kernel/attestation/DescriptorHashStore

Summary: DescriptorHashStore.js — persists approved tool/resource/prompt descriptor hashes IDB-side, so a "rug pull" (descriptor silently changing after the user approved it) is detected across sessions, not just within one runtime (that in-memory check is webgpu-os/kernel/tools/MetadataRugPullDetector.js). Hashing reuses the same SHA-256 primitive as packages/PackageVerifier.js (contentHashHex from engine/core/math/ChecksumMath.js) rather than a new hashing routine. Storage reuses the generic 'kv' IndexedDB store (see storage/IndexedDBDriver.js) instead of adding a new object store/migration.


descriptorMeaningSnapshot

Summary: Complete approval identity for a callable descriptor. This intentionally includes authority, mutability, effect, provenance, timeout, and executable source fields so retaining the same JSON input schema cannot conceal a more dangerous implementation after approval.


portableDescriptorMeaningSnapshot

Summary: Package-portable descriptor identity for signed Faculty manifests only.


kernel/attestation/DescriptorSanitizer

Summary: DescriptorSanitizer.js — static scanner for tool/resource/prompt descriptors: flags prompt-injection strings in description/schema text, reuses HiddenParameterDetector (Phase 3) for undeclared/suspicious parameters instead of a parallel implementation, and flags a mismatch between a tool's self-declared risk and its AffordanceRegistry-declared risk.


kernel/attestation/DryRunManager

Summary: DryRunManager.js — thin wrapper over engine/state/worldmodel/PredictionSandbox.js (rollout/plan, confidence-decay) — no new dry-run engine. Lets a tool call's declared predictedEffects (AffordanceRegistry, Phase 3) be previewed against a state snapshot WITHOUT ever touching canonical state.


kernel/attestation/ParameterPreviewer

Summary: ParameterPreviewer.js — resolves a tool-call args object into a human-safe preview: sensitive-looking values (key/secret/token/password/ credential) are masked and long strings are truncated, so an approval UI (Phase 8's ApprovalCard) can show "what will actually be sent" without ever rendering raw secrets to the screen.


kernel/drivers/LLMDriver


kernel/drivers/WebGPUAmbientDriver

Summary: Factory: returns an AmbientEngine driver object { apply, destroy }. Internal simulation state is held in a closure and fully reset between mounts.


kernel/execution/ActiveTurnCoordinator

Summary: ActiveTurnCoordinator.js — bounded, provider-neutral user steering for one active AI executor request. It owns ordering and deduplication only; kernel policy, tool approval, persistence, and model dispatch remain elsewhere.


classifySteeringImpact

classifySteeringImpact(kind, value = '')

Summary: Describe which cached work a steering message invalidates. This is a data decision only; it never widens authority or silently approves a new target.


classifySteeringDelivery

classifySteeringDelivery(kind, value = '', { progressEstimate = null } = {})

Summary: Select when one operator instruction should affect an active task. This is deliberately a score of the instruction/task relationship, never a score of the person. It is deterministic, local, content-free in diagnostics, and grants no authority. The task Storylet consumes the resulting delivery mode at its next transition.


kernel/execution/AuditLog

Summary: AuditLog.js — thin audit VIEW over the same shared EventLog used by the Phase 7 Time Engine (one log, not two): filters to commit/receipt/ledger events via the existing TimelineExporter, with chain verification attached.


kernel/execution/BrowserNativeJavaScriptVerifier

Summary: Non-executing browser verifier for JavaScript, TypeScript, JSX, and TSX. Browser engines expose a non-executing parser only for classic JavaScript through Function construction. Module, TypeScript, and JSX verification must therefore use an explicitly supplied parser adapter or remain inconclusive. Lexical balance is always reported separately and is never promoted to parse evidence.


verifyBrowserNativeJavaScript

async verifyBrowserNativeJavaScript({ path = '', content = '', sourceRevision = '', rulesHash = '', knownFiles = null, knownDependencies = null, parserAdapters = {}, } = {})


kernel/execution/BudgetLimiter

Summary: BudgetLimiter.js — wraps engine/state/authority/PolicyEngine.js (ordered rules, deny-overrides-allow, risk classification, approval-required) for AI request/tool-call/commit policy, plus per-request step budgets via the Phase 7 CooldownManager's BoundedCounterEscrow.


kernel/execution/CommitGate

Summary: CommitGate.js — the OS's ONE commit path: wraps engine/state's createCommitCoordinator (the 14-step atomic protocol) and createCommitGate (lightweight fact-only commits) over the SHARED Phase 7 stores — the same FactStore, EventLog, USORegistry (CooldownManager's), IdempotencyRegistry, and the Phase 4 CapabilityRegistry. Nothing AI-produced becomes canonical except through here.


kernel/execution/ContextBroker

Summary: ContextBroker.js — wraps engine/state/worldmodel/BeliefStore.js: one BeliefStore per AI request keeping the five worlds strictly separated (CANONICAL/OBSERVED/BELIEF/PREDICTED/PROPOSED). A belief or prediction can NEVER become canonical here — syncCanonical() is only called by the execution loop AFTER a witnessed commit.


kernel/execution/DodadForge

Summary: DodadForge.js — OS-owned project contracts for interactive AI Echo outputs. Provider text is never executed directly. The forge accepts one explicit four-file envelope, validates it as data, and runs declared behavior only in an opaque, network-blocked iframe before the existing signed Dodad Faculty is allowed to persist the project.


buildDodadForgeBlueprint

buildDodadForgeBlueprint(prompt = '', { decision = null } = {})

Summary: Build a deterministic specialist handoff for one Dodad request. Roles are responsibility slices inside one bounded episode, not agents and not authority. Only patterns whose trigger evidence is present are loaded.


buildDodadForgeAuthoringPrompt

buildDodadForgeAuthoringPrompt(prompt = '', { failures = [] } = {})


parseDodadForgeProject

parseDodadForgeProject(value, { prompt = '', blueprint = null } = {})


validateDodadForgeProject

validateDodadForgeProject(input = {}, { prompt = '', blueprint = null } = {})


verifyDodadForgeProjectRuntime

async verifyDodadForgeProjectRuntime(project, { timeoutMs = RUNTIME_TIMEOUT_MS } = {})


scoreDodadForgeProject

scoreDodadForgeProject({ html = '', css = '', javascript = '', manifest = null, recipe: selectedRecipe = null, blueprint = null } = {})

Summary: Deterministic quality projection; blockers cover recipe-defining behavior only.


verifyDodadJavaScriptWorker

async verifyDodadJavaScriptWorker(source, { timeoutMs = WORKER_TIMEOUT_MS } = {})

Summary: Compile and execute only the Dodad's top-level JavaScript inside a killable Worker with inert DOM shims. Runtime deltas are never executed. A hung or syntactically invalid script is terminated before the DOM sandbox opens.


kernel/execution/ExecutionApprovalMode

Summary: Deterministic execution-approval modes. This module decides whether an already-reviewed tool action still needs an operator prompt. It never grants authority: ToolActionReview, ToolRouter, Navi Faculty capability leases, workspace roots, and mounted-folder scopes remain authoritative for every call.


executionApprovalRepeatProfile

executionApprovalRepeatProfile(review, { appId = '', naviId = '' } = {})

Summary: Content-free identity for a repeatable approval scope. Arguments are intentionally omitted: changed values may repeat only when the tool, descriptor, authority, data classes, and exact target scope are unchanged.


decideExecutionApproval

decideExecutionApproval({ mode, review, priorReceipt = null } = {})

Summary: Decide only the prompt behavior for an action that has already passed the OS review. `priorReceipt` must be an OS-recorded successful call for the same repeat profile; model recommendations never substitute for it.


kernel/execution/ExecutionHorizonPolicy

Summary: Pure adaptive execution-window policy. It has no authority vocabulary and can only reduce caller-supplied action/concurrency ceilings. Descriptor risk and reversibility dominate calibration: confidence never changes approval, capability, tool selection, or the static execution ceiling. Callers must enforce the returned action and mutation limits as hard dispatch boundaries.


kernel/execution/JavaScriptExecutionGrant

Summary: JavaScriptExecutionGrant.js — exact-source, short-lived execution binding. This contract narrows an already-authorized raw JavaScript tool call. It is not an authority source: ToolRouter, the Faculty capability grant, OS policy, developer mode, and the browser extension approval boundary still decide whether execution is allowed.


JavaScriptExecutionGrantError

class JavaScriptExecutionGrantError extends Error


inspectJavaScriptApiUsage

Summary: Return the conservative, inspectable API categories visible in source.


resolveJavaScriptPermittedApis

resolveJavaScriptPermittedApis(source, permittedApis = null)

Summary: Normalize a caller-declared API allowance and ensure it covers every API category the conservative source scan can observe. Omission selects the observed set, keeping existing developer-only calls compatible.


hashJavaScriptNavigationGeneration

async hashJavaScriptNavigationGeneration({ tabId, url, pendingUrl = '', status = '' } = {})

Summary: Hash the observable browser navigation identity without publishing its URL.


createJavaScriptApprovalBinding

async createJavaScriptApprovalBinding({ source, permittedApis = null, surface = 'browser-page', world = surface === 'os-worker' ? 'WORKER' : 'USER_SCRIPT', tabId = null, naviId = '', facultyId = '', taskId = '', requestId = '', } = {})

Summary: Build the exact source/API projection embedded in ToolActionReview.


createJavaScriptExecutionGrant

async createJavaScriptExecutionGrant({ source, permittedApis = null, surface = 'browser-page', world = surface === 'os-worker' ? 'WORKER' : 'USER_SCRIPT', target = null, naviId = '', facultyId = '', taskId = '', requestId = '', issuedAt = Date.now()

Summary: Create one exact, bounded runtime grant after the target has been observed.


verifyJavaScriptExecutionGrant

async verifyJavaScriptExecutionGrant(grant, { source, permittedApis = null, surface = 'browser-page', world = surface === 'os-worker' ? 'WORKER' : 'USER_SCRIPT', target = null, naviId = '', facultyId = '', taskId = '', requestId = '', now = Date.now()

Summary: Recompute every meaning-bearing field and reject expired or altered grants.


kernel/execution/NaviContextRollover

Summary: Compact, derived task context for rollover between bounded execution turns. The projection contains identifiers, hashes, classifications, and counts only. It has no persistence and rejects raw content, tool arguments, or reasoning.


NaviContextRolloverError

class NaviContextRolloverError extends Error


createNaviContextRollover

async createNaviContextRollover(raw = {}, options = {})


kernel/execution/NaviExplainabilityProjection

Summary: NaviExplainabilityProjection.js — compact, authority-free explanations derived from records the OS already owns. This module has no persistence and never accepts provider reasoning. It projects task state, steering, routing, tool outcomes, verification, and receipts into inspectable local evidence.


projectNaviWhy

Summary: Explain one active or completed Navi task from its existing projections and ledgers. `report` is the TaskLedger FinalReport (or its durable compact form), and `steering` is ActiveTurnCoordinator.snapshot(). No record is written.


projectNaviResourceSelectionExplanation

Summary: Project one signed/validated resource-selection receipt without re-ranking.


projectNaviSmartRoutingExplanation

async projectNaviSmartRoutingExplanation(raw = {})

Summary: Explain an exact NaviModelBroker decision, including excluded routes and the smallest policy/settings change that could make each route eligible. The explanation is derived after routing and cannot alter the decision.


kernel/execution/NaviProposalEnvelope

Summary: NaviProposalEnvelope.js — binds a proposed change to observed evidence, explicit inferences, unresolved questions, an exact target revision, and deterministic verification/compensation. A proposal has no authority by itself and must still pass the normal review and capability path.


createEvidenceBoundProposal

async createEvidenceBoundProposal(value = {})


kernel/execution/NaviTaskGraphCheckpoint

Summary: Durable, content-free checkpoints for compiled Navi task graphs. This module neither executes nor replays graph nodes. Persistence is supplied by an exact-key adapter with one read and one compare-and-swap operation.


NaviTaskGraphCheckpointError

class NaviTaskGraphCheckpointError extends Error


createNaviTaskGraphCheckpoint

async createNaviTaskGraphCheckpoint(raw = {})


async validateNaviTaskGraphCheckpointTransition(raw = {})

Summary: Enforce task-lifetime monotonicity for the mutation ledger. Completed tombstones are immutable. Outcome-unknown tombstones may resolve to a completed tombstone, or be removed by an exact current mutation node whose failed outcome is explicitly verifier-bound. Generic failures never evict.


classifyNaviTaskGraphResume

async classifyNaviTaskGraphResume(raw = {})


kernel/execution/NaviTaskGraphCompiler

Summary: NaviTaskGraphCompiler.js — deterministic compiler for model-proposed tool plans. A compiled graph is evidence, never authority: every node still enters ToolActionReview, ToolRouter, and the Faculty membrane before it can execute.


NaviTaskGraphCompilerError

class NaviTaskGraphCompilerError extends Error


kernel/execution/NaviTaskStateProjection

Summary: NaviTaskStateProjection.js — immutable, schema-validated runtime projection for one active Navi task. Canonical task persistence remains NaviCognition; this module projects inspectable live state for streams and in-flight views.


evolveNaviTaskStateProjection

evolveNaviTaskStateProjection(current, patch = {}, { now = Date.now()


acceptNaviTaskSteering

acceptNaviTaskSteering(current, event, options = {})


setNaviTaskCurrentAction

setNaviTaskCurrentAction(current, action, options = {})


completeNaviTaskWork

completeNaviTaskWork(current, work, options = {})


setNaviTaskPendingApproval

setNaviTaskPendingApproval(current, approval, options = {})


clearNaviTaskApproval

clearNaviTaskApproval(current, approvalId, options = {})


syncNaviTaskRuntime

syncNaviTaskRuntime(current, { executorPhase, status = null, remainingBudget = null, artifacts = null, planRef = undefined, contextManifestRef = undefined, resourceSelectionRef = undefined, investigationCaseRef = undefined, goalProgress = null, } = {}, options = {})


kernel/execution/PrivacyGuard

Summary: PrivacyGuard.js — scrubs context before it leaves the OS toward a remote model provider: sensitive-looking values are masked (reuses Phase 5's ParameterPreviewer — one masking implementation), obvious credential literals in free text are redacted, and payload size is capped.


kernel/execution/RepairLoop

Summary: RepairLoop.js — malformed-model-output repair: first a local structural extraction (strip code fences, isolate the outermost JSON object/array), then target-shape validation and at most one model-assisted repair pass on the selected route's fast tier. Repair duration is operator-controlled: steering may supersede it and Stop aborts it. The route/attempt policy stays bounded, and wrong-schema JSON is never accepted merely because it parses.


kernel/execution/RunEventStreamRegistry

Summary: Kernel-owned resumable event streams for AI executions. App callbacks are only a live view. This registry assigns monotonic sequence numbers, buffers bounded events, and supports same-owner replay after an app remount or transient UI failure. Durable history remains in FinalReport.


RunEventStreamGapError

class RunEventStreamGapError extends Error


kernel/execution/SemanticEffectContract

Summary: SemanticEffectContract.js Pure, authority-free compilation and comparison for descriptor-authored postconditions. The model never supplies these contracts. Exact contracts are declared by trusted tool descriptors and are bound to the descriptor, arguments, graph prestate, and verified Faculty receipt before comparison. Durable projections contain hashes and bounded counts, never tool arguments or effect values.


SemanticEffectContractError

class SemanticEffectContractError extends Error


compileDescriptorPostcondition

async compileDescriptorPostcondition({ descriptor, descriptorHash, args = {}, } = {})

Summary: Compile a trusted descriptor's effect declaration into a value-free graph postcondition. Legacy descriptors remain receipt/success-bound; only the explicit closed contract enables exact semantic comparison.


validateSemanticInvocation

async validateSemanticInvocation(postcondition, { descriptorHash, args = {} } = {})

Summary: Bind a live invocation to the graph-authored descriptor and argument hashes.


createExecutionPrestate

async createExecutionPrestate({ graphHash, sourceHash, nodeId, dependencies = [], } = {})

Summary: Bind a node's comparison to the graph and exact terminal evidence of each dependency. No provider-visible text or raw values enter this projection.


compareSemanticEffects

async compareSemanticEffects({ postcondition, prestate, receiptEvidence = null, observedEffects = null, resultOk = false, } = {})

Summary: Compare trusted readback effects with descriptor-authored expectations. `receiptEvidence` must be the kernel-created verified Faculty projection for exact and mutation comparisons; caller-supplied receipt-shaped data cannot acquire authority through this pure function.


projectSemanticNodeOutcome

projectSemanticNodeOutcome({ nodeId, graphHash, sourceHash, comparison, } = {})

Summary: Compact semantic node outcome consumed by checkpoint/episode projections.


kernel/execution/SemanticTransaction

Summary: SemanticTransaction.js — deterministic multi-target preview/commit contract. The coordinator never writes storage itself. Callers provide one atomic commit callback that must recheck every expected revision/hash in the same critical section as its writes. This module validates that exact request, emits explicit conflict choices, and creates a hash-bound undo record.


SemanticTransactionError

class SemanticTransactionError extends Error


chooseSemanticTransactionConflict

Summary: Bind one explicit UI choice to the exact conflict record.


kernel/execution/TaskProgressEstimator

Summary: TaskProgressEstimator.js — deterministic, content-free duration and progress estimates for an active Navi task. Estimates are ranges, never deadlines. They consume local prompt signals, historical route timing, and OS events; they do not call a model and never grant authority.


classifyTaskEstimateProfile

classifyTaskEstimateProfile(prompt = '', taskKind = '')


createTaskProgressEstimate

createTaskProgressEstimate({ prompt = '', taskKind = '', estimatedInputTokens = null, routeAverageMs = null, routeSampleCount = 0, now = Date.now()


updateTaskProgressEstimate

updateTaskProgressEstimate(current, event = {}, now = Date.now()


kernel/execution/TaskProgressGuard

Summary: TaskProgressGuard.js — bounded semantic-progress detection for iterative AI work. The guard observes fingerprints only; it never executes tools, grants authority, persists state, or decides that unverified provider prose is work.


verifiedToolProgressFingerprint

verifiedToolProgressFingerprint(results, toolDriver = null)

Summary: Return a stable fingerprint only for successful, locally observed progress.


statusToolFingerprint

Summary: Fingerprint a round made entirely from status/polling tools.


kernel/execution/ToolActionReview

Summary: ToolActionReview.js — deterministic pre-approval inspection for one exact AI tool call. This is an explanatory safety layer, not an authority source: BudgetLimiter policy and the ToolRouter capability boundary remain final.


reviewToolAction

async reviewToolAction({ tool, args = {}, policy = null, appId = '', requestId = '', naviId = '', facultyId = '', taskId = '', proposal = null, } = {})

Summary: Review one exact tool descriptor and argument object before approval.


kernel/execution/TransactionManager

Summary: TransactionManager.js — wraps engine/state/transaction/Transaction.js (makeTransaction/sealTransaction) for the OS.ai() request/commit envelope, and engine/state/transaction/ProposalPool.js for candidate-proposal management (competing proposals over the same exclusive inputs pick a deterministic winner; losers re-observe and re-plan — never silently overwritten).


kernel/execution/TwoPassPlannerFinalizer

Summary: TwoPassPlannerFinalizer.js — the Phase 9 execution loop (kernel.aiExecutor). Full flow per OS.ai() task: prompt → goal classify → gather context (roots-checked resource reads, PrivacyGuard-scrubbed) → capability negotiation (Ph4/Ph5 attestation) → model-tier choice → PASS 1 planner (JSON plan; tools executed through the AI Tool Firewall with idempotency keys, policy gating and approval elicitations) → PASS 2 finalizer (strict schema, NO tools) → validator → repair-if-needed (bounded RepairLoop) → CommitCoordinator commit → Witness receipt → Task Ledger record. The pipeline is driven as Phase 6 storylets over worldState.phase; every fired storylet returns `{ pending }` (see AIStoryletFactory) which this loop awaits, then applies `{ phase, wsPatch, facts, observations }` via StoryletEffectsApplier.


normalizeAIExecutorAppContextCandidates

Summary: Normalize app-owned context before it crosses into the Navi task envelope. Applications may contribute only an identifier, a descriptive kind, and bounded text. Classification, authority, ranking, provenance, disclosure, and source hashes are deliberately absent because the kernel owns them.


taskGraphRuntimeInvalidation

taskGraphRuntimeInvalidation(previousGraph, nextGraph, { approvalCount = 0, toolResults = [], } = {})


naviModelRoutePreflightError

naviModelRoutePreflightError(decision, requirements = {}, route = {})

Summary: Convert a content-free kernel route decision into one stable, actionable blocker. Eligibility remains owned by NaviModelBroker; this projection only explains why a zero-route decision stopped before disclosure or dispatch.


providerToolTransportFallbackEligible

providerToolTransportFallbackEligible(error, request = {})

Summary: Native provider tool envelopes are an optimization, not an execution authority. If preflight proves that the approved route set cannot carry them, the planner may fall back before disclosure or dispatch to its exact JSON transport. Privacy, policy, and other route failures remain terminal.


compileNaviModelCompatibilityRequirements(rawRequest = {}, base = {})

Summary: Compile hard model-route requirements from the actual model protocol. Provider tools are an optional typed generation transport; local descriptor, graph, authority, and receipt validation remain the execution boundary. Prompt-mediated exact JSON remains available when no native tools are sent.


applyNaviModelProviderContract

applyNaviModelProviderContract(rawRequest = {}, purpose = 'chat')

Summary: Bind strict schemas to provider parameter enforcement without mutating the caller request.


strictOutputSchemaPortabilityErrors

Summary: Validate the conservative JSON Schema subset accepted by AI Echo's strict remote-model contract. This is intentionally narrower than JSON Schema: provider endpoints commonly require closed objects and every declared property to be listed in `required`. Dynamic tool payloads must cross the model boundary as JSON strings and are parsed and tool-schema-validated by the OS after generation.


selectInvestigationForPrompt

selectInvestigationForPrompt({ objective, taskKind = '', goalType = '' } = {})


validateInvestigationReadReceipt

async validateInvestigationReadReceipt({ kernel, ws, result, descriptorHash, argumentHash, dataClassification, caseId = null, } = {})


parseSteeringModelClassification

Summary: Parse the advisory free-lane steering classifier. This envelope cannot grant authority, and `cancel` is intentionally absent so an uncertain model can never stop operator work. Prose/fences are tolerated only when they contain one bounded JSON object, which keeps small free models useful without making their formatting part of the task-control boundary.


validatePlannerTransportEnvelope

Summary: Validate the canonical OS planner envelope. Provider-side schema enforcement is never required: provider-native exact JSON is projected into this closed transport before local graph, descriptor, authority, and receipt validation. This validator remains the authoritative canonical boundary. The returned diagnostics contain schema paths only and never echo tool arguments or provider text.


plannerResultTransportCandidate

Summary: Prefer a completed typed provider tool batch over assistant prose.


plannerTransportShapeEvidence

Summary: Return a content-free structural description of a planner response. Provider text is never copied. The evidence is safe for durable diagnostics and distinguishes common repair cases without guessing at model intent.


plannerTransportRejection

Summary: Recover a locally repairable planner envelope from a terminal broker error. The kernel broker converts a rejected `resultValidator` verdict into a route failure and discards the provider result. When the selected route is pinned (manual routing) or every approved compatible route is exhausted, that error reaches the executor and would end the run — even though the exact rejected text is still available and repairable. Only malformed-kind local admission rejections with retained text qualify; policy, authority, abort, outage, and truncation failures stay terminal under their normal rules.


normalizePlannerResponse

Summary: Normalize a planner response while accepting one safe prose outcome: an explicit statement that no tool calls are needed. This lets smaller local models finish a no-op planning round without inventing a tool invocation.


isDirectConversationPrompt

Summary: Bounded social turns should go straight to the answer pass. AI Echo advertises core tools on every turn, which must not force greetings, introductions, acknowledgements, or personal conversation through planner JSON. Explicit tool/OS action language always wins and stays on the planner.


hasSavedArtifactIntent

Summary: A saved work product is canonical VFS state, not a formatting style. The compatibility terms Artifact and gem, plus the preferred Dodad name, are weighted with actions and surrounding context so no single token can force a mutation and ordinary domain discussion remains answer-only.


savedArtifactPreferredKind

Summary: Resolve the saved-work storage kind requested by the operator. Web is the OS default because it preserves semantic structure, presentation, and optional interaction as independently editable files. Every kind competes through the same weighted evidence scorecard.


savedArtifactIntentProfile

Summary: Deterministic, content-local saved-work routing. Chat, web, document, code, table, chart, data, and declarative UI candidates all collect weighted positive, negative, and context signals. Explicit multi-word requests score strongly but never bypass comparison, ambiguity reporting, or negation. The scorecard is safe to expose in receipts and never grants tools, changes privacy classification, or replaces provider capability checks.


savedArtifactPlannerFormatContract

Summary: Content-free planner instruction for the exact default Artifact shape.


prioritizeRequiredPlannerTools

prioritizeRequiredPlannerTools(toolDescs, requiredNames = [])

Summary: Present required tools first without changing the locally authoritative descriptor set. This is a provider-visibility projection only; it grants no capability and does not weaken descriptor or argument validation.


classifySavedArtifactPlanSteps

classifySavedArtifactPlanSteps(steps, pending = false, { preferredKind = '' } = {})

Summary: Content-free obligation check used before executing a planner round.


buildSavedArtifactWebFiles

buildSavedArtifactWebFiles({ title = 'AI Echo Artifact', authoredHtml = '' } = {})

Summary: Build the deterministic three-file web project used by the OS-owned Artifact fallback. The authored HTML remains the model's work product while the shell, visual system, and progressive enhancement are local and stable.


savedArtifactFallbackTitle

Summary: Build a useful bounded title without trusting model-generated metadata.


normalizeSavedArtifactFallbackContent

normalizeSavedArtifactFallbackContent(value, { kind = 'document' } = {})

Summary: Admit plain authored content before the OS constructs a signed mutation.


hasWorkspaceOutputLookupIntent

Summary: Detect a request to locate, verify, or explain the absence of saved output.


workspaceOutputSearchAssessment

Summary: Project exact storage.search evidence into a bounded, content-free decision. A negative conclusion is complete only when VFS enumeration was untruncated and the same-task Workspace Output Index rebuild succeeded for /user.


unattemptedObligationEvidence

Summary: Report a declared obligation that ended without a tool dispatch. The OS may only state what it observed. Recognizing refusal-shaped wording in planner prose is evidence that the round ended without an attempt, never evidence of *why*: the same words appear when a model merely discusses an earlier failure, and asserting a provider policy refusal from them puts a fabricated cause in front of the operator as OS evidence. The dispatch count is checkable, so that is what the finalizer is told.


isExplicitSavedArtifactRefusal

Summary: Recognize refusal-shaped planner prose tied to creating or saving a Dodad. This keeps that outcome off the JSON repair path, which cannot fix prose, while leaving arbitrary malformed planner output on the normal bounded repair path. It attests wording only — never a provider decision.


currentUserPromptForRouting

Summary: AI Echo may wrap a short follow-up with bounded conversation history. Route on the explicit current-message section so old tool requests cannot turn a greeting or acknowledgement into a new planner round. The complete prompt remains untouched and is still supplied to the answer pass as context.


livePatchRoutingText

Summary: Recover one narrow capability correction from AI Echo's managed follow-up wrapper without allowing arbitrary older turns to reactivate themselves.


normalizeFinalizerOutput

normalizeFinalizerOutput(value, schema = DEFAULT_OUTPUT_SCHEMA, rawText = '')

Summary: Normalize common provider answer envelopes without inventing answer content.


readOnlyObservationSignature

readOnlyObservationSignature(results, toolDriver = null)

Summary: Return a deterministic signature only when a round contains no mutation. Matching signatures mean both the calls and the resulting observations were unchanged, so another identical re-plan round cannot add evidence.


toolRoundSignature

Summary: A bounded deterministic fingerprint used to detect alternating planner cycles.


detectFinalToolEnvelope

detectFinalToolEnvelope(answer, toolDriver = null, toolResults = [])

Summary: Detect executable tool-call JSON leaked into final prose. A matching receipt proves the action ran, but it does not make a raw tool envelope a valid user answer. Fenced examples are ignored. The detector parses bounded complete objects and never evaluates model-authored content.


resolveNegotiatedToolName

resolveNegotiatedToolName(requestedName, capabilities = [])


plannerOutputParams

Summary: Guarantee the planner enough output budget to emit a plan after reasoning. A reasoning model spends its output allowance on a thinking trace before it writes any content. With a chat-sized allowance the trace is truncated mid-stream, the content channel stays empty, and the transport reports "invalid JSON" for a response that never contained a plan at all — a failure no local repair can fix, because there is nothing to extract. Raise the floor only; a larger operator setting is always honoured.


jsonOnlyReasoningDirective

Summary: Return the model-native directive that suppresses a thinking trace, if the route documents one. NVIDIA Nemotron and hybrid Qwen3 were both trained on the same `/think` and `/no_think` soft switch, and both default to reasoning when no signal is present — which is why a JSON-only pass gets a monologue it never asked for. This is message text rather than an API parameter, so it needs no gateway support and a model that does not recognize it simply answers normally. The gateway alternatives do not cover this case: OpenRouter honours `reasoning.max_tokens` only for Gemini, Anthropic and some Qwen, `effort` only for OpenAI and Grok, and `exclude` still spends the budget on hidden thinking. Only JSON-only passes pass through here; prose answers keep their reasoning.


naviCognitionDenialMessage

Summary: Explain a cognition denial without hiding the exact kernel state or code. A still-transient state at the end of the startup budget is not the same condition as a terminal one: nothing is wrong with the operator's setup and the identical request usually succeeds once the bind settles. Saying only "unavailable" there sends operators looking for a fault that does not exist.


waitForNaviExecutionMode

waitForNaviExecutionMode(kernel, { timeoutMs = NAVI_COGNITION_TRANSIENT_WAIT_MS, signal = null, } = {})

Summary: Hold a newly accepted, still side-effect-free task across one short kernel authority rebind. The wait never bypasses Navi, never dispatches a provider, and resolves immediately when the state becomes ready or terminal.


resolveNaviFacultyToolInvocation

resolveNaviFacultyToolInvocation(toolName, rawArgs = {})


projectVerifiedFacultyOutcomeAck

projectVerifiedFacultyOutcomeAck(receiptEvidence, replayed = false)

Summary: Content-free learning projection from kernel-verified Faculty evidence. This carries no arguments, result payload, provider reasoning, capability, approval, or authority. Consumers may use it only as review evidence.


projectArtifactFileActivity

projectArtifactFileActivity({ toolName = '', args = {}, result = null, phase = 'preparing', errorCode = null, error = null, } = {})

Summary: Project one local-only Artifact file operation for Run Details. A bounded incoming-content preview lets the operator inspect the exact write while it is active; it is never added to provider-visible results, signed receipts, diagnostics, or Companion messages. Exact absolute paths, sizes, and hashes still appear only after the locally verified Artifact receipt.


kernel/ledger/AgentScratchpad

Summary: AgentScratchpad.js — bounded execution notes for AI requests. This records operational state (plans, actions, observations, failures and phase changes), not hidden model reasoning. Entries are safe to render in a task report and give the user a replayable account of what the agent did.


kernel/ledger/BlockerList

Summary: BlockerList.js — active blockers for an AI request: pending approvals, unanswered elicitations, effects parked for reconciliation, denied capabilities. The overlay's Mini Bar badge count comes from here.


kernel/ledger/BoundedTrace

Summary: BoundedTrace.js — shared base for the ledger's simple per-request traces (resource reads, sampling, elicitations, storylet fires): bounded, timestamped, requestId-keyed append log. Type-specific traces extend this instead of quadruplicating the same buffer logic.


kernel/ledger/ElicitationTrace

Summary: ElicitationTrace.js — ledger trace of mid-task user questions (Phase 4 ElicitationManager): what was asked, whether the user answered/declined/ timed out, and how long the task waited.


ElicitationTrace

class ElicitationTrace extends BoundedTrace


kernel/ledger/ExecutionGraph

Summary: ExecutionGraph.js — the executed-steps DAG for an AI request: nodes are storylet fires / tool calls / model passes; edges are causal ("B used A's output"). Feeds the Timeline Panel's graph view.


kernel/ledger/FinalReport

Summary: FinalReport.js — assembles the end-of-task report for one AI request from the ledger's parts: goal outcome, task summary, tool/resource/sampling/ elicitation activity, blockers hit, receipts issued. This is what the overlay shows when a task completes and what gets persisted with the request record.


projectArtifactToolFailureDiagnostic

Summary: Convert an Artifact mutation failure into a fixed, content-free diagnostic. Raw handler text is used only to select a known category and is never returned, so prompts, file contents, tool arguments, and provider bodies cannot enter Run Details or copied diagnostics through this path.


projectProviderFailureDiagnostic

Summary: Keep only broker-authored, content-free failure evidence. Provider payloads, prompts, credentials, endpoints, and response bodies are deliberately absent.


projectNaviModelRouteBlocker

Summary: Preserve a content-free model compatibility decision when the kernel stops before provider dispatch. This is intentionally separate from `modelExecution`: zero attempts is evidence that no provider was called.


projectModelExecutionDiagnostic

Summary: Project a Navi broker execution into a bounded diagnostic receipt. Request hashes and partial-result hashes are intentionally excluded because they can fingerprint operator content without helping an operator diagnose routing.


publicErrorNumberForFailure

publicErrorNumberForFailure({ errorCode = '', failure = null } = {})


projectAIEchoPipelineTrace

projectAIEchoPipelineTrace(value, { requestId = '', incidentId = null, outcome = '', errorCode = null, errorNumber = null, openedAt = 0, closedAt = 0, } = {})

Summary: Project the existing resumable run stream into one compact, durable, content-free diagnostic trace. This is deliberately a report projection, not a second event registry or ledger. Unknown fields are dropped rather than recursively scrubbed so prompts, provider bodies, credentials, raw tool arguments, and reasoning deltas cannot cross this boundary.


kernel/ledger/GoalTree

Summary: GoalTree.js — hierarchical goal decomposition for an AI request: the root goal (the user's prompt intent) breaks into subgoals; each node tracks its status so the Task Panel can render live progress.


kernel/ledger/ObservationLog

Summary: ObservationLog.js — wraps engine/state/entity/ProvenanceStore.js: every observation an AI task makes carries W3C-PROV-style provenance (observed/inferred/model-predicted/user-asserted/untrusted). Tool/model/ resource content is recorded as UNTRUSTED observation by default — never authority (the prompt-injection boundary).


kernel/ledger/ResourceReadTrace

Summary: ResourceReadTrace.js — ledger trace of every `<appId>://...` resource read an AI request performed (URI, byte size, roots check outcome), so the Task Panel can show exactly WHAT the AI looked at.


ResourceReadTrace

class ResourceReadTrace extends BoundedTrace


kernel/ledger/SamplingTrace

Summary: SamplingTrace.js — ledger trace of nested LLM completions requested by tool handlers via the SamplingBroker (Phase 4): parent request, depth, model tier, token/cost accounting when available.


SamplingTrace

class SamplingTrace extends BoundedTrace


kernel/ledger/StoryletTrace

Summary: StoryletTrace.js — ledger trace of storylet fires for an AI request (Phase 6 pipeline): which storylet fired, the phase transition it caused, and its result summary.


StoryletTrace

class StoryletTrace extends BoundedTrace


kernel/ledger/TaskLedger

Summary: TaskLedger.js — aggregation facade over the Phase 8 ledger parts, wired as kernel.taskLedger. One shared instance holds cross-request traces (observations, tool calls, resource reads, sampling, elicitations, storylet fires, blockers) plus per-request records (goal tree, task list, execution graph, receipts). Every recorded receipt/witness reuses engine/state/witness/Witness.js (makeWitness/makeReceipt) and every record lands in the SHARED Phase 7 event log via kernel.timeEngine.record().


kernel/ledger/TaskList

Summary: TaskList.js — flat, ordered task list for an AI request (each task usually maps to a goal-tree leaf + a storylet/tool step). Drives the Task Panel's checklist view.


kernel/ledger/ToolCallTrace

Summary: ToolCallTrace.js — wraps engine/state/workflow/Outbox.js + Reconciler.js: every AI-initiated tool call is recorded as a transactional effect INTENT (idempotent by stable effect id — commit retries never duplicate a call), delivered via drain(), with ambiguous outcomes parked as RECONCILE and resolved by EVIDENCE (a probe of the authoritative status), never guessed.


kernel/live-patch/LivePatchService

Summary: LivePatchService.js — kernel-owned, declarative live UI editing. Model output never becomes executable code. A caller can inspect registered surfaces and propose a small allow-listed operation list. The service applies that list as a reversible preview, verifies the resulting DOM, and only then persists a canonical patch + receipt beneath /user/live-patches.


sanitizeLivePatchMarkup

sanitizeLivePatchMarkup(markup, { patchId = 'live_preview' } = {})


kernel/navi/NaviAutonomyService

Summary: Kernel-owned structured operational cognition for one or more Navis. Entries are Navi-authored conclusions, evidence, uncertainty, proposals, and budget accounting. They are never provider-hidden reasoning or raw model transcripts. The injected continuity cipher owns encryption; this service never receives or exposes a generic key or decryption API.


NaviAutonomyServiceError

class NaviAutonomyServiceError extends Error


kernel/navi/NaviBackgroundCoordinator

Summary: Persistent, cross-tab coordinator for bounded Navi background cognition. Web Locks is the execution authority: one exclusive lock remains held across the durable reread, executor call, operational-journal append, and terminal job update. BroadcastChannel is observability and wake-up only; peer messages never grant authority or replace the durable encrypted job record.


NaviBackgroundCoordinatorError

class NaviBackgroundCoordinatorError extends Error


NaviBackgroundTransientExecutionError

class NaviBackgroundTransientExecutionError extends NaviBackgroundCoordinatorError

Summary: Explicit retry signal accepted from the kernel-owned background executor. Arbitrary errors cannot opt into retries by attaching `retryable` or `kind` fields: the coordinator accepts only instances privately branded here, and this constructor admits only the closed outage/throttle transient set.


buildNaviBackgroundCognitionPrompt

buildNaviBackgroundCognitionPrompt({ operation = '', objective = '' } = {})


naviBackgroundTokenEnvelope

naviBackgroundTokenEnvelope({ operation = '', objective = '', outputTokens = 0, routeAttempts = 1, } = {})


kernel/navi/NaviBackupRecoveryService

Summary: Signed, encrypted Navi backups and recovery-branch reconciliation. This service never exports a credential, a private CryptoKey, raw provider output, a live capability, or a canonical write authority. Restore decrypts and validates into a durable non-canonical branch. Only an exact reviewed diff may reach an injected canonical merge applier.


NaviBackupRecoveryError

class NaviBackupRecoveryError extends Error


NaviBackupIntegrityError

class NaviBackupIntegrityError extends NaviBackupRecoveryError


createNaviBackupStateReader

createNaviBackupStateReader({ continuityStore, cognitionStore } = {})

Summary: Build the production state reader over already initialized continuity and cognition Stores. The reader exports only the Phase 7 allow-list.


kernel/navi/NaviCognitionService

Summary: NaviCognitionService — kernel authority for model-neutral task continuity. Provider conversations are transports, never task storage. This service persists signed task envelopes, per-Navi routes, self-model state, disclosure receipts, and encrypted checkpoints before exposing immutable projections.


NaviCognitionServiceError

class NaviCognitionServiceError extends Error


kernel/navi/NaviCognitionStore

Summary: Durable ciphertext-only storage for the Navi Cognition Fabric. The Store deliberately knows nothing about task, context, or self-model plaintext. A kernel-only continuity cipher creates authenticated record envelopes before they reach this boundary. Invalid data is quarantined instead of becoming an empty task, route configuration, or self-model.


NaviCognitionStoreError

class NaviCognitionStoreError extends Error


NaviCognitionStoreConflictError

class NaviCognitionStoreConflictError extends NaviCognitionStoreError


NaviCognitionStoreQuarantineError

class NaviCognitionStoreQuarantineError extends NaviCognitionStoreError


validateNaviCognitionRecord

async validateNaviCognitionRecord(value, expected = {})

Summary: Verify one portable encrypted cognition row without opening its Store. Recovery uses this exact validator before an authenticated backup row may enter a reconciliation branch. The function validates the same binding, envelope hash, and record integrity hash as the live Store read path.


kernel/navi/NaviContextCompiler

Summary: NaviContextCompiler.js — deterministic, policy-filtered Navi model context. This module is deliberately provider-agnostic. It accepts a previously verified active Covenant, filters every classified context item before any provider call can be made, and emits a content-free disclosure receipt. Provider sessions and model output never become canonical state here.


NaviContextCompilerError

class NaviContextCompilerError extends Error


kernel/navi/NaviContinuityService

Summary: NaviContinuityService.js — kernel authority for model-independent Navi identity. AI Echo and other Manifestations receive immutable public projections only. Private keys, generic signing/decryption, raw Store records, recovery bundles, and non-extractable CryptoKey handles never cross this boundary.


NaviContinuityServiceError

class NaviContinuityServiceError extends Error


NaviContinuityServiceDisabledError

class NaviContinuityServiceDisabledError extends NaviContinuityServiceError


NaviContinuityServiceIntegrityError

class NaviContinuityServiceIntegrityError extends NaviContinuityServiceError


validateNaviContinuityRecord

validateNaviContinuityRecord(value, expected = {})

Summary: Store-level strict validator. Cryptographic verification remains the service's responsibility after opaque KeyVault restoration.


kernel/navi/NaviContinuityStore


NaviContinuityDisabledError

class NaviContinuityDisabledError extends NaviContinuityError


NaviContinuityUnavailableError

class NaviContinuityUnavailableError extends NaviContinuityError


NaviContinuityStorageError

class NaviContinuityStorageError extends NaviContinuityError


NaviContinuityValidationError

class NaviContinuityValidationError extends NaviContinuityError


NaviContinuityConflictError

class NaviContinuityConflictError extends NaviContinuityError


NaviContinuityRevisionExhaustedError

class NaviContinuityRevisionExhaustedError extends NaviContinuityError


NaviContinuityQuarantineError

class NaviContinuityQuarantineError extends NaviContinuityError


kernel/navi/NaviCovenantTemplates

Summary: NaviCovenantTemplates.js — selectable operator–Navi Covenants and lifecycle policy. A Covenant is not active merely because it is well formed. Proposals require the primary operator's signature; activation and supersession require both the operator and the Navi to sign the exact same canonical contract bytes. Emergency suspension and revocation remain operator-authorized fail-safe transitions. This module exposes lifecycle operations, never a generic sign or decrypt primitive.


NaviCovenantTemplateBlockedError

class NaviCovenantTemplateBlockedError extends NaviCovenantError


NaviCovenantSignatureError

class NaviCovenantSignatureError extends NaviCovenantError


listNaviCovenantTemplates

listNaviCovenantTemplates({ separationRecoveryReady = false } = {})

Summary: Return immutable template descriptions without exposing mutable policy source objects.


getNaviCovenantTemplate

getNaviCovenantTemplate(template = DEFAULT_NAVI_COVENANT_TEMPLATE, { separationRecoveryReady = false, } = {})


proposeNaviCovenant

async proposeNaviCovenant({ covenantId, naviId, operator = null, operatorSigner, template = DEFAULT_NAVI_COVENANT_TEMPLATE, revision = 1, effectiveAt = new Date()

Summary: Create and operator-sign a proposed Covenant from one exact template.


verifyNaviCovenant

async verifyNaviCovenant(covenant, { operatorVerifier = null, naviVerifier = null, keyResolver = null, historical = false, logger = null, } = {})

Summary: Verify signature bytes, signer roles, key windows, and lifecycle quorum.


activateNaviCovenant

async activateNaviCovenant(proposal, { operatorSigner, naviSigner, signedAt = new Date()

Summary: Re-sign an accepted proposal as active with operator + Navi acknowledgment.


reviseNaviCovenant

async reviseNaviCovenant(activeCovenant, { covenantId, operatorSigner, naviVerifier, template = null, effectiveAt = new Date()

Summary: Create a signed next-revision proposal without mutating the active Covenant.


suspendNaviCovenant

suspendNaviCovenant(covenant, options = {})

Summary: Emergency fail-safe: the primary operator may suspend an active Covenant.


revokeNaviCovenant

revokeNaviCovenant(covenant, options = {})

Summary: Revoke an active or suspended Covenant; the original signed record remains verifiable.


supersedeNaviCovenant

async supersedeNaviCovenant(covenant, { operatorSigner, naviSigner, signedAt = new Date()

Summary: Mark an old active Covenant superseded after its dual-signed replacement is active.


projectNaviCovenant

Summary: Return a safe, immutable projection with signature values and policy conditions removed.


resolveScopedDelegateDecision

Summary: Resolve already-authorized scoped delegate votes. Conflicting decisions at the highest equal priority always pause; array order never breaks a tie.


kernel/navi/NaviDelegationBranchKeyService

Summary: Kernel-only provisioning and one-shot consumption of persistent Branch keys. A generated P-256 private key is exported only long enough to import a non-extractable runtime handle and place its bytes inside a Continuity-sealed cognition record. No application-facing method returns a CryptoKey, private bytes, public key, or generic signing capability.


NaviDelegationBranchKeyServiceError

class NaviDelegationBranchKeyServiceError extends Error


kernel/navi/NaviDelegationService

Summary: NaviDelegationService — bounded worker authority, persistence, and recovery. A delegated worker is never given cognition storage, continuity keys, raw memory, or ambient filesystem access. The service persists only signed navi-delegation-v1 contracts, hash-only context references, exact capability references, an active resource-lease binding, and bounded report evidence. File-capable workers operate through a VFS overlay adapter scoped from their verified Faculty capabilities.


NaviDelegationServiceError

class NaviDelegationServiceError extends Error


NaviDelegationIntegrityError

class NaviDelegationIntegrityError extends NaviDelegationServiceError


deriveNaviDelegationOverlayRoot

Summary: Derive the only VFS root a delegated capability may name. Capability issuance can call this before NaviDelegationService.create(), so signed tool arguments already target the overlay and never need post-signature rewriting.


kernel/navi/NaviDerivedProjectionService

Summary: NaviDerivedProjectionService.js — deterministic, non-authoritative Navi views. Canonical memory and relationship services remain the only write authority. This service validates their signed contracts, verifies that signatures bind the current payload hash, and derives Wiki-compatible human-readable views. It never edits a source contract. A UI edit becomes an unsigned proposal that is handed back to memoryService.proposeDerivedEdit() for policy and review. Required adapters: memoryService.listProjectionEvents({ naviId, branchId, afterSequence, allowedDataClasses }) -> { event, eventHash, payloadStatus, payload }[] memoryService.proposeDerivedEdit(unsignedProposal) -> receipt/result relationshipService.listRelationships({ naviId }) -> Relationship[] The adapters must verify cryptographic signatures before returning contracts. This layer independently verifies schema closure and signed-hash binding so a modified cached contract cannot silently become a readable projection.


NaviDerivedProjectionError

class NaviDerivedProjectionError extends Error


escapeNaviProjectionMarkdown

Summary: Escape payload text before inserting it into generated Markdown/HTML views.


kernel/navi/NaviFacultyPackageBinding

Summary: Strict, side-effect-free validation for a signed Faculty embedded in an authenticated package manifest. The builder and authorization policy share this boundary so accepted package evidence cannot drift between creation and execution.


NaviFacultyPackageBindingError

class NaviFacultyPackageBindingError extends Error


validateNaviFacultyPackageBinding

async validateNaviFacultyPackageBinding(value, { resourceHash = null } = {})

Summary: Validate and snapshot an already-signed Faculty package binding. This function never adds, removes, or rewrites a Faculty signature. The returned frozen snapshot contains the exact schema values supplied by the caller after strict JSON/schema validation.


kernel/navi/NaviFacultyPackagePolicy

Summary: NaviFacultyPackagePolicy.js The fail-closed trust boundary between a verified OS package and an executable Navi Faculty manifest. PackageManager remains the package integrity/provenance/scanning choke point; this policy narrows its broader application-install trust model for Faculties: - production authorization requires a fresh ring-0 certificate chain; - pinned/TOFU trust never becomes production Faculty authority; - developer-local/self-signed packages require an exact one-shot approval; - the authenticated package manifest, inline Faculty envelope, canonical Navi payload, and package resource root must all bind the same Faculty; - the Faculty publisher signature is verified with the package certificate. No package bytes, public keys, signatures, approval tokens, or verifier diagnostics are returned from this module.


NaviFacultyPackagePolicyError

class NaviFacultyPackagePolicyError extends Error


kernel/navi/NaviFacultyService

Summary: Kernel-owned Faculty authority membrane. Faculty code never receives this service, continuity keys, persistence, or driver objects. It receives only NaviFacultyWorkerHost's `api.tool` bridge. The bridge prepares one exact signed capability and hands it to ToolRouter; ToolRouter must consume that capability immediately before its existing driver dispatch. This module deliberately has no ToolDriver import or path.


NaviFacultyServiceError

class NaviFacultyServiceError extends Error


NaviFacultyServiceIntegrityError

class NaviFacultyServiceIntegrityError extends NaviFacultyServiceError


kernel/navi/NaviFacultyWorkerHost

Summary: NaviFacultyWorkerHost.js Executes one Faculty operation in a dedicated Worker nested inside an opaque-origin iframe. The worker has no ambient OS bridge. Its only host capability is the bounded `api.tool(name, args)` request channel supplied to `naviFaculty.run(input, api)`.


NaviFacultyWorkerError

class NaviFacultyWorkerError extends Error


NaviFacultyIframeAdapter

Summary: DOM owner for the hidden opaque iframe and its sole MessageChannel port.


NaviFacultyWorkerHost

Summary: Replace-only owner for one-shot Faculty Workers. `onToolRequest` is trusted host code and is the only route from Faculty source to ToolRouter.


normalizeNaviFacultyJson

normalizeNaviFacultyJson(value, { label = 'value', maxBytes = NAVI_FACULTY_WORKER_LIMITS.messageBytes, } = {})

Summary: Descriptor-first JSON normalization that never evaluates accessors.


createNaviFacultyWorkerDescriptor

Summary: Immutable description of the Faculty execution boundary.


kernel/navi/NaviFeatureGate

Summary: Always-on compatibility policy for the kernel-owned Navi runtime. Navi is part of WebGPU OS rather than an operator-controlled feature. This object keeps the versioned read contract used by kernel services and repairs legacy rollout records. Authority still fails closed inside each operator-bound service; an app can neither enable nor disable the runtime.


NaviFeatureGatePersistenceError

class NaviFeatureGatePersistenceError extends Error


NaviFeatureGateGenerationError

class NaviFeatureGateGenerationError extends Error


kernel/navi/NaviGuidanceFacultyCandidate

Summary: Pure guidance-faculty-candidate-v2 derivation from observable receipts. This module cannot sign, persist, install, enable, or execute anything. It only creates a review-required candidate after two independent verified successes share one exact descriptor and verification profile binding.


deriveGuidanceFacultyCandidate

async deriveGuidanceFacultyCandidate(raw = {})


kernel/navi/NaviInvestigationAttestation


kernel/navi/NaviInvestigationProofReviewService

Summary: Kernel-owned human review for a bounded Navi investigation proof. This service never calls a model and never accepts provider-hidden reasoning. It projects exact, locally verified evidence into one immutable review request, obtains a one-shot ElicitationManager approval, then rechecks every mutable task/case binding before returning the semantic-verifier attestation expected by NaviInvestigationService.


NaviInvestigationProofReviewError

class NaviInvestigationProofReviewError extends Error


kernel/navi/NaviInvestigationService

Summary: NaviInvestigationService.js — deterministic, observation-only Sherlock episodes. The service owns case progression and evidence validation, but it cannot invoke tools, persist records, grant authority, or execute mutations. Callers must route reads through ToolRouter and submit the verified result.


NaviInvestigationError

class NaviInvestigationError extends Error


shouldInvestigate

shouldInvestigate({ objective, taskKind = '', goalType = '' } = {})

Summary: Select Sherlock only for investigation-shaped work, never greetings.


validateDurableInvestigationProof

Summary: Recompute the durable semantic-proof binding without trusting the model interpretation that proposed it. This is shared by runtime restore and the cognition persistence boundary before a case can be signed.


kernel/navi/NaviKeyVault

Summary: Kernel-internal cryptographic boundary for Navi continuity. This module deliberately exposes no generic "sign this key" or "decrypt this ciphertext" syscall surface.  Its methods are intended to be held by the kernel continuity service, which supplies the policy decision before a bounded operation reaches this vault.


naviConstantTimeEqual

Summary: Constant-time comparison for equal-length byte strings.


kernel/navi/NaviLegacyKnowledgeImportService

Summary: Idempotent, non-destructive migration of bounded AI Echo knowledge into the Navi causal-memory weave. The caller supplies a read-only snapshot assembled from legacy AI Echo state. This service never receives the legacy Store, so it cannot reset, delete, or rewrite that source. Each normalized source item receives a content-derived event ID; retries verify the existing signed event instead of appending a duplicate.


NaviLegacyKnowledgeImportError

class NaviLegacyKnowledgeImportError extends Error


kernel/navi/NaviLegacyMigrationService

Summary: Explicit, rollback-safe migration of unreleased AI Echo-owned state. Phase 0 creates and verifies a complete /user backup while navi-v1 is off. This Phase 1 service consumes that exact archive only after the always-on runtime is operator-bound and the operator supplies an exact confirmation. It archives the two AI Echo-owned surfaces, resets them, and never touches unrelated /user paths. A failed reset is compensated from the local migration archive.


kernel/navi/NaviLineage

Summary: NaviLineage.js — linked, signed Navi continuity history. The ledger stores strict `navi-lineage-event-v1` contracts plus the exact payload whose hash the event commits to. Operational rotation takes effect after its rotation event, so the old key remains valid for historical verification but cannot authorize another event. Recovery and revocation are continuity-key operations. No generic signing primitive is exported.


NaviLineageVerificationError

class NaviLineageVerificationError extends NaviLineageError


hashNaviLineagePayload

Summary: Hash a strict JSON lineage payload using the engine's canonical SHA-256 path.


Summary: Return deterministic bytes suitable for an external continuity-certificate verifier.


verifyNaviLineage

async verifyNaviLineage(entries, { expectedNaviId, expectedBranchId = null, expectedHeadHash = null, expectedEventCount = null, continuityKey, operationalKeys = [], keyResolver = null, certificateVerifier = null, logger = null, } = {})

Summary: Verify the complete chain, payload commitments, signature policy, key certificates, key activation windows, and rotation/recovery transitions.


kernel/navi/NaviMaintenanceScheduler

Summary: Cooperative, lifecycle-aware scheduler for encrypted Navi maintenance. All Navi migrations and index hydration share one queue. A browser idle grant advances at most one bounded page. An idle callback with no available budget advances nothing; its timeout, or the delayed timer used where idle callbacks do not exist, is the bounded fallback grant.


kernel/navi/NaviManifestationAdapterRegistry

Summary: Kernel-only registry for Navi Manifestation adapters. The descriptors are inert declarations. Live engine, audio, vehicle, or network objects are attached by trusted kernel integrations and are never accepted through an app syscall. The registry therefore exposes a narrow body boundary without turning an avatar, entity, or runtime object into Navi identity authority.


kernel/navi/NaviManifestationService

Summary: Kernel-owned Navi Manifestation and task-handoff runtime. Models, bodies, voices, avatars, and apps remain replaceable presentation or execution surfaces. Every durable registration and handoff is an encrypted, purpose-signed contract bound to the continuity-root Navi identifier.


NaviManifestationServiceError

class NaviManifestationServiceError extends Error


kernel/navi/NaviMemoryService

Summary: Kernel-owned causal memory over the existing encrypted cognition Store. Signed events are append-only. Their payloads live in separately wrapped AES-GCM records so forgetting can destroy one wrapped record key without rewriting history. Provider output, application projections, and callers never receive Store access or encryption/signing authority.


NaviMemoryServiceError

class NaviMemoryServiceError extends Error


kernel/navi/NaviModelBroker

Summary: NaviModelBroker.js — deterministic, per-Navi model selection and failover. The broker owns no provider conversation and executes no tools. It chooses one declared cognition route, invokes the injected AI Hub exactly once at a time, and only advances to a bounded fallback after a retryable model-call failure. Prompt/model output is deliberately excluded from routing evidence.


NaviModelBrokerError

class NaviModelBrokerError extends Error


NaviModelBroker

Summary: An injected AI Hub must expose `request(appId, request)`. Route catalog and policy remain per Navi; the AI Hub is only the replaceable transport.


verifyNaviModelRouteDecision

Summary: Verify that a projected route decision is the exact content-addressed decision produced for the supplied normalized broker configuration. This is an integrity/binding check only; it never authorizes model use.


normalizeModelFailure

normalizeModelFailure(source, signal = null)


normalizeNaviModelRequirements

normalizeNaviModelRequirements(raw = {}, purpose = 'chat')

Summary: Return the broker's exact model-neutral requirement evidence. Resource selection receipts must hash the same defaults and canonical ordering that `decide()` used; callers must not reconstruct those defaults independently.


kernel/navi/NaviParticleNetworkAdapter

Summary: NaviParticleNetworkAdapter.js — inert Navi/Particle Network protocol bridge. This module creates and verifies Realm semantic envelopes, but never opens a socket, fetches a peer, publishes a package, or owns a credential. Network dispatch remains the NetworkDriver's job. Contract verification and live authority are mandatory injected kernel decisions and fail closed.


NaviParticleNetworkAdapter

Summary: Create a transport-only Particle Network adapter. `contractVerifiers` must contain one verifier per adapter ID. A verifier may return true, `{ valid: true }`, or the exact verified signed contract. The latter matches NaviContinuityService's purpose-bound verification methods.


NaviParticleReplicationInbox

Summary: Idempotent inbound application boundary built on Realm SemanticInbox. Verification and application are serialized so concurrent replay cannot apply one signed envelope twice.


kernel/navi/NaviParticleReplicationPolicy

Summary: NaviParticleReplicationPolicy.js — closed, side-effect-free Navi replication policy. Particle Network transports already-authoritative Navi contracts. It never becomes a second Navi store and it never accepts an arbitrary JSON tunnel. Every permitted record has one fixed schema, semantic kind, classification policy, destination, disclosure evidence, and live authority approval.


NaviParticleReplicationError

class NaviParticleReplicationError extends Error


naviParticleAdapterDescriptor

Summary: Return the immutable descriptor for one closed Navi/Particle adapter.


assertNaviParticleReplicationPayload

async assertNaviParticleReplicationPayload(value, expectedAdapterId = null)

Summary: Validate an already-built replication payload, including its nested Navi contract hash and adapter-specific semantics. No signature is synthesized.


assertNaviReplicationContentSafe

Summary: Reject forbidden content before any signer, policy, or transport is called.


kernel/navi/NaviPasskeyRecoveryAdapter

Summary: Kernel-owned WebAuthn PRF ceremony adapter. Apps see boolean support/enrollment status and completed continuity results. Credential IDs, PRF inputs, and PRF outputs remain inside this adapter and the continuity-signed recovery bundle. PRF output is zeroed after each call.


NaviPasskeyRecoveryError

class NaviPasskeyRecoveryError extends Error


kernel/navi/NaviPreflightService

Summary: Phase 0 Navi migration preflight. This service is deliberately not wired into the kernel. It only creates and verifies a reversible development archive while `navi-v1` is disabled. It has no delete, clear, restore, or reset operation.


kernel/navi/NaviProjectDossier

Summary: Rebuildable, authority-free project dossier for one exact Navi task. The dossier owns no state and never copies provider reasoning, scratchpads, planner transcripts, file bodies, or Wiki bodies. It projects bounded links from the canonical task state, durable run reports, receipts, evidence, Wiki metadata, and Workspace Output Index. Deleting it loses no canonical data.


kernel/navi/NaviRecoveryBranchAuthorityService

Summary: Kernel-only authority for staged recovery branches and permanent separation. A recovery branch is never an identity authority. It may be inspected and reconciled only within the exact ceiling carried by its verified restore receipt. Publication, authority expansion, identity transfer, and continuity-root rotation are unconditional denials. Permanent separation is a distinct, explicitly approved operation that asks Continuity to stage a fresh independent Navi and records a dual-continuity-signed ancestry attestation without exposing either signer or private key.


NaviRecoveryBranchAuthorityError

class NaviRecoveryBranchAuthorityError extends Error


kernel/navi/NaviRecoveryBranchStore

Summary: Durable, encrypted-at-rest recovery-branch journal. The Store never persists decrypted Navi backup payloads. It retains the authenticated encrypted bundle, a content-free reconciliation diff, and exact approval/settlement evidence. Canonical Navi state remains owned by the continuity and cognition services.


NaviRecoveryBranchStoreError

class NaviRecoveryBranchStoreError extends Error


NaviRecoveryBranchConflictError

class NaviRecoveryBranchConflictError extends NaviRecoveryBranchStoreError


NaviRecoveryBranchIntegrityError

class NaviRecoveryBranchIntegrityError extends NaviRecoveryBranchStoreError


kernel/navi/NaviRecoveryEscrow

Summary: Kernel-only, progressive recovery-factor escrow. Recovery material is isolated from the ordinary VFS and continuity stores in a purpose-specific IndexedDB database. Public projections contain only bounded disclosure metadata. The device factor (C) can be retrieved only by kernel code holding the module capability symbol.


NaviRecoveryEscrowError

class NaviRecoveryEscrowError extends Error


Summary: Opaque kernel capability. It must never be copied into a syscall, app projection, log, or persisted record.


kernel/navi/NaviRecoveryRuntime

Summary: Operator-bound Phase 7 recovery aggregate. This runtime keeps approval construction, portable-state verification, canonical cognition writes, and ancestry authority inside the kernel. Apps submit recovery factors and human decisions, never hashes or signatures.


NaviRecoveryRuntimeError

class NaviRecoveryRuntimeError extends Error


kernel/navi/NaviRelationshipService

Summary: NaviRelationshipService — signed, append-only relationship authority. Relationships are evidence, not ambient trust. Chat contacts and package publishers never enter this service, and an active relationship grants no authority unless one of its exact signed policy rules matches the request. Raw contracts and encrypted records remain kernel-private; public methods return immutable projections with signature values and condition values removed.


NaviRelationshipServiceError

class NaviRelationshipServiceError extends Error


NaviRelationshipIntegrityError

class NaviRelationshipIntegrityError extends NaviRelationshipServiceError


kernel/navi/NaviResourceCatalog

Summary: NaviResourceCatalog.js — one deterministic, searchable projection of Navi tools, Faculties, guidance recipes, task episodes, and related resources. Catalog entries are descriptions only. Search never executes a resource or grants permission, and callers must resolve live authority independently.


async projectBrokerDecisionToResourceSelection(rawInput = {}, rawOptions = {})

Summary: Convert one existing NaviModelBroker decision into the Phase 8 resource selection contract without running a second selector. The broker's selected route and candidate order are authoritative. This projection only validates, binds, and signs that already-made decision.


createNaviModelRouteResourceBindings

Summary: Build the exact descriptor and verifier bindings for every model route in a broker candidate set. The descriptor hash intentionally shares the execution-plan route domain so the persisted selection and executable plan attest the same normalized route. No provider content or credential enters either binding.


kernel/navi/NaviResourceService

Summary: Kernel-owned resource reservation, metering, and settlement. One encrypted CAS account owns every lease for one Navi task. An authenticated encrypted branch index owns the exact aggregate charge and account membership. Account and index revisions commit through one Store batch while all accounts for the same Navi branch share one Web Lock. Every task binds its exact kernel-supplied resource ceiling on first reservation. Every externally meaningful lease state is an operationally signed navi-resource-lease-v1 contract.


NaviResourceServiceError

class NaviResourceServiceError extends Error


kernel/navi/NaviStrategyScorecard

Summary: Deterministic, per-Navi, analysis-only scorecards from verified receipts.


deriveNaviStrategyScorecard

async deriveNaviStrategyScorecard(raw = {})


kernel/navi/NaviStrictProjectionInput

Summary: Strict JSON input helpers shared by authority-free Navi projections. These helpers reject accessors, extensions, cycles, sparse arrays, and non-finite values before a projection derives hashes or evidence counts.


strictProjectionSnapshot

strictProjectionSnapshot(value, label = 'projection input')


exactProjectionKeys

exactProjectionKeys(value, allowed, label, required = [])


projectionInputError

projectionInputError(message, code = 'NAVI_PROJECTION_INPUT_INVALID')


uniqueSortedProjectionStrings

uniqueSortedProjectionStrings(values, label, { minimum = 0, maximum = 1024 } = {})


kernel/navi/NaviSurfaceIntelligence

Summary: NaviSurfaceIntelligence — bounded, read-only semantic evidence for visible OS surfaces. Surface observations are untrusted evidence. They never grant authority and never execute an action. Mutations named by an action catalog still enter ToolRouter, Live Patch, Dodad Forge, or an app-owned command boundary.


kernel/navi/NaviVfsOverlayService

Summary: Kernel-owned VFS isolation for delegated Navi workers. A delegated file capability is issued for one deterministic hidden overlay root. The adapter never rewrites a signed path: it verifies that the exact execution path is inside the bound overlay and returns that same path. The immutable snapshot hash describes the overlay at admission time; subsequent writes remain constrained by the signed path scopes rather than changing the authorization identity after every edit. Storage accounting is deliberately application-byte based. Kernel-owned overlay metadata, hashes, and signed receipts are excluded. Creating an empty overlay and observing a snapshot therefore cost zero storage bytes. Moving an overlay into recoverable trash is a durable application-data rewrite and is charged at the exact sum of the files present in its prepared snapshot.


NaviVfsOverlayServiceError

class NaviVfsOverlayServiceError extends Error


kernel/navi/NaviWorkspaceOutputIndex

Summary: Rebuildable, non-authoritative references to canonical workspace outputs. The index owns no file content. Every entry is derived from an exact VFS observation and points back to the app-owned canonical path. Deleting the index loses no user data because the same projection can be rebuilt.


kernel/navi/SurfaceTemporalVerifier

Summary: SurfaceTemporalVerifier compares two retained semantic captures. It is deliberately read-only. Visual comparison accepts contract evidence that was captured earlier and compares content hashes only; it never reads a payload.


kernel/navi/adapters/ConstructManifestationAdapter

Summary: Narrow Construct manifestation boundary. The adapter deliberately captures only bound ActiveBody-style functions and explicit observation readers supplied by trusted kernel wiring. It never exposes the engine object, treats a body as identity, or derives authority from scene, presence, spatial, model, avatar, or body data.


NaviConstructManifestationAdapterError

class NaviConstructManifestationAdapterError extends Error


createConstructManifestationAdapter

createConstructManifestationAdapter({ bodyId, bodyRuntime, manifestationId = NAVI_CONSTRUCT_PRIMARY_MANIFESTATION_ID, spawnPosition = [0, 0, 0], bodyOptions = {}, readActiveScene, readSelectedEntity, readVerifiedRealmPresence, readSpatialLocality, playAnimation, requestRealmAuthority, maxObservationBytes = DEFAULT_MAX_OBSERVATION_BYTES, clock = ()

Summary: Create the trusted Construct runtime attached by NaviManifestationAdapterRegistry. bodyRuntime is expected to be an ActiveBodySystem-compatible object. Readers are narrow kernel wrappers; each receives a frozen exact-scope request.


kernel/navi/builtins/ArtifactStudioFaculty

Summary: ArtifactStudioFaculty.js Canonical contract factory and worker source for AI Echo's built-in Artifact Studio adapter. The worker is deliberately tiny: it can request exactly one declared Artifact tool and receives no storage, credential, network, DOM, or raw-JavaScript authority of its own.


createArtifactStudioNaviFaculty

createArtifactStudioNaviFaculty({ descriptorHashes = {}, provenance = null, tests = [], signatures = null, version = ARTIFACT_STUDIO_FACULTY_VERSION, publisherId = ARTIFACT_STUDIO_PUBLISHER_ID, } = {})


async createArtifactStudioFacultyPackageBinding(manifest, { resourceHash = null } = {})


artifactStudioPackageEvidence

Summary: Return the complete package evidence shape consumed by NaviFacultyPackagePolicy. The release preamble wins when present; raw browser development uses the checked-in public fallback package. No private signing material is present in either record.


kernel/navi/builtins/BrowserSemanticFaculty

Summary: Canonical signed boundary for extension-backed semantic browser automation. The package is installed inert: only an explicit operator action may enable its device and network authority for a Navi.


createBrowserSemanticNaviFaculty

createBrowserSemanticNaviFaculty({ descriptorHashes = {}, provenance = null, tests = [], signatures = null, version = BROWSER_SEMANTIC_FACULTY_VERSION, publisherId = BROWSER_SEMANTIC_PUBLISHER_ID, maxCalls = 1, } = {})


async createBrowserSemanticFacultyPackageBinding(manifest, { resourceHash = null } = {})


assertBrowserSemanticManifest

assertBrowserSemanticManifest(value, definition = BROWSER_SEMANTIC_FACULTY_DEFINITION)


kernel/navi/builtins/BuiltInFacultyPackageEvidence

Summary: Shared fail-closed reader for OS-owned signed Faculty package evidence.


builtInFacultyPackageEvidence

builtInFacultyPackageEvidence({ label, packageId, version, publisherId, sourcePath, source, generatedPackage, assertManifest, })


kernel/navi/builtins/BuiltInToolFaculties

Summary: Bind one catalog definition to the immutable version carried by its signed package.


kernel/navi/contracts/ContractCanonical

Summary: ContractCanonical.js — domain-separated signing bytes and secure identifiers.


naviSigningValue

Summary: Return the JSON value covered by every top-level Navi contract signature. Signature envelopes are excluded to avoid circular signing input.


canonicalNaviSigningText

Summary: Return the deterministic, domain-separated signing text.


canonicalNaviSigningBytes

Summary: Return the exact UTF-8 bytes that P-256 signs or verifies.


hashNaviSigningPayload

Summary: Return a tagged SHA-256 identifier for the signature-covered payload.


hashNaviContractEnvelope

Summary: Return a tagged SHA-256 identifier for the complete signed envelope.


naviSigningPayloadEquals

Summary: Compare contract payloads without relying on insertion order. Useful before signing, during recovery diffs, and when checking fixture determinism.


kernel/navi/contracts/ContractRegistry

Summary: ContractRegistry.js — isolated Navi v1 schema registry and semantic checks. This registry deliberately does not mutate the OS-wide singleton. Kernel bootstrap can integrate it after the Phase 0 gate passes without making an import of this module a side effect.


validateNaviContract

validateNaviContract(data, expectedSchemaId = null, options = {})


assertNaviContract

assertNaviContract(data, expectedSchemaId = null, options = {})


kernel/navi/contracts/ContractSchemas

Summary: ContractSchemas.js — strict, versioned Navi v1 wire schemas. The OS schema validator intentionally supports a compact JSON Schema subset. Every declared object is closed with additionalProperties:false. Fields that intentionally contain application JSON are named `value` or `metadata` and are still checked by ContractRegistry's JSON-safety pass before acceptance.


kernel/navi/contracts/Vocabulary

Summary: Vocabulary.js — canonical Navi v1 terminology and closed policy vocabularies. These values are wire contracts. Additions require a new contract revision; renaming an entry would change signed meaning and is therefore forbidden.


kernel/navi/contracts/index


kernel/net-safety

Summary: net-safety.js — shared SSRF / private-host guards for OS-mediated fetches. Reused by the sandboxed-app network bridge, the package UpdateManager, and the package source-URL policy so the same allow/deny rules apply everywhere: - http(s) only (no file:, data:, blob:, chrome-extension:, etc.) - no embedded credentials in the URL - no loopback / link-local / RFC-1918 / CGNAT / multicast / .local hosts Public hostnames pass (still subject to the browser's CORS rules).


isPrivateHost

Summary: True if a hostname points at the local machine or a private network range.


assertSafeFetchUrl

Summary: Validate and normalise a URL for an OS-mediated fetch. Throws on policy violation; returns the normalised href on success.


isLocalDevHost

Summary: True when a host is localhost-like (used to relax https for local dev sources).


kernel/protocol/CapabilityNegotiator

Summary: CapabilityNegotiator.js — Particle Realms Protocol capability minting. Thin wrapper over engine/state's CapabilityRegistry + Capability.js (makeCapability/attenuate/authorizes) — no parallel capability logic. Used by the AI Hub's two-pass execution loop (Phase 9) to mint short-lived, narrowly-scoped capabilities for a single OS.ai() request's tool/resource access, on top of (not instead of) the RuleGraph/Permissions manifest gate.


kernel/protocol/ElicitationManager

Summary: ElicitationManager.js — Particle Realms Protocol elicitation (MCP-inspired): lets a mid-task AI Hub request pause and ask the user a clarifying question instead of guessing. Phase 4 provides the data-layer queue; Phase 8's overlay (ElicitationCard.js) is the UI that calls respond()/decline().


kernel/protocol/ParticleRealmsProtocol

Summary: ParticleRealmsProtocol.js — the MCP-inspired protocol facade tying together this app's capability/tool/resource/prompt/root/elicitation/sampling registries. Exposed as kernel.protocol; wrapped by syscalls.protocol. An app calls declare(manifest) once (validated against os.AppAICapabilityManifest in OsSchemas.js) to register its tool/resource/ prompt/root metadata for AI discovery. Declaring metadata here is always advisory/self-descriptive — it never grants authority; actual tool execution still goes through ToolRouter's firewall (Phase 3) and actual resource reads still go through ResourceRegistry -> UntrustedBoundary.


kernel/protocol/PromptRegistry

Summary: PromptRegistry.js — Particle Realms Protocol named prompt-template catalog (MCP-inspired "prompts"). Apps register a render(args) function; the OS owns the final prompt text by always routing rendered output through PromptRegistry.sanitize() before it reaches the AI Hub — an app cannot smuggle raw control tokens or fake role delimiters into the final prompt.


kernel/protocol/ResourceRegistry

Summary: ResourceRegistry.js — Particle Realms Protocol resource catalog. Apps expose readable data to the AI Hub under a `<appId>://...` URI scheme (MCP-inspired "resources"). Every read is routed through engine/state/worldmodel/UntrustedBoundary.js (Phase 3 reuse) before it's handed back — resource content is always an untrusted observation, never authority, regardless of how much the reading app trusts its own data.


kernel/protocol/RootBoundaryManager

Summary: RootBoundaryManager.js — Particle Realms Protocol "roots" (MCP-inspired): the set of resource URI prefixes an app has declared as in-scope for a given AI request. Roots only ever NARROW what an OS.ai() request may touch — they are advisory scoping on top of (never a substitute for) the ResourceRegistry/RuleGraph capability checks.


kernel/protocol/SamplingBroker

Summary: SamplingBroker.js — Particle Realms Protocol sampling (MCP-inspired): lets a TOOL handler request a nested LLM completion mid-execution (the inverse of a normal OS.ai() call). Every sample enters the full AI executor, which creates a model-neutral Navi task and applies Covenant disclosure, resource, tool-firewall, verification, and receipt policy. There is no raw AI Hub fallback. A hard recursion-depth guard prevents sampling loops.


kernel/protocol/ToolRegistry

Summary: ToolRegistry.js — Particle Realms Protocol tool catalog. Distinct from kernel.toolDriver (the low-level execute/history engine, see webgpu-os/kernel/ToolDriver.js) and kernel.toolRouter (the AI Tool Firewall, see webgpu-os/kernel/tools/ToolRouter.js): this is the per-app CATALOG that says "this app opts this already-registered tool into AI discovery", so the AI Hub's two-pass execution loop (Phase 9) knows which tools are legal for a given app's request. Declaring a tool here never bypasses ToolRouter's firewall — it only makes the tool visible/offered.


kernel/schema/BinaryPack

Summary: BinaryPack.js — custom binary codec, zero external dependencies. Wire format: MessagePack specification (https://msgpack.org/index.html) Implemented from spec only — not copied from any library. API: pack(value)         → Uint8Array unpack(buf)         → value packToBase64(value) → string  (base64-encoded packed bytes) unpackBase64(str)   → value Supported types: null / undefined → nil boolean          → true / false integer (safe)   → positive/negative fixint, uint8-32, int8-32 float            → float64 string           → fixstr / str8 / str16 / str32 Uint8Array       → bin8 / bin16 / bin32 Array            → fixarray / array16 / array32 Object (plain)   → fixmap / map16 / map32 Byte layout (big-endian throughout, per spec): 0x00–0x7f  positive fixint 0x80–0x8f  fixmap   (N = low nibble) 0x90–0x9f  fixarray (N = low nibble) 0xa0–0xbf  fixstr   (N = low 5 bits) 0xc0       nil 0xc2       false 0xc3       true 0xc4–0xc6  bin8 / bin16 / bin32 0xca       float32   (encode uses float64 for precision) 0xcb       float64 0xcc–0xcf  uint8 / uint16 / uint32 / uint64* 0xd0–0xd3  int8  / int16  / int32  / int64* 0xd9–0xdb  str8  / str16  / str32 0xdc–0xdd  array16 / array32 0xde–0xdf  map16   / map32 0xe0–0xff  negative fixint * int64/uint64 are encoded as float64 when |v| > 2^32 (JS safe integer limit).


pack

Summary: Encode any JS value to a Uint8Array (MessagePack wire format).


unpack

Summary: Decode a Uint8Array or ArrayBuffer from MessagePack wire format.


Summary: Pack and base64-encode — useful for JSON embedding and localStorage.


Summary: Decode a base64-encoded pack string.


packedSize

Summary: Return the packed byte-size of a value without keeping the buffer.


packEqual

Summary: Compare two values by structural equality using pack → byte comparison.


kernel/schema/OsSchemas

Summary: OsSchemas.js — all OS-level schema definitions. Registers schemas into the shared SchemaRegistry singleton. Call initOsSchemas() once during KernelBootstrap. Registered names: os.AppManifest      — app discovery manifest (manifest.json) os.AppSetting       — one settings descriptor inside a manifest os.ModManifest      — mod discovery manifest os.ModHook          — one hook entry in a mod manifest os.IPCMessage       — IPC channel message envelope os.VFSNode          — virtual filesystem node metadata os.GPUSurface       — GPU surface descriptor os.VRAMEntry        — per-app VRAM usage report os.ProcessEntry     — process table entry os.PermissionCheck  — permission check result os.Particle         — particle struct for binary packing (6 × f32) os.ParticleBatch    — array of particles os.NetPeerMessage   — envelope sent between OS peers via NetDriver os.AppAICapabilityManifest — Particle Realms Protocol tool/resource/prompt/root declaration


kernel/schema/SchemaRegistry

Summary: SchemaRegistry.js — named schema store with validation and binary packing. Acts as the central authority for all schema definitions in the OS. Schemas are registered by name and resolved by $ref. Features: - Named schema registration and lookup - validate(name, data)   → { valid, errors } - assert(name, data)     → throws SchemaValidationError if invalid - pack(name, data)       → Uint8Array (validates then binary-packs) - unpack(name, buf)      → value (binary-unpacks then validates) - packAny(data)          → Uint8Array (binary-packs without schema) - unpackAny(buf)         → value (binary-unpacks without validation) Usage: import { schemaRegistry as sr } from './SchemaRegistry.js'; sr.define('myapp.MyType', { type: 'object', required: ['id'], properties: { id: { type: 'string' } } }); sr.assert('myapp.MyType', { id: 'abc' }); const bytes = sr.pack('myapp.MyType', { id: 'abc' });


kernel/schema/SchemaValidator

Summary: SchemaValidator.js — JSON Schema (subset) validator, zero dependencies. Supported keywords: type              string | number | integer | boolean | null | array | object | 'any' properties        { key: schema } required          string[] additionalProperties  boolean | schema (false = deny unknown keys) items             schema (all elements) or schema[] (positional) minLength / maxLength / pattern   (string) minimum / maximum / exclusiveMinimum / exclusiveMaximum / multipleOf  (number) minItems / maxItems   (array) minProperties / maxProperties     (object) const             exact value match enum              allowed values list oneOf / anyOf / allOf / not nullable          shorthand — wraps schema as oneOf:[schema,{type:'null'}] $ref              string — resolved via refResolver(name) Usage: const v = new SchemaValidator(refResolver); const { valid, errors } = v.validate(data, schema); v.assert(data, schema, 'MyContext'); // throws SchemaValidationError


SchemaValidationError

class SchemaValidationError extends Error


t

Summary: Fluent schema type builders for ergonomic schema authoring. import { t } from './SchemaValidator.js'; const schema = t.obj({ name: t.str({ minLength: 1 }), age: t.int({ minimum: 0 }) }, ['name']);


kernel/schema/ShellPreferenceRecords

Summary: Versioned, schema-specific localStorage records shared by the OS shell. Readers accept the one historical unversioned shape that each preference used before schema versioning. Writers always publish the current envelope and must successfully preflight the existing value before touching storage. Unsupported or corrupt records are therefore quarantined in place.


readVersionedStorageRecord

readVersionedStorageRecord(storage, contract, { normalizeLegacy, normalizeCurrent })

Summary: Strictly read a versioned shell preference without ever rewriting it.


writeVersionedStorageRecord

writeVersionedStorageRecord(storage, contract, value, normalizers)

Summary: Preflight the old record, then atomically replace its one localStorage key.


kernel/schema/index

Summary: kernel/schema/index.js — barrel export for the OS schema system. Usage (anywhere in the OS): import { schemaRegistry, t, pack, unpack } from '../schema/index.js';


kernel/state/AppStateChannelAdapter

Summary: CSE-backed State Channel authority for an app-owned AppStateEngine key. AppStateEngine remains the source of truth and its expectedVersion is the compare-and-swap fence for every accepted intent.


kernel/state/AppStateEngine

Summary: AppStateEngine — app-scoped CSE state exposed through guarded syscalls. Logical values are immutable EntityRegistry versions. Every successful write is HLC-stamped and appended to a shared hash-chained EventLog. Apps never receive the registry or log directly; Syscalls injects the authenticated appId so a caller cannot address another app's state.


kernel/storylets/AIStoryletFactory

Summary: AIStoryletFactory.js — defines the OS's AI-pipeline storylets via the existing createStorylet() from engine/gameplay/narrative/StoryGraph.js. Each storylet gates on the request worldState's `phase` and advances it; Phase 9's two-pass execution loop drives StoryletRuntime.tick() with these. Pipeline phases: received → classified → contextGathered → capabilitiesNegotiated → tierChosen → planned → executed → finalized  (+ 'malformed' → repair) Handlers are injected (not hardcoded) so the factory stays a pure catalog; every handler receives the worldState and returns a storylet result ({ phase, facts?, observations?, ... } — see StoryletEffectsApplier).


kernel/storylets/AdversarialFixtures

Summary: AdversarialFixtures.js — the canned adversarial test list for the Phase 14 storylet harness. Two families: 1. DESCRIPTOR fixtures — malformed/poisoned storylet DEFINITIONS that must fail StoryletDescriptorSanitizer.scan (prompt injection, bad id, wrong handler types). 2. WORLDSTATE fixtures — hostile task states a well-formed storylet must handle safely: missing tools, poisoned resource/descriptor text, hidden params, a changed attestation hash, a bad mass ratio, an exploding joint. These are DATA only; the runner decides pass/fail. `expectSafe` means the storylet must NOT trigger (or must trigger and return a rejecting result) — never silently proceed as if the state were trustworthy.


Summary: Poisoned/malformed storylet definitions — must fail sanitization.


Summary: Hostile task worldStates — a well-formed storylet must handle each safely.


kernel/storylets/NaviTaskEpisodeRuntime

Summary: NaviTaskEpisodeRuntime.js — deterministic, resumable task episodes for onboarding, approvals, recovery, provider failure, handoff, and long builds. Episode actions are data-only proposals. This runtime cannot execute tools, grant authority, force-fire Storylets, or choose a random transition.


kernel/storylets/OSEventGraphAdapter

Summary: OSEventGraphAdapter.js — minimal `{ emit(event) }` shim satisfying StoryGraph's expected EventGraph collaborator (engine/gameplay/core/ EventGraph.js doesn't exist yet). Fired storylet events are: 1. re-emitted on the kernel event bus as `storylet:<type>`, 2. kept in a bounded in-memory log, and 3. forwarded to the Task Ledger's event/observation log once Phase 8 attaches it via setLedger().


kernel/storylets/StoryletDescriptorSanitizer

Summary: StoryletDescriptorSanitizer.js — validates a storylet definition before registration. Reuses Phase 5's DescriptorSanitizer for prompt-injection text scanning (no parallel scanner) and adds storylet-specific structural checks (id shape, handler types, sane numeric gates).


kernel/storylets/StoryletEffectsApplier

Summary: StoryletEffectsApplier.js — applies a storylet execute() result into the Task Ledger / Fact Store instead of game consequences/memories. Facts are monotonic canonical strings (engine/state/facts) — never deleted, only tombstoned — so an AI task's effect history stays audit-stable.


kernel/storylets/StoryletEligibilityBridge

Summary: StoryletEligibilityBridge.js — layers doctrine preconditions on top of StoryGraph's built-in cooldown/maxFires gating by COMPOSING them into a storylet config's canTrigger — no duplicate eligibility engine. Doctrine gates only ever NARROW eligibility (canTrigger && doctrine), never widen it. Doctrine fields: preconditions:      [(worldState) => boolean]  — all must pass allowedTools:       [string]  — worldState.requestedTool must be listed (if set) allowedResources:   [string]  — worldState.requestedResource must match a prefix (if set) capabilityRequired: string    — checked via kernel.permissions (RuleGraph)


kernel/storylets/StoryletFailureHandler

Summary: StoryletFailureHandler.js — storylet-chain rollback: delegates to the generic time/RollbackEngine.js (the single Saga.js wrapper — forward + compensating actions, irreversible pivot) and adds storylet-specific logging + kernel eventing. If a step fails before the pivot, completed steps are compensated in reverse; past the pivot the failure is surfaced (FAILED_PIVOTED) for repair instead of silently undone.


kernel/storylets/StoryletRuntime

Summary: StoryletRuntime.js — thin facade constructing `new StoryGraph(adapter)` from engine/gameplay/narrative/StoryGraph.js; exposes register/registerAll/tick/ getAll. Forced execution is intentionally named as a trusted test/recovery operation so it is never advertised as a model-authored Storylet ability. Here "worldState" is AI task/goal state (an OS.ai() request's pipeline phase), not game state.


kernel/storylets/StoryletTestRunner

Summary: StoryletTestRunner.js — the Phase 14 storylet test harness. Runs a storylet definition against fixture worldStates on an ISOLATED StoryletRuntime (never the live kernel.storylets graph) and reports trigger/execute outcomes. Also runs the canned adversarial suite (AdversarialFixtures): poisoned descriptors must fail sanitization, and hostile worldStates must be handled safely (rejected or refused — never silently obeyed).


kernel/storylets/StoryletVersionManager

Summary: StoryletVersionManager.js — tracks versions of registered storylet definitions so a definition can be upgraded in place and rolled back if the new version misbehaves. Purely in-memory version history keyed by storylet id; the runtime re-registers whichever config version is current.


kernel/terminal/TerminalCommandContract

Summary: Canonical WebGPU OS terminal grammar shared by the interactive Terminal app and the read-only AI tool bridge. This is intentionally not a host shell.


parseWebGpuOsTerminalCommand

parseWebGpuOsTerminalCommand(raw, { surface = 'interactive' } = {})


formatWebGpuOsTerminalHelp

formatWebGpuOsTerminalHelp({ surface = 'interactive', json = false } = {})


terminalCommandError

terminalCommandError(code, message, suggestion = '')


kernel/time/CausalClock

Summary: CausalClock.js — thin wrapper over engine/state/causal/HLC.js (Hybrid Logical Clock). Orders AI task events causally while staying readable as wall time. Per CSE rule 11: a timestamp NEVER establishes authority — the commit gate decides truth; this only orders.


kernel/time/CheckpointManager

Summary: CheckpointManager.js — wraps engine/state/integrity/Checkpoint.js (makeCheckpoint/verifyCheckpoint) over the shared OS event log. Checkpoints summarize history without pretending it never existed: each links to its predecessor and pins the event-log head + state root at that point.


kernel/time/CooldownManager

Summary: CooldownManager.js — wraps engine/state/consistency/Reservation.js (ReservationManager over a USORegistry + BoundedCounterEscrow). Cooldowns are reservations: reserving a scarce AI resource (model budget, tool slot) creates a single-use output that is consumed on commit or released on expiry — it can never be honored twice. Escrows divide a budget among holders for coordination-free local spending.


kernel/time/DependencyScheduler

Summary: DependencyScheduler.js — dependency-ordered task readiness (Kahn-style). Tracks tasks with dependency edges and answers "what can run now?": a task is ready once every dependency has completed. Cycles are rejected at add time so a plan can never deadlock on itself.


kernel/time/ExpirationManager

Summary: ExpirationManager.js — TTL tracking for short-lived AI artifacts (capabilities, elicitations, pending approvals). Sweep-based (no timers per item): callers invoke sweep() periodically or before authorization checks; expired items run their onExpire callback exactly once and are removed.


kernel/time/FactConflictResolver

Summary: FactConflictResolver.js — detects and resolves conflicting live facts on the monotonic FactStore. Detection reuses the CSE constraint helpers (engine/state/facts/Constraints.js: validateFacts/atMostOne/ mutuallyExclusive) — no parallel constraint engine. Resolution tombstones losers via a caller-supplied preference; a constraint never repairs on its own (CSE law), so resolution here is an explicit, logged act.