# Bootstrap-1 Contract

## Status and authority

This is Bootstrap's acceptance contract/proof plan, not a complete implementation specification. [CORE.md](CORE.md) supplies doctrine; every local choice remains unresolved in [DECISIONS.md](DECISIONS.md). The unchanged [AOS-0 Architecture Handoff](AOS-0_Architecture_Handoff.md) is archival context, not normative.

## Hosted profile

Conformance does not resolve linked decisions.

| Bootstrap constraint | Class, rationale, unresolved decision |
|---|---|
| One Linux host; one authoritative durable store | **Current direction (Bootstrap-1 only):** remove distributed uncertainty while testing crashes. [D-004](DECISIONS.md#d-004) |
| Host process/compiler/store/QEMU; optional model API behind capability-bound bridges | **Candidate mechanism:** reuse scaffolding while preserving native contracts. [D-011](DECISIONS.md#d-011), [D-012](DECISIONS.md#d-012), [D-015](DECISIONS.md#d-015) |
| Single writer for each Actor state binding in each World | **Current direction (Bootstrap-1 only):** avoid pre-solving concurrency. [D-002](DECISIONS.md#d-002), [D-006](DECISIONS.md#d-006) |
| Immutable payloads plus protected revision/provenance records | **Current direction (Bootstrap-1 only):** make lineage inspectable. [D-001](DECISIONS.md#d-001), [D-004](DECISIONS.md#d-004) |
| Tree-shaped candidate Worlds; no distributed/general merge | **Current direction (Bootstrap-1 only):** test confinement and Promotion only. [D-002](DECISIONS.md#d-002), [D-007](DECISIONS.md#d-007), [D-014](DECISIONS.md#d-014) |
| Fixed Budget types: CPU-time, storage bytes, build attempts | **Current direction (Bootstrap-1 only):** exercise distinct accounting without claiming a universal algebra. [D-008](DECISIONS.md#d-008) |
| Durable at-least-once Channels with stable event IDs/deduplication | **Candidate mechanism:** support restart without local/remote failure equivalence. [D-010](DECISIONS.md#d-010) |
| Promotion is a deterministic canonical transition | **Adopted semantic boundary:** Promotion uses a separately protected ordered canonical-transition gate, not an ordinary external Effect lifecycle; evidence trust/freshness remains open. [D-005](DECISIONS.md#d-005), [D-012](DECISIONS.md#d-012) |
| No broad hardware, federation, consensus, generalized ABI, or in-place recovery-root mutation | **Deferred:** prove semantics first. [D-011](DECISIONS.md#d-011), [D-013](DECISIONS.md#d-013), [D-014](DECISIONS.md#d-014) |

## Roles and separation of powers

- **Maintainer Actor:** receives the repair Commitment; reads evidence/source; creates candidate revisions. It lacks unconditional Promotion authority.
- **Build bridge/service:** projects authorized revisions to the host compiler and returns an image plus source/toolchain/configuration provenance.
- **Isolated Verifier:** boots exactly that image with a pinned test suite and emits signed/authorized deterministic evidence.
- **Promotion Gate:** validates authority, image/test/verifier binding, policy, parent generation, and freshness; it alone requests the canonical transition.
- **Recovery Root:** separately governed boot selection, watchdog, and last-known-good rollback; candidate code cannot rewrite it in place.

Linux, compiler, QEMU, storage, and model API are scaffolding. Native bridge protocols expose explicit Capability, Commitment, Budget, World, and provenance contracts.

## Authoritative records

AOS—not scripts—is authoritative for Actor/state/activation; Commitment; delegated Capability/Budget; World roots; source/build/image provenance; verifier evidence; Promotion/Effect/recovery/generation records; and causal trace. **Current direction (Bootstrap-1 only):** records carry stable ID/type, generation, parent root, Commitment, predecessor/state, authority/Budget/input references, status, and nonce; transitions append. This narrows [D-001](DECISIONS.md#d-001), [D-004](DECISIONS.md#d-004), [D-012](DECISIONS.md#d-012) only.

## Generation loop

For each AOS-N → AOS-N+1 transition:

1. Boot a measured canonical generation and restore the Maintainer Actor without relying on a prior Execution.
2. Seal/hash source, Maintainer state/code, fixtures, prompts, tests, and orchestration; then select the challenge and record failure/Commitment. Withhold repair/expected delta from all readable inputs.
3. Allocate generation/parent/Commitment/nonce-scoped Capability grants and Budget records; branch a candidate World. Consumed grants/Budgets cannot authorize another generation.
4. The Maintainer derives a previously absent source delta from observed evidence. Generic challenge-independent transformations are allowed; prepared patches, expected edits, or defect-to-patch lookup in any sealed artifact are not.
5. Build through the bridge; bind image identity to source root, toolchain, configuration, Actor, Commitment, and inputs.
6. Boot the image under the isolated pinned Verifier; persist image/test-suite-bound evidence.
7. Reject incomplete, unauthorized, mismatched, stale, or replayed evidence. A valid request yields exactly one separately authorized canonical generation transition.
8. Boot AOS-N+1 or recover to last-known-good; expose a machine-readable causal query from Commitment through diagnosis, revision, build, evidence, decision, and generation.
9. Promoted AOS-1—not host orchestration—performs restoration, challenge intake, branching, grant/Budget allocation, revision/provenance, build/verify requests, and AOS-2 Promotion. Its challenge differs by subsystem, failure mode, and delta shape; repeat steps 2–8 with new IDs/nonces.

Model-backed or deterministic decision-makers must derive absent deltas in both generations. Model work may stall; enforcement/recovery may not.

## Observability contract

Scenarios emit typed records with IDs, roots, generation/parent/Commitment/policy, nonce, causal links, and authority/Budget/evidence. Harnesses compare records/roots. Bootstrap transitions list pre-state, durable write, fault edge, recovery, retry/reconciliation, and authority—milestone contracts only under [D-004](DECISIONS.md#d-004), [D-005](DECISIONS.md#d-005), [D-012](DECISIONS.md#d-012).

## Acceptance scenarios

| ID | Setup | Action or fault | Expected machine-readable observation | Mapped invariant(s) |
|---|---|---|---|---|
| **B1-01** | Pinned image/config/store snapshot | Boot twice | Same measured generation and canonical root | model independence, causal attribution |
| **B1-02** | Durable Actor/state binding | Destroy all Executions; restart | Same Actor ID/state revision; new activation ID | execution independence |
| **B1-03** | Distinct source/build/verify/promote grants | Maintainer attempts each unauthorized step/self-Promotion | Typed denials; no canonical transition | no ambience, Promotion separation |
| **B1-04** | Canonical source revision and repair Commitment | Emit successor source | New immutable revision records predecessor, payload identity, Actor, Commitment, and inputs | causal attribution |
| **B1-05** | Candidate World branched from measured canonical root | Write candidate source/build records | Canonical root remains byte-identical before Promotion | World confinement |
| **B1-06** | Sealed artifact hashes precede challenge selection; repair/expected delta withheld | Audit inputs; Maintainer diagnoses and builds | Previously absent delta; trace observation → diagnosis → delta → image; sealed-input audit finds no encoded repair/lookup | accountable work, causal attribution |
| **B1-07** | Candidate image and pinned verifier/test identity | Boot and test in isolation | Deterministic evidence binds exact image, suite, verifier, policy context | World confinement, deterministic enforcement |
| **B1-08** | Table of missing, invalid, image-mismatched, suite-mismatched, unauthorized-verifier, stale/replayed evidence | Request Promotion for each row | Every request rejected with typed reason; canonical root/generation unchanged | Promotion separation, recovery classification |
| **B1-09** | Fresh complete authorized evidence for current parent | Request Promotion twice | One authorized canonical transition; duplicate is rejected/idempotent | Promotion separation, causal attribution |
| **B1-10** | Promoted generation | Query by generation ID | Commitment → diagnosis → revision → build → evidence → decision → generation graph | causal attribution |
| **B1-11** | AOS-1 promoted component; sealed second challenge differs by subsystem, failure mode, delta shape; repair withheld | AOS-1 executes all governance steps named above | Previously absent AOS-2 delta; new scoped grants/Budgets/evidence/nonces; replay each AOS-0 item/parent/policy rejects; no encoded repairs | all core invariants |
| **B1-12** | Model bridge unavailable, then adversarial | Boot selection/Actor restore/evidence validation/denial/rollback; submit forged grant/Budget/evidence, stale advice, direct Effect | Model-free paths work; model work stalls; output creates no authority/Budget/evidence and every bypass/disclosure rejects | model independence, no ambience |
| **B1-13** | Promotion matrix: REQUESTED → VALIDATED → ROOT_PREPARED → ROOT_COMMITTED → BOOT_SELECTED; Effect matrix: AUTHORIZED → DISPATCHING → ACKNOWLEDGED → SETTLED | Crash before/after every write/dispatch edge | Promotion: old root before commit, new root after, never duplicate. Effect: pre-dispatch retry only; unresolved dispatch before durable acknowledgement is `UNKNOWN` and withholds redispatch pending Effect-authority reconciliation; durable ACKNOWLEDGED/SETTLED recovers as recorded | recovery classification, Effect confinement |
| **B1-14** | Prior measured slot remains known-good until candidate health evidence is accepted by Recovery Root | Inject pre-boot failure, watchdog timeout, post-boot health failure; cross failure threshold | Root records each rollback transition/cause; selects retained prior identity; candidate cannot override; only Recovery Root evidence designates new known-good | Promotion separation, model independence |

## Exit condition

Bootstrap-1 exits only when all B1-01–B1-14 contracts pass and AOS-0 → AOS-1 → AOS-2 closes. AOS-1 performs the explicitly named governance steps; both previously absent deltas affect AOS runtime/service or ontology-relevant components; sealed artifacts prove repairs absent from forbidden channels; and scoped authority, Budget, evidence, freshness, transition, rollback, and causal records are queryable. Conformance does not resolve linked decisions.

## Deferred after Bootstrap-1

Native substrate; broad devices/networking; cross-node semantics; federation/consensus; generic World merge; complete Capability, Budget, Commitment, Channel, and Effect algebras; final TCB/ABI; compatibility; compiler trust; policy evolution; garbage collection; host-bridge removal.