AOS Core #
Status and authority #
Invariant. This is AOS's concise working constitution. DECISIONS.md owns unresolved questions; BOOTSTRAP-1.md owns the first executable proof. AOS-0 Architecture Handoff is the unchanged archival brief and idea reservoir, not normative. Terms below name native semantic concepts; whether any becomes a protected object or kernel object remains open in D-011.
Thesis #
Invariant. AOS's native inhabitant is a durable Actor pursuing explicit Commitments in branchable Worlds under delegated authority and finite Resources. Executions, inference, storage, networking, and legacy systems are acquired means, not Actor identity. AOS is therefore not Linux/POSIX plus an agent daemon: its machine model makes durable identity, accountable work, speculation, authority, causality, budgets, and consequential Effects explicit.
Proof target #
Current direction. Bootstrap-1 defines the acceptance contract that must close AOS-0 → AOS-1 → AOS-2 on a hosted substrate. Each successor is built from versioned source, verified in isolation, and promoted only by deterministic evidence policy; conformance does not resolve the open architecture.
Non-goals and native boundary #
- Bootstrap-1 is not a desktop OS, broad hardware effort, federation, final ABI, or in-place rewrite of its recovery root.
- POSIX, Web/model APIs, compilers, QEMU, and host storage are compatibility or Bootstrap bridges behind capability-bound native contracts.
- Natural-language goals, planning, model selection, confidence, and semantic judgment are not trusted enforcement inputs.
- A physical node is substrate, not necessarily the final AOS boundary; cross-node semantics are deferred in D-014.
Semantic concepts #
Each term has one minimum semantic role; formal identity, lifecycle, and placement remain decisions.
| Term | Canonical definition |
|---|---|
| Actor | Durable global autonomous identity that survives every Execution; its state-slot binding is World-relative under D-002. |
| Execution | Disposable computation activated for an Actor and Commitment with bounded authority and Resources. |
| Capability | Unforgeable authorization for explicit rights over a target, constrained by derivation, delegation, and revocation rules. |
| State Revision | Immutable typed occurrence with payload identity, schema, lineage, exact references, and protected provenance under D-001. |
| World | Branchable state context that confines candidate changes from canonical state until an authorized transition. |
| Commitment | Durable accountable work under D-009, linking an Actor, immutable objective reference, World, authority, typed Budget outcomes, result contract, and protected lifecycle; distinct from disposable attempts/Executions. |
| Budget | Typed, conserved allowance governing accountable Resource use or reservation. |
| Resource | Scarce compute, hardware, service, or external capacity bound under authority and Budget. |
| Channel | Typed durable asynchronous event path under D-010, with stable event identity, exact authority, explicit acknowledgement levels, scoped ordering, retained replay/tomb semantics, and no implied truth, acceptance, availability, or failure transparency. |
| Effect | Typed externally consequential operation crossing a rollback boundary, with explicit authorization, complete binding, final policy mediation, and conservative external-evidence recovery; protected disclosure crosses this boundary at its final sink under D-005. |
| Principal | Entity on whose authority a grant ultimately rests; it may be human, organizational, device, or collective. |
| Promotion | Deterministically authorized canonical transition from an evidenced candidate to a new generation. |
Identity/reference semantics are D-001; World scope D-002; authority D-003; transactions/Effects D-004 and D-005; Actor updates D-006; World proposals D-007; Budget accounting D-008; Commitment lifecycle D-009; Channel delivery D-010.
Invariants #
- Authority monotonicity and no ambience. Every protected transition has a Capability path; derivation/delegation cannot expand rights without a separate authorized grant.
- Execution independence. Destroying every Execution of an Actor does not destroy its identity or durable state.
- World confinement. Candidate mutation cannot change the canonical root except through authorized Promotion or merge.
- Effect/disclosure confinement. No irreversible consequence occurs without an authorized, completely bound typed Effect at its final gate. Protected content or metadata crossing the final disclosure sink is an Effect and needs explicit audience, cost, content-class, and metadata-class authorization. Lower-level Resource, adapter, model, network, or local-outbox access cannot bypass policy or upgrade absent external evidence.
- Typed Budget conservation. Delegated, reserved, and spent amounts obey their accounting type and cannot double-spend a parent allocation.
- Causal attribution. Every persistent revision, consequential Effect, and Promotion names its responsible Actor and Commitment and links protected transition inputs. Mechanical provenance proves what transitions occurred, not the semantic truth of an Actor's explanation.
- Recovery classification. Durable evidence classifies interrupted transitions safely or explicitly
UNKNOWN; irreversible work is never blindly repeated. - Promotion separation. A successor's proposer cannot unconditionally promote it. A separately protected gate and Recovery Root preserve a last-known-good path.
- Model independence. No model, network, or human is required for boot/recovery; probabilistic failure cannot create authority or bypass enforcement.
Trusted-boundary rule #
Invariant. Probabilistic systems may propose changes and policy advice. Deterministic mechanisms alone enforce authority, Budget rules, isolation, canonical transitions, evidence freshness, and recovery classification. TCB placement is D-011, not implied by semantic vocabulary.
Litmus test #
Replace every model with a deterministic decision-maker. Can one durable Actor survive lost Executions, accept attenuated authority and Budget, modify only a speculative World, and cross an explicit Effect boundary with auditable conservative recovery? If not—if the design reduces to process identity, ambient host authority, snapshots, and RPC labels—it is not AOS-native.