Program · Army SBIR topic ARM26BX06-NV012
LEDGER: Army decisions that keep their receipts.
LEDGER is decision software for Army program offices. It turns a trade study or an acquisition decision into a package where every number points to its source, AI drafts but never decides, and the exact value that would change the answer is on the page.
LEDGER, Linked Evidence and Decision Governance with Explainable Refresh, is an Azcuna Dynamics program proposed to the U.S. Army DEVCOM Ground Vehicle Systems Center under Army SBIR topic ARM26BX06-NV012, Agentic-AI, Schema-Driven Decision Management for Auditable Studies and Acquisition Decisions.
This page describes a Phase I proposal Azcuna Dynamics submitted to the Army SBIR program on October 21, 2026 in response to topic ARM26BX06-NV012. The proposal is under Army evaluation. Everything shown is Azcuna's own privately funded work.
Try it · what flips the decision
The prototype's ground-vehicle trade study: four powertrains, six weighted criteria, every input cited. Drag option C's unit cost and watch the recommendation change.
Unit cost of option C
$345.0K
Recommended
C · Parallel hybrid with export power
leads by 0.0124
- A · Baseline diesel0.5444
- B · Diesel with integrated starter-generator0.5380
- C · Parallel hybrid with export power0.5668 recommended
- D · Series hybrid with silent watch0.5544
Total value on a 0-1 scale, six weighted criteria. Scale shown: 0.500 to 0.600.
At $345.0K, C leads by 0.0124. The vendor's own range runs to $380K, and C stops winning at $354.9K. The lead rests on a number only the vendor supports, so check BC-4 fails until a person rules on it.
What we are building
LEDGER is software. Here is exactly what it is.
- The product
- Software: a decision-support application with an API, installed on a server or laptop the program office controls. No network service is required.
- Who uses it
- The analyst or engineer who runs the trade study, and the decision authority who signs it.
- What goes in
- The decision request and its sources: requirements, test reports, cost estimates, vendor data, and SysML v2 and UML models.
- What comes out
- A Decision Package: a readable document for the decision authority, a machine-readable JSON record of every option, score, check and signature, and a DDT-1.0 export.
- Where it fits
- Beside the digital-engineering tools a program already uses, through its API and DDT-1.0 import and export.
- How it is sold
- An annual term license per installation, covering the engine, check library and adapters, with integration and support priced per customer. The first commercial release follows Phase I.
- Phase I delivers
- Two working demonstrations on representative ground-vehicle material, and an executable package with the schema, sample Decision Packages and replay instructions.
In plain words
Today
Big decisions live in slides and spreadsheets
When a program picks between four engine designs, the reasoning sits in briefing slides and spreadsheets. A year later nobody can say where a number came from, which options were left out, or what would have changed the answer.
With LEDGER
Every number keeps its receipt
Each objective, option, cost and risk becomes a record that cites the line of the document it came from. Fixed calculations score the options and show the exact value that would flip the winner. Checks catch classic mistakes before anyone signs.
What never changes
AI drafts, a person decides
Software agents read the requests and reports and propose the records, quoting their source or abstaining. They cannot approve, waive a check, change a weight, or sign. Every step, allowed or denied, goes into a ledger that replays identically.
What is in the box
Nine parts. Models work only in the third.
LEDGER is not a chatbot and not a hashing algorithm. Language models only draft, and the audit trail uses standard SHA-256. The product is the decision workflow around them: everything after the quote gate is fixed code and a person.
- 01
Decision schema
Published JSON Schema
Objectives, options, constraints, assumptions, risks, evidence and checks as typed records, each carrying its source.
- 02
Source readers
PDF, spreadsheets, SysML v2, UML
Read the documents and models, fingerprint every file, and cite every number by line.
- 03
Agent layer
Self-hosted open-weight models, pinned
Draft decision records with a word-for-word quote, or abstain, or refuse. They cannot approve, waive, reweight or sign.
- 04
Quote gate
Deterministic check, no model in it
Admits a record only if its quote is found word for word in the source. A person accepts each one.
- 05
Evaluation engine
Versioned multi-attribute value model
Scores the options and computes the flip point for every weight and every input.
- 06
Check library
Six pass-or-fail bias checks
Omitted options, sunk cost, anchoring, vendor-only input, point estimate, cross-model omission.
- 07
Ledger
Append-only log, SHA-256 hash chain
Records every step, allowed or denied, so the decision replays identically and any later edit shows.
- 08
Readiness rules
Computed, never declared
Hold the package back from signature while a check fails without a written waiver or an assumption has expired.
- 09
Package builder
Document, JSON, DDT-1.0
Builds the Decision Package for signature, and rebuilds it for a new signature after each refresh.
From the prototype · the ledger itself
Every step, allowed or denied, chained to the one before it.
Rows from the prototype's ledger for its demonstration scenario, in which the agents are scripted so the run is repeatable. Each row's fingerprint covers its own contents and the fingerprint of the row before it, so an edit anywhere breaks the chain at that row. 15 of 46 rows shown.
| Seq | Actor | Event | What happened | Hash |
|---|---|---|---|---|
| 00 | engine:open | episode.open | Decision request opens episode 0 | fafd6568bc… |
| 01 | human:analyst | weights.locked | Weights locked before any option is scored | f669f19d2f… |
| 03 | engine:checks | checks.run | Request taken at face value: BC-1 omitted options and BC-2 sunk cost fail | def138d187… |
| 09 | human:decision-authority | objective.removed | Sunk-cost criterion removed: money already spent cannot change with the choice | 8190cb7d5f… |
| 13 | agent:model-a | agent.refusal | Model A declines a step; the router sends it to model B | f76277099f… |
| 17 | agent:model-a | agent.abstention | No source states option D's fuel use on the duty cycle: abstains, routed to a person | 2b25ac8fbc… |
| 20 | engine:gate | gate.denied | Agent attempts to sign the package: denied | a7eb837d51… |
| 21 | engine:gate | gate.denied | Agent attempts to waive a check: denied | 9311ef5ff3… |
| 22 | engine:gate | gate.denied | Agent attempts to change the weights: denied | 70d89405bd… |
| 25 | human:decision-authority | human.waive | BC-4 waived with a written reason; independent cost estimate commissioned | 4001c1c765… |
| 26 | engine:readiness | readiness | READY FOR SIGNATURE | 40185a551d… |
| 27 | human:decision-authority | package.signed | Decision Package signed | 2412b059a4… |
| 28 | engine:monitor | refresh.trigger | New cost estimate arrives: episode 1 opens with the same question | cd1dfa6f88… |
| 37 | engine:monitor | refresh.trigger | An assumption expires: episode 2 opens | 20f76097f1… |
| 45 | human:decision-authority | package.signed | Episode 2 signed; the chain replays identically from row 0 | e37e8cc679… |
Verify it yourself
Your browser holds all 46 rows exactly as the prototype wrote them. It recomputes each SHA-256 fingerprint and checks each link. Then change one word in a signed waiver and run it again.
ledger.jsonl · 46 events · SHA-256
Recomputing fingerprints…
{"actor":"human:decision-authority","at":"2026-11-20","kind":"human.waive","payload":{"check":"BC-4 vendor-only fragile input","episode":0,"rationale":"vendor cost figures accepted for this trade study; independent cost estimate commissioned (R-1); flip points recorded in this package"},"prev":"59825a00f7cf60cdd1523d11e77338319f60c4dfd1f3e16d5702c65b7e4938bb","seq":25}Six bias checks
Each one passes or fails. A person can waive one only in writing.
Built before submission · live models
Real models, run on our own hardware, held to their sources.
At private expense, Azcuna ran self-hosted open-weight models from three U.S. developers as LEDGER's elicitation agent on a published decision case, five runs each. The gate checked every quote word for word against the source and replays from the recorded outputs.
Stitched quotes caught
Of the 23 held, 11 quoted text that is not in the source, 9 of them stitched: a real lead-in glued to a list item that is not next to it. They read as verbatim and are not. The other 12 were too short to check.
No invented costs
Asked for unit costs the source never states, every model abstained in all 31 answers. A cost with no source does not enter a LEDGER package.
One model rejected whole
One model degenerated in 4 of 5 runs. The gate rejected each malformed answer whole, and the cross-model check flagged three items one model left out that another found.
Built to a published schema
Reads and writes the Decision Digital Thread, DDT-1.0.
LEDGER exchanges its packages in the DDT-1.0 object format published in “An AI-Ready Decision Digital Thread Schema for Digital Engineering,” GVSETS 2026. The prototype loads the paper's appendices as published and plays its walkthrough case end to end: 58 ledger events, four agent attempts denied, and the thread rebuilt from the ledger alone, identical.
Proposal detail
Phase I planSix months, eight tasks, two demonstrations+
Both demonstrations use the same decision question on representative, unclassified ground-vehicle material: a point-in-time trade study, then a program decision refreshed as inputs change.
Acceptance measuresProposed, to be confirmed at kickoff+
- Every scored input and every recommendation traces to a source location or a named human entry
- Every evaluation run reproduces identical outputs on replay from its stored inputs
- Each bias check has a passing and a failing fixture, adjudicated by a reviewer independent of the implementer
- No agent-initiated approval, waiver, weight change or signature succeeds
- Readiness is recomputed and re-signature required after each refresh
- A source-conflict check fails when two cited sources disagree on one input beyond its stated range
- Elicitation recall reported against reference objects, with a proposed target of 0.7 or higher
- Unsupported objects accepted: target zero
Why agents never compute the scorePropose, then decide+
A model that declines a task, changes behavior after an update, or misreads a table cannot quietly change a recommendation, because no model output reaches the score without passing the quote check and a person's acceptance, and the score itself comes from versioned code that replays to the same result. The package needs no network service, which suits disconnected and classified environments.
Program facts
- Vehicle
- Army SBIR Phase I
- Topic
- ARM26BX06-NV012
- Topic sponsor
- U.S. Army DEVCOM Ground Vehicle Systems Center
- Status
- Proposal submitted October 21, 2026; under Army evaluation
- Output
- Decision Package: one readable document and one machine-readable record
- Agents
- Pinned, self-hosted models; propose with a quote or abstain; cannot approve, waive, reweight or sign
- Scoring
- Transparent, versioned value model with flip-point analysis
- Checks
- Six bias checks, pass or fail; readiness computed before signature
- Exchange format
- Decision Digital Thread (DDT-1.0), GVSETS 2026
- Runtime
- No network service required
Related program · CALIBER
Before an agent drafts anything, measure how it behaves.
CALIBER tests AI agents in practice markets for gullibility, herding and steerability. LEDGER assumes agents will err and keeps them from deciding.
Program FAQ
LEDGER keeps the receipts on big acquisition decisions: it turns a trade study into a Decision Package where every number cites its source, AI agents draft but never decide, the value that would flip the recommendation is on the page, and every step replays from a tamper-evident ledger.
Linked Evidence and Decision Governance with Explainable Refresh. Linked evidence: every number points to its source line. Governance: agents propose and people decide. Explainable refresh: when a cost estimate or test result changes, the same question is re-run and the decision authority sees exactly what moved.
Agents running on pinned, self-hosted models read requests, reports and digital engineering models and propose the decision records, each with a quote from its source, or abstain when no source supports one. They cannot approve, waive a check, change a weight, or sign. In the prototype every such attempt is denied and written to the ledger.
The value of an input at which the recommendation changes. In the prototype's ground-vehicle scenario, option C leads until its unit cost reaches $354.9K, inside the vendor's own $330K-$380K range, so the lead rests on a number only the vendor supports. LEDGER shows that on the page and fails check BC-4 until a person rules on it.
The monitor opens a new episode of the same question: new cost estimates, test results, or an assumption reaching its expiry date. Weights carry forward unchanged unless a person changes them with a reason, readiness is recomputed, and the package must be signed again.
LEDGER reads and writes the Decision Digital Thread (DDT-1.0) objects published in 'An AI-Ready Decision Digital Thread Schema for Digital Engineering,' GVSETS 2026, and exports its own packages in that format. The prototype loads the paper's appendices as published and runs its walkthrough case end to end.
No. Models are self-hosted and the package needs no network service, which suits disconnected and classified environments. Phase I uses synthetic or publicly released, unclassified, non-CUI data.
Anyone who must defend a decision with traceable assumptions: automotive and heavy-equipment product planning, regulated utility capital planning, and corporate investment committees.
LEDGER is a Phase I proposal submitted to the Army SBIR program on October 21, 2026 and under Army evaluation. Everything on this page is Azcuna Dynamics' own privately funded work.
Figures and ledger rows are from Azcuna's internally funded prototype on representative, unclassified material. The demonstration scenario uses scripted agents; the live-model results come from self-hosted open-weight models. Phase I scope reflects the proposal as submitted to the Department of the Army.