Description

qemu-system-x86_64 -m 512M -cdrom dist/zxv-universal.iso -serial stdio

qemu-system-aarch64 -M virt,gic-version=3 -cpu cortex-a53 -m 512M \
  -kernel dist/kernel_arm64.bin -serial stdio

qemu-system-riscv64 -M virt -m 512M \
  -kernel dist/kernel_riscv64.bin -serial stdio

dd if=dist/zxv-universal.iso of=/dev/sdX bs=4M status=progress conv=fsync

Notes

Abstract

ZXV / ZEDEC pqOS — Architecture White Paper

Kernel: VOVINA SHAKINA M5 Axiomatic Kernel
System: ZEDEC XERO VULPINE (ZEDEC post-quantum OS)
Primary target: AArch64 (ARMv8-A, QEMU virt, GICv3) · freestanding, no libc/malloc/float on target
Status at this revision: host verification make verify-all = 3593 checks, 0 failures; arm64 freestanding image boots to [E0105] BOOT_OK; five-target cross-compile preflight CLEAN.

This paper explains the architecture of the whole system: the axiomatic core it computes in, the freestanding kernel it boots on, and the economy, governance, social, creative, and platform layers built on top. It is a design reference, not a file index — a companion SUBSYSTEM_INDEX.md catalogues individual files, and SOURCE_CODE_NAVIGATION_GUIDE.md is the reading order.

1. Design Philosophy — the axioms the whole system obeys

ZXV is built from a small set of non-negotiable design axioms. Every module in the tree is written to them, and the build's grep-gates and host tests enforce several of them mechanically.

1. One number type, exact on the target. All value, surplus, price, weight, and probability arithmetic uses surplus_real_t: an IEEE double under the host test build (-DTEST_HOST) and a Q32.32 fixed-point int64 on the freestanding target. Code never touches the representation directly — it goes through the SR_ macros (SR_ADD, SR_MUL, SR_DIV, SR_CMP, …). The fraction-first rule — SR_MUL(x, SR_DIV(n, d)), never SR_DIV(SR_MUL(x, n), d) — keeps intermediate products inside int64 on the target, an overflow the host double build cannot see. There is no floating-point unit dependency and no malloc on the target.

2. Phase-tick ordering, never the wall clock. Causality in the system is expressed as monotonic phase ticksadvanced explicitly (con_tick, the phase coordinator, subterminal sync). Nothing branches on real time; determinism is a property, not an aspiration. The same inputs produce the same verdicts across a thousand repeated evaluations (an actual test).

3. No hollow capabilities — ops boundaries fail closed.Wherever the system must consult a fact it cannot compute for itself — a delivered shipment, an external attestation, a market outcome, a random seed — that fact enters through a bindable hook (a function pointer on the state). When the hook is unbound, the operation fails closed: escrow stays shut, distribution is refused, money does not move. The kernel verifies the signature or attestation over the fact (Ed25519, keyed digests, content addresses); it never fabricates the real-world fact, and it never trusts a bare caller-set boolean. Every host test asserts against an external anchor — an RFC/FIPS vector, a known answer, or a conservation identity — not against the code's own output.

4. Tri-Space typing. Every artifact carries a valence in a three-space triad: S+ (.zxvc, positive), S− (.cedez, negative), S0 (.cedec, neutral). The triad is a first-class type, not a tag, and it flows through fusion, files, and judgment (Wyrmgate).

5. Sovereignty by construction. Every system is a sovereign node — a microstate — and every user a sovereign individual. There is no central kill switch anywhere in the tree (the One Policy voids terms that carry one), no platform ban primitive (it was never written, and the build greps to prove it), and no advertising primitive (likewise). Safety is achieved by matching like with like, not by silencing.

6. The One Policy is definitional, not administrative. A term that produces asymmetric harm, unilateral extraction, usury, or a non-reciprocal burden is, by definition, not a term — the Symbiotic Maxim excludes it locally and deterministically, with no clock, network, or central authority. This predicate (op_evaluate) is composed by the economy, governance, and logistics layers rather than re-implemented.

2. System Overview — how the layers stack

The system is a stack of composed layers, each grounded on the ones beneath it and none reaching around them:

  Platform · Desktop · Display · Pirate Apps         (§12)
  Languages · Legacy Compat · Terminal · Tri-Space   (§11)
  Networking · P2P · Content Addressing              (§10)
  AI (Chiglet) · Cards/Sigil · Creative Suite        (§9)
  Social Fabric · Reputation                         (§8)
  Governance · The One Policy · Sovereign Nodes       (§7)
  Economy · Finance · Nine-Form Capital              (§6)
  Security · Crypto · Admission Control               (§5)
  Architecture · Boot · Memory · Scheduling          (§4)
  ── Axiomatic Core & the Q32.32 Math Substrate ──   (§3)

The axiomatic core (§3) is the number system and ordering spine. The freestanding kernel (§4–§5) boots it on real hardware and guards its boundaries. Everything above — money (§6), rules (§7), people (§8), intelligence (§9), the network (§10), languages (§11), and the surface (§12) — is an application of the same six axioms. The sections that follow describe each layer as it exists in the source.

3. Axiomatic Core & the Q32.32 Math Substrate

This domain is the arithmetic bedrock and the causal spine every other subsystem stands on. It answers two questions freestandingly — with no libc, no malloc, and no hardware float on the AArch64 target: what number type does the kernel reason in, and in what order are coupled steps allowed to happen.

The real-number substrate

surplus.h defines surplus_real_t and its SR_ macro family. This is the house invariant that must never be hand-rolled around: on TEST_HOST the type is double and SR_MUL/SR_LN map to libm; on target it is a Q32.32fixed-point int64_t where SR_ONE == (1<<32) and every operation routes through sr_mul_impl/sr_div_impl (128-bit intermediates on any 64-bit target, hand-split long division as the 32-bit fallback). Two red-team-hardened decisions define it: SR_FROM_INT multiplies by SR_ONE rather than left-shifting, because shifting a negative int64 is UB that sr_ln() hits for every argument below 1; and sr_div_impl scales through a 128-bit numerator, fixing a prior overflow that silently returned 0 and violated ISF normalization axiom S4 (f(1,N)=ln N). Transcendentals are built from primitives — sr_ln via range reduction plus a 21-term t=(m-1)/(m+1) series, sr_sqrt via 20 Newton iterations.

Exactness where it is achievable lives in three rational types, each fit to purpose: rat_t (WyvernEye) is exact ℚ arithmetic (rat_make, rat_add, rat_div) that detectsoverflow into a valid=false flag rather than wrapping; rmag_rational_t carries always-reduced resource budgets (rmag_rational_reduce); and rational_t in m5_types.h is the manifold's magnitude axis.

The axiomatic functionals

surplus.c implements the Interaction Surplus Framework: surplus_u computes u = 1-(x·y)² and surplus_f evaluates f(u)=ln(1+(N-1)u), guarding N<2 and Q32.32 overflow before touching SR_LN. On top sit decomposition, Lipschitz stability, and the open-system dynamics surplus_dynamics_step (Q_{t+1}=(1-δ)Q_t+ηS_t-C_t). edp_risk lifts this into the M⁵ Curzi Manifold m5_coords_t = ℕ×ℝ⁺×[0,1]×iℝ×Χ, with the risk operator edp_compute_risk : M⁵ → ℂ, the coverage hyperbola edp_coverage_satisfied (r·ℓ ≥ 1.8, stored as 18/10), zero-preserving division edp_zpd, and edp_fibonacci-signed paradox algebra. The identical five axes reappear as phase_tick_t {omega, r, ell, iphi, chi} and as the composite key of axiom_matrix— axiom_matrix_project_tick reads the manifold as a sparse complex field indexed by the full tuple.

The ordering spine

Causality, not wall-clock, orders everything: oseq (K1) assigns monotonic ordinals over a causal DAG with oseq_happens_before and replay rejection; phase_coord (K6) is the admission gate whose pc_admit returns ADMIT/VETO/DEFER/RETRY over current_logical_time. This is the OPS-BOUNDARY fail-closed discipline in code: unknown or degraded health defers, and a is_hardware_action step demands both pc_check_all_gates full coverage and PC_HEALTH_HEALTHY or it is vetoed.

How it composes

The Tri-Space triad is native here: lpres (K3) four-valued paraconsistent presence (NEITHER/TRUE/FALSE/BOTH → S0/S+/S−/glut, via lpres_conjoin and lpres_safety_gate_clear) maps directly onto trit_t's GLUT states and trit_to_ell. rmag (K2) meters budgets, iphase (K4) routes, and choice (K5) resolves ties — all deferring ambiguity to S0. The speculative superpos, dualtrack, and lattice build/execution layers borrow the same GLUT vocabulary and phase-tick clock (cycle_pulse explicitly replacing the wall clock), collapsing eigenstates only at tick boundaries. Every downstream domain — governance, refinery, apps — ultimately computes in surplus_real_t and is sequenced by K6.

4. Architecture, Boot, Memory & Scheduling

This domain is the AArch64 substrate everything else stands on: the reset-vector-to-[BOOT_OK] chain, the EL1/EL0 privilege split, the page tables, the interrupt/timer path, the process scheduler, and the persistent store. The primary (and, on this host, only booting) target is qemu-system-aarch64 -M virt; the x86 mm.h/syscall.h/timer.h (32-bit page_directory_t, int 0x80 dispatch, PIT) are legacy and not on the ARM64 boot path.

Boot chain. boot.s _start runs at EL2, seeds SCTLR_EL1, sets HCR_EL2.RW, grants EL1 the physical timer via CNTHCTL_EL2, and erets to el1_entry. There it points VBAR_EL1 at vector_table, enables FP/SIMD in CPACR_EL1 (-O2 auto-vectorizes even page-table zeroing, which would otherwise trap), sets sp, clears BSS, and bl kernel_main → kernel_main_arm64(). That function is the deterministic bring-up sequence: uart_init, banner, arm64_mmu_init, gic_init + gic_register_handler(IRQ_TIMER, arm64_timer_handler), arm64_timer_init, then the M5 core (phase_coordinator_init(&tick, EXEC_DC), rmag_init, lpres_init, iphase_init, oseq_init), the economic/app subsystems, storage, sched_init, optional EL0, and finally [BOOT_OK] Phase E0082 complete, boot_features_init, boot_economy_init.

MMU. arm64_mmu.c builds static l0_table/l1_table/l2_table (no malloc): a 1 GB L2 identity map at 2 MB granularity plus 1 GB L1 blocks anchored at board_get_profile()->ram_base. Device-vs-Normal attribution is computed, not hardcoded — block_overlaps_periph() pads each board's real uart_base/gicd_base/gicr_base/virtio_mmio_baseby 16 MB and errs toward Device, so a MediaTek Tank profile can't silently leave MMIO cacheable. TCR_EL1 uses T0SZ=24 (walk starts at L0); MAIR_EL1 indexes Normal/Device. arm64_copy_pt_template() clones the kernel map into per-process tables.

Interrupts & tick. gicv3.c gic_init() enables the distributor with ARE | ENABLE_G1, routes SPIs and the timer PPI (IRQ_TIMER=30) into Group 1 through the redistributor SGI frame after the GICR_WAKER handshake. gic_handle_irq() acks via ICC_IAR1_EL1 and EOIs via ICC_EOIR1_EL1. arm64_timer.c programs the generic timer at 100 Hz; arm64_timer_handler() reloads CNTP_TVAL and fires the registered timer_cb.

EL1/EL0 & scheduling. el0_userspace.h defines the real isolation boundary: each user_proc_t owns an L0 table in TTBR0_EL1 while the kernel stays in shared, never-switched TTBR1_EL1. proc_create/proc_create_from_elf build address spaces; the irq_handler_lower_aarch64 vector calls el0_irq_handler_c → proc_sched_tick(&ps, ctx) for round-robin preemption; SVC lands in proc_handle_svc, gated by per-process CAP_* bits (CAP_APP_DEFAULT vs CAP_TRUSTED_ALL) with copy_from_user/proc_user_range_ok validating every user pointer (audit finding P0-1). EL0 is gated behind ENABLE_EL0_USERSPACE; when off, the classic scheduler_t (sched_init, sched_create_task) is a task registry mirroring long-lived kernel tasks for ps/vmstat, and kernel_event_cycle_run() — advanced by the phase tick, never wall-clock — is the heartbeat that keeps [BOOT_OK] deterministic.

Storage & updates. zxvfs.h is a redo-journaled flat FS on a block_device_t (virtio-blk in production): stage sectors → write commit header → checkpoint, replayed idempotently on zxvfs_mount (journal_replays), so a crash leaves the volume fully before or fully after a transaction. abupdate.h layers A/B slots (ab_state_t, ab_stage_update/ab_slot_to_run/ab_confirm/ab_rollback/ab_boot_tick) with probation and auto-rollback, all state journaled through ZXVFS. Execution is fail-closed: zsp_verify() checks SHA-256 integrity + Ed25519 signature against a compiled-in root public key before any .zsp runs; absent a virtio-blk device, persistence simply [SKIP]s to the volatile RAM disk.

Composition & invariants. Ordering is phase-tick, not time — event_clock.h is a Lamport-style logical clock (event_ordinal ≥ local_counter) that projects wall time only on an accepted event_clock_sync, its m5.phisaturating because surplus_real_t is Q32.32 on target. No libc/float on target: page tables and FS buffers are static. The layer feeds the M5 core its tick, hands EL0 processes to the ELF/.zsp loader and ZXVFS, enforces the OPS-boundary/fail-closed discipline (unsigned code never executes, unbound devices skip), and finally hands boot_economy_init the sovereign-node/One-Policy layer once the machine is live.

Grounding files: kernel/arch/arm64/{boot.s, arm64_mmu.c, gicv3.c, arm64_timer.c, kernel_main_arm64.c, el0_userspace.h} and kernel/src/{zxvfs/zxvfs.h, loader/abupdate.h, loader/zsp.h, clock/event_clock.h, sched/sched.h, mm/mm.h, bootfeat/boot_features.h}.

5. Security, Crypto & Admission Control

This domain is the kernel's trust boundary: the freestanding cryptographic primitives, the post-quantum key exchange, the vault that holds secrets at rest, and the two admission gates — one for peers, one for daemons — plus the role-and-authorization framework that governs offensive tooling. Everything here honors the house rule that on target there is no libc, no malloc, and no float; primitives are single-file and self-contained.

Cryptographic floor. robin_debanks/ carries the vetted symmetric/asymmetric floor: sha256 (streaming sha256_init/update/final, added specifically because two prior HMACs silently truncated past 256 bytes), aes256_gcm_encrypt/decrypt (NIST SP 800-38D, validated against GCM test case 13), and ed25519_verify. mlkem/ is the post-quantum layer: mlkem768_keygen/encaps/decaps (FIPS 203, Fujisaki–Okamoto with implicit rejection, so a decapsulation failure is indistinguishable from success — no decryption oracle). The design split is explicit in the headers: AES-256/SHA-256 stay quantum-resistant under Grover, so only public-key operations migrate to ML-KEM/ML-DSA.

The malleability guard. A load-bearing invariant lives in ed25519_s_is_canonical: before any verify, the scalar S = signature[32..63] is rejected unless S < L (the group order, little-endian), walked most-significant-byte-first in constant time. Without it, (R, S+L) is a second valid encoding of the same signature — a red-team-found malleability. Only after this check does orlp_ed25519_verify run. The embedded roots of trust (ED25519_PUBKEY_IMMIGRATION, _PORTER_HOUSE, _COUNT_HOUSE, _COMMUNITY_CHEST, _AI_LAYER) are PUBLIC keys; the private halves are never compiled in.

The vault. robin_vault_t stores up to ROBIN_MAX_ENTRIES robin_entry_t records, each AES-256-GCM-sealed with a monotonic nonce_counter(guaranteeing unique GCM nonces), a 168-bit truncated-SHA-256 integrity_hash, and a GCM tag verified on every robin_unlock. Entries can be time-locked (robin_request_unlock starts a delay measured in cycles, never wall-clock), and failed unlocks past ROBIN_MAX_ATTEMPTS transition to ROBIN_ENTRY_LOCKED_OUT. The vault holds a porter_house_t *porter so access requests are themselves gated.

Admission — peers and daemons. porter_house/ is a per-port doorman: porter_house_admit decides against a ph_seal_mode_t(OPEN/TRUSTED/ALLOWLIST/CLOSED) using a caller-supplied trust weight — deliberately decoupled from Count House. immigration/ gates executable daemons: immig_apply_visa grants RESIDENT/WORKER/TRANSITvisas only after immig_verify_sig checks an Ed25519 signature over content-hash‖pubkey‖id against the embedded immigration key. This is the OPS-BOUNDARY discipline: the verify_sig hook FAILS CLOSED — an unbound or invalid signature yields IMMIG_DAEMON_REJECTED (undocumented), and repeat violations trigger immig_deport.

Hat-color model. mage/ reifies the principle that a port scanner on your own network is diagnostics and on a non-consenting target is an attack — the tool is identical, the ENGAGEMENT differs. Hats (MAGE_HAT_WHITE…GREY) grant capability sets; OPEN capabilities (harden, detect, audit) run freely, while GATED ones (SCAN, EXPLOIT, C2, LATERAL, EXFIL) require an active mage_engagement_twhose scope covers the target. mage_authorize is the single gate every capability must call; with no covering engagement it returns MAGE_NEEDS_ENGAGEMENT, never a silent allow. Engagements are mage_engage_self (self-authorized over owned assets) or mage_engage_signed(external signature); windows are [from_tick, until_tick] phase ordinals. mage_emulate runs a technique and reports CAUGHT/GAP — a finding, not a foothold. Every decision appends to a hash-chained audit log (mage_audit_verify), and containment (mage_contain, from src/concord) is rehabilitative: a contained hat keeps defensive capabilities.

License instruments. license/ embeds the four-instrument share-alike stack (OPL-1.1, CC BY-SA 4.0, Royal Writ, SEL-3.3) into the binary; license_travels_together enforces that no derivative may drop one, license_precedence_rank orders them, and license_is_share_alike marks the copyleft carry-forward — the One Policy expressed as code.

Composition. porter_house_t pointers thread through both vault and immigration; tls/ builds a TLS 1.3 client atop x25519 + hkdf + aead, with TLS_VERIFY_REQUIRED failing closed on unverified certs, and is the natural home for the hybrid x25519+mlkem768exchange. panopticon/ rates watchers for transparency; smap/recon/ubh supply content-addressed identity that these gates key on.

6. Economy & Finance Engine

The Economy & Finance Engine is ZXV's native, no-debt money layer: value is equity, never debt, so no path in the module charges interest or forces a liquidation. Everything is freestanding — integer-only surplus_real_t (Q32.32 on target, double on host) computed fraction-first through the SR_ macros, fixed-size arrays, no libc/malloc/float, and phase-tick ordering rather than wall-clock (fm_quote_t.phase_tick).

Core data model. Two capital taxonomies coexist by design: zcapital.h's zcap_form_t is the canonical nine forms (four inalienable Crown forms — Social/Natural/Cultural/Spiritual — plus five priceable ones), while vino.h's older capital_type_t (CAP_MAX == 9) still backs triple_ledger and interop. The ledger core is the triple-rail triple_ledger_t: LEDGER_FINANCIAL (rational/debit-credit), LEDGER_PROVENANCE (logical/attestation), and LEDGER_EXTERNALITY (imaginary/relationship phase), each ledger_entry_t carrying its full M⁵ coordinates. On top of it, vino_stores_t is the settlement engine — it never re-implements double-entry, it posts throughtriple_ledger_post as three atomic rails under real ISO 4217 numeric codes: VINO_ISO_DEBIT 846 (asset/backing), VINO_ISO_CREDIT 888 (claim), and VINO_ISO_EQUITY 999 (the live equity witness, deliberately ISO XXX "no currency"). Money circulates as floating_voucher_t/vino_voucher_t — merit-based, no-debt bearer instruments on a Fibonacci denomination ladder (vino_ladder_denomination).

Load-bearing invariants. (1) Single-active-state: a Vino unit is spendable on exactly one rail — physical bearer note or digital ledger-ghost — enforced by vino_can_spend/vino_single_active_state_ok, so supply can never double. (2) System-solvency gate: vino_ledger_act is the choke-point; after the three rails post, the whole ledger must still satisfy coverage = assets/liabilities ≥ 1.8× and equity ≥ 0, or the event does a full rollback restoring every mutated scalar (VINO_ERR_COVERAGE/VINO_ERR_EQUITY) — no partial write. (3) Usury veto: a claimed equity above backing implies interest and is refused via op_symbiotic_ok → VINO_ERR_USURY, the One Policy / Symbiotic Maxim in force. (4) Double-redeem guard: a redeemed/retired voucher is terminal (VINO_ERR_STATE). (5) Inalienability wall: zcap_exchange conserves value and returns ZCAP_INALIENABLE for any Crown form — you can neither buy nor sell a language.

The Battering Ram (br_exchange_t) is a posted-rate, principal-only venue — no order book, no margin, no margin-call path. br_swap_settle is atomic (both legs at the supplied agreed_rate or neither); a Financial leg with no bound rail returns BR_ERR_NO_RAIL, closing the FINANCIAL→X→FINANCIAL mint attack. Outcomes are an OPS BOUNDARY: br_distribute fails closed (BR_ERR_NO_ORACLE) when no verify hook is bound and only verifies the attestor's signature, never the fact; non-achievement is BR_FORGIVEN with zero debt. symbiotic_ok voids asymmetric harm, non-reciprocity, and derivatives on suffering.

Substrate & interop. alloc provides conserved symbiotic distribution plus a kill-switch-free platform token (ptoken_ledger_t, append-only, double-spend refused via PTOKEN_ERR_SPENT, no seizure function by construction). abacus/smaug_clear does exact multilateral mutual-credit netting (conservation and net-position preservation asserted). count_house_tcomputes anti-Sybil trust-weighted floor valuations feeding mesh_token settlement (Porter House-gated); financial/finance_markets price instruments and reuse those pricers (br_price_capital_futurecomposes financial_price_future, never a new pricer). iso20022 serializes PACS.008/CAMT.053 (never sends), mirroring the 846/888/999 codes; community_chest links a vino_ledger_t for voucher cash-in/out. Every external fact enters through a bindable, fail-closed hook — the kernel verifies signatures and CIDs, never the real-world value they assert.

7. Governance, the One Policy & Sovereign Nodes

This is the constitutional layer: not a wall of prose but a decidable predicate plus a set of deliberately-separated organs that compose it. Every exchange, credential action, and settlement in ZXV passes through it.

The One Policy — the Symbiotic Maxim as a pure predicate. op_evaluate(const op_term_t *t) reduces "any term producing asymmetric harm, unilateral extraction, or non-reciprocal burden is, by definitional exclusion, not a term" to one function over op_term_t(give_a/give_b, harm_a/harm_b, interest, and boolean flags). It returns an op_verdict_t by checking gates in a fixed, deterministic order: fraud_root (Return Doctrine) → interest > 0 (no usury) → denies_aid | revoke_for_nonpayment | has_kill_switch (Grace of Somalia / no coercion) → asymmetric harm → unilateral extraction → non-reciprocal burden. It is freestanding, stateless, allocation-free, clock-free, integer-only (surplus_real_t via SR_ macros, net_of computed fraction-safe). The load-bearing invariant: the extraction gate if (a_gives != b_gives) fires regardless of the caller-asserted reciprocal flag — the modeled values are ground truth; a reciprocal=true that conveys nothing back is an attacker's lie the predicate ignores. op_symbiotic_ok, op_grace_of_somalia_ok, and op_return_doctrine_reverts are the composable entry points other modules call.

Anti-capture: two organs, one membrane. The Crown Pillar (crown_t/crown_isc_t) issues Individual Sovereign Credentials and verifies signatures — crown_register, crown_isc_verify, and the access gate crown_isc_is_active. It holds no private key (issued sig is zeroed; offline HSM signs), never #includes any ministry/ledger header, and references no money-moving symbol (verified by make verify-all). crown_revokeroutes every proffered ground through op_grace_of_somalia_ok, returning CROWN_ERR_COERCION for NONPAYMENT/KILL_SWITCH/DENY_AID; only a fraud root or a Maxim verdict is a valid ground. The Ministry Pillar (ministry_t) is the half that touches money — it wrapstriple_ledger_t rather than reinventing accounting, and ministry_settle passes every settlement through the One Policy (interest > 0 → MIN_VOID_MAXIM) and fails closed on coverage < 1.8x → MIN_UNDERCOVERED, leaving the ledger untouched. It holds no signing key: a treasury cannot revoke what it cannot issue. Exchange ratios are an OPS boundary — ministry_set_exchange_ratio supplies them; they are never discovered on-device.

Every node a microstate. sovereign_node_t wraps the real microstate_t; sovereign_constitute derives identity_cid = ipfs(LE(self) || charter_cid), real before any peer recognizes it. There is deliberately no function that un-makes a node — sovereign_is_sovereign has no false path. sovereign_federate composes microstate_recognize, which recomputes the peer's charter (ZXV_ECHARTER) and declaratory writ binding (ZXV_EBADSIG) — recognition theatre is prohibited — and touches only the recognizer's set: between, never over(peer is const).

Interspace — the space between spaces, under Lex Rhodia. The interstitial medium is res communis: interstitial_region_t.owner is pinned to ZXV_NODE_NONE and interstitial_claim has no success path. lex_rhodia_general_average apportions sacrifice by stake with exact conservation — the numeric antidote to the Maxim's asymmetric harm; sovereign immunity is "your hash is your key" (vessel_flag_verify); cojurisdiction_eval (flag-state co-jurisdiction) allows an action only when the host term is op_symbiotic_ok and the vessel's content still matches its flag. The minister_t computes fair contributions for all parties but binds only those who consented by joining the constellation; minister_may_seize always returns false.

How it composes. Wyrmgate's wyrm_judge renders the Tri-Space verdict (S+/.zxvc commit, S−/.cedez reject, S0/.cedec defer) over rmag/lpres/chiglet. denconnectapplies node-local sovereignty — operator-defined privilege bitmasks keyed by Ed25519 identity (den_can, den_may_connect), with escalation structurally barred (only a SET_ACCESS holder changes rules). legal_engine generates the declaratory sovereign declarations and treaties these organs cite — authority claimed by content-binding, never by fiat.

8. Social Fabric & Reputation

This domain governs how sovereign nodes meet, how boundaries are enforced without coercion, how reputation is surfaced without silencing, and how every judgment is remembered. Four modules stack: concord (the matching commons), social_spaces (named public rooms), reputation (the Pig Badge and earnable badges), and chronicle (the tamper-evident ledger of verdicts).

The commons and the ISF core. con_commons_t holds a fixed array of con_person_t (interest vector, standing_score, sociability budget) plus a table of con_divide_t. The load-bearing decision is that introductions are ranked by interaction surplus, not engagement: con_surplus calls chg_interaction to compute u = 1 - (x·y)², maximal for complementary (orthogonal) interests and zero at both extremes — echo chamber and clash alike. con_recommend gathers eligible peers and selection-sorts by that surplus descending; there is deliberately no recency, retention, or time-on-platform term anywhere. Surplus arithmetic is surplus_real_t (Q32.32 on target, double on host via SR_ macros), integer-only, no float.

Non-coercion as an invariant, not a policy. Three symmetries make abuse of the layer unexpressible. (1) A crossed boundary produces a mutual, temporarycon_divide_t; con_divided and con_can_see are strictly symmetric, so a one-way block that keeps watching cannot be written. (2) con_may_match gates on standing pools: the XOR test (sa == CON_QUARANTINED) != (sb == CON_QUARANTINED) means a quarantined person matches only other quarantined people — a bully meets bullies — and con_tick recovers standing_scoreeach event cycle, so quarantine is rehabilitative, not a scarlet letter. (3) The distinct-reporter consensus rule lives inside con_report_boundary: the standing penalty (CON_BOUNDARY_HIT) is applied only inside the guard that creates a new divide, so a repeat report by the same reporter is a no-op. One person can never unilaterally quarantine another — it takes real, distinct consensus.

Free rooms over the commons. soc_world_t embeds one con_commons_t as its single safety mechanism and adds spaces and membership. The mandate is true by construction: there is no soc_ban, soc_delete, or soc_silence — they were never written, so tests can grep-prove it. soc_post deliberately does not check standing (a quarantined heckler still posts; posts are monotonic, never erased). soc_report is first-party only, forwarding to con_report_boundary. The one moderation lever, soc_sort, fails closed: it returns SOC_ERR_NOT_QUARANTINED unless the target was alreadyquarantined through genuine reports — it imposes no quarantine and never reports on anyone's behalf, refusing to manufacture consensus. All it then does is soc_regroup_quarantine to seat fellow-quarantined people in one corner. No shadowban exists.

Reputation surfaces. rep_state_t carries two separate ledgers. The Pig Badge is self-blind by design: the raw pig_level field must be read only through pig_level_seen_by, which returns 0 when viewer == subject — the operative wears a badge the whole room reads and they cannot. pig_flag sits on an OPS BOUNDARY: it records a confirmed-abuse occurrence supplied by the upstream counter-intel pipeline (fail-closed when the table is full), never deciding guilt itself. Earnable badges (badge_award, badge_score) are monotonic and kept strictly apart — shame and score are separate ledgers.

Memory of judgment. chronicle composes Wyrmgate: chronicle_submit calls wyrm_judge, appends S+/S− verdicts to a SHA-256 hash chain (head_k = SHA256(prev ‖ seq ‖ verdict ‖ reason ‖ digest)), and parks S0 DEFER events in a pending set. chronicle_poke re-judges pending events when their blocker clears, so a deferred decision resolves itself — self-resolving, phase-tick ordered by event ordinal, never wall-clock. chronicle_verify recomputes the chain to catch tampering, closing the audit loop the rest of the fabric relies on.

9. AI, Chiglet & the Creative Suite

This domain is ZXV's answer to "native, on-device intelligence and authorship without an LLM, without the cloud, and without a single line of floating point on target." Its spine is the Chiglet (src/chiglet), a bounded mixture of tiny linear experts whose combination weights come from the Interaction Surplus Framework rather than softmax. The organizing claim: a companion should decide by how much genuinely independent evidence it holds, not by how loudly correlated predictors agree.

The core abstraction is chg_result_t, computed by chg_infer over k evidence vectors of dimension CHG_DIM. The load-bearing quantity is R, the participation ratio of the evidence Gram spectrum (R = K'^2 / SUM(e_i.e_j)^2): 1 under total collinearity, K'under orthogonality. chg_interaction yields the scale-invariant u = 1 - (a.b)^2/(|a|^2|b|^2) — computed from unnormalized vectors, with no square root anywhere in the gate (an inverse-sqrt carried ~1e-4 error, four orders worse than the decision margin). Two abstention rules gate a CHG_DECIDED verdict: R < R_min returns CHG_REASON_REDUNDANT; a small top-two margin returns CHG_REASON_LOW_MARGIN. Otherwise the runtime returns a first-class CHG_UNCERTAIN. The security-critical subtlety: R is not monotone under duplication, so chg_effective_experts first collapses directions closer than CHG_U_MERGE into groups, gating on distinctdirections that cloning cannot inflate. All arithmetic uses surplus_real_t through SR_ macros (Q32.32 on target, double on host); the model is a caller-authenticated chg_model_t with an epoch rollback counter and a caps capability mask — inference does nothing it was not granted.

Cards (src/cards) turn this math into a product. card_evidence derives one deterministic evidence direction per card from its discipline/gematria/root, so loadout_equip + loadout_apply + loadout_infermake "collect broadly, not deeply" a geometric fact: eight duplicate cards still leave R = 1. The card's printed shape is the dataflow circuit — sigil_t carries a star polygon {N/k} (the circulant graph C(N,{k})) whose sig_fabric_lanes equals gcd(N,k): the arithmetic of the drawn figure is its parallelism, scheduled by dependency waves in sig_schedule (phase-order, never clock). zca is the activation VM: zca_derive/zca_assemble converge byte-identically, and zca_exec writes only into a caller-supplied card_effect_t — total (no jumps/loops), address-free, bounded, and CRC16-SEALed so an OCR misread fails loudly rather than executing a different valid program.

The Refinery (src/refinery, enochian, gematria) is the forge: ref_forge compiles intent text in any language via eno_gematria->eno_root->star fabric, and sha256->kamea circuit, into a ref_card_t. ref_preset_pack/ref_preset_unpack serialize a card to a small sealed blob that any peer re-derives and re-verifies from the text alone, refusing tampered claims with REF_ERR_FORGERY — a shareable AI preset with no server holding anything. Its three voices ENO_VOICE_SOLAR/LUNAR/AEON map exactly onto the Tri-Space triad S+/S-/S0.

The creative suite wraps the same core in honest OPS boundaries. art_studio is a real 256x256 integer raster core (art_compose_sigil, art_export_cid via SHA-256) — no medium it cannot rasterize. voice owns one deterministic thing, voice_text_to_phonemes; the neural TTS/STT sit behind voice_set_tts/voice_set_stt and fail closed (VOICE_ERR_NO_ENGINE, not one fabricated sample). games is a phase-tick state machine where game_state_hash gives lockstep P2P, and game_companion_decide acts through chg_infer, holding position when unbound.

Composition is the whole design: wyverneye's wyvern_read stacks the Refinery on Wyrmgate so intent always forges but the action is judged (S+ commit / S0 defer / S- reject), yielding anti-manipulation for free; mage's hat/engagement gate (mage_authorize, expiry in phase ticks) authorizes any capability the suite exposes.

10. Networking, P2P & Content Addressing

This domain moves bytes between sovereign nodes without ever letting the wire dictate what those bytes are. It spans a radio/transport substrate, a self-organizing mesh, a content-addressed object layer, a fraud-proof marketplace, and two coordinators that stitch heterogeneous cells and ISAs into one constellation.

Transport substrate — JDR PirateNet. jdr_piratenetmodels a virtual SDR as hardware-as-code: jdr_network_t owns up to 32 jdr_transceiver_tregister-file devices spanning every band (jdr_band_t, ULF→neutrino→harmonic) with DMA rings, IRQ lines, and FHSS hop tables. jdr_transceiver_create, jdr_transmit, jdr_hum_compute, and jdr_fhss_next_freq are the public surface. The harmonic-hum carrier registers (reg_hum_freq, harmonics[16], coverage_ratio) are surplus_real_t— Q32.32 on target via the SR_ macros, so carrier math never touches float on the freestanding target.

Mesh & routing. mesh_net is explicitly not TCP/IP: peers are 168-bit word168_t identities, and a mesh_net_tholds user-created mn_network_t meshes plus priced mn_route_t trade routes. mn_create_network/mn_join_network gate admission through a porter_house_t * (join can return -3 on Porter rejection), mn_net_access_t ranges OPEN→PRIVATE, and price_per_unit settles in Vino vouchers — the One Policy at work: routes are voluntary, priced, revocable, never extractive. p2p_caracho (the Carracho-style direct-stream node — handshake "TCPZEDEC", DHT tracker, LPRES 5-state stream recovery) is superseded; its header marks the live implementation as bootlegger, kept only because tooling cannot delete it.

Content addressing — the load-bearing invariant. ipfsmakes a CID exactly one SHA-256 digest (IPFS_CID_LEN == 32), reusing the kernel's real sha256, never a private hash. The defining guarantee is self-certification: ipfs_get_verify recomputes SHA-256 over exactly the bytes that came back and returns IPFS_ERR_CID_MISMATCH if they don't hash to the requested CID — no port authority can rename or seize what is addressed by its own fingerprint. Transport is an OPS BOUNDARY (ipfs_transport_t, a reused upd_transport_t); with no adapter bound every fetch is IPFS_ERR_NO_TRANSPORT — bytes are never fabricated. Integer-only, no allocation.

Marketplace — Mister Shanghai's broker. broker lists any information product by its 32-byte CID under a seller-signed aipic_contract_t. Delivery (broker_deliver) routes through ipfs_get_verify, inheriting fraud-proofing verbatim. Trust is the buyer's, not the House's: an author must be on broker_trust_author's allow-list AND pass a bound broker_verify_fn (bind ed25519_verify) — unbound fails closed (BROKER_ERR_NO_VERIFY). Access is gated by a hardened capability handshake (aipi_hs_begin→_challenge→_prove→_allow) whose grant hinges on a constant-time HMAC over the whole transcript (aipi_hs_allow), with freshness driven by a verifiable monotonic beacon phase, never wall-clock. Settlement is its own OPS BOUNDARY (broker_settlement_t) — no confirming backend, no fill. tribute_split is honestly labeled app-layer economics, not a security primitive.

Coordinators. constellation_coordinator(cc_coordinator_t) is capability-based node discovery, schema routing (cc_route_event, cc_find_executor), and timeout failure detection (cc_check_health); nodes enter CC_NODE_QUARANTINED until healthy, and no coordinator is a permanent single point of failure. cellular_multikernel (cell_fabric_t) admits fault-contained cell_ts carrying crit168_value_t digests and coordinates via the Tri-Space triad — fabric_event_t.lane is S+/S-/S0, resolved by triad_commit_update. Its cell_fabric_discovercarries the red-team OOB fix (CRITICAL, 2026-08-04): candidate cell_id must be NUL-terminated and transport_count/supported_schema_count clamped to their array bounds before any loop dereferences them — an unclamped count was a control-plane memory-corruption primitive.

Composition. ipfs_install_as_bridge_resolver wires the CID layer into bridge's resolve_cid slot, so one classifier (bridge_classify) spans Web2 DNS / Web3 CID / Web4 Chiglet intent, each an unbound-fails-closed backend. event_transport is the physical bridge under the event-space fabric that both coordinators speak; ai_layer reuses 168-bit content hashes, signed packages, and Porter House admission — the same primitives, composed rather than reinvented.

11. Languages, Legacy Compatibility & the Terminal

This domain brings dead languages, future languages, and the human operator to one phase-tick floor. Its through-line: never fabricate a translation. Every bridge is either exact and asserted, or it fails closed at an OPS BOUNDARY.

The compatibility spine — one IR, not N×N bridges.orbital_compat defines a canonical typed record oc_ir_t whose fields (oc_field_t) carry a normalized type plus an exact value: the numeric normal form is rat_t (WyvernEye exact rational), so 123.45 lowered from a COBOL COMP-3 field and from a Fortran fixed-format field is the same rational bit-for-bit. Each language is described once — oc_lower() in, oc_lift() out — via a bound oc_lang_ops_t. An unbound language is simply absent and returns OC_ERR_NO_LANG; oc_register_builtins() deliberately leaves OC_LANG_SUTRA/OC_LANG_FUTURE unbound to keep the fail-closed behaviour demonstrable. The IR is a phase-tick dataflow record: a field's identity is its value, ordered by registration, never a wall clock.

Lightning Rod — the measured lowerings underneath.orbital_compat's COBOL/Fortran/C adapters reuse lightningrod, a representation adapter (not a transpiler). It converts across the conventions that actually break integration — packed/zoned decimal, EBCDIC, column-major vs row-major, 1-based vs 0-based. Every conversion returns lr_result_t whose load-bearing field is exact: lr_packed_to_rat() turns COMP-3 straight into rat_t (exact by construction, so a migrated ledger balances with the mainframe), while lr_double_bits_to_rat() reports exact=false — the conversion naive migrations silently corrupt. lr_bridge_exists() reports "no safe bridge" rather than guessing.

Sutra — the AI/nonlinear-COBOL front-end. sutra is a language whose runtime interprets its AST directly against a real vino_ledger_t; it reuses capital_type_t, payment_rail_t, rational_t rather than reinventing them. Steps are @ORDINAL(N)-tagged and dispatched in ordinal order, not line order (sutra_run()); a fused DEBIT+CREDIT pair compiles to a single atomic vino_transfer(). sutra_parse()/sutra_self_audit() refuse silent partial parses, and out-of-scope features are declared, not faked.

Orbital Elevator — event-schema, not instruction, translation. orbital_elevator translates event envelopes across schema versions/ABIs through a signed adapter graph. oe_translate() finds a bounded path (OE_MAX_HOPS = 8); with no path it returns OE_TRANSLATE_NO_PATH rather than corrupting, and untranslatable fields are marked unknown (paraconsistent) rather than dropped.

zBIOS — the ten-key measured boot. zbios is a chain-of-trust: ten keys in three triads (SILICON/STORAGE/SOVEREIGNTY) plus ZB_K9_SEAL. zb_stage() enforces order, caller-supplied signature validity, and a rollback floor, extending a hash chain M[k+1]=SHA256(M[k]||digest||index); any tamper, reorder, or skip changes zb_seal()'s attestation quote. A failed stage HALTS — no continue-anyway path.

The terminal. pterm is a freestanding console multiplexer (framebuffer + UART, no termios) with a phase-aware trit prompt. pterm_mux weights sub-terminals not by timeslice but by the Interaction Surplus Framework: g(u)=1+(N-1)u in Q16.16, recomputed each pmux_phase_tick(), so orthogonal work earns more dispatch. subterm adds a subterminal tree where subterm_spawn_synced() groups share one integer clock — subterm_tick() advances all members in lockstep. xedit is a gap-buffer editor tracking a live cid/merkle_root.

Tri-Space file types. Every ZXV program ships as a triad, not one file: positive S+ (.zxvc), negative S-(.cedez), neutral S0 (.cedec). trispace/dual_spaceenforce five hard requirements in tri_bind() — all three bound, S- never over-capable versus S+, S0 holds no production effect until a signed policy resolves it, irreversible effects must declare a compensating/constraining/observational inverse, generated S- labelled as draft — else the triad is QUARANTINED into S0. fusion treats S+ as a capability plug (provides) and S- as a socket (needs); fuse_compose() connects them associatively, refusing FUSE_ERR_UNMET when nothing plugs the socket. pungent's garlic/onion tiers map onto these same file roles, so privacy posture is a first-class artifact property, not a runtime afterthought.

12. Platform, Desktop, Display & Pirate Apps

This domain is the surface ZXV presents to a person: the document scaffold apps are built on, the living desktop, the multi-language text stack, the themed iconography, the software rasteriser beneath it all, hardware modeled as code, and the "pirate" application constellation. Its governing discipline is that a window is "a porthole onto a capability that is real or honestly dark" — the UI holds no capability of its own and never paints a success a backing module did not return.

AppKit — the document model. Every native app (Writer, Sheet, Deck, Sound, Reel) sits on one doc_t: a fixed DOC_CAPACITY gap buffer plus bounded undo/redo rings. doc_insert/doc_delete are O(1)-amortised at the caret; consecutive typing coalesces into one undo record so doc_undo behaves as a person expects. Apps differ only in how they interpret the buffer, never in how editing or persistence work. Freestanding throughout — an edit that would exceed capacity fails rather than truncating.

Shimmer — the living ground. shimmer_t is the house's key architectural exemplar: its entire animation state is a single phase counter advanced by shimmer_advance()once per event cycle — never a wall clock. The field is a sum of three incommensurate travelling plane waves plus a domain warp, sampled per pixel with a 256-entry shm_sin LUT in integer Q8.8. Identical event sequence ⇒ identical frames (shimmer_shade composites over a base ARGB), keeping it inside the phase-tick and external-clock-bridge rules.

Fonts / i18n. The hard part isn't drawing glyphs, it's deciding which script and direction each stretch of mixed text is. font_itemize (in script.h) decodes UTF-8 and cuts a string into single-script font_run_ts; font_resolve maps a run's font_script_t to a registered font_face_t from the 109-face ASCW set. The glyph boundary is stated honestly: font_glyphrenders through a bound TrueType backend (font_bind_ttf) or a builtin 8×8 diagnostic subset, and returns false — never a fabricated box — for a codepoint it cannot draw yet.

Icons / theme — the house style. theme_t makes the palette override-able tokens (THEME_GOLD, THEME_ACCENT, THEME_VOID…) so nothing hard-codes a colour; theme_set on any slot recolours everything at once. An icon_t is not a bitmap but ≤ICON_MAX_OPSdrawing ops on a 64×64 grid coloured by token, so icon_render restyles with the palette. icon_for always returns a distinct on-palette icon — hand-drawn if it exists, else icon_procedural derived from the name. (desktop.h still carries an older concrete dragon_theme_t; the token model is the newer, composable layer.)

Hardware-as-code. rtl_device_t describes kernel modules as register/DMA/IRQ devices that can emit Chisel/SystemVerilog/VHDL via rtl_device_generate_hdl, with rtl_gate_create/rtl_gate_annihilate as second-quantization operators. dlp_projector_t models the Tank line's DLP Pico projector with real, checkable optics — time-of-flight autofocus (dlp_projector_laser_measure), N-way wobulation, photometric lux — advanced only by dlp_projector_tick() off the phase-coordinator stream, the same clocked-hardware/event-space boundary as the GICv3 timer PPI. Both carry m5_coords_tand surplus_real_t coverage_ratio.

The pirate constellation. pirate_apps is a thin honest UI: an app_ctx_t borrows a capability module (ipfs/broker/vino_stores/finance/social) and forwards every side-effect verbatim — app_hold_fetch → ipfs_get_verify, app_counter_settle → broker_settle, app_cellar_swap → vino_swap_to_physical. When a module's ops boundary is dark, app_status reports UNAVAILABLE and returns the module's exact NOT-AVAILABLE code, never a fabricated "ok". pirate_fleet (the Jolly Dragon Rogers) composes four real subsystems into a crew workspace: a flag-state charter DAO whose crew_state_t FSM is gated by an anti-capture jdr_cap_wall_ok (credential authority may never also hold treasury audit); ISF stranger-matching wrapping concord's con_recommend; and compute-for-Vino, where jdr_node_certify requires a real ≥2/3 Ed25519 officer quorum and jdr_accrue_vinocredits zero unless the deed's telemetry_real bit is set — simulated work earns nothing by construction, embodying the One Policy's ban on unearned extraction.

Everything composes downward onto video's pure-software rasteriser, which itself fails closed (VIDEO_ENODEV) until a real video_ops_t scanout backend is bound via video_bind_ops — the same fail-closed OPS-boundary discipline, top to bottom.

13. Cross-Cutting Invariants

A handful of invariants are not owned by any one layer; they are the connective tissue that lets the layers compose without leaking.

• The surplus_real_t contract. Every layer speaks the same Q32.32 number. A value minted in the economy layer, weighted by a reputation score, priced by a market, and allocated by the sustainable allocator never changes representation and never rounds inconsistently — because none of them ever leaves the SR_ macros. Host builds prove the arithmetic against double; a dedicated non-TEST_HOST test (test_alloc_q32) proves the target Q32.32 path against known answers, catching overflow the host build masks.
• Ops-boundary fail-closed, everywhere value or trust moves. Escrow release (logistics), outcome distribution (battering_ram), delivery attestation, credential activation (crown), and rail settlement (vino) all take a bindable verifier and refuse when it is unbound. This is one pattern applied uniformly; a reviewer can find every trust boundary by finding every *_set_verifier / bindable hook.
• Conservation identities as tests. Splits sum exactly to their total; a redistribution's shares sum to the pool; a swap conserves principal across two distinct forms; equity equals debit − credit or the post is usury. These identities are asserted, not assumed.
• Composition over duplication. The One Policy is written once and composed by zcapital, vino, ministry, logistics, battering_ram, and crown. Concord's matching math is written once and composed by social_spaces and pirate_fleet. Chiglet's mixture-of-experts is written once and composed by the companion, the refinery, and the games. No layer re-implements another's core.

14. Security Posture

The system's trust model is verify the signature, never the fact; fail closed when unsure. Post-quantum readiness is first-class: key establishment uses ML-KEM(mlkem), and credential/attestation checks use Ed25519with a canonical-S malleability guard. Content is self-certifying — CIDs are SHA-256 over the bytes (ipfs), so an artifact is its own name.

Two adversarial red-team gates have been run against the tree, each as a multi-agent workflow of independent finders followed by skeptics who tried to refute every finding, with a frozen regression test per confirmed fix:

• Kernel-layer gate (commit 953e3ae): 20 raised, 19 confirmed and fixed, 1 refuted. Included a CRITICAL out-of-bounds in the cellular-multikernel discovery path, signed-shift UB in the fixed-point core that runs on the real target, an unauthenticated filesystem-journal write-what-where, and Ed25519 S-malleability. The untrusted-input surfaces built to be "safe by construction" (zca, refinery) raised zerofindings.
• Economy-layer gate (commit 15f5455): 12 confirmed and fixed. The CRITICAL was a logistics escrow that released funds and minted reputation on a bare caller-set confirmed boolean; it now requires a bound Ed25519 delivery verifier, contract-party membership, and a goods witness, and fails closed otherwise. Three HIGH findings closed a voucher double-redeem, a unilateral quarantine (one reporter could quarantine anyone — now real distinct-reporter consensus is required), and a soc_sort shadowban (synthesised reports — removed). A subtle MEDIUM hardened the One Policy so its unilateral-extraction check fires on the modeled values regardless of the attacker-controlled reciprocal flag; another closed a money-round-trip mint on the exchange (BR_ERR_NO_RAIL).

The guards from both gates are load-bearing and are never to be removed; their regressions live in the per-module test_*.c and run under -fsanitize=address,undefined in the host build.

15. Build, Boot & Cross-Compilation

• Host verification. make verify-all (from kernel/) compiles and runs every module's host test under -std=c11 -Wall -Werror -Wextra -DTEST_HOST -fsanitize=address,undefined, asserting against external anchors. Current: 3593 checks, 0 failures.
• Freestanding target. make -f build_system/Makefile.arm64 all builds the AArch64 image with clang --target=aarch64-none-elf -ffreestanding -fno-stack-protector -mgeneral-regs-only -nostdlib, libc symbols redirected to freestanding shims. Boot under qemu-system-aarch64 -M virt,gic-version=3 -cpu cortex-a53 reaches [E0105] BOOT_OK with the platform layer (8/8) and the economy foundation (5/5) self-checking at boot.
• Five-target cross-compile. build_system/ carries per-arch Makefiles and Dockerfiles for arm64, x86_64, riscv, riscv32, arm32. preflight_all_targets.sh compile-checks all five (currently CLEAN). AArch64 is the full-featured, boot-verified target; the others are bring-up/preflight targets, with the economy layer available as a two-line opt-in via build_system/economy_layer.mk. The server pipeline (server_full_build.sh, provision_server.sh, docker_build_server.sh, turnkey.sh) drives the real cross-toolchains; SERVER_HANDOVER.md + handover.json are the machine- and human-readable handoff.

16. Provenance & Licensing

Every source file carries a two-line SPDX header binding four instruments that travel together: the Open Piracy License 1.1, CC BY-SA 4.0, the Royal Writ of the Sicilian Crown 1.0, and SEL-3.3 — a copyleft, attribution-required, share-alike bundle enforced by a linker invariant (license_travels_together). The commercial dual-license funnel and gratuity wallets live only in README.md / FUNDING.yml, deliberately outside the license text.