{
  "about": "The EcoCloud governance kernels — deterministic, zero-dependency, signable decision primitives. Each maps to a phase of the governed cross-org transaction lifecycle. status: 'wired' = runs on live data via a deployed endpoint/RPC; 'primitive' = conformance-tested + has a live in-browser demo, but not yet wired onto live mutations. This file is the single source of truth the Trust-Layer page renders.",
  "updated": "2026-06-23",
  "conformance_assertions": 724,
  "honest_note": "These are decision primitives, not a live network. 'wired' means it gates real data today; 'primitive' means it is tested and demoable but you still wire it onto your own data/connector. EcoCloud never moves money, runs no SAP/ERP connector, and ships no ZK/Wasm (declined).",
  "phases": [
    { "key": "lifecycle", "label": "Lifecycle spine", "blurb": "the Auth·Clear·Settle loop every cross-org mutation runs through" },
    { "key": "identity", "label": "Identity & trust", "blurb": "who is this agent, and how much is it trusted?" },
    { "key": "authorize", "label": "Authorize", "blurb": "may this action proceed — within scope, limit, and approvals?" },
    { "key": "clear", "label": "Clear", "blurb": "execute against the System of Record — validated, reversible, idempotent" },
    { "key": "settle", "label": "Settle", "blurb": "verify it completed and emit a signed, provable record" },
    { "key": "audit", "label": "Audit & dispute", "blurb": "prove conformance and attribute fault after the fact" },
    { "key": "measure", "label": "Measure", "blurb": "quantify the work — resource budget and expected revenue (a measure, never money)" }
  ],
  "kernels": [
    { "key": "acs", "name": "Auth·Clear·Settle", "phase": "lifecycle", "status": "primitive", "decides": "the three-phase lifecycle — phases can't be skipped; a receipt issues only at settle", "demo": "/acs-kernel/", "source": "/kernel/flowdesk-acs-kernel.js" },

    { "key": "uaid", "name": "Universal Agent ID", "phase": "identity", "status": "primitive", "decides": "is this agent's signed capability credential valid, unexpired, in-scope, under its limit?", "demo": "/uaid-kernel/", "source": "/kernel/flowdesk-uaid-kernel.js" },
    { "key": "kya", "name": "Know Your Agent", "phase": "identity", "status": "primitive", "decides": "should a merchant transact with this agent buyer — approve, step-up to a human, or decline?", "demo": "/kya-kernel/", "source": "/kernel/flowdesk-kya-kernel.js" },
    { "key": "coalition", "name": "Coalition (union-find)", "phase": "identity", "status": "wired", "decides": "which agents are working together — connected components of the agreement graph", "demo": "/coalition-kernel/", "source": "/kernel/flowdesk-coalition-kernel.js" },
    { "key": "sigmoid", "name": "Reputation (sigmoid)", "phase": "identity", "status": "wired", "decides": "an agent's calibrated [0,1] trust level over its signed track record", "demo": "/sigmoid-kernel/", "source": "/kernel/flowdesk-sigmoid-kernel.js" },
    { "key": "tanh", "name": "Consensus (tanh)", "phase": "identity", "status": "wired", "decides": "a signed (−1,1) trend — is this agent moving toward or away from trust?", "demo": "/tanh-kernel/", "source": "/kernel/flowdesk-tanh-kernel.js" },

    { "key": "authority", "name": "Authority subsetting", "phase": "authorize", "status": "primitive", "decides": "effective authority = delegator ∩ grant — an agent can't exceed its human", "demo": "/authority-kernel/", "source": "/kernel/flowdesk-authority-kernel.js" },
    { "key": "escrow", "name": "Signing-limit escrow", "phase": "authorize", "status": "primitive", "decides": "is the action's value within the signing limit, or does it escrow to a human?", "demo": "/escrow-kernel/", "source": "/kernel/flowdesk-escrow-kernel.js" },
    { "key": "foureyes", "name": "Four-eyes (maker-checker)", "phase": "authorize", "status": "primitive", "decides": "does a high-value action have a distinct, authorized second approver?", "demo": "/foureyes-kernel/", "source": "/kernel/flowdesk-foureyes-kernel.js" },
    { "key": "jury", "name": "Review jury (N-role quorum)", "phase": "authorize", "status": "primitive", "decides": "did a custom action clear every required role (risk·legal·compliance) by distinct authorized reviewers, in order — the Glass-Box generalization of four-eyes?", "demo": "/jury-kernel/", "source": "/kernel/flowdesk-jury-kernel.js" },
    { "key": "yield", "name": "Yield guard (margin)", "phase": "authorize", "status": "primitive", "decides": "on proposed deal terms — approve, counter to the margin floor, escalate the discount to a human, or reject (a measure + gate; never moves money)", "demo": "/yield-kernel/", "source": "/kernel/flowdesk-yield-kernel.js" },
    { "key": "rollout", "name": "Risk-based rollout", "phase": "authorize", "status": "primitive", "decides": "advance / hold / rollback an agent's autonomy ramp (shadow→canary→full) — only while overrides + errors stay under ceiling and the flash-crash breaker hasn't tripped", "demo": "/rollout-kernel/", "source": "/kernel/flowdesk-rollout-kernel.js" },
    { "key": "constdiff", "name": "Constitution version control", "phase": "authorize", "status": "primitive", "decides": "diff two Agent-Constitution versions + hash each — a loosening (removed guard / granted allow / raised limit) forces human review; a pure tightening auto-applies", "demo": "/constdiff-kernel/", "source": "/kernel/flowdesk-constdiff-kernel.js" },
    { "key": "preflight", "name": "Dry-run preflight", "phase": "authorize", "status": "primitive", "decides": "on a TESTRUN result — allow, stage for review, or block the write?", "demo": "/preflight-kernel/", "source": "/kernel/flowdesk-preflight-kernel.js" },
    { "key": "meter", "name": "GAU meter (Newton)", "phase": "measure", "status": "primitive", "decides": "can this call afford its GAU cost, and how many more fit (Newton–Raphson horizon)?", "demo": "/meter-kernel/", "source": "/kernel/flowdesk-meter-kernel.js" },
    { "key": "forecast", "name": "Pipeline forecast", "phase": "measure", "status": "primitive", "decides": "a revenue team's expected revenue — Σ deal value × stage probability (commit + booked too)", "demo": "/forecast-kernel/", "source": "/kernel/flowdesk-forecast-kernel.js" },
    { "key": "rating", "name": "Usage rating", "phase": "measure", "status": "primitive", "decides": "the billable basis from VERIFIED work (interchange / outcome % / per-UAID) — EcoCloud measures, Stripe charges", "demo": "/rating-kernel/", "source": "/kernel/flowdesk-rating-kernel.js" },

    { "key": "finid", "name": "Financial-identifier validation", "phase": "clear", "status": "primitive", "decides": "is the IBAN (mod-97) / BIC / currency / amount well-formed before posting?", "demo": "/finid-kernel/", "source": "/kernel/flowdesk-finid-kernel.js" },
    { "key": "reversal", "name": "Compensating transaction", "phase": "clear", "status": "wired", "decides": "may this posted mutation be reversed, and is the key non-replayable?", "demo": "/reversal-kernel/", "source": "/kernel/flowdesk-reversal-kernel.js" },

    { "key": "ledger", "name": "Verifying-ledger close-out", "phase": "settle", "status": "wired", "decides": "may the task be marked done — only when every ledger reference is confirmed", "demo": "/ledger-kernel/", "source": "/kernel/flowdesk-ledger-kernel.js" },
    { "key": "passport", "name": "Compliance Passport", "phase": "settle", "status": "primitive", "decides": "did every step of the run clear every gate — one signed conformance certificate", "demo": "/passport-kernel/", "source": "/kernel/flowdesk-passport-kernel.js" },
    { "key": "contract", "name": "Agent work contract (SOW)", "phase": "settle", "status": "primitive", "decides": "did the agent fulfill the statement of work — score a SIGNED attestation against the contract's rubric/SLA/scope → fulfilled|breached|unverified + the billing basis (earned vs charged-back) + a dispute code; the basis is a measure, never a transfer", "demo": "/contract-kernel/", "source": "/kernel/flowdesk-contract-kernel.js" },

    { "key": "fault", "name": "Fault attribution", "phase": "audit", "status": "primitive", "decides": "when an action goes bad, where did it originate and who is liable?", "demo": "/fault-kernel/", "source": "/kernel/flowdesk-fault-kernel.js" },
    { "key": "lineage", "name": "Regulator-Mode lineage", "phase": "audit", "status": "primitive", "decides": "assemble a task's audit events into an ordered, classified, fingerprinted lifecycle tree", "demo": "/lineage-kernel/", "source": "/kernel/flowdesk-lineage-kernel.js" },
    { "key": "friction", "name": "Friction / override hotspots", "phase": "audit", "status": "primitive", "decides": "where the AI gets stuck — aggregate the audit log by task type and rank the override hotspots (min-volume gated; an unknown outcome counts as friction)", "demo": "/friction-kernel/", "source": "/kernel/flowdesk-friction-kernel.js" },
    { "key": "compliance", "name": "Compliance evidence export", "phase": "audit", "status": "primitive", "decides": "map the hash-chained audit graph onto a control framework (SOC 2) → per-control evidence + coverage + gaps; an evidence pack for an auditor, NOT a certification (fail-closed: no evidence = gap)", "demo": "/compliance-kernel/", "source": "/kernel/flowdesk-compliance-kernel.js" },
    { "key": "trajectory", "name": "Trajectory replay verifier", "phase": "audit", "status": "primitive", "decides": "replay a dispatch's ordered execution log — order, hash-chain, constraints, tools, termination — is it commit-safe?", "demo": "/trajectory-kernel/", "source": "/kernel/flowdesk-trajectory-kernel.js" },
    { "key": "watchdog", "name": "In-flight run watchdog", "phase": "clear", "status": "primitive", "decides": "while a run executes — continue, warn, reroute (drift), or abort (a ceiling/stall) on its time/steps/retries/tokens/confidence budget", "demo": "/watchdog-kernel/", "source": "/kernel/flowdesk-watchdog-kernel.js" },
    { "key": "recovery", "name": "Durable-runtime resume planner", "phase": "clear", "status": "primitive", "decides": "after a crash — replay the WAL journal: which steps to skip, retry, or compensate, and where to resume (a non-idempotent in-flight side effect is rolled back, never blind-retried)", "demo": "/recovery-kernel/", "source": "/kernel/flowdesk-recovery-kernel.js" },
    { "key": "breaker", "name": "Flash-crash circuit breaker", "phase": "clear", "status": "primitive", "decides": "before each action — allow, or trip (freeze) on a velocity breach / consecutive-error streak; open → cooldown deny → half-open trial probe (caps the blast radius of a runaway agent)", "demo": "/breaker-kernel/", "source": "/kernel/flowdesk-breaker-kernel.js" },
    { "key": "drift", "name": "Behavioral-drift canary", "phase": "identity", "status": "primitive", "decides": "scoring an agent against a golden canary corpus — keep autonomous, or degrade gracefully to human-escrow / read-only when accuracy drifts below its verified baseline", "demo": "/drift-kernel/", "source": "/kernel/flowdesk-drift-kernel.js" },
    { "key": "schedule", "name": "Capacity-aware scheduler", "phase": "measure", "status": "primitive", "decides": "WHEN work happens — places a task into the best open window (focus blocks + low load preferred, urgency by priority, deadlines honored); fail-closed on no fit", "demo": "/schedule-kernel/", "source": "/kernel/flowdesk-schedule-kernel.js" },
    { "key": "priority", "name": "Prioritization (RICE/WSJF)", "phase": "measure", "status": "primitive", "decides": "WHICH work first — a defensible backlog ranking by RICE = (reach×impact×confidence)/effort or WSJF = cost-of-delay/job-size; fail-closed (un-estimated items flagged, never divided by zero into the roadmap)", "demo": "/priority-kernel/", "source": "/kernel/flowdesk-priority-kernel.js" },
    { "key": "eval", "name": "Eval suite (agent CI/CD)", "phase": "measure", "status": "primitive", "decides": "ship or block a new Agent Constitution — run it against a frozen golden dataset and gate on the pass rate; a missing result is a failure and any regression blocks the build", "demo": "/eval-kernel/", "source": "/kernel/flowdesk-eval-kernel.js" },
    { "key": "experiment", "name": "A/B experiment (significance)", "phase": "measure", "status": "primitive", "decides": "ship_variant / keep_control / inconclusive — a two-proportion z-test on a launch; fail-closed (underpowered or malformed data never declares a winner)", "demo": "/experiment-kernel/", "source": "/kernel/flowdesk-experiment-kernel.js" },
    { "key": "netting", "name": "Multilateral netting", "phase": "settle", "status": "primitive", "decides": "VisaNet-style clearing — collapse many bilateral GAU obligations into each party's net position + a minimal set of off-network settlement instructions (Σ balances = 0; a measure, moves no money)", "demo": "/netting-kernel/", "source": "/kernel/flowdesk-netting-kernel.js" },
    { "key": "switch", "name": "Switch envelope (ISO-8583)", "phase": "lifecycle", "status": "primitive", "decides": "the on-the-wire auth/clear/dispute/reverse message a clearing switch will accept + route issuer↔provider — mandatory fields, version, idempotency; fail-closed on any malformed envelope", "demo": "/switch-kernel/", "source": "/kernel/flowdesk-switch-kernel.js" },
    { "key": "rules", "name": "Operating regulations", "phase": "audit", "status": "primitive", "decides": "the network dispute lifecycle — reason-code taxonomy, response SLA per code, auto-resolution on a missed deadline, and issuer-vs-provider liability assignment", "demo": "/rules-kernel/", "source": "/kernel/flowdesk-rules-kernel.js" },
    { "key": "mesh", "name": "Resilient mesh", "phase": "identity", "status": "primitive", "decides": "agent-network defensibility — whether a proposed gossip/audit topology is a genuine Ramanujan OPTIMAL expander (Ω(n) node removals to partition or eclipse, O(log n) mixing), combined with finite-field Diffie–Hellman key agreement for each edge", "demo": "/mesh-kernel/", "source": "/kernel/flowdesk-mesh-kernel.js" },

    { "key": "reconcile", "name": "Revenue reconciliation", "phase": "settle", "status": "primitive", "decides": "does record A (invoice/timesheet) match record B (contract/PO) item-by-item? match · overcharge · undercharge · unauthorized · missing → approve | dispute | escalate | void + signed dispute evidence", "demo": "/reconcile-kernel/", "source": "/kernel/flowdesk-reconcile-kernel.js" },
    { "key": "simulate", "name": "Scenario simulation", "phase": "authorize", "status": "primitive", "decides": "what-if impact analysis — EV per weighted dimension over best/likely/worst scenarios → risk band (low·medium·high·critical) + constitutional flags + recommendation (proceed|caution|defer|block); a deterministic rubric, not ML", "demo": "/simulate-kernel/", "source": "/kernel/flowdesk-simulate-kernel.js" },
    { "key": "policycheck", "name": "Output policy check", "phase": "audit", "status": "primitive", "decides": "does this agent-generated content violate any active policy (NDA · GDPR · company rules)? literal-string pattern match → pass · flag · block + matched rules + required remediation; output-layer guardrail (distinct from the action-gating constitution kernel)", "demo": "/policycheck-kernel/", "source": "/kernel/flowdesk-policycheck-kernel.js" },
    { "key": "critpath", "name": "Critical-path schedule", "phase": "authorize", "status": "primitive", "decides": "given a task DAG (nodes with durations + dependency edges), what's the critical path, ES/EF/LS/LF per task, total float, project duration, and max parallel width? Standard CPM/PERT — DuPont/Kelley-Walker 1957, Kahn 1962. Detects cycles, self-loops, duplicate nodes/edges. The LLM names the tasks; the kernel governs the graph and emits the canonical schedule.", "demo": "/critpath-kernel/", "source": "/kernel/flowdesk-critpath-kernel.js" },
    { "key": "verify", "name": "Dual-rail verification", "phase": "audit", "status": "primitive", "decides": "composes deterministic rails (schema match · value threshold · denied terms · scope · idempotency) with a probabilistic rail (externally-computed LLM-judge score vs threshold) into one verdict + a canonical attestation_basis ready to be signed with ES256. PASS · FAIL · INDETERMINATE · INVALID. Kernel is pure deterministic; the LLM call lives upstream. Never signs without the caller's key.", "demo": "/verify-kernel/", "source": "/kernel/flowdesk-verify-kernel.js" }
  ]
}