deterministic recompute
A pure, effect-free inference is recomputed and compared with the original receipt.
Formula and statistical modules use this law, so the same inputs produce the same belief every time.
Kernel reference · contracts
One kernel, typed identities, and a boundary every effect crosses.
Every domain, model class, and effect adapter composes with the same typed kernel. This page is the contract: what each identity carries, the invariant it holds, the replay law, the reasons a run may decline, and exactly what a pack or a module has to supply to be admitted.
live:falsesimulation-onlyone kernelabstain is a result
Ownership
Four writers, one flow.
Each boundary owns its own truth, and the kernel owns the flow between them. The rows below state what each writer owns and what it deliberately cannot do.
| Writer | Owns | What it never does |
|---|---|---|
| The kernel | Generic envelopes, identities, point-in-time admission, belief and uncertainty invariants, decision-run identity, the order authority is applied in, replay protocols, and the single idempotent simulated-effect readback. | It never authors a market, an evidence meaning, an action, a settlement, an evaluation, or a ruin rule. |
| A domain pack | Every domain fact: evidence, market facts, belief, action, effect intent, execution receipt, outcome value, settlement, evaluation, and the domain ruin policy. | It cannot add a decision law, reach an adapter on its own, or weaken the mandate floor it composes with. |
| A model module | Its inference semantics: artifact, configuration, lineage, inference receipt, replay law, and the receipt validation that binds the output to the observation. | It returns a belief, never an intent; it has no authority to act, and recorded replay never re-calls a provider or tool. |
| An effect adapter | Effect truth and the idempotent readback of its own receipt. | It does not decide, does not apply policy, and is reached only by an admitted act. |
Typed identities
Seven identities, seven invariants.
These are the customer-facing names for the kernel’s typed roots. Each one is a contract rather than a label: the invariant column is what the kernel refuses to proceed without.
| Identity | What it carries | The invariant |
|---|---|---|
| market | The identity and envelope around one pack-owned set of market facts. | The facts must validate, and market facts that carry a time must have been available with the observation. A market this envelope cannot vouch for never reaches planning. |
| observation | Typed evidence, the time it was observed, the time it became available, its source identity, and a content fingerprint the pack derives. | The fingerprint is derived from the evidence rather than supplied by the caller, and the availability time is read against the decision clock. Evidence published after the decision time is refused before any model runs. |
| belief | One pack-owned belief value, its bounded uncertainty, the model reference, the inference receipt, the observation fingerprint, and provenance. | Uncertainty is part of the output: bounds must be finite and inside the probability range, and a bare point estimate is invalid. The model’s receipt validation must bind output, lineage, and observation before the kernel accepts the belief. |
| mandate | The authority to act: permitted effects, expiry, confidence floor, exposure bound, and the domain ruin policy it composes with. | Nothing acts by default. A missing, expired, or invalid mandate, a prohibited effect, or a breached bound produces a reasoned abstention, and the domain policy may strengthen the floor but never weaken it. |
| decision | Exactly one typed outcome: an admitted act, or an abstention with its reason, bound to the decision run identity. | One decision receipt per run, reproducible from the same inputs. A rejected candidate produces no decision at all rather than an empty one. |
| execution | The optional adapter receipt of an act, bound to the run identity and the idempotency key that requested it. | It is never inferred from a decision and never required for settlement. The first call returns the receipt; a retry reads the same receipt; a conflicting request fails closed. |
| outcome | The resolved truth, bound to the market identity and the decision run identity, with an effect identity only when an execution occurred. | An outcome that does not name the run it belongs to is refused rather than credited. A correction appends a new record and never rewrites the original. |
The identity that ties one flow together
The decision run identity is the correlation identity for one flow — not an eighth root. It binds, in one canonical form:
- The market facts and the point-in-time evidence, with its observation and availability times and its source
- The model reference, artifact, configuration, lineage, replay law, and inference receipt
- The full belief value and its uncertainty envelope
- The full mandate and the domain ruin policy
- The decision time, and the resulting act or abstention
Identical valid inputs reproduce the same identity and the same typed receipt, and an outcome that names a different run is refused rather than credited.
LawA typed mismatch is a stop, not a repair
Every comparison the kernel makes — market identity, evidence availability, belief uncertainty, mandate, replay, execution binding, dataset role — fails closed with a named error. Nothing in the flow is repaired by best effort, and no stage infers a value another stage declined to supply.
Replay law
Two laws, no third option.
Replay is part of the contract, not a debugging feature. A run records which law it follows, and replay reproduces the decision under that law before anything else happens.
recorded inference
The original immutable inference receipt is the replay authority. The module validates the observation and its lineage, then returns the recorded output.
Recorded model and tool modules use this law, and replay never calls the provider or the tool again.
Zero adapter calls
Replay performs no effect and reads no external state. It recomputes the pure decision.
A mismatch stops the run
If replay does not reproduce the recorded decision, the run fails closed. It does not choose which one to believe.
No silent recompute
A recorded module that cannot replay its receipt is refused. The kernel never re-calls a provider to fill the gap.
Abstention reasons
Eight reasons a run may decline.
Abstention is a typed decision, not a failure mode: it carries one of these reasons, settles like any other run, and stays inside evaluation coverage.
| Reason | When the run declines |
|---|---|
| missing_mandate | No authority was presented for the requested effect. |
| invalid_mandate | The mandate was malformed or internally inconsistent, and nothing is interpreted loosely on the caller’s behalf. |
| expired_mandate | The mandate had passed its expiry at the decision clock, which is where expiry is read. |
| prohibited_effect | The requested effect is not permitted by this mandate, even when the belief is strong. |
| low_confidence | The belief sits inside the zone where acting is not justified by the declared confidence floor. |
| exposure_limit | The request exceeds the declared exposure or stake bound, which is enforced before the decision rather than at execution. |
| ruin_policy | The request breaches the domain risk policy that composes with the mandate. |
| domain_declined | The pack’s own action rule returned no action for this belief and these facts. |
Extension contract
What a domain pack or model module must supply.
A pack is the sole writer of its domain facts; a model module owns its inference. Neither can add a rule to the kernel, and both are asked for types rather than documents.
Domain pack
Ten typed inputs
Evidence, market facts, belief, action, effect intent, execution receipt, outcome value, settlement, evaluation, and ruin policy. No universal enum, dynamic map, or raw document stands in for them.
Domain pack
Fingerprints for each of them
The pack derives the canonical identity of its own evidence, market, belief, action, ruin policy, and outcome, so identity is typed rather than string-concatenated.
Domain pack
Pure validation and derivation
Validate the market (including its availability), the evidence, and the belief; map a belief to an action or to none; state the exposure units; validate the action against the ruin policy; map the action to an effect intent; settle; evaluate; and report the scalar loss evaluation aggregates.
Domain pack
The simulated-effect hooks
The namespace label of the execution identity, the intent a decided action must produce, the intent bytes that enter that identity, and the typed receipt the execution records.
Model module
Four typed authorities
An artifact, an inference configuration, a lineage record, and an inference receipt. A model records the authorities that apply to it — coefficients or runtime configuration for a formula, dataset and training lineage for a learned artifact, prompt and transcript lineage for a recorded tool or model.
Model module
A reference and a replay law
Module, version, and artifact digest, plus which of the two replay laws the module follows.
Model module
Receipt-bound output
Inference returns the belief with its uncertainty and receipt; the module validates that the receipt belongs to this observation, this lineage, and this output before the kernel will accept it.
Model module
The recorded replay hook
A recorded module implements the receipt-only replay path, which returns the immutable typed output. A module that does not implement it fails with a typed replay-unsupported error instead of silently recomputing.
Effect boundary
What the adapter boundary admits.
The boundary between a decision and an effect is the one place where something outside the run could happen, so it is stated as five rules rather than as a description.
- 01Only a replay-verified admitted act reaches an adapter. A rejected candidate cannot plan, and an abstention emits no intent.
- 02Tracing a decision value back to an adapter is deliberately constrained: the admitted run accepts only the simulation-marked adapter boundary, so a real external effect adapter cannot cross it by accident.
- 03The first call returns a typed receipt bound to the requested idempotency key; the same key with the same request reads that receipt back.
- 04The same key with a different requested effect fails closed, and the original receipt stands.
- 05Pure replay performs zero adapter calls: replaying a decision is not a reason to touch an effect.
The no second kernel rule
- One kernel and one lifecycle serve every domain. There is no second semantic path, and no compatibility route around the typed contracts.
- There is no model-specific decision path: formula, statistical, recorded, and recorded tool modules all arrive at the same envelope, and the decision law above it is unchanged.
- A pack composes by implementing the contract. It cannot add a domain switch to the kernel or bypass a temporal, risk, replay, or outcome rule.
- There is no universal rule document: a caller cannot hand the kernel a generic expression to evaluate in place of typed evidence, belief, and authority.
ReasonWhy this is a product rule, not a style choice
A second path would mean a second place where evidence can arrive late, where authority can be bypassed, or where an effect can be repeated. The kernel is the only writer of the decision flow, so there is exactly one place to audit: the verification method describes what that audit checks.
From the contract to the domains.
The domain reference shows what each shipped pack supplies through this contract and what its gates mean. The receipt reference shows the lines those contracts project.