How every part of the [&] / ComputeDriven stack fits together, and how far each part has got. Written 2026-09-24 from four read-throughs of the tree. Rungs are strict; see the ladder at the end.
WRL describes a world (objects, routes, boundaries), and sealing that world gives it a permanent address: its meaning is a hash. TRVM runs the world on the interaction calculus, where the order of steps cannot change the answer. So every run can, by design, be replayed byte-for-byte on any machine and kept as a film (so far checked on one machine at a time). Above that, a small arithmetic of governance (box-and-box: feasible ▸ permitted ▸ best) and the World Enforcement Kernel decide what is allowed to happen, and nothing gets power just by existing. Super is the desktop cockpit where a person and their bots do real work inside that discipline. Its runtime, ampd, turns every action into a grant, an approval and a receipt. Later stages keep the whole machine rather than just the files (World Cloud), and host a customer's world on rented, replaceable machines, billed only for the steps the world actually took (locu.systems). Every one of those claims carries its rung on an evidence ladder, and most of them are honestly not at the top.
The thesis in six words: Any order. Any machine. Same answer. (TRVM's tagline) The thesis in one sentence: make computation an address you can check, make authority something you are granted and never something you have, and never claim a rung you have not climbed.
flowchart TB
subgraph L5["5 · Surfaces: what people see"]
SITES["Portfolio sites<br/>computedriven.com · opensentience.org · locu.systems · graphonomous.com …"]
BOOKS["Books · Academy<br/>Unboxed Patterns + this series"]
end
subgraph L4["4 · Products & cloud: what gets sold"]
CLOUD["World Cloud<br/>keep the world, not just the files"]
LOCU["locu.systems<br/>host a locus, bill admitted steps"]
GRAPH["Graphonomous<br/>memory / evidence graph"]
WB["Workbench<br/>sessions → skill bundles"]
STUD["studbook<br/>content-addressed data layer"]
end
subgraph L3["3 · Cockpit & authority: where work happens"]
SUPER["Super (CD)<br/>desktop cockpit"]
AMPD["ampd<br/>grants · approvals · receipts"]
WEK["WEK<br/>World Enforcement Kernel"]
BOTS["Bots · Lanes"]
end
subgraph L2["2 · Governance & protocols: what is allowed"]
AMP["[&] Protocol<br/>declare capabilities"]
BOX["box-and-box<br/>8-rung ladder · 210 laws"]
PULSE["PULSE<br/>loop heartbeat"]
PRISM["PRISM<br/>measure learning"]
end
subgraph L1["1 · Substrate: what runs"]
WRL["WRL<br/>world language · meaning is a hash"]
TRVM["TRVM<br/>any order, same answer"]
TRVS["TRAAVIIS / trvs<br/>replayable test worlds"]
FLOOR["ComputeDriven floor<br/>cd-kernellet · counts admitted steps"]
end
subgraph L0["0 · Machines: where it lives"]
TR["T&R<br/>FreeBSD distro"]
RR["RRABBIT<br/>the road as a window manager"]
PARK["PARKVPS · lab<br/>cd-floor-01 · locuchest"]
end
WRL -- "sealed world (sem-…)" --> TRVM
TRVM -- "films, verifier agreement" --> TRVS
AMP -- "governance block compiles to policy" --> BOX
BOX -. "design intent" .-> WEK
WEK -- "B2 write-boundary contract + verifier" --> AMPD
SUPER <-- "frames up · intents down" --> AMPD
BOTS -- "proposals only; humans accept" --> SUPER
AMPD -- "trvm.reduce effect → receipt" --> TRVM
TRVM -- "certificates" --> GRAPH
WRL -- "sealed projection" --> GRAPH
PULSE -. "loop manifests" .-> GRAPH
PRISM -- "benchmarks" --> GRAPH
SUPER -- "world chunks direct to R2" --> CLOUD
FLOOR -- "count record per epoch" --> LOCU
STUD -. "store for the publish path" .-> BOOKS
RR -- "road surface" --> SUPER
PARK -- "runs T&R images" --> TR
CLOUD --> SITES
LOCU --> SITESSolid arrows are edges that exist in code (at some rung). Dotted arrows are design intent only.
| Part | In plain English | Rung |
|---|---|---|
| WRL (WallRiderLang) | A language for describing worlds: objects joined by routes and separated by boundaries. A world seals to a sem-… identity that comes out the same on every host. "An executable topology language whose meaning is a hash." | spec (Core 0.1.2) + in_tree playground and conformance |
| TRVM | A term-rewriting virtual machine on the interaction calculus. The order of steps can't change the answer, so by design work can split across machines with no locks and no coordinator (so far checked on one host: simulated shards, local processes, Wasm workers). The Wasm build is about 10 KB (9,999 bytes committed; the site embeds a 9,883-byte copy). Compiled backends turn a world into one C step function, accepted only if it matches the reference reducer on every sealed world. | in_tree / live_local; not externally reproduced |
| TRAAVIIS / trvs | Turns WRL worlds into replayable test environments for agents. It checks every run three ways and keeps a content-addressed film. It does not choose or run a model. | live_local (trvs verify 3/3 and replay re-run 2026-09-24); install from source, not on PyPI |
| WRLM | Proposes new worlds as text. The only statistical part of the stack. | steps 1–2 built, 3–10 paper |
ComputeDriven floor (computedriven/) | A tiny Rust scheduler (cd-kernellet, production image 4,529 B against an 8 KB gate) that decides which locus takes its next step, and counts admitted steps, not CPU time. | in_tree (size gate PASS). FCB competitive benchmark: executed, not established |
| Part | In plain English | Rung |
|---|---|---|
| [&] Protocol | One file (ampersand.json) declares what an agent can do: remember, reason, time, space, body, govern. It can be checked and compiled into MCP / A2A wiring. "MCP: agents call tools. A2A: agents call agents. [&]: capabilities compose into a coherent agent." CC1 (one agent) shipped; CC2 (coalitions) is a draft. | CC1 in_tree, CC2 spec |
| box-and-box | The governance kernel: an eight-rung ladder of small algebras (can it happen · how to rank · is it allowed · safe over time · may the rules change · do we know enough · who can ensure it · can we afford it). The bridge (govern) runs feasible ▸ permitted ▸ best over the first three rungs, and the others join through their own bridge laws: a vetoed option scores zero, and no heuristic utility, however large, can resurrect it. 210 laws are enforced and property-tested (109 kernel + 101 compose); 3 are declared open and print FALSIFIED on purpose. | in_tree; witness pages run the suites live |
| PULSE (OS-010) | The heartbeat: a manifest standard for how a loop cycles (retrieve → route → act → learn → consolidate), how loops nest, and the six signals loops send each other. | draft; MCP server v0.1 on Fly (answering 2026-09-24; Fly is slated for teardown, R96) |
| PRISM (OS-009) | The measuring stick: a benchmark that checks whether an agent's memory actually improves over time, scored on 9 continual-learning dimensions. | in development; v0.1 on Fly (answering 2026-09-24; slated for teardown, R96) |
| OS-001…OS-012 | The OpenSentience research protocols (continual learning, κ routing, deliberation, attention, model tiers, governance shim, robustness, harness, PRISM, PULSE, embodiment, SCOPE). Source of truth: opensentience.org/_rebuild/data/protocols.json. | OS-001 shipped; the rest range from spec-complete down to draft (OS-012 SCOPE is also recorded as deferred) |
Keep them apart: the 8 rungs govern one decision; PULSE's 5 phases sequence a loop over time. They are orthogonal. The kernel rules on what may happen at a phase and is not itself a phase.
| Part | In plain English | Rung |
|---|---|---|
| Super (CD) | The desktop cockpit the whole stack is built with (Tauri). It shows one live world: workspaces, goals, lanes, bots, grants, evidence. Its rule: the rendered world is a function of the last frame and of nothing else. The screen never draws its own optimism. | live_local (runs on Travis's machine, launched as a super-desktop user unit, which was absent when checked on 2026-09-24; no installer) |
| ampd | The authority runtime (Elixir/OTP). Every action goes through one door: seal → grant → placement → approval → claim → receipt. | live_local, well tested |
| WEK | The World Enforcement Kernel: a research architecture for a small reference monitor, written as models, laws, mutants and a verifier. Its first product is the B2 write boundary, the guarded path by which an approved effect may write to the world. | model in_tree (47/47 laws); B2 is in the locally installed Super build since 2026-09-19 (not in Super's main) |
| Bot | A model connection (Claude, Codex, Ollama…). A Bot does not know the world. It knows its projection of the world. Creating a Bot confers zero authority. Bots propose; humans accept. | live_local |
| Lane | One independent attack on a goal: agent + worktree + budget + placement. | live records in the app |
| Part | In plain English | Rung |
|---|---|---|
| World Cloud (ComputeDriven Cloud v1) | Keep the world, not just the files. It backs up a whole machine (a WORLD, 10 GB–10 TB) to Cloudflare R2. Restoring onto a new machine is a separate grant that can be refused. Workers decide and never carry the bytes; Postgres (Pigsty) runs on Vultr; sign-in is WorkOS. | in_tree / live_local; nothing deployed |
| locu.systems | A host for ComputeDriven loci. The customer's world is the locus; the rented machine under it is a replaceable carrier. You pay for admitted transitions, never utilization, from a prepaid balance that can never move between accounts. | spec, and on schedule (stage 3) |
| Graphonomous | Memory. v0.4 is a continual-learning knowledge graph beside a small model, served over MCP. v2 is a read-only evidence graph over the other lanes' registries: WRL describes understanding, TRVM reduces it, Graphonomous stores and evolves it. | v0.4 live_deployed (Fly, to be torn down last); v2 in_tree |
| Workbench | Records Claude Code sessions and turns them into signed, replayable skill bundles. | recorder live_local; the site serves a short readable page (7,828 bytes, checked 2026-09-24), not the product |
| studbook | The planned data layer that replaced Supabase. A record's ID is the hash of its content plus its ancestry, and a record that can't show provenance is refused. | spec; blocked on one question (where confidentiality comes from) |
| Part | In plain English | Rung |
|---|---|---|
| T&R (Travel & RRABBIT) | A FreeBSD 15 distribution that ships its own verifier; server image 364 MB. | live_local; download page live |
| RRABBIT | The road as a windowing system: apps are signs along a 3D road, and you fly into one to use it at pixel-exact 1:1. It is also a surface inside Super. | live_local as a shell prototype; the ruled Tier 1 road-shell product is not implemented |
| RAVIO | RRABBIT's ancestor: a drivable sky road showing the amp harness's real work, with altitude as the evidence rung. | live_local |
| PARKVPS | A browser-controlled local VM fleet (QEMU/KVM, no root) that runs T&R. | live_local |
| The lab | MikroTik router; cd-floor-01 (FreeBSD, the quiet bench host and WiFi gateway); locuchest (Proxmox: super-worker-01, and now AFFiNE); the laptop. | — |
amp (code/): the lead-manager harness. One chat window dispatches coding work to Claude and
Codex workers across every repo and tracks them on a board. live_local.
Portfolio sites: computedriven.com is the front door (*one destination, World Cloud; two
ways in, T&R and Super*). The other .coms are mostly specs with honest status banners; see the series plan appendix.
| From → To | What flows | Exists? |
|---|---|---|
| WRLM → WRL | Proposed world text, applied through six frozen typed operations | partly |
| WRL → TRVM | A sealed world (sem-…), lowered to interaction-calculus terms or a C compile plan | yes |
| TRVM → TRAAVIIS | Per-epoch films and verifier agreement. "WRLM proposes, WRL seals, TRVM reduces, TRAAVIIS admits." | yes |
| Person → Super | Intents, which are mutations only. The cockpit cannot ask the world a question | yes |
| Super ⇄ ampd | Frames up to the screen; intents and valve control down | yes |
| Bot → Super | propose_file_edit proposals. A human records, checks and accepts | yes |
| ampd → TRVM | A trvm.reduce effect through the Gateway to a pinned Wasm or compiled host; a receipt comes back with the result's hash | yes (isolated branch / super-live) |
| WEK → ampd | The B2 write-boundary contract; the unmodified WEK verifier judged every trace, 6/6 | yes |
| [&] → box-and-box | ampersand.json governance block compiled into a policy, then a verdict plus a certificate | yes |
| box-and-box → Super | The governance vocabulary | design intent only; no Super code references it |
| TRVM + WRL → Graphonomous v2 | Certificates and sealed projections, read-only | yes (in_tree) |
| Super / machines → R2 | World chunks and manifests, direct with a scoped credential; bytes never pass through the Worker | built locally |
| computedriven → locu.systems | A count record: one class symbol per admitted transition per epoch. Money never flows back | ruled; spec |
| locu.systems → carriers | Placing a locus on Vultr (stable), DigitalOcean (burst) or the customer's own machine | spec |
| Stage | What | Where it stands |
|---|---|---|
| 0 | Super IS the MVP | In progress. "Super builds Super" is still spec: one bot-proposed change ran every step of the gate on 2026-09-23 on a build that is not installed; the reviewer ruled the workflow demonstrated, the task not done. R98 (2026-09-24) made that run eligible by naming the bot by identity; the gate stays open until the accepted change and its restart evidence are inspected |
| 1 | Component MVPs: TRVM, WEK, Fabric | Built and tested beside Super. Counts only when built through Super |
| 2 | World Cloud | Built locally, nothing deployed |
| 3 | locu.systems | Nothing built, and that is on schedule |
Every stage is built with Super. Work done beside Super produces no evidence about stage 0.
| Rung | Means |
|---|---|
spec | Written down. Nothing runs |
in_tree | Code and tests exist; exercised only against stubs |
live_local | Ran end to end on a developer machine |
live_deployed | Running in production |
external | Checked by someone outside |
Nothing in the stack is `external` yet. Rule: when in doubt, downgrade. A related rule: a number in two places will drift, so derive counts; never type them.
World: comes in three sizes with three names (R11). WORLD is the machine (10 GB–10 TB),
a WORLD VERSION is a manifest root at one instant, and the WRL GRAPH is the small semantic layer inside (247 KB for a realistic world).
Seal / `sem-…`: a world's content address. The same meaning gets the same hash on every host.
Film: a run's byte-exact receipt.
Active locus: "An agent is an active locus in a world", the point where state, scoped
authority and continuity are coupled. (AGENCY.md, proposed)
Carrier: the machine a locus runs on: rented, replaceable, never its identity.
Admitted transition: one complete step the world actually took. It is the unit of progress
and of billing. Migration is never progress.
Grant / receipt: authority you are given for a scope; the durable record that you used it.
The only durable objects are receipts.
Certificate: the artifact that justifies a transition. Absent means zero: fail closed.
Feasible ▸ permitted ▸ best: the order every governed decision is made in: floor first,
gradient second.
Refusal: a first-class outcome, not an error. A divergence is refusable, never silent.
7.1×: a compiled trvm.reduce through Super's runtime (a test harness on an uninstalled lane branch), one-shot 129 ms vs resident 18 ms (median); 7.1 is the median of 90 paired ratios, and the two medians divide to 7.3.
Not the executor-span 439×. Fixed workload, latency only. (2026-09-23)
480 / 480 sharded runs (simulated shards on one host) byte-identical to single-node. **No parallel speedup is
claimed**; distribution claims are correctness claims.
1.1×: the gap by which HVM4 beat TRVM's ic32 (87.4 vs 80.2 M interactions/s) on a clean host, single core, one workload family, with ic32 built
from an uncommitted working tree; startup 0.4 ms vs 94 ms.
4,529 B: the cd-kernellet production image, against an 8,192 B gate (re-checked 2026-09-24
with tools/kernellet_census.py --check: PASS, receipts match). STACK_COMPLETION.md's "5.3 KB" is the older ring profile (5,264 B), not the production image.
210 + 3: box-and-box laws enforced + declared open. Re-derive from LAW_MANIFEST.json
before quoting.
0: things externally reproduced. Say it out loud; it is the most credible number here.
The box-and-box README says "76-law compose harness"; the manifest says 101.
AmpersandBoxDesign/docs/UMBRELLA.md says 103 laws.
PULSE/README.md says "97 laws" and PULSE/docs/ARITHMETIC_INTEGRATION.md says "v0.8.0 (8 rungs, 97
laws)"; the manifest says 210 + 3 and the package is 0.10.0.
STACK_COMPLETION.md §1.2 lists OS-002/006/009/010/011 as "Shipped"; protocols.json disagrees
(OS-002 spec-complete, OS-006 and OS-009 in development, OS-010 and OS-011 draft).
Twelve root documents still carry the name WebHost.Systems; the directory is locu.systems.
a2atraffic.com is listed as a property but has no directory; it is a spec-rung row only.