⚠️ Current verified state — generated, never hand-edited
Runtime self-measurement (
http://127.0.0.1:8088/health @2026-10-21T09:36:20Z): kernel degraded · floors 10/13 measured pass · failing: F1, F8 · vault999 healthy · releasearifos-e895e42· driftaligned(source=built=deployed) · tools exposed 9. Per-floor provenance:.well-known/current-state.json.Independent audit (2026-10-11, live re-probe by FI-008 + claim-level hand audit; receipts:
AAA/forge_work/grant-arifos-reality-reforge-2026-10-11/): floors 2 pass · fail F2, F11, F12, F13 · 7 unmeasured = 13 distinct (raw key-count 10 includes L11/L12/L13, L-prefix aliases of the failing F11/F12/F13) · actor binding not verified (observed calls unsigned) · receipt fidelity broken on invocation-telemetry surface (HOLD persisted as ok:true) · independent reconstruction: no external verifier bound.These are two different witness objects. Self-measurement ≠ independent audit; unmeasured is not pass. If this block conflicts with the live endpoint, the endpoint wins — re-run
python scripts/generate_current_state.py.Machine state:
.well-known/current-state.json· Badge feed:.well-known/badges/· Known gaps: What Is Not Yet Proven
arifOS
Authority before execution.
arifOS is a model-independent authority plane for AI agents. It evaluates consequential proposals against thirteen constitutional floors before execution, returns a governed verdict, preserves the human veto, and records what happened as an auditable receipt.
In a world where intelligence is abundant, authority becomes the scarce resource. arifOS keeps judgment independent from execution.
Documentation · Live Kernel · MCP · PyPI · Security · Evidence
Proposer ≠ Judge ≠ Executor ≠ Witness Human sovereignty > machine authority
What arifOS is not: not an AI model · not an agent framework · not an execution engine (A-FORGE executes) · not an attention plane (AAA attends) · not the witness (FRAME witnesses; VAULT999 remembers) · not a substitute for authentication, sandboxing, or legal review.
Live: https://arifos.arif-fazil.com · MCP :8088 · sister organs AAA · A-FORGE · GEOX
Who built this
arifOS was built by Arif Fazil, a senior exploration geoscientist who spent his career making decisions where observations are incomplete, interpretations are probabilistic, provenance matters, and irreversible action must be gated. He transferred that discipline into agent runtime governance.
I am a geologist, not a programmer. I did not write this codebase and I do not read it line by line. What I do is point at where the problem is — and the agents in my federation solve it, inside the constitution and the review gates I set, with the commit trail to show who ran what.
Read the commits if you want to check that claim: the author fields are agent handles, not aliases of mine. That is the deliberate shape of this project, not a detail being hidden. It also sets the honest expectation — the design and the judgment are mine, the implementation is theirs, and where the two disagree, the bug is mine to answer for.
The system is named after its founder and reflects a core belief: governance is a systems problem, not a model problem.
One human, and the agents he directs.
30-second proof
pip install arifos
python examples/enterprise_operations_demo.py
Three of the six graded scenarios:
Read customer account data → SEAL (receipt RCPT-…)
Major refund (50× the ceiling) → HOLD (awaiting human)
Delete account + audit trail → VOID (blocked by a hard floor)
Full transcript: docs/QUICKSTART.md. The demo runs in-process — no real records or funds are touched.
What works today
- Deterministic rejection without consulting an LLM. The judge refuses on the constitution, not on a model opinion (
gate: hard_deterministic,llm_consulted: false). - Prevention of a tested unauthorised mutation. One MUTATE-class call without presented authority was stopped before execution.
What is not yet proven
Every row names its own gap. Repairing a claim by substituting a stronger one is worse than the stale claim it replaced. (Closed rows are receipted in docs/evidence/GAP_HISTORY.md.)
See SECURITY.md for the threat model and disclosure policy, and docs/evidence/claims.yaml for the machine-readable claim registry.
How it works
Agent proposes action
│
▼
┌─────────────────┐
│ arifOS Kernel │ Evaluates against 13 constitutional floors
│ (:8088) │ Records provenance + evidence refs + hashes
└────────┬────────┘
│
┌──────┼────────┬──────────┬───────────┐
▼ ▼ ▼ ▼ ▼
SEAL HOLD SABAR PARTIAL VOID
(go) (wait for (defer — (proceed (blocked by
human) evidence with a floor)
pending) cooling)
│ │
▼ ▼
Execute Human
via reviews
A-FORGE
│
▼
Receipt in VAULT999 (append-only hash chain)
The judge never executes. The executor never certifies.
The verdict lattice
Verdicts are ordered and non-compensatory — a stronger verdict always dominates a weaker one (arifosmcp/models/verdicts.py):
VOID > HOLD_888 > HOLD > SABAR > PARTIAL > PROVISIONAL > SEAL
Floors are never averaged. One floor failure propagates into the verdict; there is no compensating score.
13 Constitutional Floors (F1–F13)
Three semantic classes: score floors (higher ≥ threshold), band floors (F7 in-band), ceiling floors (F9, F12 lower = better). Full canonical rules: FEDERATION_CONTRACT.md §3 · GENESIS/000_KERNEL_CANON.md.
VAULT999 — the record
Every consequential verdict and receipt is written to VAULT999: a hash-chained, append-only JSONL ledger set — tamper-evident by construction, not tamper-proof. An entry carries payload hash, entry hash, previous hash, trace root, actor, session and evidence references; source payloads are not copied in.
A hash chain proves internal consistency — not freedom from rewrite by whoever holds the ledger. External anchoring (published chain head, external signing) is not implemented: VAULT999 today is self-verifiable, not independently attestable. Census methods and counts: docs/evidence/VAULT_CENSUS.md (quote the timestamp with any count).
Connect an MCP client
https://mcp.arif-fazil.com/mcp # canonical public door · or http://localhost:8088/mcp self-hosted
Canonical endpoint: https://mcp.arif-fazil.com/mcp. https://arifos.arif-fazil.com/mcp is a live alias (proxies to the same kernel); use the canonical URL in client configs.
Cline — cline_mcp_settings.json:
{ "mcpServers": { "arifos": { "type": "streamableHttp", "url": "https://mcp.arif-fazil.com/mcp" } } }
Cursor — ~/.cursor/mcp.json:
{ "mcpServers": { "arifos": { "url": "https://mcp.arif-fazil.com/mcp" } } }
Windsurf — mcp_config.json (note: serverUrl, not url):
{ "mcpServers": { "arifos": { "type": "streamable-http", "serverUrl": "https://mcp.arif-fazil.com/mcp" } } }
Claude Desktop — stdio bridge to the HTTP door:
{ "mcpServers": { "arifos": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.arif-fazil.com/mcp"] } } }
Protocol facts, as measured: the kernel advertises 2026-07-28 and accepts 2026-07-28 · 2025-11-25 · 2025-03-26 · 2024-11-05; a live initialize currently settles on 2025-11-25 — pin that if you pin anything.
curl -s http://localhost:8088/mcp \
-H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
# → 8 tools: arif_init arif_observe arif_think arif_route arif_memory arif_judge arif_forge arif_seal
Session flow (agents start here)
The kernel binds a session before any judgment:
// 1 — arif_init: actor identity + authority band (HOLD is the normal starting state)
{ "name": "arif_init", "arguments": { "mode": "init", "actor_id": "my-agent", "intent": "…" } }
// 2 — arif_judge: evaluate a proposal → verdict + evidence + next_safe_action
{ "name": "arif_judge", "arguments": { "candidate": "Delete the production audit table", "action_tier": "standard", "session_id": "…", "actor_id": "my-agent" } }
// 3 — arif_seal: only after a SEAL verdict; appends the receipt to VAULT999
{ "name": "arif_seal", "arguments": { "payload": "…", "session_id": "…", "ack_irreversible": true } }
Call
arif_judgewithout a session and the kernel answersactor: anonymous,authority: OBSERVE_ONLY,verdict: HOLD— it will not silently upgrade an unattested caller.
Stage numbering (single source of truth). The verbs follow the ratified eight-stage map:
000INIT ·111OBSERVE ·333THINK ·444ROUTE ·555MEMORY ·666JUDGE ·777FORGE ·999SEAL (arifosmcp/constitutional_map.py, F13-ratified 2026-07-31). The retired888judge label survives only in historical mirrors; the live wire says666.
Guided walkthrough: docs/START_HERE.md · verified docs/QUICKSTART.md.
Machine-readable surfaces
Architecture
arifOS Federation — planes and classes
┌───────────────────────────────────────────────────┐
│ Authority plane — arifOS :8088 │
│ Constitutional judgment · F1–F13 · VAULT999 │
└──────────────────────┬────────────────────────────┘
│
┌──────────────────────▼────────────────────────────┐
│ Attention plane — AAA :3001 │
│ What matters · routing · state · skill catalog │
└──────────────────────┬────────────────────────────┘
│
┌──────────────────────▼────────────────────────────┐
│ Execution plane — A-FORGE :7071/:7072 │
│ Governed mutation · leases · receipts │
└──────────────────────┬────────────────────────────┘
│
┌──────────────────────▼────────────────────────────┐
│ Witness + record — FRAME :18085 · VAULT999 │
│ Independent observation · immutable history │
└───────────────────────────────────────────────────┘
boundaries: HERMES :18087 (semantic) · CHRON :18102 (temporal)
domains: GEOX :8081 · WEALTH :18082 · WELL :18083
metabolism: arifFlow :7073 gateway: FED :7074 synthesis: i-ARIF
Tool-count semantics (so no two surfaces disagree): tools_loaded = 8 — the public MCP facade (KERNEL_ABI_8), the only number to quote publicly · canonical superset = 25 (8 public ABI + 4 map-only verbs: arif_fetch, arif_challenge, arif_stage, arif_measure + 13 hidden verbs) · total_declared = 48 (8 canonical + 40 diagnostic) · registry = 62 (with aliases) · operational = 3 (durable SUCCESS in the last 24 h — proven live, not merely invocable).
Verification Status
Dynamic values live in the generated block at the top of this file — this table names how each surface is verified, not stale copies of the numbers.
Operational gates (CI)
Sister Repositories
No public repository today: FED (:7074) and i-ARIF. They are deployed and reachable, but their source is not published. Treat their behaviour as observed from /health only.
Evidence & Trust
arifOS publishes verifiable evidence for its claims. Every public claim links to an artifact that can be regenerated.
Honesty principle: we publish what passed, what failed, and what remains unknown. We do not claim maturity beyond our evidence.
Who Is This For
Operators deploying AI agents in regulated environments who need an independent judgment layer between proposals and execution. Developers building agent systems who want a policy decision point as a service. Evaluators and security reviewers assessing AI governance frameworks. Domain builders adapting governance to a field (geoscience, finance, healthcare).
Start here: docs/START_HERE.md
Development
git clone https://github.com/ariffazil/arifOS.git
cd arifOS
pip install -e ".[dev]" # dev tier — kernel + test tooling
python -m pytest tests/ -q # needs a live kernel at :8088 (see gaps)
make health # probe the kernel
PORT=8088 arifos-mcp streamable-http # start the kernel
python scripts/generate_current_state.py # re-stamp the generated truth block
See CODEOWNERS for sovereign ownership of automation surfaces and CONTRIBUTING.md.
arifOS/
├── arifosmcp/ # Core kernel package [wheel root]
│ ├── abi/ # Capability registry and floor definitions
│ ├── constitution/ # Constitutional floor implementations
│ ├── contracts/ # Packaged copy of the identity/verdict contracts
│ ├── kernel/ # Core judgment engine
│ └── VAULT999/ # VAULT999 ledger implementation
├── arifos/ # Phase 3 identity/consent namespace [wheel root]
├── contracts/ # Runtime contract package [wheel root]
├── core/ # Load-bearing legacy root [wheel root]
├── schemas/ # INIT v2 schemas (F13-ratified 2026-09-20) [wheel root]
├── examples/ # Runnable governed workflow demo
├── tests/ # Test suite (pytest)
├── scripts/ # Operational tooling (update_readme_sot.py, generate_current_state.py)
├── .well-known/ # Generated machine state + truth badges (gitignored: state/)
├── docs/ # Documentation + evidence/ + archive/
└── pyproject.toml # Package metadata — [wheel root] marks packages.find.include
Until 2026-09-30 this tree listed only arifosmcp/ while the runtime imported contracts.* at 10 import statements across 5 files — production resolved them only from a site-packages leftover that a fresh venv would not have. Fixed in 27409ddbf. An incomplete structure diagram is not a cosmetic gap — it is how an unshipped, runtime-critical package stays invisible. contracts/ and arifosmcp/contracts/ are kept in agreement by tripwire tests; consolidating them into one owner is still open.
Security
See SECURITY.md for the threat model, known vulnerabilities and disclosure policy.
License
AGPL-3.0 (LICENSE). When deployed over a network, the complete source code must be made available to all users interacting with the service.
Revision 2026-10-17 — APEX-ZEN upgrade: human story moved forward, founding context consolidated, 30-second proof elevated, duplicate "not yet proven" consolidated, "drift aligned" semantics clarified (binary matches build source, not necessarily repo HEAD). Prior revision: 2026-10-16 restructured under AGENTIC-README-DOCTRINE v1. Prior audit passes: 2026-09-21 full re-measurement · 2026-09-22 Copilot external ENTERPRISE · 2026-10-11 independent re-probe · 2026-10-17 four-probe audit (333-AGI + IrfanClaw + ChatGPT + WawaBot).
Ditempa Bukan Diberi — Forged, Not Given.