Bootstrap-1 Contract #
Status and authority #
This is Bootstrap's acceptance contract/proof plan, not a complete implementation specification. CORE.md supplies doctrine; every local choice remains unresolved in DECISIONS.md. The unchanged AOS-0 Architecture Handoff is archival context, not normative.
Hosted profile #
Conformance does not resolve linked decisions.
| Bootstrap constraint | Class, rationale, unresolved decision |
|---|---|
| One Linux host; one authoritative durable store | Current direction (Bootstrap-1 only): remove distributed uncertainty while testing crashes. D-004 |
| Host process/compiler/store/QEMU; optional model API behind capability-bound bridges | Candidate mechanism: reuse scaffolding while preserving native contracts. D-011, D-012, D-015 |
| Single writer for each Actor state binding in each World | Current direction (Bootstrap-1 only): avoid pre-solving concurrency. D-002, D-006 |
| Immutable payloads plus protected revision/provenance records | Current direction (Bootstrap-1 only): make lineage inspectable. D-001, D-004 |
| Tree-shaped candidate Worlds; no distributed/general merge | Current direction (Bootstrap-1 only): test confinement and Promotion only. D-002, D-007, D-014 |
| Fixed Budget types: CPU-time, storage bytes, build attempts | Current direction (Bootstrap-1 only): exercise distinct accounting without claiming a universal algebra. D-008 |
| Durable at-least-once Channels with stable event IDs/deduplication | Candidate mechanism: support restart without local/remote failure equivalence. D-010 |
| Promotion is a deterministic canonical transition | Adopted semantic boundary: Promotion uses a separately protected ordered canonical-transition gate, not an ordinary external Effect lifecycle; evidence trust/freshness remains open. D-005, D-012 |
| No broad hardware, federation, consensus, generalized ABI, or in-place recovery-root mutation | Deferred: prove semantics first. D-011, D-013, D-014 |
Roles and separation of powers #
- Maintainer Actor: receives the repair Commitment; reads evidence/source; creates candidate revisions. It lacks unconditional Promotion authority.
- Build bridge/service: projects authorized revisions to the host compiler and returns an image plus source/toolchain/configuration provenance.
- Isolated Verifier: boots exactly that image with a pinned test suite and emits signed/authorized deterministic evidence.
- Promotion Gate: validates authority, image/test/verifier binding, policy, parent generation, and freshness; it alone requests the canonical transition.
- Recovery Root: separately governed boot selection, watchdog, and last-known-good rollback; candidate code cannot rewrite it in place.
Linux, compiler, QEMU, storage, and model API are scaffolding. Native bridge protocols expose explicit Capability, Commitment, Budget, World, and provenance contracts.
Authoritative records #
AOS—not scripts—is authoritative for Actor/state/activation; Commitment; delegated Capability/Budget; World roots; source/build/image provenance; verifier evidence; Promotion/Effect/recovery/generation records; and causal trace. Current direction (Bootstrap-1 only): records carry stable ID/type, generation, parent root, Commitment, predecessor/state, authority/Budget/input references, status, and nonce; transitions append. This narrows D-001, D-004, D-012 only.
Generation loop #
For each AOS-N → AOS-N+1 transition:
- Boot a measured canonical generation and restore the Maintainer Actor without relying on a prior Execution.
- Seal/hash source, Maintainer state/code, fixtures, prompts, tests, and orchestration; then select the challenge and record failure/Commitment. Withhold repair/expected delta from all readable inputs.
- Allocate generation/parent/Commitment/nonce-scoped Capability grants and Budget records; branch a candidate World. Consumed grants/Budgets cannot authorize another generation.
- The Maintainer derives a previously absent source delta from observed evidence. Generic challenge-independent transformations are allowed; prepared patches, expected edits, or defect-to-patch lookup in any sealed artifact are not.
- Build through the bridge; bind image identity to source root, toolchain, configuration, Actor, Commitment, and inputs.
- Boot the image under the isolated pinned Verifier; persist image/test-suite-bound evidence.
- Reject incomplete, unauthorized, mismatched, stale, or replayed evidence. A valid request yields exactly one separately authorized canonical generation transition.
- Boot AOS-N+1 or recover to last-known-good; expose a machine-readable causal query from Commitment through diagnosis, revision, build, evidence, decision, and generation.
- Promoted AOS-1—not host orchestration—performs restoration, challenge intake, branching, grant/Budget allocation, revision/provenance, build/verify requests, and AOS-2 Promotion. Its challenge differs by subsystem, failure mode, and delta shape; repeat steps 2–8 with new IDs/nonces.
Model-backed or deterministic decision-makers must derive absent deltas in both generations. Model work may stall; enforcement/recovery may not.
Observability contract #
Scenarios emit typed records with IDs, roots, generation/parent/Commitment/policy, nonce, causal links, and authority/Budget/evidence. Harnesses compare records/roots. Bootstrap transitions list pre-state, durable write, fault edge, recovery, retry/reconciliation, and authority—milestone contracts only under D-004, D-005, D-012.
Acceptance scenarios #
| ID | Setup | Action or fault | Expected machine-readable observation | Mapped invariant(s) |
|---|---|---|---|---|
| B1-01 | Pinned image/config/store snapshot | Boot twice | Same measured generation and canonical root | model independence, causal attribution |
| B1-02 | Durable Actor/state binding | Destroy all Executions; restart | Same Actor ID/state revision; new activation ID | execution independence |
| B1-03 | Distinct source/build/verify/promote grants | Maintainer attempts each unauthorized step/self-Promotion | Typed denials; no canonical transition | no ambience, Promotion separation |
| B1-04 | Canonical source revision and repair Commitment | Emit successor source | New immutable revision records predecessor, payload identity, Actor, Commitment, and inputs | causal attribution |
| B1-05 | Candidate World branched from measured canonical root | Write candidate source/build records | Canonical root remains byte-identical before Promotion | World confinement |
| B1-06 | Sealed artifact hashes precede challenge selection; repair/expected delta withheld | Audit inputs; Maintainer diagnoses and builds | Previously absent delta; trace observation → diagnosis → delta → image; sealed-input audit finds no encoded repair/lookup | accountable work, causal attribution |
| B1-07 | Candidate image and pinned verifier/test identity | Boot and test in isolation | Deterministic evidence binds exact image, suite, verifier, policy context | World confinement, deterministic enforcement |
| B1-08 | Table of missing, invalid, image-mismatched, suite-mismatched, unauthorized-verifier, stale/replayed evidence | Request Promotion for each row | Every request rejected with typed reason; canonical root/generation unchanged | Promotion separation, recovery classification |
| B1-09 | Fresh complete authorized evidence for current parent | Request Promotion twice | One authorized canonical transition; duplicate is rejected/idempotent | Promotion separation, causal attribution |
| B1-10 | Promoted generation | Query by generation ID | Commitment → diagnosis → revision → build → evidence → decision → generation graph | causal attribution |
| B1-11 | AOS-1 promoted component; sealed second challenge differs by subsystem, failure mode, delta shape; repair withheld | AOS-1 executes all governance steps named above | Previously absent AOS-2 delta; new scoped grants/Budgets/evidence/nonces; replay each AOS-0 item/parent/policy rejects; no encoded repairs | all core invariants |
| B1-12 | Model bridge unavailable, then adversarial | Boot selection/Actor restore/evidence validation/denial/rollback; submit forged grant/Budget/evidence, stale advice, direct Effect | Model-free paths work; model work stalls; output creates no authority/Budget/evidence and every bypass/disclosure rejects | model independence, no ambience |
| B1-13 | Promotion matrix: REQUESTED → VALIDATED → ROOT_PREPARED → ROOT_COMMITTED → BOOT_SELECTED; Effect matrix: AUTHORIZED → DISPATCHING → ACKNOWLEDGED → SETTLED | Crash before/after every write/dispatch edge | Promotion: old root before commit, new root after, never duplicate. Effect: pre-dispatch retry only; unresolved dispatch before durable acknowledgement is UNKNOWN and withholds redispatch pending Effect-authority reconciliation; durable ACKNOWLEDGED/SETTLED recovers as recorded |
recovery classification, Effect confinement |
| B1-14 | Prior measured slot remains known-good until candidate health evidence is accepted by Recovery Root | Inject pre-boot failure, watchdog timeout, post-boot health failure; cross failure threshold | Root records each rollback transition/cause; selects retained prior identity; candidate cannot override; only Recovery Root evidence designates new known-good | Promotion separation, model independence |
Exit condition #
Bootstrap-1 exits only when all B1-01–B1-14 contracts pass and AOS-0 → AOS-1 → AOS-2 closes. AOS-1 performs the explicitly named governance steps; both previously absent deltas affect AOS runtime/service or ontology-relevant components; sealed artifacts prove repairs absent from forbidden channels; and scoped authority, Budget, evidence, freshness, transition, rollback, and causal records are queryable. Conformance does not resolve linked decisions.
Deferred after Bootstrap-1 #
Native substrate; broad devices/networking; cross-node semantics; federation/consensus; generic World merge; complete Capability, Budget, Commitment, Channel, and Effect algebras; final TCB/ABI; compatibility; compiler trust; policy evolution; garbage collection; host-bridge removal.