Ledger Kernel · research-stack
POC · measured 2026-09-16 · every number is from the project's records, listed at the end
seq 1Questioncharter.locked

It is all on the ledger.

On 11 September the direction changed: not a Python pipeline, but the whole system as composed, append-only, content-addressed ledgers. Eleven ledgers, three consistency classes, one writer, one gate.

seq 2Questioncharter.locked

Composed ledgers, as rails.

sequenced · one writer · dense seq per stream Question Plan Doctrine Policy Decision Run Unit Argument mergeable · order by (hlc, node) Fetch Eval scarce · Σ live + settled ≤ cap Budget one transaction admit() · schema · refs · invariants ledger.sqlite3 append-only derived views triggers · rebuilt hash-equal report.md a pure function of the ledger rejected: nothing written · admission.rejected + the attempt, kept
sequenced · one writer · dense seq Question Plan Doctrine Policy Decision Run Unit Argument mergeable · (hlc, node) order Fetch Eval scarce · Σ live + settled ≤ cap Budget admit() · schema · refs · invariants · class ledger.sqlite3 append-only derived views rebuilt hash-equal report.md pure function of the ledger rejected: nothing written admission.rejected + attempt kept

Eleven ledgers in three consistency classes run as rails into one admission gate. Every event's id is a hash of its content; every ref must resolve; admitted events land in one append-only file, and the views and the report are re-derived from the events alone. A rejection writes only the rejection.docs/SPEC-kernel.md §1–§2 · docs/DESIGN-kernel.md §0 · BENCH K-3: rebuild hash-equal on 29 tables

seq 3Argumentclaim.asserted · seq 2

Append-only, addressed by content.

Argument · stream = run id · seq dense · one writer refs — ids of earlier events, hashed into this id hypothesisseq 1id = blake3(content) claim.assertedseq 2id = blake3(content) verdictseq 3id = blake3(content) edge.attacksseq 4id = blake3(content) synthesisseq 5id = blake3(content) claim.asserted′same seq 2 · new bytes rejected · no UPDATE exists: the only write is an appendnew bytes → a different id · seq 2 is taken (UNIQUE ledger, stream, seq)the stream stays as written · the attempt is kept as an attempts row

Events append in order; each id is blake3 over its content, the ids it references included. There is no update. A rewrite would be a different id under a seq that is already taken; the batch is rejected and the attempt is kept as evidence. Replay re-derives the same ids from the same bytes.docs/SPEC-kernel.md §1 event shape, id definition · docs/DESIGN-kernel.md P6–P7, §13.3

seq 4Argumentclaim.asserted · anchors[0]

The quote has to be in the bytes.

report.md · Findings Stripe caches status codes and response bodies for keyed requests once endpoint execution begins, replaying even 500 server errors on subsequent retries. high confidence · docs.stripe.com “Stripe’s idempotency works by saving the resulting status code and body of the first request made for any given idempotency key, regardless of whether it succeeds or fails. Subsequent requests with the same key return the same result, including 500 errors.” A1 fetch.done · status ok · docs.stripe.com bodies/<sha256_text>.zst · extracted text, bytes Stripe’s idempotency works by saving the resulting status code and body of the first request made for any given idempotency key, regardless of whether it succeeds or fails. Subsequent requests with the same key return the same result, including 500 errors. start end the model cites url + quote · the kernel resolves fetch_ref and [start, end) · rungs exact → nfc → folded GATE-4 · every resolved anchor decoded from the store and compared byte-for-byte 451 / 451 · 0 mismatches

The model cites a URL and a quote; the kernel resolves the URL to the page it fetched and finds the quote in the stored bytes — exact first, then NFC-normalised, then with whitespace runs and typographic punctuation folded; there is no rung for case folding or edit distance — and records the byte offsets. A quote that is not in the bytes is a rejection, not a footnote. The gate re-read every resolved anchor: 451 of 451 matched, 0 mismatches.docs/SPEC-kernel.md §2 anchor resolution · docs/GATE-POC.md check 4 · BENCH K-4: exact / nfc / folded 0.09 / 0.32 / 1.78 ms at 315 KB

seq 5Runadmission.rejected · attempts

Mechanical checks reject on the spot. Judged ones come back with a reason.

admission mechanical · program schema · number.unsafe refs resolve · refs.unresolved A1 anchor bytes == quote A2 a label needs evidence B2 Σ live + settled ≤ cap class · seq · hlc judged · reasoned L1 audit first L2 evidence > priors L3 source opened L4 epistemics labelled L5 gaps reported L6 reframe offered claim.assertedobserved · quote not found rejected on the spot · invariant.A1 · /anchors/0/quoteattempts row kept · the model gets attempt 2 with the reason claim.assertedobserved · 1 anchor resolved COMMITseq n · hlc judge unitor the owner judge.scored · label, reason, calibration → Eval ledger

What a program can decide — schema, refs, the anchor's bytes, budget arithmetic, 33 named codes — is enforced at the gate in the same transaction. What only a judgment can decide — the six laws — goes to a judge unit or the owner and returns as a scored event with its reason. The guarantee: no unlabeled error.docs/DESIGN-kernel.md §7.2 · docs/SPEC-kernel.md §7 judged.L1–L6 · doctrine/v1/DOCTRINE.md

seq 6Runrun.lease · resume

Survives kill -9 without paying twice.

live run process 1 audit orient recharter investigate + verify synthesise done kill -9process dies resume process 2 served from the ledger: checkpoint (task_ref, attempt) → no call repeated model calls: 0 · report hash equal O-1 · 20 random kills · 0 repeated model calls · report hash equal · gate check 2 · resume_repeats = 0 the one sanctioned re-issue: a call lost between the wire and its output commit

Each model call has three durable points: recorded before the wire, the raw body committed on arrival, then admission. A new process resumes from the ledger and re-issues only what was never committed. Twenty random kills: zero repeated calls, identical report.docs/BENCH-POC.md O-1 · docs/GATE-POC.md check 2 · docs/SPEC-kernel.md §2 Unit row, §8 check 2

seq 7Runresearch replay

Replays for $0.

live run job 20260910- 225300-83c859 OpenRouter · Brave · the pages 10 calls · $0.1625 · 19 sources call 1 call 2 call 3 call 4 call 5 call 6 call 7 call 8 call 9 call 10 replay rsk --offline research replay ledger ledger ledger ledger ledger ledger ledger ledger ledger ledger no network client is constructed · every call answered by its checkpoint (task_ref, attempt) every search and fetch answered by the seeded Fetch events 0 calls · 0 reserves · $0 · same event ids · report blake3 equal U-4 · 78 of 78 calls served from the ledger · 0 calls · 0 reserves gate check 3 · 73 / 73 · report identical · rebuild equal on 29 tables

Replay opens the source read-only, seeds the run's roots and re-executes the plan with the model client and the fetcher replaced by ledger lookups. No network client is built. 78 of 78 calls served from the ledger; the same event ids; the same report bytes.docs/BENCH-POC.md U-4 · docs/GATE-POC.md check 3 · docs/DESIGN-kernel.md §13.2 · job id and cost: Gold-8 Verdicts, Q6

seq 8Budgetreserve · settle · cap

Money is reserved before it is spent.

cap · run:<id> · $0.40 for a standard run reserve reserve reserve reserve reserve refused · class.scarce_cap settled actuals reserve before the call Σ live + Σ settled + amount ≤ cap checked by the one writer settle after the actual replaces the estimate integer micro-dollars refused a rejection with a reason never an overrun, never a crash G-2 · 8 clients × 5 reserves of 10 against a cap of 100 · 100 admitted · 30 refused · 0 over-cap · p99 1.35 ms caps are events · expiry is an event · a settle that arrives after expiry is accepted and marked late

A unit is never invoked without a reservation; the writer checks live plus settled plus the new amount against every cap the reserve names. Settle replaces the estimate with the actual. Eight clients demanding 400 against a cap of 100: 100 admitted, 30 refused, none over.docs/SPEC-kernel.md §2 Budget row · docs/GATE-POC.md G-2 · bench/sets/gold-8/caps.toml (standard cap $0.40)

seq 9Runrun.started … run.finished

One run, on the record.

rsk research start · or deep_research_start over MCP plan and doctrine hashed into run.started audit audited orient oriented recharter chartered investigate investigation_done synthesise synthesised done investigator × lines · verifier × claims, together state.entered task.created unit.invoked unit.output unit.admitted premise ×n search.done fetch.done task.retrieved hypothesis ×n charter.locked lines + claims to verify claim.asserted + anchors verdict → edge.attacks claim_status (the fold) unit.rejected → repaired synthesis A5: cites observed claims, or gap run.finished report.md report.md Decision.feedback · actor owner refs the run and the claim it judges every arrow above is an event; every column is a stream you can query

The plan is the old method as a hashed statechart: audit, orient, recharter, investigate with verification alongside, synthesise. Every state writes its events; the report is rendered from them; the owner's verdict is an event that refs the claim it judges.docs/SPEC-kernel.md §3 plan v1, §7 report and Decision appends · docs/E1-2026-09-16.md

The walk-through, state by state

  • run.startedrsk research start, or deep_research_start over MCP. The plan and the doctrine are hashed into the first event, so the run names exactly the method it will follow.
  • auditThe auditor unit is invoked under a reservation. state.entered · task.created · unit.invoked · unit.output · unit.admitted · premise ×n
  • orientSearches and fetches are events; every page the task read is a task.retrieved ref. search.done · fetch.done · task.retrieved · hypothesis ×n
  • recharterThe charter is locked: the lines to pursue and the claims to verify. charter.locked
  • investigateInvestigators work the lines and verifiers the claims, together. A claim is asserted with its anchors; a verdict becomes an attacking edge; claim_status is the fold over them. A rejected output comes back repaired. claim.asserted + anchors · verdict → edge.attacks · claim_status · unit.rejected → repaired
  • synthesiseThe synthesis may cite only observed claims, or declare a gap (A5). synthesis
  • donerun.finished; report.md is rendered from the ledger — a pure function of it, with no timestamps. run.finished · report.md
  • Decision.feedbackThe owner's verdict on the report, actor owner, refs the run and the claim it judges. The eight side-by-side verdicts on the proof page were recorded exactly this way.

next: the proof — what all of this measured to, including the check that fails.