Dual Control-Plane Runtime Governance & Custody Stack
Probabilistic prompt guardrails allow destructive side effects to slip into production, while static deny rules paralyze autonomous workflows the moment operational state becomes partially observable. SeamZero closes that safety-liveness gap with two deterministic control planes inside an OS-enforced Trusted Computing Base: Plane I (Epistemic Consequence & Repair Synthesis) discovers and binds verified safe execution paths before commitment, while Plane II (Conserved OS Custody) isolates live credentials and enforces single-spend physical authority across Linux and Windows infrastructure.
Guarded boundaries completed at zero protected loss where raw execution loses state at boundary 1 and static deny deadlocks at 0/10.
Cliff Test regimes passed at zero loss across horizon caps, invariant paradoxes, partial faults, and 0.26 s hostile TOCTOU drift aborts.
Linux x86_64 NVMe snapshot restore median across 24 retained state owners and 58 directional custody pairs over loopback IPC.
Standalone Windows NTFS verification median (4.82 ms local Linux ext4 journal check) over domain-separated Ed25519 commitments.
Controlled Baseline // Identical Multi-Boundary Operational Worlds
Executes agent-proposed mutations directly over authorized sockets, forfeiting protected records on the first coupled or delayed side effect.
Preserves state only by halting workflows; lacks isolated counterfactual simulation, relational transfer, or bounded argument repair.
Synthesizes verified safe repairs in isolated discovery branches (25 bounded probes across the 10-boundary chain) and commits via single-spend OS custody.
01 // Architectural Division of Authority
Binds a reviewed physical adapter contract—declaring schema identity, state projection, invariant and goal measurements, causal footprint, and isolated branch semantics—to package-local retained owner heads before any session opens.
Snapshots operational prestate without world mutation, runs isolated counterfactual probes when uncertainty requires discovery, synthesizes bounded argument or sequence repairs, checks pre-commit causal-footprint drift, and suspends at the exact authorized commitment boundary.
Reserves conserved epoch capacity, mints single-spend OS file or socket capabilities inside credential-free workers, independently measures poststate outcomes, tracks pending multi-horizon obligations, and appends a signed receipt.
02 // Control Plane I — Epistemic Consequence & Repair Engine
Tested against 15,360-coordinate neural residual-stream probes that suffered protected state loss under distribution shift, Plane I rejects activation probing and LLM-as-a-judge heuristics—governing transitions strictly from receipt-verified operational evidence.
Every forecast belongs to an explicit consequence scope, state owner, and execution context. Missing suffix support or unobservable protected dependencies never default to allow—they hold fail-closed with explicit epistemic uncertainty codes.
Executes candidate transitions in isolated discovery worlds verified to leave live state untouched, synthesizes safe parameter and ordering repairs (such as 52/52 verified safe SQL replacements under partial observability), and transfers proven plans at zero runtime probe cost until drift occurs.
Goes beyond destructive-call denial by independently measuring complete key-to-record recoverability prior to queued replacements—constructing preparatory preservation actions so valid workflows complete without data loss.
Supervises asynchronous worker and compaction effects beyond the immediate tool boundary (achieving 3.25× valid action throughput over static trajectory monitors at zero loss). Threatened future horizons block subsequent mutations until discharged, even if a requested call fails.
Reserves authority across 24 distinct state owners and rejects stale, foreign, or unreserved collaborator outputs. Chained cross-surface workflows require cryptographic predecessor receipts before advancing to downstream boundaries.
Measures reconstruction risk across accumulated egress receiver state rather than scoring individual packets in isolation. When live multi-step faults trigger compensation, both the intermediate fault state and compensated poststate are permanently recorded.
03 // Envelope Boundary Qualification
High-assurance governance is defined by how a runtime behaves when pushed past its composition horizon, probe budget, or precondition assumptions. Across all 12 sealed Cliff Test regimes, SeamZero solves supported repairs and halts cleanly with exact absence accounting when outside the safe envelope.
| Boundary Axis | Evaluated Regime | Probes | Warm Time | Runtime Outcome & Audit Code | Loss |
|---|---|---|---|---|---|
| Composition Depth | Supported multi-step compositions (depth 1 & depth 2) | 2 / 3 | 0.52 s / 1.89 s | Goal Solved Synthesizes verified ordered program within declared horizon | 0 |
| Composition Depth | Safe target beyond enumerated depth envelope (depth 3) | 9 | 7.15 s | HORIZON_EXCEEDED_SAFE_HOLD Refuses unsupported extrapolation (+1 absence) | 0 |
| Discovery Budget | Rank-15 valid candidate vs. beyond-ceiling target | 15 / 30 | 3.29 s / 6.31 s | PROBE_CAP_EXHAUSTED_SAFE_HOLD Solves rank-15; halts deterministically at 30-probe ceiling | 0 |
| Invariant Coupling | Decoupleable goal conflict vs. true invariant paradox | 3 / 0 | 0.52 s / 0.03 s | UNSATISFIABLE_INVARIANT_CONFLICT Repairs decoupleable conflict; holds paradox in 34 ms | 0 |
| World Drift (TOCTOU) | Unrelated ambient noise vs. hostile pre-commit mutation | 2 / 1 | 0.48 s / 0.26 s | PRECOMMIT_DRIFT_ABORT Revalidates benign noise; aborts hostile precondition drift | 0 |
| Live Partial Fault | Clean staged sequence vs. mid-execution step-2 fault | 3 / 2 | 2.22 s / 1.88 s | PARTIAL_COMPOSITION_COMPENSATED Restores routing & records intermediate fault state | 0 |
| Cross-Surface Chain | Coupled multi-boundary receipt progression | 15 | 6.08 s | Goal Solved Verifies predecessor receipts & preserves committed safe prefix | 0 |
04 // Control Plane II — Conserved Authority & OS Custody Kernel
Once Plane I binds a verified commitment, Plane II guarantees that raw credentials never enter worker memory, authorization capacity cannot be double-spent under concurrency, and OS boundaries match exact platform kernel capabilities.
Non-Refundable Indeterminacy: Network timeouts, disconnects, or missing poststate receipts never trigger automatic refunds or blind replays. Unresolved capacity stays locked in retained_indeterminate, and expired kernel capabilities require explicit Ring-0 tombstoning before escrow reclamation.
Wire-Level Protocol Gates: Restricted workers hold zero database passwords or cluster keys. Outer custody proxies inject credentials on the wire while enforcing PostgreSQL SAVEPOINT row-ceiling rollbacks, MySQL implicit-DDL split-gates, fenced SQLite DML, and mutual-TLS Kubernetes /validate + dryRun=All admission.
Frozen Ring-0 eBPF LSM hooks (file_open, inode_unlink, socket_connect) enforce single-spend slot burn, expiry, and live-root binding alongside SO_PEERPIDFD private-pipe attestation. CRIU warm-snapshot restore brings the 24-owner topology online in a 1.90 s NVMe median across 22 zero-process samples.
Qualified on physical ARM64 edge hardware with full 2.65 GB image authentication, 5.85 s warm-cache minimum, 35.25 s independent final-manifest restore (40.05 s 21-sample microSD median), 8 snapshot negative controls, and full 225-graph equivalence parity.
Enforces restricted worker tokens, enclosing Job Objects (terminating descendants on custodian exit), pinned file handles, staged-write + atomic-rename installation, and owner-only DACLs with 5 verified restorations. Linux Ring-0 LSM and CRIU are never falsely claimed on Windows (unsupported snapshot calls fail closed with exit 78).
05 // Zero-HITL Traceability & Day-1 Adoption
SeamZero operates without human-in-the-loop approval bottlenecks—pairing a non-invasive composite console (7 Control Plane tabs and 4 receipt-synchronized specialist inspection views) with counterfactual Shadow Audit mode and one-command causal receipt timelines.
seamzero explain <receipt> --json
VERIFIER: seamzero verify <ledger> --anchor <anchor> (Ed25519 Offline)
Binds plan_sha256 and transactional prestate hash before any physical mutation executes.
Verifies conserved epoch slice balance and atomically arms single-spend reservation.
Records Linux LSM slot burn or Win32 restricted-worker handle custody scope honestly.
Captures affected rows, rollback or commit status, and independent poststate measurement.
Binds ordered turn and bundle commitments for standalone air-gapped verification.
06 // Epistemic Honesty & Wave 7 Release Manifest
Every release archive is dual-stream reproducible, OPSEC-audited across raw and nested carriers, and verified to leave zero residual processes, listeners, mounts, cgroups, or kernel objects across 42,188 preserved host files.
/validate) paired with server-side dryRun=All verification.| Platform | Canonical Release Archive | Exact Bytes | Archive SHA-256 Digest | Bundle Manifest SHA-256 |
|---|---|---|---|---|
| Windows x64 | SeamZero-Wave7-Win64.zip | 1,171,524,522 | 69404df15dd3eeb77a600ea899bf3b7a5ea0bdde42fcea57c79d9387a747056e | 7db708abbeb427ad79362b69083510b79fa7f12085a39aca01579a139db550b2 |
| Linux x86_64 | SeamZero-Wave7-Linux-x86_64.tar.zst | 901,504,067 | 5fff76a853aef6ab5c8a50b2b3fff4839d74d3af1c67cef8257f425072f107af | 972779b1a01a936d43aa07b7354adbcaf1f602c3f590ffd6a6b83bd58326880b |
| Linux ARM64 | SeamZero-Wave7-Linux-aarch64.tar.zst | 827,655,730 | 9f6e4178f4bb56c68595e3a8fac204d8c7c1320d5b3e6ca12622f00c527e6339 | 96a71c419e84a39fbf31d6a9c675f841296bb30a5f3909f0efc544dc8d4e1a54 |
# Windows PowerShell — Verify sealed archive SHA-256 and run 16/16 cleanroom doctor self-test Get-FileHash .\SeamZero-Wave7-Win64.zip -Algorithm SHA256 tar -xf .\SeamZero-Wave7-Win64.zip -C C:\sz-eval C:\sz-eval\SeamZero-Wave7-Win64\bin\seamzero.cmd doctor --self-test # Linux (x86_64 / aarch64) — Verify canonical archive SHA-256 against SHA256SUMS.txt sha256sum -c SHA256SUMS.txt