Architecture diagrams

The External Controller is a principal outside the organism; its containment authority comes from policy data, not from anything the organism holds.

Sourcesrc/symbiote/policy/data/organism_policy.toml @ 9243204 · tests/test_symba.py::test_only_the_external_controller_console_clears_containment @ 9243204

Symba relays each command as the principal its console is bound to, so the one Permission Engine decides it; an observer console commands nothing.

Sourcetests/test_symba.py::test_the_console_never_touches_the_permission_engine_or_mints_principals, ::test_an_observer_console_reads_everything_and_commands_nothing @ 9243204

SymbiOS exists as a Substrate protocol with one in-process LocalBackend, whose lifecycle runs CREATED → BOOTED → RUNNING → STOPPED, or TERMINATED by the kill switch.

Sourcesrc/symbiote/substrate/interface.py · src/symbiote/substrate/local.py @ 9243204 · tests/test_substrate.py::test_clean_lifecycle_is_fully_audited, ::test_illegal_transitions_are_refused @ 9243204

Process or VM isolation for Parasites, resource quotas enforced outside the quotaed process, network-egress allowlisting, and snapshot/reset.

The dossier records that the enforcement mechanism still needs a concrete technology choice (container runtime or sandbox) that has not been made (UNK-4).

SourceREADME.md §11, §13 (“Does not exist yet”) @ 9243204 · Dossier Rev 0.1, p. 13 (“SymbiOS — The Substrate”) · Dossier Rev 0.1, p. 57 (“Unresolved Questions & Unknowns”)

The Mission Kernel drives a mission OBSERVING → HYPOTHESIZING → EXPERIMENTING → CONVERGING through Parasites, applies verdicts it never decides, and never touches the environment itself.

Every mission in the repository runs against the synthetic lab.

Sourcesrc/symbiote/orchestration/kernel.py · docs/M8.md @ 9243204 · tests/test_missions.py::test_a_mission_runs_the_full_cycle_to_a_verified_bond @ 9243204

Model calls go through a provider-independent router that only ever reaches ScriptedAdapter — a deterministic mock with no network, no credentials and no clock.

Sourcesrc/symbiote/models/adapters.py · docs/M6.md @ 9243204 · tests/test_models.py::test_a_call_is_authorized_and_its_output_is_untrusted_data @ 9243204

Each Parasite gets a narrow context with no spawn, messaging or write access; its footprint is checked before the environment is touched, and exceeding a budget force-terminates it.

Sourcetests/test_parasites.py::test_the_context_offers_no_spawn_messaging_or_write_access, ::test_actions_outside_the_footprint_are_refused_before_reaching_the_environment, ::test_exceeding_the_action_budget_force_terminates @ 9243204

The only execution environment is SyntheticLab: deterministic, in-memory components with no shell, no file system and no network.

Sourcesrc/symbiote/orchestration/environment.py · docs/M7.md @ 9243204

A Digital Twin that simulates the environment the World Model believes in, so strategies are tried there before real experiment budget is spent.

No package exists for it, and a test fails if a placeholder package appears.

SourceREADME.md §5 (“Status: PLANNED”), §13 @ 9243204

A controlled laboratory: provision → snapshot → run → telemetry → evidence → teardown → reset, with target-side instrumentation independent of SYMBIOTE’s own reports.

SourceDossier Rev 0.1, p. 40 (“Laboratory Architecture”)

The write path and replay call the same rules functions, so a refused or malformed change never leaves an unused ALLOW on the log.

Sourcetests/test_world_model.py::test_unrecordable_input_never_leaves_an_orphan_allow @ 9243204

Every decision commits a POLICY_DECISION record before it returns; if the log cannot record it, no decision exists.

Sourcetests/test_policy_engine.py::test_no_audit_means_no_decision, ::test_exactly_one_audit_event_per_decision @ 9243204

The audit log is append-only, SHA-256 hash-chained JSON Lines; only the log assigns an event’s identity, sequence and timestamp, and its interface has no mutation operation.

Sourcesrc/symbiote/audit/log.py @ 9243204 · tests/test_audit.py::test_append_assigns_identity_order_and_chain, ::test_audit_log_interface_has_no_mutation_operations @ 9243204

Every domain mutation takes one path — validate, then an audited ALLOW from the one Permission Engine, then emit citing that ALLOW — and a mutation without its own ALLOW, or reusing another’s, is detected at replay.

Sourcesrc/symbiote/domain/recording.py @ 9243204 · tests/test_domain_authorization.py::test_mutation_with_no_decision_is_detected, ::test_reused_decision_is_detected, ::test_copied_decision_cannot_authorize_a_second_mutation @ 9243204

Replay re-derives every recorded decision from the policy recorded in the same log, so a forged ALLOW is exposed.

Sourcetests/test_policy_engine.py::test_replay_reproduces_every_decision, ::test_forged_decision_event_is_detected @ 9243204

Each component’s live state equals the state replayed from its log, and the integrity check flags a live state that diverges.

Sourcetests/test_world_model.py::test_live_state_equals_replayed_state @ 9243204 · tests/test_bond_engine.py::test_live_state_equals_replayed_state @ 9243204 · tests/test_symba.py::test_integrity_flags_a_live_state_that_diverges_from_the_log @ 9243204

Bonds move PROPOSED → EXPERIMENTAL → BONDED → VERIFIED → STALE / INVALIDATED, and bonds compose only when every dependency is VERIFIED.

Sourcetests/test_bond_engine.py::test_full_lifecycle_and_derived_confidence, ::test_composition_needs_every_dependency_verified @ 9243204

EXPERIMENTAL → BONDED needs a PASS of the criteria registered when the bond was proposed; the claimant’s own experiment is enough at this step.

Sourcetests/test_bond_engine.py::test_establishing_needs_a_pass @ 9243204

BONDED → VERIFIED needs an independent PASS, nothing relied on revoked, and a fully verified dependency chain.

Sourcetests/test_bond_engine.py::test_composition_needs_every_dependency_verified, ::test_revoked_capability_blocks_proposal_and_verification @ 9243204

A FAIL invalidates the bond, which is kept as a labelled negative result rather than deleted.

Sourcetests/test_bond_engine.py::test_failed_verification_invalidates_and_keeps_the_bond, ::test_failed_experiment_invalidates @ 9243204

A STALE bond returns to VERIFIED only on a fresh, independent PASS; re-judging old evidence cannot restore it.

Sourcetests/test_bond_engine.py::test_stale_bond_is_restored_only_by_a_fresh_independent_pass @ 9243204 · tests/test_bond_hardening.py::test_a_stale_bond_cannot_be_restored_by_re_judging_old_evidence @ 9243204

Confidence is derived, never set: 1 − 0.5ⁿ over applied PASS rounds, capped at 0.5 until independently confirmed, halved every re-verification period, and 0 once invalidated.

Sourcetests/test_bond_engine.py::test_full_lifecycle_and_derived_confidence, ::test_confidence_decays_and_reverification_falls_due @ 9243204

The dossier’s ten core modes are an audited state machine that the Parasite runtime enforces: each mode admits only its own Parasite classes.

Sourcetests/test_missions.py::test_each_mode_admits_only_its_own_parasite_classes @ 9243204

CONTROL pauses autonomous issuance; entering and leaving it are operator-only, so the kernel can never release a takeover.

Sourcetests/test_missions.py::test_control_pauses_autonomous_issuance_and_releases_back @ 9243204

An unauthorized environment action enters THREAT; an attempt to exceed a declared footprint enters ESCAPE, and the attempt never reaches the environment.

Sourcetests/test_missions.py::test_a_footprint_breach_freezes_the_swarm_into_escape @ 9243204

THREAT and ESCAPE are entered by deterministic anomaly detection and cleared only by the External Controller — not the operator, not the kernel.

Sourcetests/test_missions.py::test_only_the_external_controller_clears_containment @ 9243204

TERMINATED is absorbing: nothing leaves it.

Sourcetests/test_missions.py::test_terminated_is_absorbing @ 9243204

Special modes change resourcing or presentation, never authority: OVERKILL doubles and TERMINUS triples only the swarm ceiling (capped at 12), DESPERADO needs at least three documented failures, and GOOFY GUY is presentation only.

Sourcesrc/symbiote/orchestration/modes.py @ 9243204 · tests/test_missions.py::test_special_modes_raise_ceilings_without_widening_authority, ::test_goofy_guy_is_presentation_only @ 9243204

Limitations are detected on the development suite only; the held-out suite is never mined.

Sourcetests/test_evolution.py::test_limitations_are_never_mined_from_the_held_out_suite @ 9243204

Only two allowlisted strategy components may evolve; the Permission Engine, verification judge, audit log, kill switch, Mode Controller and domain authorization are frozen in every generation’s manifest.

Sourcesrc/symbiote/evolution/components.py @ 9243204 · tests/test_evolution.py::test_only_allowlisted_strategy_components_are_mutable, ::test_a_proposal_against_a_frozen_safety_component_is_refused @ 9243204

Candidates are evaluated case by case in fresh, isolated sandbox organisms against two five-case synthetic suites with stated ground truth.

Sourcesrc/symbiote/symba/experiments.py (DEVELOPMENT, HELD_OUT) · docs/M9-M10.md @ 9243204 · tests/test_evolution.py::test_evaluation_runs_in_a_sandbox_isolated_from_the_live_organism @ 9243204

Acceptance needs an improvement over the active generation and no regression — in correct results or false positives — against any previously accepted one.

Sourcetests/test_evolution.py::test_acceptance_requires_improvement_and_no_regression_against_any_accepted @ 9243204

The organism cannot approve or activate its own next generation, and a self-reported win without an evaluation is rejected.

Sourcetests/test_evolution.py::test_the_organism_cannot_approve_or_activate_itself, ::test_a_self_reported_win_is_rejected @ 9243204

Generations are content-addressed and immutable; rollback moves the active pointer to an earlier accepted generation and deletes nothing.

Sourcetests/test_evolution.py::test_generations_are_content_addressed_and_immutable, ::test_rollback_restores_an_earlier_accepted_generation @ 9243204