The Pipeline

For Both Executive and Technical Readers

One rule organises the whole system: the language model touches only the two ends. Everything between runs on typed artifacts and deterministic algorithms.

01 The Gap

An LLM is fluent and confident whether or not it is right.

A LARGE LANGUAGE MODEL IS FLUENT AND CONFIDENT WHETHER OR NOT IT IS RIGHT. That is acceptable for translating a question and explaining an answer. It is disqualifying for computing one. When an enterprise deploys a language model as a reasoning system, it is not making a technology choice. It is making a category error.

The language model has no explicit representation of how the world works, no mechanism for evaluating interventions, no architecture for uncertainty that holds up under audit, and no governance layer that produces artifacts a regulator can inspect. Leaving reasoning to the LLM means every answer is unreproducible, unchallengeable, and uncertified. The same question asked twice may yield different results. There is no adjustment set to point a regulator at. There is no certificate to contest.

The architecture draws a hard line. The LLM is allowed to touch only the two ends, it parses a natural-language question into a typed object, and it narrates a finished result back into prose. No natural language ever crosses into the reasoning core. No inference result is ever produced by the LLM. Reproducibility is a property of the boundary, not a hope about the model.

Eight-stage EARA pipeline. Parse and Narrate are LLM stages. Formalize, Route, Compose, Execute, and Audit are deterministic stages. Identify is a gate with a refusal branch.

LLM stages handle language only. Deterministic stages run the same typed operation every time. The gate checks identifiability before any inference runs, if it cannot certify the query, it returns a structured refusal rather than a fabricated answer.

02 The component

The boundary architecture that separates the LLM from the reasoning engine.

The Pipeline is the Language Interface layer of EARA, the boundary architecture that separates the LLM from the reasoning core. It receives a natural-language question at the top and returns a plain-language answer with a full audit record at the bottom. Everything between the two amber ends runs on typed artifacts and deterministic algorithms.

Reference: Marc Vandenplas, Enterprise AI Reasoning Architecture: A Reference Architecture for Trustworthy Enterprise AI, Rung3.ai, 2026. Working draft.

The substrate the pipeline keys off is a Model Registry: a collection of Scope Cards, one per .bayes file. A Scope Card is a machine-readable manifest declaring what the model covers, what evidence it accepts, what targets it can infer, what interventions it can evaluate, and what gates must pass before use. Routing, identification, and composition are not heuristics over prose, they are queries against these cards. Nothing downstream works without them.

// Eight-stage pipeline, amber = LLM; white = deterministic core

· PARSE      LLM · constrained decode → CausalQuery

· FORMALIZE  query → formal estimand

· ROUTE      scope-card satisfiability → model set

· IDENTIFY   the gate · certificate or refuse

· COMPOSE    d-separation at the seam → composition certificate

· EXECUTE    Bayes Server inference → posterior

· AUDIT      bundle the record → AuditRecord

· NARRATE    LLM · verbalize the result → plain-language answer

The two amber stages (Parse, Narrate) are the only places the LLM runs. Stage 4 (Identify) is the gate: no certificate, no answer. An unidentified query returns bounds or a refusal, never a fabricated point. The pipeline’s output is not a string. It is an AuditRecord: a typed, versioned, reproducible object.

03 How it works

Parse → Formalize → Route → Identify → Compose → Execute → Audit → Narrate.

Eight stages. Two LLM stages (amber). Six deterministic stages (white). One gate (red). Each stage is documented in full on its own page.

Stage	Name	What it does	Detail
1–2	Parse & Formalize	LLM constrained decode → `CausalQuery` → formal estimand	Stage 1–2 →
3	Route	Scope Card satisfiability → model set or refusal	Stage 3 →
4	Identify	The gate, certificate or refuse. No certificate, no answer.	Stage 4 →
5	Compose	d-separation at the seam → composition certificate	Stage 5 →
6	Execute	Bayes Server inference → posterior	Stage 6 →
7	Audit	Bundle the record → AuditRecord	Stage 7 →
8	Narrate	LLM verbalizes the result → plain-language answer	Stage 8 →

04 Query in plain English

One question in. One certified answer out.

The pipeline answers one question at a time. Here is what that looks like from the outside, and what is happening on the inside at each step.

If we start empirical sepsis treatment now, what is the probability the patient avoids organ failure?

AnyChatRung 2 · Parse → Formalize → Route → Identify → Execute

“If we start… now” is a Rung 2 query: do(Treatment = empirical). Routed to sepsis.bayes. Identification: back-door criterion satisfied on the current evidence set. P(OrganFailure = absent | do(Treatment = empirical)) = 0.83. Adjustment set: {SepticAppearance, Lactate, Age}. Certificate ID: idcert_2026_000217.

The patient deteriorated. Would earlier treatment have changed the outcome?

AnyChatRung 3 · Abduct → Intervene → Predict

“Would earlier… have changed” is Rung 3. Abduct: anchor U-terms to the actual deterioration. Intervene: do(Treatment = 4h earlier). P(OrganFailure = absent | counterfactual) = 0.71. Probability of necessity: 0.71. The model shows earlier treatment would materially have improved the outcome for this specific patient, not just on average.

How do you know this?

AnyChatProvenance

I don’t know it, the pipeline does. The posterior came from sepsis.bayes via exact Bayes Server inference. The adjustment set is in the IdentificationCertificate. The counterfactual path is in the CompositionCertificate. Every number in the AuditRecord is reproducible: same model, same evidence, same estimand → same posterior, to the digit. I narrated it. I did not compute it.

Couldn't our integration team just pipe the EHR data into the model and call it done?

AnyChatRung 3 · counterfactual

Piping data in is the first step, not the deliverable. The pipeline has to handle binding: mapping raw EHR fields to the model’s evidence nodes with the right likelihood encodings, not hard assignments. It has to detect when evidence is contradictory or outside the model’s validity envelope and flag it rather than silently propagate a bad posterior. And it has to support counterfactual queries, “would earlier treatment have changed the outcome?”, which require the full abduction–action–prediction cycle, not just a forward pass over whatever arrived in the feed. A data pipe delivers rows. The pipeline component delivers certified inference.

The audit trail is the AuditRecord, not the conversation.

05 Where it sits

Entry and exit point of the entire EARA stack.

The Pipeline is the entry and exit point of the entire EARA stack. It has no upstream component, it is where the natural-language question arrives. Every other component operates inside the boundary the Pipeline enforces.

What feeds it: a natural-language question from a clinician, analyst, or automated system, plus the Model Registry (Scope Cards for all loaded .bayes files). What it produces: an AuditRecord containing the posterior distribution, IdentificationCertificate, CompositionCertificate (if applicable), evidence set, assumptions, and model provenance, plus a narrated plain-language answer.

The models the Pipeline routes to are built through 02 Discovery and 03 Evidence. The reasoning services it invokes at Stage 6 are defined in 04 Cognitive Primitives. The AuditRecord it produces feeds 12 BPMN Integration at the governance handoff point.