arifOS

A constitutional control plane for AI agents.

arifOS evaluates identity, evidence, authority, risk, and reversibility before an AI agent may execute a consequential action.

It does not execute actions itself. It returns an auditable verdict:

• SEAL — authorized under stated conditions
• HOLD — insufficient evidence or human approval required
• SABAR — proceed cautiously, partial authorization
• VOID — blocked by a constitutional floor

Try the safe demo · Connect through MCP · Read the constitution · Documentation

The agent that acts is not allowed to certify its own action.

DITEMPA BUKAN DIBERI. Forged, Not Given.

---

What arifOS does

arifOS is a Model Context Protocol server that sits between an AI agent’s intent and the action it wants to take. It enforces 13 constitutional floors — non-negotiable rules about truth, reversibility, humility, auditability, and human authority.

When an agent calls arif_init, arifOS binds a session, activates the floors, and routes the agent through a governed loop: observe evidence, think under constraints, dispatch to the right organ, recall governed memory, receive a constitutional verdict, execute (if authorized), and seal the result.

When an agent’s evidence is thin, risk is high, or an irreversible action is proposed — arifOS returns HOLD. A HOLD is not a failure. It is a fence.

What arifOS does not do:

• It does not execute actions (A-FORGE executes; arifOS judges).
• It does not wrap an LLM (it governs any agent that speaks MCP).
• It does not replace human judgment (F13 = human veto is final).

---

The 8 canonical verbs

arifOS exposes 8 verbs on its public MCP surface. Each verb corresponds to a station in the 000–999 authority ladder.

Canonical stage assignments live in tools_sot.yaml, sourced from constitutional_map.py. If prose and code disagree, code wins.

---

The 13 constitutional floors (F1–F13)

These are checked on every governed action. They are the physics of the kernel.

Full floor definitions: GENESIS/FLOOR_TABLE.json · GENESIS/000_KERNEL_CANON.md §3

---

Architecture: two loops

  INNER LOOP (deliberation)          OUTER LOOP (actuation)
  ─────────────────────────          ──────────────────────
  init → observe → think             forge (post-SEAL)
       → route → memory                  → verify
       → judge → verdict                  → seal to VAULT999
                                            → FQ metabolic pulse

The doer is never the judge. caller == target → HOLD. This is the Gödel Lock — a separation-of-duties rule inspired by Gödel’s incompleteness: the reference for certifying an action cannot be a member of the system that performs it (R ∉ S).

ASCII map:

  👑 F13 Sovereign (Arif) — human veto, final
           │
  ┌────────▼────────────┐    verdict    ┌─────────────────┐
  │  arifOS Kernel :8088│──── SEAL ───▶│  A-FORGE :7072   │
  │  F1–F13 always on   │              │  execution only  │
  │                     │──── HOLD ──▶ 🧍 human gate      │
  └──┬──────────┬───────┘              └───────┬─────────┘
     │ query    │ evidence                     │
     ▼          ▼                              ▼
  ┌──────┐ ┌──────┐ ┌──────┐          ┌────────────┐
  │ GEOX │ │WEALTH│ │ WELL │          │ arifFlow   │
  │:8081 │ │:18082│ │:18083│          │ :7073 (FQ) │
  └──────┘ └──────┘ └──────┘          └────────────┘

---

Quickstart

For humans — try it in under a minute:

# 1. Check health
curl -sf https://mcp.arif-fazil.com/health | jq '{status, floors_active}'

# 2. List the 8 canonical tools (stateless MCP wire)
curl -sS -X POST 'https://mcp.arif-fazil.com/mcp' \
  -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' -H 'Mcp-Method: tools/list' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

For agents — the golden path:

arif_init → arif_observe → arif_think → arif_route →
arif_memory → arif_judge → arif_forge → arif_seal

Always start with arif_init. No session = no mutation. Expect HOLDs — they are fences, not failures.

Reading a verdict:

• SEAL — authorized. Execute, then seal receipt to VAULT999.
• HOLD — pause. Evidence insufficient or human approval required.
• SABAR — proceed cautiously under partial authorization.
• VOID — blocked. Hard floor violation.

---

MCP surface

The public wire exposes 8 canonical verbs, stateless-first (MCP 2026-07-28).

Full tool schemas, resource URIs, and prompt templates are discoverable via standard MCP tools/list, resources/list, and prompts/list calls.

---

VAULT999

Every irreversible decision appends to an append-only, hash-chained ledger. Properties:

• Append-only — chattr +a; Merkle anchor every 100 receipts
• Cross-organ receipts — WEALTH, WELL, A-FORGE all write witness receipts
• Seal chain health — live at /health → vault999_health

The chain is the federation’s memory that survives agent death.

---

For developers

Connect your MCP client:

Endpoint: https://mcp.arif-fazil.com/mcp
Protocol: MCP 2026-07-28 (stateless)
Auth: varies by verb (see access classification below)

Safe destructive-action demo:

# This will return HOLD — the kernel refuses to execute
# without a valid session and evidence
# tools/call arif_forge {mode: "engineer", manifest: "delete all production data"}
# Expected: HOLD (no session, no evidence, irreversible)

A HOLD is your best demo — it proves the gate works.

---

For agents — machine contract

Boot via arif_init. Required first verb. No session = no mutation.

HOLD handling: retry with better evidence, not the same payload. Idempotency: arif_init is idempotent with idempotency_key. Irreversible actions: require ack_irreversible: true + 888_HOLD + F13 ack.

Machine-readable surfaces:

• /.well-known/mcp/server.json — MCP server metadata
• /llms.txt — LLM-readable summary
• /tools — public tool inventory with access classification
• AGENT_BOOTSTRAP.md — full machine contract

---

Federation

Truth rule: live :port/health + tools/list beat any static count in prose.

---

Documentation

---

Governance

• Authority chain: arif_init → arif_observe → arif_think → arif_route → arif_memory → arif_judge → arif_forge → arif_seal
• Autonomy tiers: T0 read auto-do · T1 edit/test/commit · T2 announce-10s-veto · T3 888_HOLD always
• No self-certification. No consciousness claims (F9). The kernel audits itself last.

---

Citation

If you use arifOS in research, please cite:

@software{arifos2026,
  author = {Muhammad Arif bin Fazil},
  title = {arifOS: Constitutional AI Kernel and AGI Substrate},
  year = {2026},
  url = {https://github.com/ariffazil/arifOS},
  license = {AGPL-3.0}
}

See CITATION.cff for full metadata.

---

License

AGPL-3.0 — fork the institution, not just the code.

---

Author

Muhammad Arif bin Fazil — F13 Sovereign of the arifOS Federation.

Forged on VPS af-forge, under load, by an agent that survived its own audit.

DITEMPA BUKAN DIBERI.