Product-wide system card

Where the model is. And where it is not.

Most of this product computes. Some of it drafts. A few things it hands you are a model's judgement and nothing more. Below is every subsystem, labelled by how its output was actually produced, with the file you would open to check the label.

The ledger

31/454

31 server routes call a language model. The other 423 compute.

Counted by listing every route file in the repository and searching each one for the provider endpoint. It is the most checkable form of the boundary, and it is not the whole story: one of those routes returns a score, which is what the rest of this page is for.

4
RETRIEVED

You can ask the source directly and compare.

8
COMPUTED

Run it twice, or run it yourself, and get the same answer.

2
EXTRACTED

Open the source document and find the span.

9
INFERRED

There is no check. Treat it as a colleague’s opinion.

Those four figures are a tally of the register further down this page, not a summary written beside it. Every output listed below counts once.

The vocabulary

Four labels, and what each one obliges us to name.

A label is only worth reading if it is expensive to apply. Each of these forces a specific disclosure: the source, the function, the grounding, or the admission that there is neither.

RETRIEVED

The system fetched it from a named external source and passed it through. No model participates in the lookup, so the value is whatever the source said at the time it was read.

COMPUTED

A deterministic function produced it. The same inputs return the same value, with no model, no network call and no clock in the path, and the function has unit tests you can open.

EXTRACTED

A model pulled it out of a document you supplied, and something mechanical checks that it really came from there. The grounding is named per subsystem below, because grounding that is not specified is not grounding.

INFERRED

A model produced it and it is a judgement, not a measurement. Nothing was counted to arrive at it. It can be useful, specific and wrong at the same time, and it needs a person to accept or reject it.

The awkward one, stated first

One score in this product is written by a model.

A system card that omits its most inconvenient subsystem is worth less than no system card, so here is ours before anything else.

INFERRED

The protocol risk score

Ask Olto to review a protocol before you run it and a model reads the whole protocol and returns an overall severity, from none through critical, with findings in six named categories. Nothing is counted to reach that severity. It is not derived from the Rigor Score, it does not consult the Standards Library, and it is not a measurement of anything. It is one reviewer's opinion, produced by a model, saved next to your protocol and shown alongside it.

We keep it because a specific objection raised before you spend three weeks at the bench is useful even when its provenance is only a judgement. We label it because the alternative is a site that says no number here comes from a model while this one does. Every claim about the boundary on this site is scoped for exactly this reason.

Open it yourself
src/app/api/protocols/[id]/risk-score/route.ts
The register

Subsystem by subsystem, output by output.

Each row names one thing the product hands back, how it was produced, and the module a reader opens to check that. Where a subsystem produces some outputs one way and some another, it gets a row per output rather than an average.

Protocol generation

You write a research goal in one sentence and get back a 12-section protocol. Two different things happen inside that one request, and they do not have the same standing.

INFERRED

The prose sections

A model writes them from your sentence. They are a draft in the shape of a protocol: no concentration, volume or incubation time in that text was looked up, measured, or checked against a source before it rendered. Read it the way you would read a first draft from a colleague who has not run the experiment either.

Evidence
src/app/api/generate-protocol/route.ts
COMPUTED

The editable step graph

stepsFromSections() derives the draggable step graph from the procedure text by rule, not by a second model call. The same prose yields the same graph, and the derivation has its own unit tests.

Evidence
src/lib/protocol/normalizeSteps.ts

The split is the point. Edit the prose, re-derive, and you get the same graph back, because the model is not consulted a second time.

The Rigor Score

A protocol scored before it runs, on the signals a reviewer, a journal or a funder looks for.

COMPUTED

The score and its 7 signal checks

analyzeRigor() scans the section text for 7 named signals: controls, replication, sample size and power, a statistical plan, quantitative parameters, randomization and blinding, and safety. It reports the share that are present. Pure function, no model, no network, no clock. The count on this page came from calling it on this request.

Evidence
src/lib/protocol/rigor.ts

It never calls a protocol good. It reports which rigor signals are present and which are worth adding, and that refusal is written into the file that computes it.

The Reproducibility Fingerprint

The content address that lets two differently-worded write-ups of the same experiment resolve to one identity.

COMPUTED

The rpf_ identifier, the entity counts, the compression ratio

canonicalize() reduces a protocol to its measurable backbone: quantities normalized to canonical units, techniques, reagents, statistical methods, referenced standards. hash128() then content-addresses that form. 5 mL, 0.005 L and 5000 µL collapse to one token, so wording and unit choice drop out. No model, no network, no clock.

Evidence
src/lib/fingerprint

A fingerprint is a content address, not a cryptographic signature. The file that computes it says so in its own header, and says what it does support instead: recompute and compare. It establishes nothing about who wrote the protocol.

The protocol risk score

The one score in the product that a model writes. It is called out again below, in a section of its own, because it is the case a system card is most tempted to leave out.

INFERRED

The severity verdict and the finding list

A model reads the protocol and returns an overall severity (none, low, medium, high or critical) plus findings in six named categories: controls, sample size, safety, reagents, statistics, feasibility. Nothing is counted to arrive at that severity. It is one reviewer’s judgement, produced by a model, stored beside the protocol and rendered with the protocol.

Evidence
src/app/api/protocols/[id]/risk-score/route.ts

This is why the boundary claim elsewhere on this site is always scoped. The absolute version, that no number in Olto is model-derived, would be false, and this row is the reason.

The AI assistant

A conversation that can read your own records and draft work against them.

RETRIEVED

The records it reads

Your own rows: papers, findings, protocols, read through tools against the database under row-level security. The assistant can see what your account can see and nothing beyond it.

Evidence
src/app/api/assistant/chat/route.ts
INFERRED

The reply, and any draft it produces

The answer is a model’s judgement over those records. Its own instructions forbid it from claiming that anything was saved, created, applied or ordered: a draft is presented for review, and you are the one who commits it.

Evidence
src/app/api/assistant/chat/route.ts

Paper import and analysis

Getting a published method out of a PDF and into something you can run.

RETRIEVED

Citation metadata for a DOI

Fetched from CrossRef, falling back to PubMed. No model participates in that lookup, so the title, authors and journal are the registry’s values rather than a reconstruction of them.

Evidence
src/app/api/papers/doi/route.ts
EXTRACTED

The methodology pulled out of a paper

resolveGrounding() picks the deepest source available before the model is asked anything: the paper’s stored full text, then the attached PDF handed over as a document block, then the abstract. Which of the three was used is part of the request rather than a preference. When a raw PDF is attached the route forces a model with reliable PDF handling instead of the cheaper one the router would otherwise select.

Evidence
src/lib/literature/grounding.ts
INFERRED

A synthesis or a gap analysis across several papers

Comparing papers and naming what the literature is missing is a judgement. It is not tied to a span in any one document, and it belongs on your reading list rather than in your results.

Evidence
src/app/api/papers/synthesize/route.ts

Image and gel analysis

Quantitation of a blot or a micrograph, and a separate opt-in read of the image itself.

COMPUTED

The numbers: lane density, cell counts, areas

Classical computer vision running in your browser: Otsu thresholding, Gaussian smoothing, connected components, distance transform and marker-controlled watershed, the same algorithm family as ImageJ and CellProfiler. Pure functions over a grayscale buffer, unit-tested on synthetic images whose right answer is known in advance.

Evidence
src/lib/imaging/core.ts
INFERRED

The interpretation panel

A separate route sends the image to a vision model for quality control: what kind of image it is, which artifacts are visible, which analysis mode to try. It does not produce or adjust a measurement. Invoking it is the point at which the image itself is sent to the model provider, and it is a separate action from the measurement.

Evidence
src/app/api/image-analysis/interpret/route.ts

The Verity engines

The precision-medicine surface: 15 sealed engines, a literature pipeline, and a narrated brief. It carries the most machinery and the sharpest boundary.

COMPUTED

Every classification, dose and score across 15 engines

Each engine is a pure function carrying the published work it implements, a version, and a SHA-256 over both its constant tables and a fixed grid of its own outputs. The public registry re-runs all of them when you load it and prints whether each still reproduces its recorded hash. A drifted hash fails the test suite, and the test suite gates the build.

Evidence
src/lib/precision/provenance.test.ts
RETRIEVED

The literature corpus behind an evidence score

Real PubMed retrieval through the NCBI E-utilities, esearch then efetch, stored as an immutable corpus snapshot alongside the query that produced it, so the same search can be re-run against the same identifiers.

Evidence
src/lib/verity/literature/pubmed.ts
EXTRACTED

Each claim taken out of an abstract

The model proposes a claim and the quote that supports it. The claim is persisted only if that quote is verified to be a contiguous verbatim span of the real abstract. A paraphrase is rejected. The verification is a deterministic string check, not a second model, so the model cannot invent a source.

Evidence
src/lib/verity/evidence/extract.ts
INFERRED

The direction label on a grounded claim, and the case brief

Two judgements, declared rather than buried. Whether a grounded claim supports or refutes the hypothesis is labelled by the model, and that label feeds the deterministic strength engine. The case brief narrates a workup that has already been computed: it is instructed never to emit a number, and the numbers are returned whether or not the brief succeeds at all.

Evidence
src/lib/verity/evidence/manifest.ts

Verity is research-use-only and non-diagnostic, and a classification requires molecular-pathologist review before release. That boundary sits above every label on this page.

The engineering calculators and the Standards Library

Uncertainty budgets, tolerance stacks, process capability, measurement system analysis, bill of materials roll-ups.

COMPUTED

Every calculator result across 61 tool routes

Those 61 routes resolve to 51 computation libraries, and all 61 of them sit on a module with unit tests. Searching that code for a call to a model returns 0. That figure was measured over this tree in August 2026 and covers this tree only.

Evidence
src/lib/engineering
RETRIEVED

A standards record

Read from the seeded Standards Library table, which holds at least 490 records across 16 seed migrations. The count is reproducible from the repository without touching a database, because the seeds are the source.

Evidence
supabase/migrations
INFERRED

Which standards might apply to your experiment

The standards finder maps a description or an uploaded document to candidate standards. It is a shortlist to go and check, never a compliance determination, and it is the single route in this tree that reaches a model.

Evidence
src/app/api/utilities/standards-finder/route.ts

LIMS result interpretation

The regulated-lab workspace, where the ratio is at its sharpest.

COMPUTED

Result flags and QC verdicts

A result is flagged against its reference range in code, and control measurements are evaluated against 6 Westgard rules in the database, mirrored by a pure module that drives the live preview and is the tested specification.

Evidence
src/lib/lims/qc/westgard.ts
INFERRED

The plain-language read of an order

1 of 72 LIMS routes calls a model, and this is the one. It narrates results that were already released, it is instructed not to alter a number, it persists nothing, and it only ever receives rows the viewer is already entitled to see.

Evidence
src/app/api/lims/orders/[id]/interpret/route.ts

Olto is Part 11 capable. Only a configured, validated, operated system is compliant, and no label on this page changes that.

Statistics

The test itself, and the two AI operations that sit on either side of it.

COMPUTED

The statistic, the p value, the effect size, the interval

The statistical engine runs in your browser on distribution primitives verified against published reference values. Your raw data does not leave the machine in order to produce them.

Evidence
src/lib/stats/tests.ts
INFERRED

Which test to use, and what the result means in words

Two separate metered operations: a method recommendation before the test, and a plain-language reading of an already-computed result after it. Both are advice about a number. Neither is the number.

Evidence
src/app/api/stats/route.ts
Routing and metering

Every metered operation, and what it is allowed to cost.

One router decides which model runs, for every AI-assisted action in the product. The table below is not a description of it: the operations are its own keys and each cell is a routing call made while this page rendered, so an operation added to the router appears here without anyone editing this page.

Each AI operation, the model name it routes to on each plan, and its per-call cost ceiling.
OperationExplorerResearcherLabEnterpriseCeiling per call
protocol_generationOlto AIAI ProAI ProAI Max$0.20
protocol_refinementOlto AIAI ProAI ProAI Max$0.10
design_assistOlto AIAI ProAI ProAI Max$0.15
source_auditOlto AIAI ProAI ProAI Max$0.12
protocol_simulationOlto AIAI ProAI ProAI Max$0.15
assistant_chatOlto AIAI ProAI ProAI Max$0.05
education_authoringOlto AIAI ProAI ProAI Max$0.15
education_gradingOlto AIAI ProAI ProAI Max$0.06
notebook_assistOlto AIAI ProAI ProAI Max$0.05
paper_analysisOlto AIAI ProAI ProAI Max$0.08
paper_qaOlto AIAI ProAI ProAI Max$0.08
paper_synthesisOlto AIAI ProAI ProAI Max$0.20
paper_importOlto AIAI ProAI ProAI Max$0.12
stats_advisoryOlto AIAI ProAI ProAI Max$0.06
stats_interpretOlto AIAI ProAI ProAI Max$0.05
risk_scoreOlto AIAI ProAI ProAI Max$0.10
findings_insightsOlto AIAI ProAI ProAI Max$0.12
research_agent_planOlto AIAI ProAI ProAI Max$0.06
verity_case_briefOlto AIAI ProAI ProAI Max$0.08
verity_evidence_extractOlto AIAI ProAI ProAI Pro$0.04
standards_finderOlto AIAI ProAI ProAI Max$0.12
image_analysisOlto AIAI ProAI ProAI Max$0.08
file_summaryOlto AIOlto AIOlto AIOlto AI$0.02
doi_lookupOlto AIOlto AIOlto AIOlto AI$0.01
search_rankingOlto AIOlto AIOlto AIOlto AI$0.01
The names in the table

Three model tiers, under the product names the router uses. The provider is Anthropic PBC, named on our subprocessor list. The specific model identifier behind each name changes as models are superseded, so it lives in the router rather than in advertising. Where a route reports which model answered, it reports the name in this table, not the vendor identifier.

The ceiling is enforced, not documented

The right-hand column is a dollar ceiling per call. The router converts it into a hard output-token cap for the selected model, and routes clamp their request to that cap, so a single call cannot cross the figure shown.

The gate fails closed

A call is reserved before the inference runs, in one atomic database statement, and refunded if the inference never happens. If the gate cannot read your plan or your usage, it denies the call rather than letting it through unmetered.

What one call means

One gated inference: one budget reservation taken when you make the request, counted once. Allowances are per seat, per month, and are not a shared team pool: 5 on the free plan, 200 and 2000 on the paid plans. The definition we bill against is quoted in full on pricing.

Where your content goes

Olto is not end-to-end encrypted, and cannot be.

Any product that sends your text to a model hosted by someone else has this property. Most do not say so on a page like this one, which is the only reason saying it reads as unusual.

PLATFORM_TRUTHS.endToEndEncryptedfalse

When you invoke an AI-assisted action, the content it needs leaves our servers and reaches the model provider: your prompt, the protocol text, the assistant conversation, the paper you attached, the image you asked to have interpreted. That is what the value above records, it is read straight from the constant the rest of the site branches on, and no configuration changes it.

What bounds it is that the AI half of the product is opt-in per action, and the other half does not depend on it. The statistics engine, the imaging engine and the fingerprint run in your browser. The engineering calculators and the QC rules run in code that never contacts a model. The Verity workup returns its numbers whether or not the narrative brief succeeds. You can use a great deal of this product and send nothing to a model at all.

The rest of the honest negatives, including the ones that decide whether a procurement process can start, are on what Olto is not, and the controls around the data itself are on security.

Reading this card

What a label settles, and what it leaves open.

These four labels are narrow on purpose. Here is the exact edge of each of them, so the card cannot be read as claiming more than it does.

A label is about provenance, not correctness

COMPUTED means reproducible, and a function can be reproducibly wrong. That is why a scientific result here is asked to stand on three legs rather than one: cited to a published source, unit-tested against that source’s worked examples, and recomputable by you. This card is only the first leg made visible.

INFERRED is not a warning to discard the output

A model reading of a released result, or a risk review of a draft protocol, can be worth having. The label states what it is: a judgement no measurement backs, needing a person to accept or reject it. Where one is stored, as the risk score is, it is stored as a model assessment carrying that label rather than as a measurement.

The ratio is checkable, and it moves

Of 454 server routes, 31 call a language model and 423 compute, measured in August 2026 by listing every route file and searching each one for the provider endpoint. Adding a single route that calls a model changes it, which is why the figure is dated and re-measured rather than assumed.

This card describes the code, not an intention

Every row was written by opening the module named beside it. Where a subsystem does something awkward, the awkward thing is the row. Counts on this page are imported from a single dated constants file or derived on this request, and are current as of August 2026.

The COMPUTED rows are not asking to be taken on trust either. The Engine Registry re-runs all 15 sealed engines when you open it and prints whether each still reproduces its recorded hash, and the Fingerprint page runs a production engine in your browser while you change its inputs.

Check the label, don't take it.

Generate a protocol from your own sentence and watch which parts of the result a model wrote and which parts were computed. It takes no account.

Try OltoRecompute the engines