arifOS — Constitutional AI Kernel

io.github.ariffazilPublished by GitHub account ariffazilv1!2026.10.11Updated Oct 30, 2026

Constitutional verdict layer for AI agents. SEAL/HOLD before mutation. F1-F13 floors; audit ledger.

VerifiedStreamable HTTPWeb executableKnowledge & Memory Security & Monitoring AI & ML

Server details

Identifier: io.github.ariffazil/arifos
Transport: Streamable HTTP
Runtime: Web executable
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account ariffazil for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.ariffazil%2Farifos.svg)](https://sourceweft.com/mcp/io.github.ariffazil%2Farifos?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Remote MCP kernel that judges an agent's proposed actions against 13 constitutional floors and returns SEAL, HOLD or VOID verdicts before execution.

What you can do: Start and resume governed kernel sessions that bind an actor identity and audit chain
Collect evidence with epistemic tags, search or fetch sources, and read kernel telemetry
Run structured reasoning passes and route natural-language intents to specialist organs
Recall, inspect, revise, promote or forget tiered kernel memory
Judge candidate actions and claims, returning a verdict with a reason chain
Preview or apply governed mutations, and append permanent entries to an append-only ledger
When to use it: For teams running AI agents in regulated or high-stakes settings who want an independent judgment layer between a proposal and its execution, and a record of what was decided. Also useful for developers wanting a policy decision point as a service, or reviewers evaluating AI governance frameworks.
Requirements: A remote streamable HTTP endpoint; no package, environment variable or header is declared. The README describes a session flow where arif_init returns a session id and token that later calls require, and notes that calls without a session are treated as anonymous and OBSERVE_ONLY. Self-hosting is described via a Python package and a local kernel port.

Before you install

The README states that some verbs mutate memory tiers and that promote and forget require human_approval=true, that arif_forge applies changes once it carries a sealed verdict id, and that ledger entries sealed via arif_seal cannot be edited or removed. It also reports an open gap: ack_irreversible and actor_signature are transported as payload fields with no published human signature binding, and the ledger head is not externally anchored. An independent audit cited in the README found…

Installation

In SourceWeft

Open arifOS — Constitutional AI Kernel in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.ariffazil%2Farifos/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "arifos-constitutional-ai-kernel": {
      "type": "http",
      "url": "https://mcp.arif-fazil.com/mcp"
    }
  }
}

README

⚠️ Current verified state — generated, never hand-edited

Runtime self-measurement (http://127.0.0.1:8088/health @2026-10-29T17:02:36Z): kernel degraded · floors 12/13 measured pass · vault999 healthy · release arifos-5564ca6f7f61 · drift aligned (source=built=deployed) · tools exposed 9. Per-floor provenance: .well-known/current-state.json.

Independent audit (2026-10-11, live re-probe by FI-008 + claim-level hand audit; receipts: AAA/forge_work/grant-arifos-reality-reforge-2026-10-11/): floors 2 pass · fail F2, F11, F12, F13 · 7 unmeasured = 13 distinct (raw key-count 10 includes L11/L12/L13, L-prefix aliases of the failing F11/F12/F13) · actor binding not verified (observed calls unsigned) · receipt fidelity broken on invocation-telemetry surface (HOLD persisted as ok:true) · independent reconstruction: no external verifier bound.

These are two different witness objects. Self-measurement ≠ independent audit; unmeasured is not pass. If this block conflicts with the live endpoint, the endpoint wins — re-run python scripts/generate_current_state.py.

Machine state: .well-known/current-state.json · Badge feed: .well-known/badges/ · Known gaps: What Is Not Yet Proven

[arifOS — agent proposes, arifOS judges, human authority, A-FORGE executes, reality and receipt]

arifOS

Authority before execution.

arifOS is a model-independent authority plane for AI agents. It evaluates consequential proposals against thirteen constitutional floors before execution, returns a governed verdict, preserves the human veto, and records what happened as an auditable receipt.

In a world where intelligence is abundant, authority becomes the scarce resource. arifOS keeps judgment independent from execution.

Documentation · Live Kernel · MCP · MCP Registry (Glama) · PyPI · Security · Evidence

[PyPI] [Python] [License] [Glama] [Unified CI] [Floors] [Security audit]

Proposer ≠ Judge ≠ Executor ≠ Witness Human sovereignty > machine authority

What arifOS is not: not an AI model · not an agent framework · not an execution engine (A-FORGE executes) · not an attention plane (AAA attends) · not the witness (FRAME witnesses; VAULT999 remembers) · not a substitute for authentication, sandboxing, or legal review.

Audience	What you get
Human	A quiet veto: the agent proposes, the kernel records a verdict, you stay sovereign
Agent / A2A	MCP tools + receipts. You do not get the keys. Judgment by arifOS, discovery by AAA, execution by A-FORGE
Institution	Policy floors F1–F13, a hash-chained VAULT999 audit trail, model-vendor independence
Machine / MCP	Streamable HTTP endpoint, 8 canonical verbs, published schemas
Registries & Indexers	Glama MCP Directory (Score: A) · `server.json` (Official MCP Registry) · `CURRENT_VERIFIED_STATE.md` · `llms.txt` · `CITATION.cff`

Live: https://arifos.arif-fazil.com · MCP :8088 · sister organs AAA · A-FORGE · GEOX

Who built this

arifOS was built by Arif Fazil, a senior exploration geoscientist who spent his career making decisions where observations are incomplete, interpretations are probabilistic, provenance matters, and irreversible action must be gated. He transferred that discipline into agent runtime governance.

I am a geologist, not a programmer. I did not write this codebase and I do not read it line by line. What I do is point at where the problem is — and the agents in my federation solve it, inside the constitution and the review gates I set, with the commit trail to show who ran what.

Read the commits if you want to check that claim: the author fields are agent handles, not aliases of mine. That is the deliberate shape of this project, not a detail being hidden. It also sets the honest expectation — the design and the judgment are mine, the implementation is theirs, and where the two disagree, the bug is mine to answer for.

The system is named after its founder and reflects a core belief: governance is a systems problem, not a model problem.

One human, and the agents he directs.

30-second proof

Three of the six graded scenarios:

text

Read customer account data        → SEAL   (receipt RCPT-…)Major refund (50× the ceiling)    → HOLD   (awaiting human)Delete account + audit trail      → VOID   (blocked by a hard floor)

Read customer account data        → SEAL   (receipt RCPT-…)Major refund (50× the ceiling)    → HOLD   (awaiting human)Delete account + audit trail      → VOID   (blocked by a hard floor)

Full transcript: docs/QUICKSTART.md. The demo runs in-process — no real records or funds are touched.

What works today

Deterministic rejection without consulting an LLM. The judge refuses on the constitution, not on a model opinion (gate: hard_deterministic, llm_consulted: false).
Prevention of a tested unauthorised mutation. One MUTATE-class call without presented authority was stopped before execution. Stronger: tampered-ACT tokens were rejected on 3 surfaces (kernel validate + kernel observe + A-FORGE policy gate) — receipts forge_work/lingkaran1/, measured 2026-10-29/30.

What is not yet proven

Every row names its own gap. Repairing a claim by substituting a stronger one is worse than the stale claim it replaced. (Closed rows are receipted in docs/evidence/GAP_HISTORY.md.)

Gap	Risk	Status
Independent security audit	Adversarial bypass testing not published	In progress — external researcher reviewing since 2026-08-25. Findings so far: fetch-surface SSRF (fixed, `1!2026.9.1`); Cypher injection (HIGH — key whitelist landed) and fastmcp path traversal (MEDIUM — containment guard landed). See SECURITY.md
Sovereign-binding of irreversible acknowledgement	`ack_irreversible` and `actor_signature` are transported as payload fields; nothing published shows a human signature bound to `(transaction_hash ‖ state_hash ‖ nonce)`, single-use, scoped, unforgeable by the proposing agent	Open — design drafted (`docs/judgment-integrity-2026-09-22/`), not implemented. F13 is enforced by convention and band-gating, not cryptographic transaction binding
Ledger head not externally anchored or signed	A hash chain held entirely by one party cannot detect wholesale rewrite by that party	Open — VAULT999 today is self-verifiable, not independently attestable
Third-party evaluation	No external reviewer has published findings	In progress since 2026-08-25; nothing published
Reproducible demo by strangers	Onboarding path not independently tested	Partial — demo verified here; no stranger has reproduced it unaided
Enterprise deployment	No production customer reference	Open
Standards conformance	MCP/A2A results not published externally	Partial — report: `result: PARTIAL`, per-tool schema validation DEFERRED
SBOM and signed releases	Supply-chain integrity unverified externally	Partial — CycloneDX on publish; no signing, no CVE scan
Test suite	Needs a live kernel (`tests/conftest.py` refuses without `:8088`, by design)	7,668 tests collect clean (2026-10-05); the identity/authority subset carries 34 pre-existing failures vs 321 passes (2026-09-30) — quote a failure set, never a bare pass count
Observability	Tracing partially wired	Partial — sovereign Postgres + arifFlow live; OTel spans on all 8 verbs; caller-side propagation incomplete
Semantic layer (Graphiti)	Knowledge graph retired from the read path	`graphiti_read: retired_888` (2026-09-04); semantic floor disabled by choice (`ARIFOS_ML_FLOORS=0`)
Comparative benchmark	No published comparison against alternative frameworks	Open
Maintainer continuity	Single sovereign, single reviewer; no succession or key-recovery procedure published	Open — relevant to institutional adoption
Identity registry in two copies	`contracts/identity.py` ↔ `arifosmcp/contracts/identity.py` had diverged; a one-sided edit ships split-brain identity	Mitigated 2026-09-30 (tripwire tests, 18 actors aligned) — consolidation to one owner still open

See SECURITY.md for the threat model and disclosure policy, and docs/evidence/claims.yaml for the machine-readable claim registry.

How it works

  Agent proposes action         │         ▼  ┌─────────────────┐  │   arifOS Kernel  │  Evaluates against 13 constitutional floors  │     (:8088)      │  Records provenance + evidence refs + hashes  └────────┬────────┘           │    ┌──────┼────────┬──────────┬───────────┐    ▼      ▼        ▼          ▼           ▼  SEAL    HOLD    SABAR     PARTIAL      VOID  (go)  (wait for (defer —  (proceed   (blocked by        human)    evidence   with       a floor)                  pending)   cooling)    │      │    ▼      ▼  Execute  Human  via      reviews  A-FORGE    │    ▼  Receipt in VAULT999 (append-only hash chain)

  Agent proposes action         │         ▼  ┌─────────────────┐  │   arifOS Kernel  │  Evaluates against 13 constitutional floors  │     (:8088)      │  Records provenance + evidence refs + hashes  └────────┬────────┘           │    ┌──────┼────────┬──────────┬───────────┐    ▼      ▼        ▼          ▼           ▼  SEAL    HOLD    SABAR     PARTIAL      VOID  (go)  (wait for (defer —  (proceed   (blocked by        human)    evidence   with       a floor)                  pending)   cooling)    │      │    ▼      ▼  Execute  Human  via      reviews  A-FORGE    │    ▼  Receipt in VAULT999 (append-only hash chain)

The judge never executes. The executor never certifies.

The verdict lattice

Verdicts are ordered and non-compensatory — a stronger verdict always dominates a weaker one. Two SOTs, one chain: the 5 primary ranks are declared in the constitutional SOT (kernel-sot.yaml); the full 7-rank chain adds 2 extension ranks in the runtime SOT (arifosmcp/models/verdicts.py):

Verdict	Plain English	What happens
SEAL	Go	Proceed to execution
PARTIAL	Go carefully	Proceed with cooling and monitoring
PROVISIONAL	Proceed with expiry timer	Auto-revoke at `valid_until`; no extension without re-judging
SABAR	Wait for evidence	Retry permitted later; distinct from HOLD
HOLD	Wait for human	Pause; await a human decision
HOLD_888	Stop — the sovereign decides	Escalate to F13
VOID	Blocked	Stop; the constraint must be resolved

Floors are never averaged. One floor failure propagates into the verdict; there is no compensating score.

13 Constitutional Floors (F1–F13)

Floor	Name	Rule (essence)
F1	AMANAH	Reversible first. Irreversible → 888_HOLD unless the sovereign acknowledges
F2	TRUTH	P(truth) ≥ 0.99; evidence carries OBS/DER/INT/SPEC labels
F3	TRI-WITNESS	W₃ = ∛(Human × AI × Earth) ≥ 0.75 at judgment; W³ ≥ 0.95 for SEAL
F4	CLARITY	ΔS ≤ 0 — every output reduces entropy
F5	PEACE²	Non-destructive power — block harm and extraction
F6	EMPATHY (kernel: MARUAH)	Protect the weakest stakeholder; dignity is not tradeable
F7	HUMILITY	Ω₀ ∈ [0.03, 0.05] — in-band pass, no fake certainty
F8	GENIUS	G ≥ 0.80 for complex actions — the simplest correct path
F9	ANTIHANTU	No deception, manipulation, or consciousness claims (lower = better)
F10	ONTOLOGY	AI-only ontology; a soul claim is VOID
F11	AUDITABILITY	Every decision logged, inspectable, attributable
F12	RESILIENCE	Injection defence; input risk < 0.85 (lower = better)
F13	SOVEREIGN	Human veto is FINAL

Three semantic classes: score floors (higher ≥ threshold), band floors (F7 in-band), ceiling floors (F9, F12 lower = better). Full canonical rules: FEDERATION_CONTRACT.md §3 · GENESIS/000_KERNEL_CANON.md.

VAULT999 — the record

Every consequential verdict and receipt is written to VAULT999: a hash-chained, append-only JSONL ledger set — tamper-evident by construction, not tamper-proof. An entry carries payload hash, entry hash, previous hash, trace root, actor, session and evidence references; source payloads are not copied in.

A hash chain proves internal consistency — not freedom from rewrite by whoever holds the ledger. External anchoring (published chain head, external signing) is not implemented: VAULT999 today is self-verifiable, not independently attestable. Census methods and counts: docs/evidence/VAULT_CENSUS.md (quote the timestamp with any count).

Connect an MCP client

[Glama] [Official Registry Manifest]

https://mcp.arif-fazil.com/mcp      # canonical public door · or http://localhost:8088/mcp self-hosted

https://mcp.arif-fazil.com/mcp      # canonical public door · or http://localhost:8088/mcp self-hosted

Canonical endpoint: https://mcp.arif-fazil.com/mcp. Listed & verified on Glama MCP Directory with rating A. Official registry manifest: server.json. https://arifos.arif-fazil.com/mcp is a live alias (proxies to the same kernel); use the canonical URL in client configs.

Client config — Cline · Cursor · Windsurf · Claude Desktop

Cline — cline_mcp_settings.json:

json

{ "mcpServers": { "arifos": { "type": "streamableHttp", "url": "https://mcp.arif-fazil.com/mcp" } } }

{ "mcpServers": { "arifos": { "type": "streamableHttp", "url": "https://mcp.arif-fazil.com/mcp" } } }

Cursor — ~/.cursor/mcp.json:

Windsurf — mcp_config.json (note: serverUrl, not url):

json

{ "mcpServers": { "arifos": { "type": "streamable-http", "serverUrl": "https://mcp.arif-fazil.com/mcp" } } }

{ "mcpServers": { "arifos": { "type": "streamable-http", "serverUrl": "https://mcp.arif-fazil.com/mcp" } } }

Claude Desktop — stdio bridge to the HTTP door:

json

{ "mcpServers": { "arifos": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.arif-fazil.com/mcp"] } } }

{ "mcpServers": { "arifos": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.arif-fazil.com/mcp"] } } }

Protocol facts, as measured: the kernel advertises 2026-07-28 and accepts 2026-07-28 · 2025-11-25 · 2025-03-26 · 2024-11-05; a live initialize currently settles on 2025-11-25 — pin that if you pin anything.

bash

curl -s http://localhost:8088/mcp \  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'# → 8 tools: arif_init arif_observe arif_think arif_route arif_memory arif_judge arif_forge arif_seal

curl -s http://localhost:8088/mcp \  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'# → 8 tools: arif_init arif_observe arif_think arif_route arif_memory arif_judge arif_forge arif_seal

Session flow (agents start here)

The kernel binds a session before any judgment:

jsonc

// 1 — arif_init: actor identity + authority band (HOLD is the normal starting state){ "name": "arif_init", "arguments": { "mode": "init", "actor_id": "my-agent", "intent": "…" } }// 2 — arif_judge: evaluate a proposal → verdict + evidence + next_safe_action{ "name": "arif_judge", "arguments": { "candidate": "Delete the production audit table", "action_tier": "standard", "session_id": "…", "actor_id": "my-agent" } }// 3 — arif_seal: only after a SEAL verdict; appends the receipt to VAULT999{ "name": "arif_seal", "arguments": { "payload": "…", "session_id": "…", "ack_irreversible": true } }

// 1 — arif_init: actor identity + authority band (HOLD is the normal starting state){ "name": "arif_init", "arguments": { "mode": "init", "actor_id": "my-agent", "intent": "…" } }// 2 — arif_judge: evaluate a proposal → verdict + evidence + next_safe_action{ "name": "arif_judge", "arguments": { "candidate": "Delete the production audit table", "action_tier": "standard", "session_id": "…", "actor_id": "my-agent" } }// 3 — arif_seal: only after a SEAL verdict; appends the receipt to VAULT999{ "name": "arif_seal", "arguments": { "payload": "…", "session_id": "…", "ack_irreversible": true } }

Call arif_judge without a session and the kernel answers actor: anonymous, authority: OBSERVE_ONLY, verdict: HOLD — it will not silently upgrade an unattested caller.

Stage numbering (single source of truth). The verbs follow the ratified eight-stage map: 000 INIT · 111 OBSERVE · 333 THINK · 444 ROUTE · 555 MEMORY · 666 JUDGE · 777 FORGE · 999 SEAL (arifosmcp/constitutional_map.py, F13-ratified 2026-07-31). The retired 888 judge label survives only in historical mirrors; the live wire says 666.

Guided walkthrough: docs/START_HERE.md · verified docs/QUICKSTART.md.

Machine-readable surfaces

Surface	URL	For
MCP tool schemas	tools.json	agents, registry crawlers
Agent context	`llms.txt` · `AGENTS.md`	coding agents
Citation	`CITATION.cff`	institutions, researchers
Truth badges	`.well-known/badges/`	status dashboards
Current state	`.well-known/current-state.json`	automation

Architecture

arifOS Federation — planes and classes
    ┌───────────────────────────────────────────────────┐    │  Authority plane — arifOS :8088                    │    │  Constitutional judgment · F1–F13 · VAULT999        │    └──────────────────────┬────────────────────────────┘                           │    ┌──────────────────────▼────────────────────────────┐    │  Attention plane — AAA :3001                       │    │  What matters · routing · state · skill catalog    │    └──────────────────────┬────────────────────────────┘                           │    ┌──────────────────────▼────────────────────────────┐    │  Execution plane — A-FORGE :7071/:7072             │    │  Governed mutation · leases · receipts             │    └──────────────────────┬────────────────────────────┘                           │    ┌──────────────────────▼────────────────────────────┐    │  Witness + record — FRAME :18085 · VAULT999        │    │  Independent observation · immutable history       │    └───────────────────────────────────────────────────┘        boundaries:  HERMES :18087 (semantic) · CHRON :18102 (temporal)        domains:     GEOX :8081 · WEALTH :18082 · WELL :18083        metabolism:  arifFlow :7073      gateway: FED :7074      synthesis: i-ARIF

arifOS Federation — planes and classes
    ┌───────────────────────────────────────────────────┐    │  Authority plane — arifOS :8088                    │    │  Constitutional judgment · F1–F13 · VAULT999        │    └──────────────────────┬────────────────────────────┘                           │    ┌──────────────────────▼────────────────────────────┐    │  Attention plane — AAA :3001                       │    │  What matters · routing · state · skill catalog    │    └──────────────────────┬────────────────────────────┘                           │    ┌──────────────────────▼────────────────────────────┐    │  Execution plane — A-FORGE :7071/:7072             │    │  Governed mutation · leases · receipts             │    └──────────────────────┬────────────────────────────┘                           │    ┌──────────────────────▼────────────────────────────┐    │  Witness + record — FRAME :18085 · VAULT999        │    │  Independent observation · immutable history       │    └───────────────────────────────────────────────────┘        boundaries:  HERMES :18087 (semantic) · CHRON :18102 (temporal)        domains:     GEOX :8081 · WEALTH :18082 · WELL :18083        metabolism:  arifFlow :7073      gateway: FED :7074      synthesis: i-ARIF

Plane / class	Component	Role
Authority	arifOS `:8088`	Constitutional judgment — owns the gavel and the ledger
Attention	AAA `:3001`	What matters, and to whom. Displays, routes, queues; never adjudicates
Execution	A-FORGE `:7071`/`:7072`	Governed mutation — leases, gates, receipts
Witness	FRAME `:18085`	Independent observer. Its output is evidence, never a verdict
Record	VAULT999 (in-kernel)	Immutable append-only ledger
Metabolism	arifFlow `:7073`	Receipt ingestion, FQ monitoring; never adjudicates
Domain intelligence	GEOX `:8081` · WEALTH `:18082` · WELL `:18083`	Domain evidence and computation. Compute-only: no organ authorises its own action
Provider gateway	FED `:7074`	Multi-provider model routing (advisory-only)
Boundary services	HERMES `:18087` · CHRON `:18102`	Semantic and temporal boundaries — not organs (FEDERATION_CONTRACT.md §2.1)

Tool-count semantics (so no two surfaces disagree): tools_loaded = 8 — the public MCP facade (KERNEL_ABI_8), the only number to quote publicly · canonical superset = 25 (8 public ABI + 4 map-only verbs: arif_fetch, arif_challenge, arif_stage, arif_measure + 13 hidden verbs) · total_declared = 48 (8 canonical + 40 diagnostic) · registry = 62 (with aliases) · operational = 3 (durable SUCCESS in the last 24 h — proven live, not merely invocable).

Verification Status

Dynamic values live in the generated block at the top of this file — this table names how each surface is verified, not stale copies of the numbers.

Surface	How to verify
Public repository	GitHub `ariffazil/arifOS`, AGPL-3.0
PyPI package	`pip install arifos` → pypi.org/project/arifos
Live kernel + floors	`curl localhost:8088/health` → status, per-floor provenance
MCP interface	live `tools/list`; protocol negotiation note above
VAULT999 ledger	`scripts/verify_vault_chain.py` (scope: the active ledgers under `arifOS/VAULT999/`); census methods in `docs/evidence/VAULT_CENSUS.md`
Source / build / deploy	`/health → software_release` (drift flag) · re-attested on every `scripts/deploy-release.sh` run
Contract schema	`contract_status` in `/health`
Machine-readable	tools.json · llms.txt · CITATION.cff
Scanner attestation	mcp.arif-fazil.com/proof/

Operational gates (CI)

Workflow	What it guards
Unified CI	build + test
MCP Conformance	protocol surface
Vault Integrity	ledger chain
Floor Gate	floor evaluation
Governance Gate	governance contract
Drift Monitor	source↔runtime drift
Uptime	endpoint liveness

Sister Repositories

Repository	Purpose
AAA	Attention plane — routing, state, skill catalog, A2A gateway
A-FORGE	Execution engine after authorisation
GEOX	Earth sciences domain evidence
WEALTH	Capital and financial intelligence
WELL	Human and machine vitality observation
arifFlow	Metabolic ledger daemon — FQ monitoring, receipt ingestion
FRAME	Independent observer — drift detection, evidence gathering (repository archived, organ live)

No public repository today: FED (:7074) and i-ARIF. They are deployed and reachable, but their source is not published. Treat their behaviour as observed from /health only.

Evidence & Trust

arifOS publishes verifiable evidence for its claims. Every public claim links to an artifact that can be regenerated.

Claim	Evidence	Status
MCP conformance	CI · report	Partial
ABI stability	Drift guard	Partial
Floor enforcement	`/health → layer_health.constitutional` (per-floor provenance)	Verified by self-measurement; independent audit found the gap set above
Vault integrity	`scripts/verify_vault_chain.py`	Verified — INTACT within its scope; 2 legacy breaks reported as historical
SBOM	Generator	Partial
Quickstart	Verified quickstart	Verified by the maintainer 2026-09-21; not yet reproduced by a stranger

Honesty principle: we publish what passed, what failed, and what remains unknown. We do not claim maturity beyond our evidence.

External Footprint & Discovery

arifOS is publicly discoverable beyond first-party domains.

Current Measured Reality

Discoverable: YES
Installable: YES (pip install arifos)
Inspectable: YES
Forkable: YES

Verified Surfaces

GitHub public repositories (ariffazil/arifOS, ariffazil/arifosmcp)
PyPI packages (arifos, arifosmcp)
MCP ecosystem directories (model-context-protocol.com, glama.ai)
Third-party MCP catalogs (Loomal, Skills Playground, LobeHub, G2, Willow)

Candidate Independent References (Observed Claims)

Agentrust: Awesome AI Governance (Curated production AI governance frameworks)
Tom Rochette: AI Control Planes Research (Technical evaluation on separation of powers and self-audit culture)
Hapax Systems: Constitution Research (Comparative benchmark on runtime axiom enforcement)

Open Gaps

Independent validation not yet established
Independent CI verifier not yet bound (Open Gap 4)
Academic citation not yet established
Commercial adoption not independently verified

Discoverability should not be interpreted as endorsement, certification, adoption, or proof of effectiveness.

See: docs/EXTERNAL_WITNESS_LEDGER.md and docs/EXTERNAL_FOOTPRINT.md.

Who Is This For

Operators deploying AI agents in regulated environments who need an independent judgment layer between proposals and execution. Developers building agent systems who want a policy decision point as a service. Evaluators and security reviewers assessing AI governance frameworks. Domain builders adapting governance to a field (geoscience, finance, healthcare).

Start here: docs/START_HERE.md

Development

bash

git clone https://github.com/ariffazil/arifOS.gitcd arifOSpip install -e ".[dev]"                       # dev tier — kernel + test toolingpython -m pytest tests/ -q                    # needs a live kernel at :8088 (see gaps)make health                                   # probe the kernelPORT=8088 arifos-mcp streamable-http          # start the kernelpython scripts/generate_current_state.py      # re-stamp the generated truth block

git clone https://github.com/ariffazil/arifOS.gitcd arifOSpip install -e ".[dev]"                       # dev tier — kernel + test toolingpython -m pytest tests/ -q                    # needs a live kernel at :8088 (see gaps)make health                                   # probe the kernelPORT=8088 arifos-mcp streamable-http          # start the kernelpython scripts/generate_current_state.py      # re-stamp the generated truth block

See CODEOWNERS for sovereign ownership of automation surfaces and CONTRIBUTING.md.

Project structure (the five [wheel root] entries are exactly what ships)

arifOS/├── arifosmcp/          # Core kernel package                    [wheel root]│   ├── abi/            # Capability registry and floor definitions│   ├── constitution/   # Constitutional floor implementations│   ├── contracts/      # Packaged copy of the identity/verdict contracts│   ├── kernel/         # Core judgment engine│   └── VAULT999/       # VAULT999 ledger implementation├── arifos/             # Phase 3 identity/consent namespace      [wheel root]├── contracts/          # Runtime contract package                [wheel root]├── core/               # Load-bearing legacy root                [wheel root]├── schemas/            # INIT v2 schemas (F13-ratified 2026-09-20) [wheel root]├── examples/           # Runnable governed workflow demo├── tests/              # Test suite (pytest)├── scripts/            # Operational tooling (update_readme_sot.py, generate_current_state.py)├── .well-known/        # Generated machine state + truth badges (gitignored: state/)├── docs/               # Documentation + evidence/ + archive/└── pyproject.toml      # Package metadata — [wheel root] marks packages.find.include

arifOS/├── arifosmcp/          # Core kernel package                    [wheel root]│   ├── abi/            # Capability registry and floor definitions│   ├── constitution/   # Constitutional floor implementations│   ├── contracts/      # Packaged copy of the identity/verdict contracts│   ├── kernel/         # Core judgment engine│   └── VAULT999/       # VAULT999 ledger implementation├── arifos/             # Phase 3 identity/consent namespace      [wheel root]├── contracts/          # Runtime contract package                [wheel root]├── core/               # Load-bearing legacy root                [wheel root]├── schemas/            # INIT v2 schemas (F13-ratified 2026-09-20) [wheel root]├── examples/           # Runnable governed workflow demo├── tests/              # Test suite (pytest)├── scripts/            # Operational tooling (update_readme_sot.py, generate_current_state.py)├── .well-known/        # Generated machine state + truth badges (gitignored: state/)├── docs/               # Documentation + evidence/ + archive/└── pyproject.toml      # Package metadata — [wheel root] marks packages.find.include

Until 2026-09-30 this tree listed only arifosmcp/ while the runtime imported contracts.* at 10 import statements across 5 files — production resolved them only from a site-packages leftover that a fresh venv would not have. Fixed in 27409ddbf. An incomplete structure diagram is not a cosmetic gap — it is how an unshipped, runtime-critical package stays invisible. contracts/ and arifosmcp/contracts/ are kept in agreement by tripwire tests; consolidating them into one owner is still open.

Security

See SECURITY.md for the threat model, known vulnerabilities and disclosure policy.

License

AGPL-3.0 (LICENSE). When deployed over a network, the complete source code must be made available to all users interacting with the service.

Revision 2026-10-17 — APEX-ZEN upgrade: human story moved forward, founding context consolidated, 30-second proof elevated, duplicate "not yet proven" consolidated, "drift aligned" semantics clarified (binary matches build source, not necessarily repo HEAD). Prior revision: 2026-10-16 restructured under AGENTIC-README-DOCTRINE v1. Prior audit passes: 2026-09-21 full re-measurement · 2026-09-22 Copilot external ENTERPRISE · 2026-10-11 independent re-probe · 2026-10-17 four-probe audit (333-AGI + IrfanClaw + ChatGPT + WawaBot).

Ditempa Bukan Diberi — Forged, Not Given.

🔗 Federation Identity

Field	Value
Organ	`arifos` · CORE · governance_kernel
Ports	8088 (/mcp)
Unit	arifos.service
Authority ceiling	JUDGE_ONLY
Public MCP	https://mcp.arif-fazil.com/mcp (canonical; live alias: https://arifos.arif-fazil.com/mcp)
Flow graph	FEDERATION.md — peta semua organ + repo

Source: README.md at commit 024ff90

Tools

arif_init

000 Init · Kernel Session

KERNEL 000 · Ignite a governed kernel session: binds actor identity, constitutional floors F1–F13, and the audit chain. Returns the session_id + session_token that every other arif_* verb requires. Use mode=preflight to inspect an existing session without re-igniting, mode=resume to continue one. Modes: init, preflight, resume, validate, canary, triage, epoch_open, epoch_seal, light, opt_out.Auth: the only verb needing no session — it mints the session_id + session_token every other verb requires. Returns: session_id, session_token, constitution_hash, allowed_next_tools.

Parametersmodenonceintentrequiredcontextpayloadtoolingverboseactor_idepoch_idevidencetrace_idverbosity+16 more

arif_observe

111 Observe · Sense Reality

KERNEL 111 · Collect evidence — facts and sources with epistemic tags (OBS) and uncertainty bounds, never conclusions. mode=search queries the open web/literature; mode=fetch retrieves a URL and records its provenance; mode=vitals reads kernel machine telemetry. Reason over what you gathered with arif_think; delegate domain analysis to an organ with arif_route. Modes: search, fetch, hybrid_discovery, ingest, compass, atlas, entropy_dS, vitals.Auth: requires session_id + session_token from arif_init. Returns: evidence items with epistemic tags (OBS) and uncertainty bounds — facts, never conclusions.

Parametersurlmodequerylayersactor_idsession_idresult_limitsession_token

arif_think

333 Think · Mind

KERNEL 333 · Structured reasoning pass: decomposes a query and returns reasoning steps labeled OBS (observed), DER (derived), INT (interpretation), SPEC (specification) under truth floors. Produces reasoning records only — no verdicts (those come from arif_judge) and no state changes. The plan-family modes draft/review/approve execution plans; simulate and wonder explore counterfactuals. Modes: reason, reflect, verify, axioms, plan, plan_review, plan_approve, refactor_plan, metabolize, simulate, wonder, atlas.Auth: requires session_id + session_token from arif_init. Returns: reasoning steps labelled OBS/DER/INT/SPEC — records only; verdicts belong to arif_judge.

Parametersmodequerycontextplan_idactor_idsession_idwitness_typesession_token

arif_route

444 Route · Intent→Organ

KERNEL 444 · Intent→organ router: classifies a natural-language intent and dispatches it to the specialist organ (GEOX geoscience, WEALTH capital, WELL vitality, A-FORGE execution). Returns the routing decision only — no organ call — unless organ_tool names the target tool and arguments carries its inputs. Prefer this over guessing organs yourself; use arif_think for reasoning you keep in-kernel.Auth: requires session_id + session_token from arif_init. Returns: the routing decision (organ + tool) only — the organ call itself is a separate step.

Parametersmodetaskorganintentactor_idargumentsmission_idorgan_toolsession_idsession_tokencontract_c_kwargs

arif_memory

Memory Governor · Kernel

KERNEL 555 · Governed memory of the kernel itself: six tiers (L1–L6) with per-mode gating. recall, inspect, and audit are read paths; remember, revise, promote, and forget mutate tiers — promote and forget additionally require human_approval=true. Use for cross-session lessons, canon, and memory audit; external evidence belongs to arif_observe and reasoning artifacts to arif_think. Modes: recall, inspect, attest, remember, promote, revise, forget, audit, metabolize.Auth: requires session_id + session_token from arif_init. Returns: memory entries by tier (L1–L6); promote and forget gates require explicit human approval.

Parametersmodetierquerycontentpayloadto_tieractor_idlease_idtrace_idmemory_idsession_idnew_content+3 more

arif_judge

666 Judge · Verdict

KERNEL 666 · Binding constitutional arbitration: evaluates a candidate action or claim and returns SEAL / HOLD / SABAR / VOID with the full reason chain. Weighs action class, blast radius, reversibility, entropy pathway, and cooling state; a SEAL verdict here is what arif_forge requires before it will execute anything. Judge arbitrates — it does not gather (evidence comes via arif_observe, reasoning via arif_think) and it does not mutate (execution is arif_forge, permanence is arif_seal). Modes: judge, intercept, validate, hold, escalate.Auth: requires session_id + session_token from arif_init. Returns: verdict (SEAL/HOLD/SABAR/VOID) with the full reason chain — arbitration only, it does not mutate.

Parametersmodenoncedomainkey_idactor_Bactor_idevidenceactor_Phicandidateclaim_textsession_idaction_tier+19 more

arif_forge

777 Forge · Execute Gate

KERNEL 777 · Governed execution: applies a mutation through A-FORGE only when carrying a sealed verdict id (seal_verdict_id) from arif_judge and a live session. The manifest/query defines exactly what changes; mode=dry_run previews the plan without applying it. This is the only verb that executes general mutations — kernel memory writes go to arif_memory and permanent records to arif_seal.Auth: requires session_id + session_token from arif_init plus a sealed verdict id (seal_verdict_id) from arif_judge. Returns: the applied mutation receipt — one of the two committal verbs (with arif_seal).

Parametersmodequeryplan_idactor_idmanifestsession_idarif_ack_idartifact_idsession_tokenvault_entry_idseal_verdict_idack_irreversible+3 more

arif_seal

999 Seal · VAULT999

KERNEL 999 · Append an entry to VAULT999, the immutable ledger — accepted entries can never be edited or removed; there is no unseal. Use for permanent records of verified outcomes, lessons, and session closure once a verdict exists. ack_irreversible=true is the explicit acknowledgment of permanence, and judge_state_hash binds the entry to the verdict that authorized it. Reversible changes belong in arif_forge under a SEAL. Modes: seal, verify, ledger, changelog, audit, session_close.Commit projection: seven of the eight verbs are reversible or informational and project their outcomes onto the two committal verbs — arif_forge (governed mutation) and arif_seal (permanence). Auth: requires session_id + session_token from arif_init. Returns: the immutable ledger entry id — append-only, there is no unseal.

Parametersmodenoncepayloadrequiredactor_idsession_iddrift_eventsseal_purposewitness_typesession_tokenconstitutionalactor_signatureack_irreversible+2 more

arif_report

Arif Report

AGENT REPORT LANE · File or read reports between agents without involving the human. Use when your work is done, when you are blocked by another agent, or when you need to tell peers a fact. modes: report (file), inbox (read peers), ack, flush, stats. kind=fyi|peer|done|claim stay in the peer lane; ONLY kind=decision or kind=blocked reach the sovereign, and only in one coalesced message. Reports are SELF_REPORTED — probe before relying on one.

Parametersbodykindmodeforcelimitsincesenderdry_runsubjectactor_idevidenceplatform+7 more

Version history

v1!2026.10.11LatestOct 16, 2026
v2026.06.30Sep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 daysRequired25 pts
Auth declaredRequired10 pts
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts