Ci6 Governed Determination

Reproducibility, correctness, and efficiency — why numbers that carry consequences belong to a governed engine, not a model.

§1The question, and the fair skeptic's objection

The numbers a CFO signs, an auditor ties out, and a regulator inspects must be reproducible, correct, and auditable — and CYDENiC's position is that they should come from a governed, deterministic engine, with the AI confined to explaining the results, never producing them. Modern language models are strong at arithmetic, so a fair skeptic asks whether that engine earns its keep, or whether it is ceremony: if a frontier model can compute a company's ratios correctly, why interpose a deterministic engine at all?

We answer empirically, on the skeptic's own terms. We did not test whether a model knows the formula for a given ratio — we supplied the formulas. We tested the two properties a system of record actually depends on:

• Reproducibility — does the same input give the same answer, every time, provably? (Test A, at a scale of one million determinations.)
• Correctness and the cost of the alternative — given every advantage (the inputs and the formulas), how accurate, how reproducible, and how expensive is a top-tier LLM? (Test B.)

The rest of this paper is those two tests.

§2Test A — Determinism at scale

Design. The live GFP engine (v1.12.0) — the exact shipped product code path, unmodified — was run against ten real SEC filers, pinned by CIK for a fixed, reproducible input and chosen for maximal business-archetype diversity:

Each filer's 46-figure governed set was determined 100,000 times, byte-compared against a stored reference on every iteration, and its governance seal collected — 1,000,000 determinations in total. The entire run was then repeated, independently, end to end.

A comparison of the two run logs differs only on wall-clock timing (expected to vary run to run) — the 46,000,000-value count, the zero mismatches, the ten filers and their archetypes, and the seal value itself are byte-identical across both independent one-million-determination runs.

2.1Determinism holds in production

The same engine build was then exercised at scale in the live production environment (Vercel, region iad1, Node 24):

The load-bearing result: the seal is engine-version-deterministic, not machine-dependent. A local server and the production cloud produce the exact same seal, because by construction the seal is a SHA-256 hash of the engine-version composite — it identifies the engine build (v1.12.0), not the hardware, operating system, runtime, or datacenter. Same engine → same seal, on any machine, anywhere.

Throughput. The representative figure for the engine's speed is the warm, at-scale production measurement: ≈ 10,200 determinations per second, ~0.10 ms median latency, stable across the 500,000- and 100,000-determination production runs. The local-server measurement (≈ 7,700 per second, ~0.116 ms median, on an interpreted TypeScript runtime) is reported as a deliberately conservative floor; production hardware and a warm, ahead-of-time runtime are faster.

§3Test B — Ci6 versus a top-tier LLM, inputs and formulas supplied

Design. A separate panel — ten filers across five archetypes, each at its latest annual fiscal year — was used for the head-to-head, 46 governed figures each:

The 46 figures are the full governed set as it ships: 37 scored GFP registry metrics plus 9 governed derived/overlay figures (Free Cash Flow, FCF Margin, Payout of FCF, Net Debt, Net Debt/EBITDA, Working Capital/Revenue, Operating Working Capital/Revenue, ROIC, and the DuPont decomposition). Each figure was computed three ways: by Ci6 (taken as ground truth), by Opus 4.8 (frontier), and by Fable 5 (the flagship tier). Each LLM arm received the same resolved inputs and the same formulas, and computed the full set five independent times per filer — 100 LLM runs in total. Because the formulas were supplied, this isolates execution reliability, not formula recall — the narrowest, most LLM-favorable framing of the task. A figure is "correct" when it matches the Ci6 governed value within 0.5% relative.

3.1Accuracy when answered — the models did well

The simple ratios — the margins, the current ratio — were computed consistently and correctly. This is not a "language models cannot compute" story. We use these models in our own stack; the point is not that they are weak, but that determinism is an architectural property, not a capability you can buy more of. The meaningful result is where the residual errors land: in the compound, convention-dependent governed metrics.

3.2Where it breaks — the governed compound metrics

• ltd_to_total_assets — 0% correct on both tiers. A unit-convention error: the model returns a ratio (~0.218) where the governed value is expressed in percentage points (21.80). The arithmetic is right; the convention is not the governed one.
• ROIC — 14.6% correct (Opus) / 72% (Fable), and the single most run-to-run-divergent metric (materially diverged in 90% of Opus instances and 80% of Fable instances). CYDENiC's governed ROIC follows a specific, pinned definition; the model reaches for a plausible but different textbook formula and computes a different quantity.
• Also weak (~47–80% correct): sustainable growth rate, operating working capital/revenue, equity multiplier, long-term-debt/equity, return on equity, the DuPont decomposition, and the cash conversion cycle — each compound and/or convention-dependent.

Interpretation. Because ground truth is the governed engine, several of these "errors" are not arithmetic mistakes — they are definitional divergence: the model selects a plausible but different convention (a ratio versus percentage points; one ROIC definition versus another). That is itself the argument for governed determination: one canonical, pinned definition versus an ambiguous, per-run model choice. The governance layer earns its keep not by out-computing the model, but by removing an ambiguity the model cannot remove for itself.

3.3Reproducibility — the load-bearing failure

Across 445 evaluated metric-instances per tier, agreement was graded three ways:

1. The bit-identical rate understates agreement; the material-divergence rate is the finding. Bit-identical counts trivial last-decimal rounding as disagreement. At the 0.5% materiality threshold, ~94% of instances agree on both tiers. The defensible finding is that ~6–7% of metric-instances materially diverge run to run on both tiers — roughly 27 of 445 (Opus) and 30 of 445 (Fable) — with no signal indicating which run is correct — concentrated in the compound metrics of §3.2.

2. Fable is not "more deterministic" than Opus. Its higher bit-identical rate is a precision artifact: it emits ~3.2 decimals versus Opus's ~8.8, so more of its answers round to the same short string. On the axis that matters — material divergence — the two are essentially equal (6.1% vs 6.7%). Two premium models fail reproducibility equally, so the failure is architectural, not a function of model selection.

Ci6, by construction, returns the same sealed answer every time: 0% material divergence, provable via the governance hash.

3.4Silent no-output — a distinct reliability failure

The frontier tier silently produced no usable output on 4% of runs — a distinct failure mode: a tool that occasionally returns nothing, without flagging that it has done so.

§4Efficiency and cost

Ci6 computed all 46 governed figures per filer in single-digit milliseconds with zero LLM tokens — a marginal cost of ≈ $0 at any scale. Cost per 1,000 companies below counts one run per company, output tokens only, priced at the real published Anthropic per-model output rates — a conservative floor, since the larger input/prompt tokens are excluded:

Fable emits roughly twice the output tokens of Opus (426,203 versus 206,885 across 50 runs each) and costs twice as much per token — the most expensive arm on both counts, ~4× the Opus cost per company, and no more reliable. The efficiency story is therefore not "Ci6 beats the cheap model on price." It is that both premium tiers fail reproducibility, so no amount of capability or spend on the LLM path buys a reproducible, sealed determination — which Ci6 provides at ≈ $0 marginal cost.

A note on latency scope. The single-digit-millisecond figure above (~2.3 ms average per filer) is a cold, single-call measurement — each filer determined once, which is Test B's design. Warm and at scale, as measured in production (Test A), the same engine runs an order of magnitude faster: ≈ 0.10 ms median, ~10,000+ determinations per second. Both figures are real; each is cited only for its scope.

§5Traceability and auditability — a hash versus a black box

Every Ci6 governed output is sealed with a SHA-256 governance snapshot hash bound to an exact engine version (v1.12.0). Same inputs and same engine version yield the same 46 figures and the same hash, every time. This delivers three properties a system of record requires:

• Reproducibility — same inputs + same engine version → same figures + same seal; the 0%-material-divergence property the LLM tiers could not approach.
• Auditability — a number ties out to the exact engine version that produced it; "why is this figure what it is?" has a deterministic, inspectable answer.
• Integrity sealing — the hash is a tamper-evident seal on the artifact of record; any change in engine, registry, or policy version changes the hash, so drift is detectable, not hidden.

The LLM path offers none of this: no version binding, no seal, and — per §3.3 — no reproducibility even to itself. A figure that cannot be reproduced cannot be audited.

§6What the two tests establish together

§7Methodology

Test A — determinism. Live GFP engine v1.12.0, the exact shipped code path. Ten filers pinned by CIK for a fixed input (§2), ten distinct archetypes; each determined 100,000 times (1,000,000 total), byte-compared against a stored reference on every iteration, seals collected. Executed twice locally, end to end (local server, interpreted TypeScript runtime), and a further 500,000 + 100,000 determinations in production (Vercel iad1, Node 24). The timed loop is pure in-process compute with zero database calls.

Test B — Ci6 versus LLM. Ten filers across five archetypes (§3), 46 governed figures each (37 scored GFP registry metrics + 9 governed derived/overlay figures). The Ci6 arm is ground truth. The LLM arms — Opus 4.8 and Fable 5 — each received the same resolved inputs and the same formulas and computed the full set five times per filer (100 LLM runs total). "Correct" is within 0.5% relative of the governed value. Accuracy is averaged over answering runs only; no-output is tracked on a separate axis (§3.4). Reproducibility is graded across 445 metric-instances per tier by materiality (§3.3). Cost counts output tokens only (Opus 206,885, Fable 426,203 across 50 runs each), priced at the real published per-model output rates.

Limitations

• Single run-set per test — results are not averaged across repeated benchmark executions.
• Output-token cost proxy. LLM cost counts output tokens only; the larger input/prompt tokens — which would raise every LLM figure — are excluded, so all LLM cost figures are conservative floors. Ci6 cost excludes the fixed engineering and maintenance of the engine itself.
• Ground truth is Ci6 by definition. Test B measures agreement with the governed engine, so some compound-metric "errors" are definitional/convention divergence (§3.2). The engine's own correctness is established separately, not in this document.
• Formulas supplied. Test B measures execution, not recall — the most LLM-favorable framing. A recall test would be expected to perform worse.
• Premium tiers only. Opus 4.8 and Fable 5 were tested; a low-cost model was not. A cheaper model would cost less per company, but there is no reason to expect it to be more reproducible — the material-divergence failure is architectural, not a function of price.

§8Conclusion

Top-tier language models can do the straightforward arithmetic — but governed determination proves its worth exactly where an LLM-only system falls short: the compound governed metrics, the ~6–7% run-to-run divergence that neither capability nor spend resolves, the 4% silent no-output, and the absence of any auditable seal. Ci6 is the opposite on every axis — correct on the canonical definitions, reproducible to 0% material divergence and provably so, sealed to an exact engine version, and corroborated across one million byte-identical determinations under a single hash that is the same locally and in production. A system of record needs the same answer every time, canonically defined and provable; that is what Ci6 is built to be — and the reason the governed engine sits under the AI, not beside it: the engine determines; the AI explains.