Konsonans AI GovernanceFormal governance specification

The book treats a single thesis: a compliance obligation is best discharged by an architecture in which the obligation cannot structurally be violated, rather than one in which it is merely promised and later inspected.

Its form is propositional: cardinal propositions 1…7 carry the argument; decimal propositions elaborate so that each claim has an address and each mechanism a place.

Each cardinal closes with the product feature it justifies — its why and its what — so the document reads simultaneously as philosophy of the design and as a product specification.

The world is the totality of agent actions, not of agent code. A model's weights are opaque; its actions are discrete, typed, and namable — and therefore governable.

An action is an artifact attempting to cross a boundary: approveLoan:, denyClaim:, placeOrder:. Each is a candidate fact about the world.

To govern is to interpose a membrane between the action and its effect, and to decide each crossing: admit, refuse, or suspend pending a human.

The Annex III categories — credit, recruitment, medical, law-enforcement, critical infrastructure, education — fix which worlds are high-risk. Risk classification (art. 9) is the prior act of naming the world.

That a thing happened must be recordable independently of the agent that did it (art. 12). The record is not a log file the agent writes; it is a witness the agent cannot edit.

A rule selects actions by their properties and disposes of them into a terminal state or a suspended one. The selectors are the boundary; the disposition is the verdict.

A ligand is a property a rule needs but does not itself possess — a risk level, an approval flag, a PII verdict. A ligand required but not produced is an unsatisfiable guard.

The keystone. An unsatisfiable guard becomes a WIT import with no provider; the component fails to link. An incoherent policy is a compile error, never a silent runtime gap.

The same grammar (roux) hosts many dialects. A dialect is a vocabulary plus host bindings — never a new compiler. glither.governance for the Act; glither.hft for pre-trade risk; glither.mail for mailguard.

From one typed IR the compiler emits two artifacts: a production Rust component and an auditable Gleam oracle. They must agree byte-for-byte on every conformance case; divergence is a compiler bug.

The compiled component has authority only through its WIT imports. No sockets, no filesystem, no clock unless a host binding grants it. The capability sandbox is the product, not a setting.

State changes are events, never updates. The store enforces this: UPDATE and DELETE are refused at the database rule level, not merely by convention.

Each entry carries previous_hash and a signature = SHA-256(id ‖ time ‖ action ‖ previous_hash). The chain makes any insertion, deletion, or reordering detectable from the hashes alone.

One copy can be rewritten by whoever holds it. Therefore the record streams — synchronously — to a second host whose only role is to re-verify the chain as rows arrive.

The strongest replica is one the operator does not control: an independent auditor node that signs a daily manifest over the chain's first and last hash. Leak-freeness toward it is structural — see proposition 6 (Dana).

The suspended disposition hold into human_review is a real state with a liveness obligation: it carries a deadline, and its only lawful settlements are allowed or blocked.

The reviewer acts on a typed surface, not a chat message: the action, its arguments, its risk flags, the offending policy, and the audit entry's hash with its chain status.

A decision is itself an event: {reviewer, decision, rationale, decided_at} — appended to the chain. Oversight is auditable as conduct in its own right.

Art. 14 §4, structurally. When the SLA expires the rule's after arm fires into blocked. The system defaults to the safe state by construction; an absent human cannot become a tacit approval.

The reviewer works inside a live Smalltalk image (proposition 5): the queue, the inspector, and the decision controls are one running object graph, observable and modifiable while live.

The orchestrator does little and shows everything. It routes captured actions to the membrane, suspends for oversight, appends to the spine, and projects live documents — and no more.

Agents connect over the transport that fits them: a unix socket for a co-located model, tcp+mTLS for a container, HTTP/SSE for a remote function. One wire protocol (JSON-RPC 2.0) underneath.

Live documents are projections of the event stream. A compliance dashboard is not generated nightly; it advances as events arrive, by subscription, not by polling.

The heavy, sandboxed work lives in WASM; the live, inspectable work lives in the image. The split is deliberate: provable isolation where authority matters, live malleability where humans look.

The deployment is not a diagram; it is a typed object. glither.world selects components and guards each Pour → Pier wiring against the same discipline the inner rules use.

The keystone lifts to the graph: an edge whose types do not satisfy makes the composition fail. An unsound deployment does not start.

A Dana membrane imports but exports nothing that carries data back to the donor — a passive uniport, no retrograde channel, no side-channel. The audit replica is exactly this.

The signed graph attestation records, per edge, the negotiated guarantee and flags every Dana edge — so a third party can verify the whole deployment's information-flow shape from signed artifacts alone.

A missing host binding is a link failure, not a silent degraded mode. A missing required ligand is a typed, audited guard-fail, never an exception that leaks.

An expired oversight deadline resolves to refusal (4.2). An unsatisfiable wiring fails the compose (6.11). An unverifiable Dana vow rejects the edge (6.21).

These are one principle in many places: the unsafe path is made unrepresentable or unreachable, so that compliance is the only state the system can occupy.

This is why the document is a specification and not a checklist: a checklist enumerates what one must remember to do; an architecture fixes what one cannot fail to do.