Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content
A kernel/host framework

The kernel cannot touch the world.
The host cannot decide anything.

A total, synchronous update over a Model. Effects as Cmd data, never as calls. Hosts that perform them through declared ports — and gates that refuse the shape when it drifts back.

Read the introduction
   action ──▶ kernel.update(model, msg) ──▶ [model', Cmd[]]
                                                  │
                                       dispatcher records, then drains
                                                  │
                                    host.performNow(cmd) ─▶ ports

An effect that goes nowhere says so

A Cmd the host cannot route is reported — [cmd] not performed: no persist port — and the log gate fails the run. The alternative is the defect this whole shape exists to remove: a write that silently did not happen, behind a guard that asked a port whether it would work.

A decision is data, so a test can read it

{ kind: 'submit', target: { to: 'enclave', id }, encrypt: { scheme: 'sent', to, text } }. Which cipher seals a write is the kernel's decision and the host's execution — so the decision is assertable without a network, a key, or a browser.

The claim is measured, not written down

Every rule has a gate: declared ports equal supplied equal travelled; the kernel names no platform global; a conformance corpus replays through the shipping module and not a copy of it. A claim with no gate drifts within a week — measured, repeatedly.

Proven in Lean, replayed in TypeScript

The protocol rules and one app's own decisions are executable Lean with theorems checked by Lean's kernel. An oracle emits the corpus; the real code replays it. A model nothing replays is a proof about a path nobody takes.

CVN was extracted from a running messenger by moving its application runtime into this shape one borrowed method at a time, with every claim tied to code by a gate. Nothing here is a design sketch — it is what survived that.

Start here