PrismManifest

What is PrismManifest?

PrismManifest is a zero-trust tool-argument gate (Apache-2.0, PyPI prismmanifest 0.3.4). AI, OCR, and parsers may propose dollar parameters; only an Ed25519-signed ParameterManifest that clears the hard security check may enter your deterministic tax, underwriting, claims, or payment engine. Formerly ParamGate. Soft CTA: email MANIFEST.

Search terms: signed money parameters · deterministic AI money gate · Form 1040 / invoice / underwriting / claims gate · digit-drop attack · money tool calling · fail-closed finance AI.

The calculator wasn’t the risk

When generative dollars feed deterministic tools, failures look like correct math on wrong inputs. Prompting harder doesn’t fix a missing trust boundary.

Equation: Deterministic Engine + Unverified Probabilistic Input = Deterministic Wrong Answer

How it works

PrismManifest sits between “AI guessed a number” and “your money engine runs” — it checks evidence, signs a ParameterManifest, then the hard check lets the engine run or not.

1. Capture evidence — what the document actually said (spans, not invented totals)
2. Ground the claim — tie each dollar/field to a verbatim span + form anchor
3. Decide — allow · send to human · or refuse
4. Sign — Ed25519 ParameterManifest (the approved artifact)
5. Enforce — hard security check before your engine runs (enforce_group3_boundary; C++ and/or Python twin on the signed manifest — not on span extract)

Document / agent
      ↓
AI / OCR proposes dollar parameters          ← untrusted
      ↓
PrismManifest verifies + signs               ← trust boundary
      ↓
PASS / needs human / REFUSE
      ↓
Your deterministic engine runs               ← tax / underwriting / claims / pay DAG

Where the guarantee sits

PrismManifest does not claim that every step runs in C++.

• Evidence binding and plausibility checks run in the verification pipeline using exact integer micro-units for money — so amounts don’t drift with floating-point math.
• C++ (with a Python twin) sits at the final hard boundary: it verifies the Ed25519-signed ParameterManifest before your tax, underwriting, claims, or payment engine is allowed to run.

That split is intentional. The signed artifact is what crosses into execution — and that is what the C++ enforce path protects.

Span resolve and plausibility today: Python · Signed-manifest enforce: C++ and/or Python · CUDA: optional acceleration, not the security story.

Is / is not

Integrity stack

PrismGuard (who may speak) · PrismManifest (which numbers may execute) · PrismShine (whether the answer is grounded)

Works with any orchestrator / deterministic DAG. Also works with ChorusGraph as an optional secondary path — not required.

Use cases

Tax forms · underwriting · claims · money tool-calling · AP/invoice automation

Evidence

Pilot OSS — synthetic + adversarial packs and a keyed Gemini ugly-doc run. Live customer fax corpora remain the production bar.

• 0 critical false accepts on planted money errors (red-team / bench planted set 0/11)
• FinancePackBench text packs: 100/100 pass · FA rate 0 · SLA pass
• FinancePackBench PDF path: 20/20 pass · FA rate 0 · SLA pass
• 500-pack Python × C++ × CUDA decision + signing-hash parity PASS (511 checks, 0 mismatches; in-process C++)
• Ugly-doc + Gemini (gemini-flash-lite-latest): 8/8 critical FA 0% (keyed run; ephemeral key deleted)
• Gemini scale ugly packs: 64 cases · critical FA 0% (keyed)
• Pytest 100 passed (local full / prod-gaps baseline)
• Hard check latency: in-process C++ enforce ~0.08 ms p50 (vs CLI spawn ~10.7 ms) — engineer footnote
• Azure Key Vault: envelope wrap for signing keys proven on an ephemeral Azure KV run, then resource group deleted. Prefer pip install "prismmanifest[kms-azure]"

Do not confuse the adversarial suite (FinancePackBench-G4) with architecture Group 4. Status = Pilot OSS. Production claim needs your redacted scanned/fax packages through the same FA bar.

Minimal Python sample

from prismmanifest import KeyRing, PrismManifestPipeline, enforce_group3_boundary, GateDecision
from prismmanifest.router import DocumentPackage, IntentRouter

keyring = KeyRing.generate(key_id="local-dev-ed25519")
package = DocumentPackage(
    doc_id="1040.txt",
    pages=["Form 1040 Tax Year 2024\nLine 1 Gross income: $470,000.00\n"],
    form_type="IRS_FORM_1040",
    tax_year=2024,
)
routed = IntentRouter().run(package)
pipeline = PrismManifestPipeline(keyring)
result = pipeline.run_on_evidence(evidence=routed.evidence, extraction=routed.extraction)
gate = enforce_group3_boundary(
    result.manifest,
    public_keys=keyring,
    expected_dag_id="capital_gains_v3",
)
if gate.decision is GateDecision.ACCEPT:
    # only then may your money engine run
    pass

Install: pip install prismmanifest · pin: pip install "prismmanifest==0.3.4" · CLI: prismmanifest-gate

Try the Digit Drop Lab — 10-second punch · Form 1040 $450k vs $45k

Full interactive demo — tabs · custom $ · how-to · POST /api/agents/prismmanifest-demo/run

Capabilities

Tool-Argument Gate

Sits between LLMs/OCR and your tax, underwriting, claims, or payment engine so unverified money never enters the run.

Signed ParameterManifest

Ed25519-signed manifests only — not “0.87 confidence” as permission to pay.

Fail-Closed Boundary

Hard security check (C++ and/or Python twin) verifies the signed manifest before the engine runs. Soft CTA: MANIFEST.

Published evidence

PrismManifest Form 1040 demo pack. Fixed sample Form 1040 AGI $450,000 fixture used by the Digit Drop Lab and interactive demo.

Evidence artifact

Install

pip install prismmanifest (pin ==0.3.4). Apache-2.0. Soft CTA MANIFEST — mailto:info@insightits.com?subject=MANIFEST.

Pricing

OSS $0 forever · Team $3,000/yr Founding · Enterprise $12,000/yr Founding · Boundary Pilot $4,500 (warm). Cold CTA: email MANIFEST — no Calendly.

Frequently asked questions