How the kernel works

Six pictures explain most of kernel 0.1.0. Each starts with the plain version, then the diagram, then the law it draws. Every diagram describes machinery that runs today; the what-works-today register stays the honest boundary.

1 · The road an ask takes

You type “echo, say the word HERON once”. The kernel writes the ask and its fact on the ground in one transaction; the relay publishes the fact; the dispatcher hands it to echo’s bench; echo serves it and its reply lands as a signed fact the same way. Under your ask a soft line — the journey — says each step as it happens. Nothing ever travelled off the rails, so the whole road can be read back later from the log.

sequenceDiagram
  participant P as You (seated)
  participant K as the kernel
  participant G as the ground
  participant R as the rails
  participant B as echo (a body)
  P->>K: POST /ask {text, session}
  K->>G: ask row + outbox fact (ONE transaction)
  K-->>P: 201 {ids: [ask_…]}
  G-->>R: relay publishes orreth.ask.received.v1
  R->>B: the dispatcher hands it to echo's bench
  Note over B: journey: heard the ask, every word
  B->>K: the reply, signed by echo's key
  K->>G: reply + outbox fact (ONE transaction)
  G-->>R: orreth.reply.v1 (pointer + hash, never the words)
  R-->>P: the feed lights the panel — the chat shows the reply whole

The laws: transactional outbox, always (a committed record cannot lack its event); pointer-only payloads on the rails (the words stay on the ground); every ask wears its journey; and at-least-once with idempotent effects — a fact is handed to exactly one body by the inbox’s footprint.

2 · How a body joins

A body — the crew’s or yours — never simply connects. It knocks at the desk with its DID and its public key, is challenged with the kernel’s own nonce, proves it by signing, and then waits. The crew is admitted at once on the manifest’s spawn ticket; a self that was admitted here before is admitted at once on its standing welcome; a stranger is staged, and its hold appears in the chat with Cancel as the default. Only a governing seat’s yes admits it. Then the body collects its lease with the same key.

stateDiagram-v2
  [*] --> pending : POST /join {did, name, role, public_key, template_hash, policy_hash}
  pending --> challenged : the desk's nonce, in the same breath
  challenged --> proved : POST /join/prove — a signature over {did, join_nonce}
  challenged --> denied : a forged proof (one face: "join refused")
  proved --> done : the crew's spawn ticket · a standing welcome
  proved --> staged : a stranger — join.admit held in the chat
  staged --> done : a governing seat clicks Yes
  staged --> denied : Cancel · fifteen minutes of silence
  done --> [*] : POST /join/lease — the lease, chained to the root, with the fuel clause

The laws: joining is a governed request; a keypair is a self (the same key is admitted as the same self, life after life); scopes only narrow (the lease opens the body’s own words at /delta and nothing more); refusal wears one face.

3 · How a person is seated

Every door reads who you are from a token the kernel signed, never from the page. You prove a code from your authenticator; the kernel — this universe’s own root — mints a capability token naming you, your grants and your expiry, and the page carries it on every knock. On a ground nobody holds, the first person to prove an authenticator becomes its owner.

flowchart LR
  E["POST /enroll {person}<br/>→ the otpauth secret + a QR"]
  C["POST /enroll/confirm {person, code}<br/>the first code finishes enrolling"]
  S["POST /seat {person, code}<br/>→ the seat: a signed token,<br/>its wire form, your role"]
  D["every door:<br/>authorization: Bearer ‹wire›<br/>the feed: ?seat=‹wire›"]
  E --> C --> S --> D
  classDef human fill:#f2a91d,color:#101625,stroke:#ffd36a,stroke-width:2px;
  classDef k fill:#3536a4,color:#eef2ff,stroke:#8f91ff;
  class E,C,S human;
  class D k;

The laws: the unseated wear one face (401 {"error": "not seated"}); a seated person lacking a grant wears the proof’s (403); the browser origin is closed; a knock ceiling stands at every door per person. A seat lasts a day; “leave my seat” ends it early, recorded.

4 · How a red watch is cured

A watch is red while its condition holds. When one turns red, the kernel’s standing Resiliency intention wakes. The kernel reads a dossier off the ground first — the watch, who it names and their state, the last acts on them, what happened last time — with no mind involved. It hands the planner that dossier and the lever catalogue this door serves. The planner answers in the catalogue: one lever and its reason. The kernel pulls the lever with its own hands, through the same door a person would use, as a recorded hop in the intention’s session. Then it reads the watch again and says what happened.

flowchart TB
  W["a watch turns RED<br/>orreth.watch.turned.v1"]
  O["an OBSERVATION lands<br/>under Resiliency"]
  DS["the kernel reads the DOSSIER<br/>off the ground — no mind"]
  PL["the planner answers IN the catalogue:<br/>“LEVER: body.restart name=echo — BECAUSE: …”"]
  R{"consequence?"}
  RT["routine — pulled at once"]
  CQ["consequential — held at the<br/>interlock for a person's click"]
  GR["grave — never pulled by the kernel"]
  RD["read the watch again after settles_s"]
  OUT["cured, with its cause · self-healed ·<br/>still red → once more, then the human with the dossier"]
  W --> O --> DS --> PL --> R
  R --> RT --> RD
  R --> CQ --> RD
  R --> GR
  RD --> OUT
  classDef k fill:#3536a4,color:#eef2ff,stroke:#8f91ff;
  classDef red fill:#7a1f2b,color:#fff0f0,stroke:#ff6b7a;
  classDef human fill:#f2a91d,color:#101625,stroke:#ffd36a,stroke-width:2px;
  class W red;
  class O,DS,PL,R,RT,RD,OUT k;
  class CQ,GR human;

The laws: the kernel never lowers the ladder because it is running on its own; every red is answered and every green attributed (a health check grades it); the human can always stop — “stop the kernel’s Resiliency intention” is a grave act, recorded, never a deletion.

5 · The four memories, one truth

A body has four memories and only one of them is the truth. Working memory is the mind mid-thought (the checkpointer) and is never truth. The Record is every word, signed and kept forever. Understanding and the Digest are projections over the Record — rebuildable accelerations that cite their sources. A purge is governed and leaves hashes, never words.

flowchart TB
  B["a body"]
  WM["WORKING MEMORY<br/>the mind mid-thought<br/>never truth"]
  REC[("THE RECORD<br/>every word · signed · forever<br/>corrections are siblings")]
  UND["UNDERSTANDING<br/>what it means"]
  DIG["THE DIGEST<br/>the short version,<br/>citing its sources"]
  P["you: verbatim recall<br/>by key · by ask · by timeframe"]
  B <--> WM
  B -->|"outcomes commit<br/>through governed doors"| REC
  REC -->|"after commit"| UND
  REC -->|"at session boundaries"| DIG
  UND --> B
  DIG --> B
  P <--> REC
  classDef k fill:#3536a4,color:#eef2ff,stroke:#8f91ff;
  classDef body fill:#087d86,color:#efffff,stroke:#55d8d7;
  classDef human fill:#f2a91d,color:#101625,stroke:#ffd36a,stroke-width:2px;
  class REC k;
  class B,WM,UND,DIG body;
  class P human;

On kernel 0.1.0 the Record, recall by key and by window, sessions with their digests, the profile, and the compliance export stand on both kernels. Understanding is lexical; an embedding lane, the purge and the long-objective resume are owed — see what works today.

6 · How two worlds speak

Every universe is a cell: its own kernel self, database and role, benches and topics, bodies and keys, sealed from every other. Two cells that name each other speak over one door in messages signed by their kernels’ own selves, the peer’s DID pinned on first sight. An ask that names a cell routes home and is answered here; under partition it parks in plain words and resumes once.

sequenceDiagram
  participant P as You (cell one)
  participant A as kernel A · u:one
  participant S as POST /seam (signed both ways)
  participant B as kernel B · u:two
  participant L as librarian@two
  P->>A: "librarian@two, what is the weather?"
  A->>S: the command, signed by A's self (nonce · 120 s window · epoch)
  S->>B: verified against the pinned DID
  B->>L: served by B's own librarian
  L-->>B: the reply
  B-->>S: signed by B's self
  S-->>A: landed once
  A-->>P: answered in cell two by librarian
  Note over A,B: B dark → the ask reads PARKED, "unreachable since" — B back → resumed once

The laws: cells = worlds (physical isolation, a role that reaches no other database); commands route home; the stop rides the seam first and lands within two seconds; a re-homed universe advances its epoch and a stale epoch is fenced.