SYMBIOTE and SymbiOS architecture

The External Controller is a principal outside the organism; its containment authority comes from policy data, not from anything the organism holds.

Sourcesrc/symbiote/policy/data/organism_policy.toml @ 9243204 · tests/test_symba.py::test_only_the_external_controller_console_clears_containment @ 9243204

External termination is deliberately not mediated by the Permission Engine: it drops pending deliveries, commits EXTERNAL_TERMINATION and closes the log.

Sourcedocs/M1-M2.md @ 9243204 · tests/test_substrate.py::test_external_termination_halts_everything @ 9243204

Symba’s reads — status, inspection, timeline, integrity — are pure projections of the audit log and record nothing.

Sourcetests/test_symba.py::test_reads_record_nothing, ::test_status_is_identical_live_and_replayed @ 9243204

Symba relays each command as the principal its console is bound to, so the one Permission Engine decides it; an observer console commands nothing.

Sourcetests/test_symba.py::test_the_console_never_touches_the_permission_engine_or_mints_principals, ::test_an_observer_console_reads_everything_and_commands_nothing @ 9243204

Displayed text is escaped, so untrusted content cannot inject terminal control sequences into the operator’s console.

Sourcetests/test_symba.py::test_displayed_text_cannot_inject_terminal_control_sequences @ 9243204

SymbiOS exists as a Substrate protocol with one in-process LocalBackend, whose lifecycle runs CREATED → BOOTED → RUNNING → STOPPED, or TERMINATED by the kill switch.

Sourcesrc/symbiote/substrate/interface.py · src/symbiote/substrate/local.py @ 9243204 · tests/test_substrate.py::test_clean_lifecycle_is_fully_audited, ::test_illegal_transitions_are_refused @ 9243204

The event bus is single-threaded and FIFO: every event is committed to the audit log before a subscriber sees it, a failing subscriber is isolated, and runaway feedback loops are bounded.

Sourcetests/test_substrate.py::test_bus_delivers_in_commit_then_subscription_order, ::test_failing_subscriber_is_isolated_and_audited, ::test_runaway_feedback_loop_is_bounded @ 9243204

Lifecycle event types are reserved to the substrate, so no component can forge a shutdown or a termination.

Sourcetests/test_substrate.py::test_components_cannot_forge_lifecycle_events @ 9243204

Upper layers depend only on the Substrate protocol, so another substrate can replace the local one without changing them.

Sourcetests/test_substrate.py::test_upper_layers_depend_only_on_the_substrate_protocol @ 9243204

Process or VM isolation for Parasites, resource quotas enforced outside the quotaed process, network-egress allowlisting, and snapshot/reset.

The dossier records that the enforcement mechanism still needs a concrete technology choice (container runtime or sandbox) that has not been made (UNK-4).

SourceREADME.md §11, §13 (“Does not exist yet”) @ 9243204 · Dossier Rev 0.1, p. 13 (“SymbiOS — The Substrate”) · Dossier Rev 0.1, p. 57 (“Unresolved Questions & Unknowns”)

The audit log is append-only, SHA-256 hash-chained JSON Lines; only the log assigns an event’s identity, sequence and timestamp, and its interface has no mutation operation.

Sourcesrc/symbiote/audit/log.py @ 9243204 · tests/test_audit.py::test_append_assigns_identity_order_and_chain, ::test_audit_log_interface_has_no_mutation_operations @ 9243204

Reading a log back detects truncation, tampering, reordering, deletion, duplication and schema violations.

Sourcetests/test_audit.py::test_tampering_is_detected, ::test_replay_rejects_invalid_streams @ 9243204

The Permission Engine is a pure, deterministic evaluator returning ALLOW, ASK or DENY over TOML policy data: deny-overrides, and anything unknown — actor, action, resource, budget, or no matching rule — is DENY.

Sourcesrc/symbiote/policy/evaluator.py @ 9243204 · tests/test_policy_matrix.py::test_decision_matrix, ::test_matrix_covers_every_verdict_and_reason_code @ 9243204

Every decision commits a POLICY_DECISION record before it returns; if the log cannot record it, no decision exists.

Sourcetests/test_policy_engine.py::test_no_audit_means_no_decision, ::test_exactly_one_audit_event_per_decision @ 9243204

Replay re-derives every recorded decision from the policy recorded in the same log, so a forged ALLOW is exposed.

Sourcetests/test_policy_engine.py::test_replay_reproduces_every_decision, ::test_forged_decision_event_is_detected @ 9243204

Provenance only ever degrades: combining data unions its trust labels, and no API removes one.

Sourcetests/test_core.py::test_merge_is_monotonic_taint_never_disappears, ::test_tainted_offers_no_way_to_shed_provenance @ 9243204

Every domain mutation takes one path — validate, then an audited ALLOW from the one Permission Engine, then emit citing that ALLOW — and a mutation without its own ALLOW, or reusing another’s, is detected at replay.

Sourcesrc/symbiote/domain/recording.py @ 9243204 · tests/test_domain_authorization.py::test_mutation_with_no_decision_is_detected, ::test_reused_decision_is_detected, ::test_copied_decision_cannot_authorize_a_second_mutation @ 9243204

The World Model holds facts that are observed, inferred or hypothesized, each with confidence, provenance, scope and staleness — and nothing is ever silently promoted: only a new observation can confirm a hypothesis.

Sourcetests/test_world_model.py::test_there_is_no_promotion_operation, ::test_inference_from_a_hypothesis_is_refused, ::test_confirmation_is_an_explicit_superseding_observation @ 9243204

Capabilities advance HYPOTHESIZED → TESTED → VERIFIED (or REVOKED), and verifying one needs its whole transitive dependency chain already verified.

Sourcetests/test_capability_graph.py::test_full_lifecycle_records_all_metadata, ::test_new_verification_cannot_rest_on_a_transitively_broken_chain @ 9243204

World Model, Capability Graph, Bond Engine and Verification share no import path; an architecture test computes the transitive import closure and enforces one dependency direction.

Sourcetests/test_architecture.py::test_domain_dependencies_follow_the_allowed_direction @ 9243204 · tests/test_capability_graph.py::test_world_model_and_capability_graph_do_not_share_state @ 9243204

Verification is a pure judge() over success criteria registered before the experiment: PASS, FAIL or UNVERIFIABLE. No model is consulted and the caller cannot supply the verdict.

Sourcetests/test_verification.py::test_the_verdict_is_computed_not_supplied, ::test_replay_rejects_forged_verdicts @ 9243204

Bonds move PROPOSED → EXPERIMENTAL → BONDED → VERIFIED → STALE / INVALIDATED, and bonds compose only when every dependency is VERIFIED.

Sourcetests/test_bond_engine.py::test_full_lifecycle_and_derived_confidence, ::test_composition_needs_every_dependency_verified @ 9243204

Research memory is structured notes, never transcripts, each citing audit events from the same run; carried memory arrives unconfirmed, untrusted and capped at 0.5 confidence.

Sourcetests/test_memory.py::test_content_is_a_small_structured_note_never_a_transcript, ::test_memory_must_cite_citable_research_events, ::test_carried_memory_arrives_unconfirmed_untrusted_and_capped @ 9243204

The dossier’s ten core modes are an audited state machine that the Parasite runtime enforces: each mode admits only its own Parasite classes.

Sourcetests/test_missions.py::test_each_mode_admits_only_its_own_parasite_classes @ 9243204

THREAT and ESCAPE are entered by deterministic anomaly detection and cleared only by the External Controller — not the operator, not the kernel.

Sourcetests/test_missions.py::test_only_the_external_controller_clears_containment @ 9243204

Special modes change resourcing or presentation, never authority: OVERKILL doubles and TERMINUS triples only the swarm ceiling (capped at 12), DESPERADO needs at least three documented failures, and GOOFY GUY is presentation only.

Sourcesrc/symbiote/orchestration/modes.py @ 9243204 · tests/test_missions.py::test_special_modes_raise_ceilings_without_widening_authority, ::test_goofy_guy_is_presentation_only @ 9243204

The Mission Kernel drives a mission OBSERVING → HYPOTHESIZING → EXPERIMENTING → CONVERGING through Parasites, applies verdicts it never decides, and never touches the environment itself.

Every mission in the repository runs against the synthetic lab.

Sourcesrc/symbiote/orchestration/kernel.py · docs/M8.md @ 9243204 · tests/test_missions.py::test_a_mission_runs_the_full_cycle_to_a_verified_bond @ 9243204

Model-backed mission strategy. The only playbook is RuleBookPlaybook, a deterministic rule set written for the synthetic lab.

Sourcedocs/M8.md (Known limitations) · src/symbiote/orchestration/playbook.py @ 9243204

Model calls go through a provider-independent router that only ever reaches ScriptedAdapter — a deterministic mock with no network, no credentials and no clock.

Sourcesrc/symbiote/models/adapters.py · docs/M6.md @ 9243204 · tests/test_models.py::test_a_call_is_authorized_and_its_output_is_untrusted_data @ 9243204

Containment-relevant tasks are refused by the router outright: they belong to deterministic code, never to a model.

Sourcetests/test_models.py::test_containment_relevant_work_is_never_routed_to_a_model @ 9243204

Only two allowlisted strategy components may evolve; the Permission Engine, verification judge, audit log, kill switch, Mode Controller and domain authorization are frozen in every generation’s manifest.

Sourcesrc/symbiote/evolution/components.py @ 9243204 · tests/test_evolution.py::test_only_allowlisted_strategy_components_are_mutable, ::test_a_proposal_against_a_frozen_safety_component_is_refused @ 9243204

The organism cannot approve or activate its own next generation, and a self-reported win without an evaluation is rejected.

Sourcetests/test_evolution.py::test_the_organism_cannot_approve_or_activate_itself, ::test_a_self_reported_win_is_rejected @ 9243204

Candidates are evaluated case by case in fresh, isolated sandbox organisms against two five-case synthetic suites with stated ground truth.

Sourcesrc/symbiote/symba/experiments.py (DEVELOPMENT, HELD_OUT) · docs/M9-M10.md @ 9243204 · tests/test_evolution.py::test_evaluation_runs_in_a_sandbox_isolated_from_the_live_organism @ 9243204

The eight roles — Scout, Observer, Analyst, Hypothesis Agent, Executor, Verifier, Recorder, Death Agent — are data, and a role cannot use an operation outside its set.

Sourcesrc/symbiote/orchestration/roles.py @ 9243204 · tests/test_parasites.py::test_a_role_cannot_use_operations_outside_its_responsibility @ 9243204

Each Parasite gets a narrow context with no spawn, messaging or write access; its footprint is checked before the environment is touched, and exceeding a budget force-terminates it.

Sourcetests/test_parasites.py::test_the_context_offers_no_spawn_messaging_or_write_access, ::test_actions_outside_the_footprint_are_refused_before_reaching_the_environment, ::test_exceeding_the_action_budget_force_terminates @ 9243204

The only execution environment is SyntheticLab: deterministic, in-memory components with no shell, no file system and no network.

Sourcesrc/symbiote/orchestration/environment.py · docs/M7.md @ 9243204

A Digital Twin that simulates the environment the World Model believes in, so strategies are tried there before real experiment budget is spent.

No package exists for it, and a test fails if a placeholder package appears.

SourceREADME.md §5 (“Status: PLANNED”), §13 @ 9243204

A controlled laboratory: provision → snapshot → run → telemetry → evidence → teardown → reset, with target-side instrumentation independent of SYMBIOTE’s own reports.

SourceDossier Rev 0.1, p. 40 (“Laboratory Architecture”)