Cognitive Kernel ABI

Cognitive Kernel & its ABI

The Cognitive Kernel is a real kernel — for cognition instead of processes. It arbitrates the scarce, dangerous resources of a mind: the token budget, the right to act, and the shared truth.

What the kernel guarantees

1. Budget never overflows — a subsystem must spend() from the kernel's budget; an over-spend is refused early and explicitly, not discovered three steps later as a mysterious model error.
2. Nothing acts unpoliced — every lifecycle step is preceded by a Policy Hook Surface check.
3. Everything is recorded — Telemetry emits a record for each event, decision, and outcome.
4. Only conforming subsystems load — conformance is a load-time gate, not a warning.

The nine kernel services

Event · Context (budget) · Memory · Policy · Execution · Validation · Scheduling · Governance · Telemetry. Think of them as the syscall table of the mind.

The ABI — what a subsystem implements

Deliberately tiny (a small contract is one people actually keep):

Subsystem:
    name        : str
    abi_version : str                      # must match the kernel's
    provides    : list[Capability]
    handle(event, ctx) -> Event | None
    conforms_to(abi_version) -> bool       # load-time gate

handle is a pure-ish function of an incoming Event and the current Context. Everything a subsystem may do — recall memory, spend budget, request an action — it does through the Context and by emitting events, never by reaching outside the kernel, and never by calling another subsystem directly.

The lifecycle

sequenceDiagram
    participant K as Kernel
    participant H as Hooks
    K->>H: PRE_PLAN?
    H-->>K: allow
    K->>K: Planning.handle → plan
    K->>H: PRE_ACT?
    H-->>K: allow / DENY (fail-closed)
    K->>K: Execution.handle → result
    K->>H: PRE_VALIDATE? → Validation
    K->>H: PRE_COMMIT? → commit (persist)
    K->>H: PRE_RESPONSE? → respond
    K->>K: Telemetry.emit(the whole chain)

Loading

Every arrow into H is a place the system can say no; every step emits to Telemetry. That is the kernel's whole job: make the mind's lifecycle interruptible by policy and legible afterward.

Why "conforms_to" is a hard gate

The most corrosive thing in a long-lived system is the "mostly works" plugin that loads and then violates an invariant months later. A load-time gate turns a future runtime mystery into a present, obvious startup error. The blueprint would rather fail loudly at boot than lie quietly at runtime.

---

📖 Full document: docs/02 · 📐 Normative spec: specs/kernel-abi.md · 🧩 Code: genesis_kernel/kernel.py → Next: Policy Hook Surface