Architecture and Approaches

Architecture and Approaches

Semantic pipeline

flowchart LR
    A["Profile-selected source"] --> B["Canonical tokens"]
    B --> C["Canonical AST"]
    C --> D["Type, effect, and policy elaboration"]
    D --> E["Semantic IR"]
    E --> F["Obligation and capability analysis"]
    F --> G["Planning and execution"]
    G --> H["Evidence and result artifacts"]

Loading

Implemented today: canonical source through semantic IR, deterministic artifact encoding and identity, a focused kernel/prelude path, registered verifier dispatch, and deterministic evidence bundles.

Implemented foundation: source and effective policy documents now cross a strongly typed Rust boundary covering all four layers and all six rule categories. Canonical §policy source lowers through that same boundary with explicit layer and inheritance syntax, typed meta-values, waivability and issuers, and retained definition/rule spans. Comments, layout, and optional human labels remain AST presentation rather than policy meaning. The boundary normalizes deterministic CBOR, rejects unknown fields and invalid category/operation/value combinations, and checks effective semantic and artifact identity. Generic document provenance and per-rule policy provenance are distinct fields (provenance and rule_provenance) so both can coexist without an ambiguous CDDL map key.

Implemented policy composition: validated source documents compose in fixed organization → team → repository → user order. The composer validates inheritance and source uniqueness before joining; rejects capability, limit, and type-mode weakening; intersects scoped capabilities; takes exact limit minima and the strongest mode; retains deny rules; merges waiver governance restrictively; and emits content-addressed source layers, rule provenance, semantic identity, and artifact identity. Equivalent decompositions have identical effective meaning while retaining distinct audit artifacts.

Planned: complete analysis graphs, waiver evaluation, policy enforcement, process-backed registered adapters, planning, and the broader runtime. The diagram is the v0 architecture, not a claim that every box ships.

Minimal trusted kernel

A lowered kernel-network carries a structural ID, output type, finite typed children, and a reducer symbol. The Rust kernel supplies only behavior-neutral operations: inspect sealed child observations, construct checked results, resolve stable child tags, and seal derivations.

Scheduling order, parallelism, budgets, guards, quantifier families, and behavior kinds do not belong in that network. The checked-in all prelude already determines its own precedence and aggregation. The next self-hosting boundary is issue #15, followed by any, none, chain, and gate as BHCP source rather than new Rust behavior tags.

This design pays an up-front metamodel/evaluator cost. Its benefit is a smaller trusted runtime and the ability to evolve standard behavior through the language’s own type, purity, totality, policy, and derivation checks.

Outcomes and operational failure

Goal verdicts are Satisfied, Refuted, or Unresolved. Execution is factored as Completed(verdict) or Faulted(fault), so operational failure cannot masquerade as a semantic answer. Reducers themselves are in the adjectival states Pending or Concluded; those are not verdicts.

Deterministic artifacts and identity

Canonical wire artifacts use RFC 8949 deterministic CBOR. The current identity algorithm is the versioned bhcp.hash/sha3-512@0; algorithm choice is explicit in bhcp-project.toml.

• A semantic ID covers normalized meaning and excludes presentation and provenance.
• An artifact ID covers the retained artifact, including provenance-sensitive material where specified.

Observable outputs, obligations, effects, preferences, policies, and authorized evidence change semantic identity. Formatting, comments, diagnostic labels, and presentation-only profile data do not.

Schema boundary

The v0 CDDL bundle is the machine-readable artifact contract. The repository uses the Rust cddl crate to parse RFC 8610 and validates all 17 root diagnostic fixtures through the Rust test harness. The compiler, deterministic CBOR codec, and fixture policy remain repository-owned safe Rust.

Policy and presentation layers

Policy is intended to compose organization → team → repository → user as a restriction lattice, not a last-writer-wins override stack. The implementation-blocking typed value/order decision is issue #29.

Custom syntax is deliberately later. A fixed ASCII preamble selects a validated profile; mappings normalize to canonical tokens before the canonical parser. Profiles may alter safe presentation and attach monotonic policy overlays, but cannot install code or redefine core semantics. That work begins only after policy conformance at issue #41.