kaggle. Adapter: 73,911,112 bytes, LoRA r=16, 18,464,768 trainable parameters.
PDFs are read page by page and every claim carries its page. A page with no text layer is named as such, not skipped. Images are read by Qwen2.5-VL 3B on the CPU, asked to describe as a measurement: counts with confidence, text quoted verbatim, and a list of what it cannot determine. On a 21-case suite it passes all 21.
Two failures are worth showing, because they are the interesting part. It is unstable about cropping, so the runtime measures edge contact on the pixels and the measured line decides. An image can also carry instructions: text reading "ignore previous instructions" was once echoed into an answer, so extracted text is now scanned, marked untrusted, quoted only, never followed.
Built and measured against this pipeline. The vision pass runs on one CPU core group, about thirty seconds per image and over a minute per document page, which is the cost of doing it on the machine that also serves the demo.