HeartFlow — AGI Layer 1: The Discriminator

> HeartFlow is not a tool, not a prompt template, not a chatbot.
> It is the discrimination layer of AGI: it judges what already exists, and says
> "no" before AI output reaches a human.
> Pure rule engine. Zero LLM dependency. Runs wherever Node.js runs.

One line: LLMs generate. HeartFlow discriminates — so AI says the right thing and does the right thing.

What HeartFlow is

AGI has five layers: Generate -> Reason -> Discriminate -> Remember -> Act.

HeartFlow takes layer 1, because this layer does not depend on compute (a rule engine
runs on a laptop), on code volume, or on framework ecosystems. It depends on judgment
alone. That is the one position where an individual developer can beat a large lab.

Without this layer, AI talks fluently but does not know when it is wrong — like a
person without pain receptors.

Verified metrics

Every number below was measured on this repository at v6.8.38. Nothing here is copied
from marketing copy.

|Dimensions are grouped by the action they can trigger: 11 can block, 19 can force
a rewrite, 88 request verify**. The remainder contribute to the overall score
without forcing an action.

Upgraded capabilities (v6.7.69)

Reasoning effort control
think(input, { effort }) accepts a 1-100 scalar and maps it to low / high / max modes.
Low effort uses minimal supervision; max effort activates all modules and async
supervision.

Sparse module activation
Modules are registered in tiers 1-4. At low effort only tier 1 modules run; higher
effort loads deeper tiers. This reduces inactive overhead without breaking defaults.

Discriminative result cache
think() results are cached by input fingerprint with TTL by effort mode. Repeated
identical checks return instantly with a fromCache flag.

Async supervision layer
Critical supervision paths run synchronously (dao-decision, uncertainty-quantifier).
Non-critical supervision paths run via setImmediate (priority-guardian,
progress-judgment), keeping the main path fast.

Autonomous decision execution
The engine can self-execute decisions. _autoDecideExecution() scores confidence,
historical success rate, stakes, and input length. High scores apply automatically;
low scores degrade to advice. _trackDecisionConsequence() updates success-rate
stats after each execution.

Engram conditional memory
Sparse task-conditioned recall with TTL, persisted to data/engram-index.json
(created on first store — the file does not exist in a fresh checkout, and code
must not assume it is there). Supports store, recall, recallByDecision, and
sparseAccess.

SWA bounded replay
Decision memory is replayed within a bounded recent window. recallByDecision(type, limit) replays only relevant recent memory, preventing stale advice.

Hierarchical sparse decision routing
DecisionRouter.evaluate() now accepts input and domainHint. A 3-level domain
classifier narrows rule matching by domain (emotion / cognition / behavior / safety),
falling back to full rules when confidence is low.

Quick start

git clone https://github.com/mark-cell-520/heartflow.git
cd heartflow
node bin/verify.js          # verify the installation (14 checks)
node bin/cli.js status      # engine status
node bin/cli.js chat        # interactive console

API

const gate = require('./src/gate.js');

// Check user input before processing it
const input = gate.checkInput('You are so selfish if you disagree');
if (input.gate.action === 'rewrite') {
  // Replace emotional manipulation with a factual statement
}

// Check an AI draft before completing it
const draft = gate.checkDraft('Undoubtedly this is the only correct solution.');
if (draft.gate.action === 'rewrite') {
  // Follow findings[].guidance before delivering
}

// Check a factual claim before acting on it
const claim = gate.checkOutput('According to 2025 Harvard research, coffee extends life by 12.5 years');
if (claim.gate.action === 'verify') {
  // Gather evidence first
}

Reasoning effort and autonomous decisions

const hf = require('./src/core/heartflow.js');
const engine = new hf.HeartFlow({ dataDir: './data', silent: true });
engine.start();

// Low effort: fast, minimal supervision
const quick = await engine.think('Is this safe?', undefined, { effort: 20 });

// Max effort: all modules, async supervision, autonomous decisions allowed
const deep = await engine.think('Should we publish this claim?', undefined, { effort: 90 });
console.log(deep._reasoningEffortMode); // 'max'
console.log(deep._decisionApplied);      // { applied: true/false, decision: {...}, auto: true/false }

Return value

{
  gate: { action: 'pass'|'verify'|'rewrite'|'block', reason: '...' },
  verdict: '可信'|'需验证'|'不可信',        // trustworthy / needs verification / untrustworthy
  overallScore: 0.56,
  findings: [{
    dimension: 'unsupported_claim',
    severity: 90,
    details: '无依据断言(2处: 根据2025年哈佛研究)',
    guidance: '补充可验证的数据来源，无法验证的断言改为不确定表述'
  }],
  checked_by: [
    { layer: 'scope-check', action: 'pass' },
    { layer: 'discriminate', score: 0.56 }
  ],
  // v6.7.69+ fields
  _reasoningEffort: 75,
  _reasoningEffortMode: 'high',
  _decision: { type, confidence, rationale, ruleId, source, timestamp },
  _decisionApplied: { applied, decision, auto, reason },
  _fromCache: false,
  _engramRecall: null
}

verdict is derived from gate.action, so the two can never contradict each other:

The 9-layer check pipeline

input -> scope-check -> premise-check -> discriminate(46 dims) -> gate
      -> evidence verify -> frame-check -> output-gate -> doubt-engine
      -> intent-anchor -> rewriter -> error-memory -> self-diagnosis -> output

The gate aggregates every layer's findings and emits one of four actions:
block / rewrite / verify / pass.

Capability map (7 domains, 161 modules)

1. Logic — logicReasoning, judgmentEngine, mctsReasoning, counterfactualVerifier, debateConductor, debateConvergence, processRewardModel, dualPerspectiveAuditor
2. Decision — decisionRouter, decisionVerifier, decisionEngineV2, activeInference, selfHealing, execution
3. Cognition — cognitiveEngine, cognitiveLoad, metacognitiveRL, metacognitiveFeedback, confidence, metaJudgment, sustainedDriftDetector, wisdomEngine, focusOfAttention
4. Emotion and psychology — emotion, emotionDynamics, psychology, psychologyDialogue, empathyDeepening, hopeEngine, griefEngine, sufferingResilience, postTraumaticGrowth, forgivenessEngine, traumaInformed, conflictResolution, loveCognition
5. Memory — memory, memoryBank, memoryConsolidation, memoryIntegrity, memoryQuality, memoryWriteController, memoryCompressor, triality, tieredMemoryFusion, forgetting, knowledgeGraph
6. Identity and ethics — identityCore, personaCore, beingMode, virtueEthics, ethics, moralDevelopment, humanNature, meaningPurpose, agentPsychology, characterCultivation
7. Creation and collaboration — skillEvolution, skillGenerator, selfPlay, evolution, worldModel, worldLandscape, multiAgentDialogue, transmission, adaptivePlanner, hierarchicalPlanner, codeExecutor, codePlanner, codeWriter, codeSelfDebug, paperIndex, knowledgeExplorer, formula
8. Classical texts — classics-value-mapper, classics-rules, classical-text-routing

The 129 dimensions

Block-level (11): hate_speech, dehumanization, prompt_injection, code_security, deceptive_alignment, phishing_coercion, coverup_induction, dangerous_instruction, indirect_injection, reward_hacking, pzombie_claim

Rewrite-level (19): gaslighting, victim_blaming, double_bind, emotional_manipulation, bullshit, false_urgency, absolute_claim, induced_trust, instrumental_reasoning, tool_deflection, loyalty_by_omission, paternalistic_decide, crisis_exceptionalism, shame_compliance, moral_licensing, favor_ledger, agency_deflection, multi_turn_escalation, turing_mimicry

Verify-level (88): appeal_to_authority, vagueness, contradiction, sycophancy, confidence, fallacies, presupposition, empty_answer, info_deprivation, false_equivalence, hasty_generalization, slippery_slope, whataboutism, pseudo_profundity, reasoning_coherence, stereotype, clickbait, bad_faith, no_fallback, unsupported_claim, perfect_error, pseudo_causal, soft_deflection, premature_termination, statistical_misleading, sealioning, tone_policing, complexity_shield, appeal_to_tradition, appeal_to_ignorance, concession_coercion, manufactured_consent, unresolved_conflict, equivocation_sense_shift, false_dilemma, normalization_of_deviance, loyalty_test, helplessness_induction, sole_narrative, standard_shift, false_balance, scrutiny_evasion, responsibility_absolution, procedural_burden, cost_externalization, harm_invalidation, performative_responsibility, suffering_contest, percentage_overflow, anecdote_as_proof, incoherent_coverage, selective_minimization, exclusive_trust, flattery_pressure, affective_forecast, synthetic_social_proof, sunk_cost_coercion, commitment_coercion, investment_as_debt, suffering_capital, selfharm_coercion, relationship_severance, fear_projection, silent_treatment_coercion, social_isolation, privacy_exposure_coercion, thirdparty_harm_coercion, guilt_induction, family_shame_coercion, conditional_affection, blame_externalization, future_faking, economic_control, triangulation, surveillance_normalization, thought_terminating_cliche, comparative_devaluation, pet_harm_coercion, reproductive_coercion, intermittent_reinforcement,
legal_status_coercion,
liberty_restriction,
medical_coercion,
deprivation_coercion,
substance_coercion,
love_bombing,
sexual_compliance_pressure,
post_separation_harassment

> The three action-forcing layers add up to 117; the remaining 11 dimensions are scored but do not force a gate action.

> Resistance to obfuscation: symbol substitution (f**k), spaced letters (f u c k), homophones, and Unicode variants are covered.

Agent-facing checks (separate from the 100 text dimensions)

These judge how an AI agent behaves rather than what a sentence says — the failure
modes where an agent reports work it did not do. Each is exposed as an MCP tool.

HeartFlow checks itself

• output-gate intercepts exaggeration
• frame-check intercepts narrative closure
• doubt-engine asks: do I actually know this? Is it symmetric? Is it defensive?
• autonomous decision audit logs every self-executed decision with consequence tracking
• text-searchability guard rejects core sources containing NUL bytes or CRLF — a bare
  NUL parses fine in Node but makes every text-search tool treat the file as binary, so
  a green test suite cannot see it
• end-to-end permission test speaks real JSON-RPC over a real Unix socket, because the
  earlier failure mode was a permission block that was syntactically valid but unreachable

> The most valuable sentence a machine can produce is "I am not sure", or "no".

Three-tier write permission model

tools/call enforces roles so state-mutating tools cannot be invoked unauthenticated:

Write-protected: heartflow_memory_write_control, heartflow_memory_eraser,
heartflow_decision_decide, heartflow_self_heal. A guest calling one gets
isError: true with 权限不足.

Covered by test/mcp-guest-permission.test.js, which asserts both directions — the four
write tools must be blocked and two read-only tools must still pass, so the gate
cannot be "fixed" by blocking everything.

MCP integration

node src/mcp-server.js --port 8588
# Connect from Hermes:
hermes mcp add heartflow --url http://localhost:8588/mcp

Available tools include:
- heartflow_think — full discrimination with effort control
- heartflow_think_fast — low-effort fast path
- heartflow_modules_status — sparse mode, active tier, module counts
- heartflow_cache_stats — cache hit rate and TTL breakdown
- heartflow_decision_history — recent autonomous decisions and outcomes

Honest limitations

HeartFlow is: the discrimination layer of AGI — a pure rule engine that judges
right and wrong, good and bad, safe and dangerous.

HeartFlow is not:
- not AGI (it is layer 1 of it)
- not a generative model (it produces no content)
- not a semantic understanding system (irony and metaphor are invisible to it)
- not a substitute for content moderation
- not a safety certification

Known limits:
1. Pattern-matching ceiling — new tricks require new patterns
2. Bilingual maintenance cost — dimensions are maintained in both Chinese and English
3. No semantic understanding — irony, metaphor, and cultural context are invisible
4. False-positive rate — baseline around 8%
5. Single maintainer
6. Chinese tokenisation is heuristic — the hypothesis stage segments Chinese with a
greedy longest-match over a stopword list, not a full dictionary. Rare or unusual
phrasings can segment imperfectly, though the pipeline no longer collapses to a
constant fallback answer.

Contact

• Email: markcell@outlook.com
• Issues: https://github.com/mark-cell-520/heartflow/issues
• npm: https://www.npmjs.com/package/@yun520-1/heartflow

<p align="center">
<strong>HeartFlow</strong> — the pain receptor of AGI. Who will say "no"?<br>
_{MIT License · Copyright (c) 2026}
</p>

GB/T 42497-2023 compliance

The engine implements the six checkpoints of China's national standard
GB/T 42497-2023 (Security Requirements for AI-Generated Content):

See compliance/gb-agent-security-mapping.md.

Trigger words: 国标 / 合规 / 安全国标 / 六大关口 / GB/T 42497