A closed algorithmic system cannot be audited from inside a rented walled garden. Cloud-based AI inference carries inherent risks for proprietary data ingestion: hidden caching, swap-file leakage, and the fundamental absence of a verifiable chain of custody between the operator and the model. None of these risks exist on bare-metal hardware under direct physical control.

The value of this node is not the components. It is the topology. The architecture enforces a Bimodal Security Constraint: for adversarial audits and proprietary ingestion, Mode 0 applies - a complete physical air-gap. When broad external extraction is required, Mode 1 applies - frontier models are engaged strictly as untrusted sub-contractors. Proprietary metadata is stripped before transmission via the SEGA protocol. The returned payload is treated as contaminated until it passes the local Independent Protection Layer. The cloud is never trusted. The local interlock is.

This architecture is hardware-agnostic. The ISN and IPL components can operate locally while the AG is accessed via a remote API. The pattern applies to cloud-deployed frontier models without requiring cooperation from the model provider. The local interlock retains its authority regardless of where inference runs.

Specifications provided as reference for replication. Not a commercial requirement. The architectural pattern is what transfers.

The Epistemic Control Architecture runs three inference nodes sequentially. Every query passes through all three before the operator receives any output. No token is rendered until the IPL issues its verdict.

Methodological Note on Model Selection: The specific models listed below (Qwen2.5, Llama-3.3) represent the commissioned configuration used during the Phase 1 RAD demonstration in Perth. The Epistemic Control Architecture is intrinsically model-agnostic; it is a structural framework for causal isolation and propositional auditing. These specific weights were selected solely to prove the physical feasibility of the pipeline on bare-metal hardware and do not constrain future operational implementations.

The pipeline enforces deterministic trip states. These are not error messages. They are non-repudiable audit records of exactly why the system halted. [ILK-DEV] and [ILK-BYP] are the primary epistemic interlocks. Both are quarantine states requiring explicit logged operator release action.

The central unsolved problem in knowledge representation in AI is not computational — it is architectural. A language model operating without an independent verification layer has no mechanism to distinguish between what it knows and what it statistically predicts. The Trinity Architecture addresses this at the hardware level by making the knowledge boundary physically enforced rather than inferentially estimated.

The three nodes function as a logic gate for knowledge representation. The Input Sanitisation Node (ISN) extracts the verifiable technical claims embedded in a query, stripping credentials and user framing that contaminate the epistemic signal. The Autoregressive Generator (AG) operates exclusively against the sanitised claim set — it has no access to the original prompt context. The Independent Protection Layer (IPL) performs a propositional audit: does the AG's response actually address the verified claims, or has it drifted into statistically plausible territory that fails the knowledge representation test?

The result is a system where ontological engineering is used for more than theoretical constraint — it is enforced by physical causal isolation between nodes. The IPL cannot collude with the AG because they run on separate GPU hardware under separate OS processes. The knowledge boundary is not a policy. It is a refusal primitive enforced by the topology of the machine itself. This is what DABA 3.0 Section VII.2 requires any compliant deployment to log: not just what the system decided, but the cryptographic evidence of how the knowledge representation was verified.