# AOS

Architecture research toward an operating system built around durable actors, explicit authority, versioned state, and recoverable change.

This is a pre-prototype, not a working OS. The repository is intentionally rigorous—and occasionally a little absurd—because its first job is to make foundational decisions falsifiable before code makes them expensive.

## Current status

- **D-001 through D-012 are resolved.** D-001–D-010 adopted the representation-neutral algebras (identity, World-relative scope, authority, recovery, Effects/disclosure, Actor updates, World proposals, typed Budgets, Commitment lifecycles, typed Channels). **D-011 is RESOLVED (2026-09-13): TRUSTED_RUNTIME**, selected by the frozen v15 strict-subset selector over a G6-authorized production bundle — evidence run `v15-evidence-003` (518/518 jobs, zero halts), independent decision review 7/7 CONFIRMED; see [ADR-011](decisions/ADR-011-boundary-and-abi.md). **D-012 is RESOLVED (2026-09-14): promotion-evidence governance contracts G-1..G-4 adopted**, evidenced by bounded executable models rev17 (68/68 tests, machine-readable run result) and the adversarial review chain through `reviewer:d012-rev16-verifier` (PASS); see [ADR-012](decisions/ADR-012-promotion-evidence-governance.md). D-013–D-015 remain DEFERRED.
- **Historical v14 implementation state (superseded by the D-011 resolution; retained):** the v14 experimental contract produced the focused TEST_ONLY slice (518/518 jobs, exact 2,086/496/22 engine/checker calls, retained under `decisions/d011_v14/development/production-readiness/`), complete fail-closed routing predictions for all 377,595 obligations, bounded catalogue membership, and the six v14 modules ([d011_protocol.py](decisions/d011_v14/d011_protocol.py), [d011_stage_c.py](decisions/d011_v14/d011_stage_c.py), [d011_runtime.py](decisions/d011_v14/d011_runtime.py), [d011_authority.py](decisions/d011_v14/d011_authority.py), [d011_producers.py](decisions/d011_v14/d011_producers.py), [d011_stage_b.py](decisions/d011_v14/d011_stage_b.py)) — all TEST_ONLY. The v13 lineage (including its fourteen-artifact freeze at F=`c17a6a2f4040729f4ea9d58b31aa04fd2651c9f7`) and v12 checkpoints are historically retained, not fallback qualification routes.
- **Known D-012 deferred items:** the protected-worker pilot (owner-ratified triggers T-1/T-2/T-3a) and compiler-verifier assurance (T-3b) are deferred with pre-registered blocking triggers; the sixth H1 verification attack of the design-convergence record is UNRESOLVED-ENUMERATION and must be reconstructed before the pilot's go/no-go gate can run.

Reviewed checkpoints: Stage A v12 `4d2d361168d7b861c4a67df717139fa2357b8b8b`; retained v12 Stage B `13c80d2170fa796a16b9b60dfd3fb9995611deb7`; hardened operational validation/tests `bda378b76c7c06100dbd33c9e664d43ad31ff312`; inert Stage C scaffold `3e7a83554161b2d1f93d73f2a737873a50d42d1b`; inert Node1 protocol/recovery checkpoint `270129bce818377a1bc80f3fc02c1e9eb54ec2d9`; native Phase 1 checkpoint `6f0822a5a40ae24d41ba8805f374b0a7ccb8f7ca`. Earlier inactive/unfrozen statements in the frozen v12 and v13 candidate packets describe their preregistration checkpoints; they are not a reason to rewrite frozen packets or repeat a retained ceremony. Memory-heavy parser tests run sequentially under a 7 GiB address-space limit after earlier uncapped runs exhausted the development VM.

Start with [CORE.md](CORE.md), then [DECISIONS.md](DECISIONS.md) and [BOOTSTRAP-1.md](BOOTSTRAP-1.md); the governing boundary decision is [ADR-011](decisions/ADR-011-boundary-and-abi.md) (D-011 RESOLVED: TRUSTED_RUNTIME) and the governance decision is [ADR-012](decisions/ADR-012-promotion-evidence-governance.md). The [D-011 v14 packet](decisions/d011_v14/D-011-PACKET.md) is superseded historical implementation context, not current governance. The original [architecture handoff](AOS-0_Architecture_Handoff.md) is archival context.

Licensed under [GNU GPLv3](LICENSE).