# AOS Decision Register

## Status and use

[CORE.md](CORE.md) is doctrine; [BOOTSTRAP-1.md](BOOTSTRAP-1.md) directs. [AOS-0 Architecture Handoff](AOS-0_Architecture_Handoff.md) is archival, not normative. D-001–D-012 resolved (the [agent-native harness analysis](decisions/agent-native-harness-completion-v1.json) constrained D-011's resolution); D-013–D-016 deferred.

## Entry schema

Entries give **Question; Blocks; Options; Inclination; Evidence; Depends; Status**. Inclinations nonbinding before ADRs; status is `OPEN`, `DEFERRED`, or `RESOLVED`.

## Ordered decisions

### D-001
**Question:** How do Actor, state, typed payload, immutable revision occurrence, World, aliases, retention, and GC identities relate? **Blocks:** durable references/provenance/GC. **Options:** content, cryptographic, logical, or compound identity. **Inclination:** S-O adopted: opaque Actor/World IDs, owner-scoped typed slots, content-derived payload IDs, occurrence-bearing revision IDs. **Evidence:** [ADR-001](decisions/ADR-001-identity-and-references.md) and [packet](decisions/D-001-PACKET.md). **Depends:** none. **Status:** `RESOLVED`.

### D-002
**Question:** What is global versus World-relative: Actor state, revocation, Budgets, inboxes, Executions, Resources, observations, settled Effects? **Blocks:** isolation/replay. **Options:** global, relative, or typed mixed scope. **Inclination:** M adopted: reversible selections/projections are World-relative; authority, accounting, ingress, acquisition, and external-reality facts are global and World-attributed. **Evidence:** [ADR-002](decisions/ADR-002-world-relative-state-scope.md) and [packet](decisions/D-002-PACKET.md). **Depends:** D-001. **Status:** `RESOLVED`.

### D-003
**Question:** What is the Capability/activation algebra, including genesis/human Principal authentication, rights, constraints, transfer, persistence, attenuation, joins, revocation, and invocation context? **Blocks:** every protected transition. **Options:** representation-neutral grant semantics; bearer tokens, protected grants, and capability spaces remain conforming projections. **Inclination:** durable grants plus ephemeral activation/selection, complete witness/context binding, attenuation, compound issuance, replay protection, and global ancestry revocation. **Evidence:** [ADR-003](decisions/ADR-003-grant-activation-algebra.md), [v2 packet](decisions/D-003-PACKET-v2.md), and [retained summary](decisions/evidence/d003/summary.json). **Depends:** D-001, D-002. **Status:** `RESOLVED`.

### D-004
**Question:** Which crash model gives conservative recovery? **Blocks:** state, Effect, Promotion. **Options:** conforming journal/store/root. **Inclination:** atomic deltas; pre-dispatch retry; post-dispatch `UNKNOWN_EXTERNAL`/reconcile-only; bounded idempotent recovery; protected Promotion/rollback. **Evidence:** [ADR-004](decisions/ADR-004-durable-transition-and-recovery-algebra.md), [packet](decisions/D-004-PACKET.md), [summary](decisions/evidence/d004/summary.json). **Depends:** D-001–D-003. **Status:** `RESOLVED`.

### D-005
**Question:** How do typed Effects, disclosures/remote inference, and canonical transitions differ, including reconciliation, idempotency, privacy/cost, and bypass prevention? **Blocks:** external safety/promotion. **Options:** shared lifecycle, separate protocols, typed adapters remain conforming projections; none selected. **Inclination:** one representation-neutral algebra: final typed Effect/disclosure gates, complete binding, retained outcomes, conservative external evidence, per-child compound recovery, no cross-system atomicity, separate protected Promotion ordering. **Evidence:** [ADR-005](decisions/ADR-005-effect-and-disclosure-algebra.md), [packet](decisions/D-005-PACKET.md), and retained [E](decisions/evidence/d005/E.json). **Depends:** D-003, D-004. **Status:** `RESOLVED`.

### D-006
**Question:** What concurrency/update rule governs multiple Executions of one Actor? **Blocks:** durable Actor state. **Options:** representation-neutral update algebra; serialized turn, CAS revision, and coordinated multi-writer remain unselected. **Inclination:** `ACTOR_UPDATE_ALGEBRA`: deterministic protected-admission-token-ordered sequential transitions per exact Actor/World/typed-state-slot domain; Bootstrap single writer is local direction. **Evidence:** [ADR-006](decisions/ADR-006-actor-update-algebra.md), [packet](decisions/D-006-PACKET.md), and retained [E](decisions/evidence/d006/E.json). **Depends:** D-001–D-004. **Status:** `RESOLVED`.

### D-007
**Question:** What World proposal/commit protocol is valid? **Blocks:** Promotion/merge. **Options:** algebra with conforming projections. **Inclination:** `WORLD_PROPOSAL_ALGEBRA`: closed proposals, deterministic validation, candidate publication; no universal merge. **Evidence:** [ADR-007](decisions/ADR-007-world-proposal-algebra.md), [packet](decisions/D-007-PACKET.md), [E](decisions/evidence/d007/E.json). **Depends:** D-001–D-006. **Status:** `RESOLVED`.

### D-008
**Question:** Which typed Budget and delegation/refund laws apply? **Blocks:** conservation. **Options:** conforming projections. **Inclination:** `TYPED_BUDGET_ALGEBRA`: consumable, peak, rate, lease, share, and product rules. **Evidence:** [ADR-008](decisions/ADR-008-typed-budget-algebra.md), [packet](decisions/D-008-PACKET.md), [E](decisions/evidence/d008/E.json). **Depends:** D-002–D-004. **Status:** `RESOLVED`.

### D-009
**Question:** What Commitment lifecycle, cancellation/delegation, priority authority, and scheduler boundary apply? **Blocks:** accountable work. **Options:** representation-neutral lifecycle algebra; protected-service and kernel-visible projections remain unselected. **Inclination:** adopted algebra separates durable Commitment, disposable attempts/Executions, handoff/activation, result/validation/acceptance, cancellation cuts, substitution, intervention, priority, and observation; no fairness/liveness claim. **Evidence:** [ADR-009](decisions/ADR-009-commitment-lifecycle-algebra.md), [packet](decisions/D-009-PACKET.md), [E](decisions/evidence/d009/E.json). **Depends:** D-003, D-006, D-008. **Status:** `RESOLVED`.

### D-010
**Question:** What Channel delivery/acknowledgement semantics preserve location-independent addressing without failure transparency? **Blocks:** dormant/remote communication. **Options:** representation-neutral typed delivery algebra; transport projections remain unselected. **Inclination:** `TYPED_CHANNEL_ALGEBRA`: class-selected applicability, stable events, exact authority, typed transport/process acknowledgements, final-point dedup, scoped ordering, replay/retention/tombs, one-use evidence, and conservative stale/late handling; no liveness or failure-transparency claim. **Evidence:** [ADR-010](decisions/ADR-010-channel-delivery-algebra.md), [packet](decisions/D-010-PACKET.md), [E](decisions/evidence/d010/E.json). **Depends:** D-001–D-005, D-009. **Status:** `RESOLVED`.

### D-011
**Question:** Which concepts are native, protected-service objects, or kernel objects; what is the TCB and derived ABI? **Blocks:** implementation boundary. **Options:** minimal kernel, capability microkernel, broader runtime. **Inclination:** derive ABI from protected transitions, not operation count; archive the provisional sketch. **Evidence:** invariant-to-enforcer map; [ADR-011](decisions/ADR-011-boundary-and-abi.md) — **RESOLVED 2026-09-13: TRUSTED_RUNTIME selected** by the frozen v15 strict-subset selector over a G6-authorized production bundle (`_inner_validate` True; exposure sets 48/28/24; unique strict subset; evidence run `v15-evidence-003`, 518/518 jobs, zero halts; independent decision review seven-of-seven CONFIRMED). Known limitations recorded in ADR-011 as D-012 inputs (pin granularity; pre-freeze assembly gate). **Status:** `RESOLVED`.

### D-012
**Question:** How are Promotion evidence, policy evolution, compiler/verifier trust, freshness, and replay protection governed? **Blocks:** recursive proof. **Options:** pinned policy, signed generations, diverse/reproducible builds. **Inclination:** evidence binds image/source/toolchain/tests/verifier/policy/parent/freshness. **Evidence:** [ADR-012](decisions/ADR-012-promotion-evidence-governance.md) — **RESOLVED 2026-09-14: governance contracts G-1..G-4 adopted** (pre-freeze assembly gate; whole-file identity retained with deferred protected-worker pilot under owner-ratified triggers T-1/T-2/T-3a, plus T-3b: compiler-verifier assurance and the malicious-candidate matrix reopen — and block promotion — at the recursive-proof milestone or any candidate self-build promotion; immutable policy generations with typed compatibility outcomes; final-point fresh one-use admission with global replay registry and atomic final-point transitions), evidenced by bounded executable models rev17 (68/68 tests incl. the alternate-digest retry reconciliation probe, the exception-atomicity failure-injection probes at every commit boundary, the standalone-API-absence probe, the metaclass-behavior probes over M-A intake and M-B time rejection, behavioral identifier/digest/outcome probes, exception-string probes, the no-copy-protocol intake probe, cyclic/over-deep value probes, immutable-expiry-ceiling probes, non-finite-float rejection probes, single-snapshot pair-intake probes, injective-encoding probes, snapshot-derived fork probe, reentrant temporal probes, parameterized cross-registry linearizability probes, no-mutation postconditions, reentrant recovery/expiry probes, closed-grammar and time-domain probes; machine-readable run result) and adversarial reviews (`reviewer:d012-packet-reviewer`, `reviewer:d012-resolution-reviewer`, `reviewer:d012-final-reviewer`, `reviewer:d012-rev5-verify2`, `reviewer:d012-final-reviewer2`, `reviewer:d012-rev7-verifier`, `reviewer:d012-rev8-verifier`, `reviewer:d012-rev9-verifier`, `reviewer:d012-rev10-verifier`, `reviewer:d012-rev11-verifier`, `reviewer:d012-rev12-verifier`, `reviewer:d012-rev13-verifier`, `reviewer:d012-rev14-verifier`, `reviewer:d012-rev15-verifier`, `reviewer:d012-rev16-verifier` — findings corrected through rev17; rev16 review verdict PASS). **Review-closure gate G-5 adopted 2026-09-15** (owner-approved; adversarial review ADOPT-WITH-AMENDMENTS; prospective — first applied to the hosted-proof loop). **Owner ratification of the T-3a/T-3b split recorded 2026-09-16** (relayed via Anna; owner: "can be considered signed"). Owner P0: constrained orchestrator model, TCB pricing deferred, lean caps. Known deferred item: protected-worker pilot (triggers recorded). **Status:** `RESOLVED`.

### D-013
**Question:** Which native target substrate follows the hosted proof? **Blocks:** H1 only. **Options:** seL4/Microkit, other capability kernel, exokernel, custom. **Inclination:** none before semantic evidence. **Placement note (2026-09-17):** native-substrate evaluation SHALL assess D-011's hosted placement against measured TCB composition, isolation, verification, recovery, and port evidence; adoption of any alternative conforming placement occurs only through D-013's own decision procedure. D-011's semantic enforcement obligations remain binding; its hosted placement profile is not presumed to be the final native decomposition. **Evaluation triggers (preregistered 2026-09-17):** TRUSTED_RUNTIME is retained unconditionally through Bootstrap-1; the named observations — materially excessive trusted code, poor fault isolation, an unmanageable recursive-verification surface, or a migration path requiring semantic redesign — authorize evidence *collection* during Bootstrap-1 but cannot alter the Bootstrap-1 placement or preselect D-013. Before any comparative evaluation, D-013 must preregister measurable comparison criteria and thresholds; the triggers are grounds to evaluate D-013 against the listed options, never automatic reversal criteria or a narrative winner. **Evidence:** TCB/port experiments; ADR-011 recorded limitations (inputs to D-012); ADR-012 P0-2 — TCB-composition pricing deferred as an open evaluator-design question (D-011 exposure-atom counts measure placement-law exposure distinctions, not trusted implementation size/complexity). **Depends:** D-011, D-016. **Status:** `DEFERRED`.

### D-014
**Question:** What distributed/federated semantics govern cross-node Capabilities, Worlds, migration, and partitions? **Blocks:** federation only. **Options:** restricted locality or explicit consistency protocols. **Inclination:** no failure transparency. **Evidence:** later partition model. **Depends:** D-001–D-012, D-016. **Status:** `DEFERRED`.

### D-015
**Question:** Which compatibility personality/bridges remain and how are they removed? **Blocks:** post-proof native replacement. **Options:** guest, service/personality, external bridge. **Inclination:** hide host mechanisms behind native contracts. **Evidence:** bridge inventory after Bootstrap. **Depends:** D-011, D-013. **Status:** `DEFERRED`.

### D-016
**Question:** Which laws govern cross-Actor Resource views, authority-bearing carriage, mutation coordination, and governed projections of runtime state? **Blocks:** D-013 substrate mapping; D-014 distributed form. **Options:** derived compositions with narrow formalizations (E1/E2-shaped evidence) vs new subordinate concepts; governed-projection mechanism choices. **Inclination:** none before reviewed evidence. **Evidence:** [AGENT-NATIVE-IPC-SHARING-INTROSPECTION-WORK-ITEM.md](decisions/AGENT-NATIVE-IPC-SHARING-INTROSPECTION-WORK-ITEM.md) (PARKED exploration; E1/E2 executed PASS; E3–E5 specified, D-016-gated) and the D-011 packet's dated boundary-constraint addendum adopting its constraint set. Outstanding evidence obligations named by the source: the CA-3 conjunction (persistence × capability × attenuation sharing, closure proven not assumed), competent-baseline E3–E5, an adversarial carriage/anti-smuggling review, and reclamation-recursion closure. While D-016 is `DEFERRED`, the parked work item remains non-doctrinal source evidence; opening D-016 supersedes it as the decision vehicle. **Depends:** D-003, D-005, D-006, D-010, D-011. **Status:** `DEFERRED`.

## Original brief disposition

Exactly one audit row covers each numbered section; destinations preserve mixed content.

| § | Classified disposition and concrete destination | Rationale |
|---:|---|---|
| 1 | settled → [Core boundary](CORE.md#non-goals-and-native-boundary); open → D-011, D-014 | Method. |
| 2 | settled → [Thesis](CORE.md#thesis), [Trust](CORE.md#trusted-boundary-rule); milestone → [B1](BOOTSTRAP-1.md#generation-loop) | Summary. |
| 3 | settled → [Litmus](CORE.md#litmus-test), [Boundary](CORE.md#non-goals-and-native-boundary) | Test. |
| 4 | settled → [Concepts](CORE.md#semantic-concepts), [Invariants](CORE.md#invariants) | Premises. |
| 5 | roles → [Concepts](CORE.md#semantic-concepts); open → D-001–D-010; sketches → archive-only | Provisional. |
| 6 | settled → [Invariants](CORE.md#invariants) | Nine; provenance. |
| 7 | candidate ABI → archive-only; open → D-003, D-007, D-011 | Derived. |
| 8 | settled distinction → [Commitment](CORE.md#semantic-concepts); resolved → D-006; open → D-009, D-011 | Scheduler open. |
| 9 | settled confinement → [Invariants](CORE.md#invariants); open → D-002, D-007 | Scope/merge open. |
| 10 | settled boundary → [Concepts](CORE.md#semantic-concepts); settled → resolved D-004, D-005 | Effect/disclosure settled; mechanisms open. |
| 11 | goal → D-010, D-014; protocol examples → archive-only | Distribution deferred. |
| 12 | settled → [Boundary](CORE.md#non-goals-and-native-boundary), [Trust](CORE.md#trusted-boundary-rule); Effect classification → resolved D-005 | Inference replaceable; disclosure crosses Effect boundary. |
| 13 | settled → [Boundary](CORE.md#non-goals-and-native-boundary); open → D-015 | Non-native. |
| 14 | milestone → [Loop](BOOTSTRAP-1.md#generation-loop), [Scenarios](BOOTSTRAP-1.md#acceptance-scenarios) | Recursive proof. |
| 15 | direction → [Profile](BOOTSTRAP-1.md#hosted-profile); later phases → D-013, D-015 | Hosted proof. |
| 16 | settled → [Powers](BOOTSTRAP-1.md#roles-and-separation-of-powers), [Invariants](CORE.md#invariants); open → D-012 | Independent recovery/promotion. |
| 17 | direction → [Records](BOOTSTRAP-1.md#authoritative-records); open → D-001, D-004 | Version/provenance, not files. |
| 18 | document suite → archive-only; activation rule → [Status](DECISIONS.md#status-and-use) | Prevent sprawl. |
| 19 | open → identity/GC D-001; scope/persistence D-002, D-004; authority/human Principal D-003; Effect/remote inference D-005; resolved → concurrency D-006; open → D-007–D-010; TCB/promotion/substrate/distribution/compatibility D-011–D-015 | Families assigned. |
| 20 | deferred → [Deferred](BOOTSTRAP-1.md#deferred-after-bootstrap-1) | Narrow milestone. |
| 21 | milestone → [Scenarios](BOOTSTRAP-1.md#acceptance-scenarios), [Exit](BOOTSTRAP-1.md#exit-condition) | Contracts observable. |
| 22 | repository sketch → archive-only; rule → [Observability](BOOTSTRAP-1.md#observability-contract) | No tree. |
| 23 | mission → [Thesis](CORE.md#thesis), [Exit](BOOTSTRAP-1.md#exit-condition) | Authority chain. |
| 24 | research links → archive-only; differentiation → [Litmus](CORE.md#litmus-test) | Art omitted. |
| 25 | terms → [Concepts](CORE.md#semantic-concepts); identity ambiguities → D-001 | Canonical glossary. |
| 26 | settled checks → [Invariants](CORE.md#invariants), [Scenarios](BOOTSTRAP-1.md#acceptance-scenarios); unresolved → D-001–D-015 | Separated. |