---
type: "GovernanceKernelSuite"
title: "Governance kernel suite"
description: "The 44 deterministic governance kernels that enforce policy, clear/settle work, and produce proof — each with a live demo and conformance assertions."
resource: "/trust-layer/"
tags: ["governance", "trust", "reference"]
timestamp: "2026-06-25"
---

Deterministic, dependency-free kernels grouped by lifecycle phase. These are decision primitives, not a live network. 'wired' means it gates real data today; 'primitive' means it is tested and demoable but you still wire it onto your own data/connector. Operant never moves money, runs no SAP/ERP connector, and ships no ZK/Wasm (declined).

# Schema
## Lifecycle spine (2)
- **Auth·Clear·Settle** — the three-phase lifecycle — phases can't be skipped; a receipt issues only at settle [primitive]
- **Switch envelope (ISO-8583)** — the on-the-wire auth/clear/dispute/reverse message a clearing switch will accept + route issuer↔provider — mandatory fields, version, idempotency; fail-closed on any malformed envelope [primitive]

## Identity & trust (7)
- **Universal Agent ID** — is this agent's signed capability credential valid, unexpired, in-scope, under its limit? [primitive]
- **Know Your Agent** — should a merchant transact with this agent buyer — approve, step-up to a human, or decline? [primitive]
- **Coalition (union-find)** — which agents are working together — connected components of the agreement graph [wired]
- **Reputation (sigmoid)** — an agent's calibrated [0,1] trust level over its signed track record [wired]
- **Consensus (tanh)** — a signed (−1,1) trend — is this agent moving toward or away from trust? [wired]
- **Behavioral-drift canary** — scoring an agent against a golden canary corpus — keep autonomous, or degrade gracefully to human-escrow / read-only when accuracy drifts below its verified baseline [primitive]
- **Resilient mesh** — agent-network defensibility — whether a proposed gossip/audit topology is a genuine Ramanujan OPTIMAL expander (Ω(n) node removals to partition or eclipse, O(log n) mixing), combined with finite-field Diffie–Hellman key agreement for each edge [primitive]

## Authorize (10)
- **Authority subsetting** — effective authority = delegator ∩ grant — an agent can't exceed its human [primitive]
- **Signing-limit escrow** — is the action's value within the signing limit, or does it escrow to a human? [primitive]
- **Four-eyes (maker-checker)** — does a high-value action have a distinct, authorized second approver? [primitive]
- **Review jury (N-role quorum)** — did a custom action clear every required role (risk·legal·compliance) by distinct authorized reviewers, in order — the Glass-Box generalization of four-eyes? [primitive]
- **Yield guard (margin)** — on proposed deal terms — approve, counter to the margin floor, escalate the discount to a human, or reject (a measure + gate; never moves money) [primitive]
- **Risk-based rollout** — advance / hold / rollback an agent's autonomy ramp (shadow→canary→full) — only while overrides + errors stay under ceiling and the flash-crash breaker hasn't tripped [primitive]
- **Constitution version control** — diff two Agent-Constitution versions + hash each — a loosening (removed guard / granted allow / raised limit) forces human review; a pure tightening auto-applies [primitive]
- **Dry-run preflight** — on a TESTRUN result — allow, stage for review, or block the write? [primitive]
- **Scenario simulation** — what-if impact analysis — EV per weighted dimension over best/likely/worst scenarios → risk band (low·medium·high·critical) + constitutional flags + recommendation (proceed|caution|defer|block); a deterministic rubric, not ML [primitive]
- **Critical-path schedule** — given a task DAG (nodes with durations + dependency edges), what's the critical path, ES/EF/LS/LF per task, total float, project duration, and max parallel width? Standard CPM/PERT — DuPont/Kelley-Walker 1957, Kahn 1962. Detects cycles, self-loops, duplicate nodes/edges. The LLM names the tasks; the kernel governs the graph and emits the canonical schedule. [primitive]

## Clear (5)
- **Financial-identifier validation** — is the IBAN (mod-97) / BIC / currency / amount well-formed before posting? [primitive]
- **Compensating transaction** — may this posted mutation be reversed, and is the key non-replayable? [wired]
- **In-flight run watchdog** — while a run executes — continue, warn, reroute (drift), or abort (a ceiling/stall) on its time/steps/retries/tokens/confidence budget [primitive]
- **Durable-runtime resume planner** — after a crash — replay the WAL journal: which steps to skip, retry, or compensate, and where to resume (a non-idempotent in-flight side effect is rolled back, never blind-retried) [primitive]
- **Flash-crash circuit breaker** — before each action — allow, or trip (freeze) on a velocity breach / consecutive-error streak; open → cooldown deny → half-open trial probe (caps the blast radius of a runaway agent) [primitive]

## Settle (5)
- **Verifying-ledger close-out** — may the task be marked done — only when every ledger reference is confirmed [wired]
- **Compliance Passport** — did every step of the run clear every gate — one signed conformance certificate [primitive]
- **Agent work contract (SOW)** — did the agent fulfill the statement of work — score a SIGNED attestation against the contract's rubric/SLA/scope → fulfilled|breached|unverified + the billing basis (earned vs charged-back) + a dispute code; the basis is a measure, never a transfer [primitive]
- **Multilateral netting** — VisaNet-style clearing — collapse many bilateral GAU obligations into each party's net position + a minimal set of off-network settlement instructions (Σ balances = 0; a measure, moves no money) [primitive]
- **Revenue reconciliation** — does record A (invoice/timesheet) match record B (contract/PO) item-by-item? match · overcharge · undercharge · unauthorized · missing → approve | dispute | escalate | void + signed dispute evidence [primitive]

## Audit & dispute (8)
- **Fault attribution** — when an action goes bad, where did it originate and who is liable? [primitive]
- **Regulator-Mode lineage** — assemble a task's audit events into an ordered, classified, fingerprinted lifecycle tree [primitive]
- **Friction / override hotspots** — where the AI gets stuck — aggregate the audit log by task type and rank the override hotspots (min-volume gated; an unknown outcome counts as friction) [primitive]
- **Compliance evidence export** — map the hash-chained audit graph onto a control framework (SOC 2) → per-control evidence + coverage + gaps; an evidence pack for an auditor, NOT a certification (fail-closed: no evidence = gap) [primitive]
- **Trajectory replay verifier** — replay a dispatch's ordered execution log — order, hash-chain, constraints, tools, termination — is it commit-safe? [primitive]
- **Operating regulations** — the network dispute lifecycle — reason-code taxonomy, response SLA per code, auto-resolution on a missed deadline, and issuer-vs-provider liability assignment [primitive]
- **Output policy check** — does this agent-generated content violate any active policy (NDA · GDPR · company rules)? literal-string pattern match → pass · flag · block + matched rules + required remediation; output-layer guardrail (distinct from the action-gating constitution kernel) [primitive]
- **Dual-rail verification** — composes deterministic rails (schema match · value threshold · denied terms · scope · idempotency) with a probabilistic rail (externally-computed LLM-judge score vs threshold) into one verdict + a canonical attestation_basis ready to be signed with ES256. PASS · FAIL · INDETERMINATE · INVALID. Kernel is pure deterministic; the LLM call lives upstream. Never signs without the caller's key. [primitive]

## Measure (7)
- **GAU meter (Newton)** — can this call afford its GAU cost, and how many more fit (Newton–Raphson horizon)? [primitive]
- **Pipeline forecast** — a revenue team's expected revenue — Σ deal value × stage probability (commit + booked too) [primitive]
- **Usage rating** — the billable basis from VERIFIED work (interchange / outcome % / per-UAID) — Operant measures, Stripe charges [primitive]
- **Capacity-aware scheduler** — WHEN work happens — places a task into the best open window (focus blocks + low load preferred, urgency by priority, deadlines honored); fail-closed on no fit [primitive]
- **Prioritization (RICE/WSJF)** — WHICH work first — a defensible backlog ranking by RICE = (reach×impact×confidence)/effort or WSJF = cost-of-delay/job-size; fail-closed (un-estimated items flagged, never divided by zero into the roadmap) [primitive]
- **Eval suite (agent CI/CD)** — ship or block a new Agent Constitution — run it against a frozen golden dataset and gate on the pass rate; a missing result is a failure and any regression blocks the build [primitive]
- **A/B experiment (significance)** — ship_variant / keep_control / inconclusive — a two-proportion z-test on a launch; fail-closed (underpowered or malformed data never declares a winner) [primitive]

# Citations
724 conformance assertions. Index: [Trust Layer](/trust-layer/). Catalog JSON: [/data/kernels.json](/data/kernels.json).