statecraft.
Catalog/rahi

015-kernel-manifest-and-adjudication

The kernel: a declared capability ceiling, verified at build, enforced at runtime, denials ledgered

Lifecycle approvedImplementation completeVerification unknownQualification unknown

The governance seam. An app declares a manifest (TOML, embedded at compile time): identity, services, resources by name, a capability catalog, per service grants, the gate roster, ledger and observability policy. The kernel canonicalizes and hashes it, verifies at build that every governed facade the app links is covered by a grant, adjudicates every store, lock, notify, secret, and egress operation at runtime through the action-gate primitive, denies anything not granted, and appends a Decision for every denial without the request path awaiting the ledger. Carries enrahitu://020 and enrahitu://021 with the parser-based extractor replaced by a declared manifest.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/Cargo.toml"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/src/lib.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/src/manifest.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/src/capability.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/src/verify.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/src/adjudicate.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/src/facade.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/src/observe.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/tests/manifest.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/tests/adjudicate.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-kernel/testdata/manifests/"
}
  • extends
    {
  "nature": "additive",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "anchor": "workspace.dependencies",
    "file": "Cargo.toml",
    "kind": "section"
  }
}
  • constrains
    {
  "flavor": "invariant-freeze",
  "note": "deny by default; constitution X",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-kernel/src/adjudicate.rs"
  }
}

Source headings

  1. 015: The kernel
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. Verification

Frozen anchors

No frozen anchors declared.