Ask a model once.
Keep a symbol that answers forever.
A symbol is a question about your data turned into a signed, exact procedure your AI assistant calls over MCP. A model composes it once; the floor proves it; a person approves it; your machine runs it. Every answer carries model_calls: 0 and the derivation that produced it.
See it run Read how it works Join the beta ▸
you> How much have we paid, by vendor region? → tools/call derive_demo_paid_by_region ← DERIVED · model_calls: 0 Central 11215.45 East 21576.59 South 4800.25 West 32996.02 rows -> filter(status equals 'paid') -> join(vendors on vendor_id=id) -> group_by(vendors.region) -> sum(amount)
Recorded from the 1.1.2 runtime over MCP stdio on the fictional demo data that ships in the download. Nothing on this page was typed by hand as output.
One question. One procedure. Signed twice. No model at answer time.
Composed from a closed vocabulary
Not code. A pipeline of named steps — rows → filter → join → group_by → reducer → top — that the executor understands and nothing else. There is no escape hatch into Python, no eval, no network.
Admitted by the floor, then reviewed by a person
Ten mechanical checks (do the columns exist? is it deterministic? does the verifier reject wrong answers? is it grounded in the data?), proved three times, then read by a person who signs the approval into the tool.
Exact, with its derivation attached
Decimal arithmetic end to end — 9,007,199,254,740,992 + 1 stays exact. Every answer names the procedure that produced it. When the data cannot support an exact answer, the tool refuses by name instead of returning a plausible number.
The model proposes. The floor decides. A person approves. Your machine executes.
Most “AI decisions” inside software are arithmetic over data you already hold. Sending them to a model means paying per token, every time, for something that was checkable all along — and getting a number you cannot check. Perslis Symbols keeps the model where it is useful: reading the question once.
Six reviewed symbols over fictional invoices. Run them here.
Pick a question. The recorded answer of the real runtime is shown first; Run computes it again in your browser with a JavaScript port of the runtime's executor and says whether the two agree. Edit the data first to watch a refusal happen.
The port is pinned equal to the Python runtime on every shipped example by the site's own test (scripts/check_symbols.js): values, refusal texts, derivations and tool descriptions. It executes; it never admits — the gate stays at Perslis.
The runtime's own check, recorded
Cold numbers, dated.
model_calls: 0Sources: the Perslis Floor build status (26 September 2026), the measurements section of the paper, and the recordings behind the demo above.
Paying per call grows forever. A symbol is paid for once.
Let one model answer cost c and one symbol cost A to author (a few model calls to compose the spec, plus a person's review). After N questions:
t = tokens per call, p = price per million tokens, ε = the cost of one local execution (a few milliseconds of CPU — effectively zero), N* = the break-even call count. Past N*, every further question is a saving of c − ε; the model bill is linear in questions, the symbol bill is flat.
Put in your own numbers. The defaults are placeholders to edit, not a quotation of any provider's price list.
Not in the formula, because it cannot be priced honestly: the cost of a wrong answer. A model's number cannot be checked; a symbol's answer carries the procedure that produced it and refuses when the data cannot support it.
What it does not do yet.
Not yet
Relative dates (“last 30 days”), parameterised tools, direct database connections, and a self-serve gate. A question that needs anything outside the vocabulary is reported unmappable — that question genuinely still needs a model, and saying so is the output.
Tools come through a pilot
The admission gate and the signing keys stay at Perslis, deliberately: a wrong tool that got signed would answer confidently, offline and forever, with nothing left to re-examine it. In the beta you send an export and your questions; we build, review and sign each tool; you run the kit.
Status
Pilot. The runtime is free to download and use, including commercially, from Perslis Floor 1.1.2. Everything measured on these pages is dated and reproducible; nothing is claimed beyond it.
Six things people ask first.
- What is a symbol?
- One question about your data — “how much have we paid, by vendor region?” — bound to one procedure from a closed vocabulary (rows → filter → join → group → sum), proved by the floor, approved by a person, signed, and served to your AI assistant as an MCP tool that runs locally with no model in the loop.
- Is a model still involved?
- Only once, to compose the specification from your question. After admission the answer is computed by the runtime on your machine; every answer carries
model_calls: 0and the exact derivation that produced it. - What does it refuse to do?
- It will not guess when the evidence is missing (
NO_EVIDENCE), it will not run a tool whose signature or review does not verify, and it will not answer over data that cannot support an exact answer — an N/A in a number column, an ambiguous date, an unmatched or duplicate lookup key — each refused by name. - Why does a person have to approve each symbol?
- The gate proves a procedure is correct as written; it cannot prove the procedure means what the question means. A spec labelled “total of paid invoices” that filters
status = openpasses every mechanical check. So a person reads what the tool computes, in words, next to its answer on the real data, and the approval is signed into the tool. - How does it change the cost of using a model?
- Paying per call grows with every question asked; a symbol costs one authoring plus review and then executes locally for approximately nothing. The break-even point is the authoring cost divided by the cost of one model answer — with the example figures on this page, a few thousand calls, or about two days.
- Is the demo real?
- Every runtime and gate output on these pages is a recording of the real 1.1.2 runtime and the real admission gate on the fictional demo data. The “run it in this browser” button executes a JavaScript port of the runtime's executor, which the site's own test pins equal to the Python runtime's recorded answers on every example.
Send an export and your questions. Get back a kit.
We are admitting a small number of teams with real data and real questions. You get reviewed, signed symbols for your data and a runtime that answers them offline; we get the gap log — the questions no symbol answered yet.
Join the beta ▸ How it works — the paper Download Perslis Floor 1.1.2