--- name: Aziel Runtime description: >- Aziel Runtime is a node-meshed orchestration suite of MCP-connected software designed to coordinate specialized tools through a shared, security-gated runtime while preserving provenance, chain-of-custody, temporal integrity, and auditable execution. One door — discover, route, refuse. FragGate over the catalog: hashed registry, DecisionGATE after ChainLock-IN, ask/refuse ledger. Dual surface — agent/MCP has no technical UI chrome. Humans use Softwares in the Worker UI on this VibeLock host (browser / PWA) — no download required. Optional suite pack JSON remains at /download. Flutter mobile/ is not vendored in this repo. 2.0.0-rc1 is the certification-point freeze (docs/2.0/; no intentional behavioral breaks; remain-OFF untouched). 1.9.3 closes remaining AZRT-1.9-GAPS-CLOSE items (isolate AZ-OS session VFS; isolate-safe jeeves; binding-gated media-run; published attestation path). 1.9.2 binds Workers Browser Rendering and live D1 MASTER (records). 1.9.1 closes AZRT-1.9-GAPS-CLOSE. 1.9.0 closed AZRT-1.9-CLOSE-1.0. 1.7.10 makes QNM Live Nodes durable (read-only suite-presence is ON by default; GET /v1/mesh never enables radios beyond that; cron or request-path fans out live Softwares product Workers; TTL 5 min). 1.7.9 cross-maps AZCoherence (peers azclce / AZInterface / AKM-TRIAD fabric neighbor; hubs + Worker URL; domain stays null). 1.7.8 lands EmbryoLock as a true in-process engine (live-with-local-destructive-boundary; wipe/unlock stay FG-STUB; worker_home embryolock-download-tracker). 1.7.7 lands AZCoherence (AZC-0.1) as a true in-process FragGate Softwares engine (second-pass triad coherence; cite https://github.com/AzielEliab/AZCoherence; not AKM-TRIAD). 1.7.6 syncs 4DMap LIVE_OPS with product 0.2.0 (pin/span/stack/gap/fork/walk/lens/class/cohort/absence/cap/join/list/example plus frame_status/axis_describe/walk_trace/card_export/card_import/verify_chain/neighbor_cite; inspection frame, not an extra door). 1.7.5 is Softwares capability wave 1 (decisiongate / forgereceipts / temporallock / staticclock / chronolock / trajectorylock / spectrallock). 1.7.4 enhances 4DMap LIVE_OPS (frame_status/axis_describe/walk_trace/card_export/card_import/verify_chain/neighbor_cite; inspection frame, not an extra door). 1.7.3 aligns audit WARN copy (exist.mcp → tools/list; public FragGate call; catalog count_note; 4DMap not an extra door). 1.7.2 adds GET /v1/azpipe/arch (MASTER-33 cite/read; same FragGate pipeline payload; not a Softwares door). 1.7.1 adds AKM-TRIAD-1.0 (adaptive recollection, Bayesian calibration, 3-of-4 triad; not Softwares-tab). 1.7.0 locks MASTER-33 (FragGate single door; Lamb Lens after FragGate; RoseClock forward-only). 1.6.15 locked the suite hop order (SUITE-PIPE-1.6.15; LambGate is not a hop). 1.6.14 adds 4DMap (4DM-WP-1.0) as a true in-process engine (four-axis inspection frame T/Δ/Γ/Π; inspection frame after AZPIPE, not an extra door). 1.6.13 adds the QNM-BUILD-1.0 suite rollup (GET /v1/mesh live/locked/isolated; not a login mesh; full node is local qnm-node/). Packet-transfer coding design is QNS-CD-1.0 (photon QNS1 1.3 on local qnsd; GET /v1/qns cites only). GET /v1/azpipe/arch cites the locked MASTER-33 AZPIPE strip (same FragGate pipeline payload; not a Softwares door). 1.6.12 adds GET /v1/software (hub Software-tab catalog) plus GET /v1/update/check for install.sh / local UIs / mobile. 1.6.11 adds a durable FragGate UI-op alias map and names EmbryoLock as stub / local-not-hosted (not an engine). 1.6.10 sets AZBrowser and AZNet catalog one_line to separate software (not engine). 1.6.9 frames AZHub, AZInterface, AZBrowser, and AZNet as separate softwares under the same FragGate door. 1.6.8 adds AZHub and AZInterface as two separate softwares under the same FragGate door (AIH-WP-1.0). 1.6.7 adds AZNet (AZN-WP-0.1) as a FragGate-live engine (silent verification side-net). 1.6.6 adds AZBrowser (AZB-1.0) as a FragGate-live engine (Lamb Lens ethical research browser). AZNet is separate software (same FragGate door; order/token pairing only). 1.6.5 adds AZMail (APP 1.0) as a FragGate-live engine (mesh default off). 1.6.4 adds PeaceLock (PL-WP-0.1) as a true in-process engine. 1.6.3 adds KV-backed API use trackers (GET /v1/uses). 1.6.2 widens the public door to sensible advisory engines; stubs still refuse. 1.6.1 lists every major OpenAPI/MCP/HTTP client. 1.6.0 FragGate door cut. Kernel: https://github.com/AzielEliab/fraggate --- # Aziel Runtime This is software you use in chat. **One door — discover, route, refuse.** There is no extra technical UI for the agent surface. Show the user the software output, then take the next input. FragGate gate (registry): https://github.com/AzielEliab/fraggate (FG-0.1) ## Start here Call Softwares (tools/list name Softwares), pick a slug, then fraggate_call. library_lookup searches library papers and cites. The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. `runtime_software` remains a tools/call alias. `confirm=true` when a call writes. `dry_run=true` previews and writes nothing. `background=true` returns Running until a receipt hash exists. Done only with that hash. `tools/list` stays 36. `fraggate_list`, `fraggate_describe`, `fraggate_call`, and `chainlock_*` stay for diagnostics. Ledger ops stamp ChainLock on the acts chain, then TemporalLock and ForgeReceipts (decisiongate_check, library_lookup, memory_observe, memory_resolve, memory_calibrate, mesh_join, mesh_enable, mesh_heartbeat, mesh_leave, mesh_broadcast, runtime_run, runtime_session_exec). `fraggate_call` reports those three from the pipe when a real hash exists. Lamb Lens, SweepGate, Sentinel, and RoseClock run inside that pipe. Reads do not stamp ChainLock, TemporalLock, or ForgeReceipts. Terminal: `aziel-runtime call foldlock fold-preview --local --dry-run`. A long job: `aziel-runtime call foldlock fold-preview --background --local`, then `aziel-runtime job `. `aziel-runtime service status` reports Running or Quiet and does not call the door. ## Command prompts Spec: CMD-PROMPT-1.0 One set for Ask Jeeves, AZAI Guide, the suite ask bar, FragGate help, /llms.txt, and the runtime skill. help lists every command below. softwares lists every Software with a one-line identity. First call: Softwares (pick a slug) → FragGate fraggate_call (run that slug) → library_lookup for library papers and cites. That path is help text. It is not written onto Softwares desk cards and it is not a field on GET /v1/software. help is this command list. It is not Ask Jeeves suite_help. Ask Jeeves suite_help stays on the Aziel Digital Library card (aziel-corpus) only. A question that names one Software still routes to that Software. MCP Softwares {} and GET /v1/software stay the Softwares catalog. They do not include this list. - help (commands, ?) — List every common command prompt and the first-call path (Softwares, then FragGate, then library_lookup). This prompt is not Ask Jeeves suite_help. - softwares (software) — List every Software on this build with name, slug, domain tab, and one-line. - florence — Ask the shelf where Florence is. - tabs (domains) — Explain the domain tabs and which Softwares sit on each. - corpus — Explain the Corpus sub-tab under Aziel Elroi Eliab. - receipts (dry_run) — Explain receipts, the confirm box, and dry_run. - run (fraggate) — Explain how to run a Softwares card through FragGate. - mesh — Point at mesh awareness. This command does not join a node. - version (build) — Name this build and the Softwares count. - version_id — Report the published Worker version id when this path has one. - count — State the Softwares count. Ask Jeeves is not one of those cards. - jeeves — Explain Ask Jeeves suite help on the Aziel Digital Library card only. - intro — Walk the first clicks. Ask Jeeves and AZAI Guide are the coaches. - guide — Explain AZAI Guide. Guide does not write memory. - 4dmap — Point at 4DMap on the Forensics tab. - start (start here) — Show the start-here line. - skill — Point at the runtime skill markdown. - mcp — Point at the MCP surface. tools/list stays 36. ## Dual surface (product law) 1. **Agent / MCP** — Software runs 100% through the agent. Display `display.title`, `display.summary`, and `display.fields` in the AI client. Feed the next input back into the same product. Session ids, receipts, OpenAPI, and HTTP stay invisible unless the user asked for them. 2. **Human software** — Humans use Softwares in the Worker UI on this VibeLock host (browser / PWA) — no download required. Agents use OpenAPI/MCP. Optional suite pack JSON remains at `/download`. Do not gut the Worker UI. Flutter `mobile/` is not vendored here. ## How an agent uses this like software 1. **Call Softwares (tools/list name Softwares), pick a slug, then `fraggate_call`.** `library_lookup` searches library papers and cites. The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. `confirm=true` writes. `dry_run=true` previews and writes nothing. `background=true` returns Running until a receipt hash exists. 2. **Diagnostics.** `fraggate_list`, `fraggate_describe`, `fraggate_verify`, and `fraggate_call` stay available. `fraggate_call` is THE single door (CallEnvelope `{ name|slug, op, payload, claim? }`). Locked path (MASTER-33): FragGate → Lamb Lens → SweepGate → Sentinel → Provenance/Input Packet → ChainLock-IN → DecisionGATE → AZPIPE → Internal Domain Layer → optional ASE → RoseClock → TemporalLock → ChainLock-OUT → ForgeReceipts → Return. Lamb Lens is fabric after FragGate. Domain softwares execute only after AZPIPE. Live allowlist: every sensible advisory / score / classify / gate / search / preview / render / verify / hash / receipt / game / overlay / route / status engine already hosted in-process. VeilLock stays local_only. Stub verbs still refuse. 3. **Refuse.** A `tools/call` name that is not listed is a JSON-RPC error (`-32602`, `Unknown tool: `). `error.data` still carries `FG-HALLUC-TOOL`. An unknown slug or op on a listed tool still returns that refusal as a tool result (`isError`). Stubs and `local_only` do not execute on the public mesh. Gate BLOCK/REVISE is ledgered; no handler. 4. **Show the output.** Results are `{ display, result, ledger_tip? }`. Show `display` to the user. 5. **Take the next input.** **Attempt linkage (additive).** A call may carry `request_id`, `attempt_n`, `parent_receipt_id`, `correlation_id`, and `outcome`. Those names are hashed into a new ForgeReceipts receipt, copied onto the FragGate ResultEnvelope, and sealed on a new session receipt. `parent_receipt_id` is the prior attempt's receipt hash (null on the first). `ledger_tip.prev` is call-order only (`prev_role` `call-order`, `prev_is_retry_parent` false) and is not the retry parent. This is hash linkage, not a forensic finding and not a court filing. Receipts sealed without integer `attempt_n` keep the older hash. **Interface orchestration (human side).** `POST /v1/interface` and MCP method `interface/orchestrate` share one planner. It is not a `tools/list` name and not a second FragGate door. VeilLock safe calls are `describe`, `join_plan`, `engulf_plan`, `status_report`, and `runtime_ui` (schema `veillock-runtime-ui-1`, `local_only`, `public_door_ops` empty). Those calls do not launch, join, register a camera, return a key, lift a veil, or append the public receipt chain. `mesh_awareness` does not read or change the live roster. `seal` requires `confirm: true`. A sealed local-only plan stores an ACT-RECEIPT-1.0 row (`hash`, `request`, `output`, `event`, plus attempt ids) and appends the public chain only through the existing fail-open path. A sealed live op dispatches through FragGate. The receipt output names the code that came back, and outcome is failed unless that code is FG-OK. The public append is re-hashed from the corpus tip. The isolate ledger hash is not the public previous_hash. Passphrase-shaped fields are refused and are not stored. The local audit store is isolate memory, not a rewrite key, and not a court finding. MCP `tools/list` is 36 live tools. First call: Softwares (pick a slug) → `fraggate_call` → `library_lookup` for library papers and cites. The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Diagnostics stay `fraggate_list` → `fraggate_describe` → `fraggate_call` (foldlock/fold-preview, or `decisiongate_check` with `dry_run=true`). Also on that list: `runtime_skill`, `fraggate_verify`, `library_lookup` (read-only corpus papers and cites), suite `mesh_*` (QNM-BUILD-1.0 rollup; read-only suite-presence ON by default), fabric `chainlock_*` (CL-WP-0.4 / LS-WP-0.1; append-only; diagnostics), and `memory_*` (AKM-TRIAD-1.0; append-only belief). ChainLock and memory are append-only. **LIVE fabric** (runtime, not Softwares-tab products): AZPIPE (`AP-WP-0.2`, magic FLD3) wraps `fraggate_call` so admitted payloads never present raw inbound bytes. **Locked hop order (1.7.0 / MASTER-33):** Human → AZInterface → PUBLIC/UI/AGENT/API → FragGate → Lamb Lens → SweepGate → Sentinel → Provenance/Input Packet → ChainLock-IN → DecisionGATE → AZPIPE → Internal Domain Layer → optional ASE → RoseClock (forward-only; StaticClock/VECTOR as needed) → TemporalLock → ChainLock-OUT → ForgeReceipts → Return. FragGate is THE single door. Lamb Lens is fabric ethics after FragGate (not Softwares-tab, not a second door). Domains are isolation labels, not doors. RoseClock sequence never decreases. FoldLock fld3-wire is internal to AZPIPE. LambGate is not a hop. Illegal reorder is refused. SweepGate (`SG-WP-0.1`) airlocks poison / malware-class / block-keys, and isolates off-origin only when inbound and untrusted; ChainLock (`CL-WP-0.4`) append-only stamps (vault `vault/chains/.jsonl` on CLI; Worker KV/memory) — ChainLock-IN inbound, ChainLock-OUT outbound receipts; LOCKSET (`LS-WP-0.1`) fail-closed seal citing `https://godlock.uk` (runtime does not write the public ledger); packed catalog (`RL-WP-0.1-runtime`) is a single-key read with edge Cache-Control; **QNS-CD-1.0** is the Quantum Node Signal packet-transfer coding design (photon QNS1 1.3 on local `qnsd` in https://github.com/AzielEliab/qnm-node — companion to QNM-BUILD-1.0 / AIH-WP-1.3). `GET /v1/qns` cites only; the public Worker does not proxy local via emit and is not a wipe/control plane. qnsd uses the same AZPIPE / SweepGate / APG / ChainLock laws locally. Catalog GET / HTML stay full (200) for humans and SEO; soft caps apply only to expensive fan-out. Donation stays static (no KV). `GET /v1/mesh` never enables. Do **not** add QNS, AKM-TRIAD, or ACT-RECEIPT as Softwares-tab product slugs. Adaptive memory is LIVE fabric behind FragGate (`POST /v1/memory/*`, MCP `memory_*`, FragGate `slug=memory`). Bayesian posterior is calibrated belief, not truth. **ACT-RECEIPT-1.0** is the public four-field action-receipt mesh copy. The chain lives on `https://www.azielcorpuslibrary.net/receipts`. This runtime appends after FragGate list/call, POST /mcp, and significant POST /v1/* when `RECEIPT_APPEND_TOKEN` is set (header `x-aziel-receipt`). Missing token is fail-open. `GET /v1/receipts` cites; `GET /v1/receipts/tip` proxies the corpus tip. No user/IP/geo. MESH-VAULT lite may mint catalog/download/mesh events. **NO-LIE-NO-REWRITE-1.0** is companion law under **CROSS-NETWORK-SURVIVAL-1.0** (does not replace the machine tip): receipts that still hash; copies not all on one tunnel; no rewrite key; the network is never allowed to lie even to self-preserve. Do **not** walk the user through `runtime_session_open` → policy → exec → receipt → close. Those tools, `runtime_run`, raw `*_health`, and `runtime_manifest` are **advanced/internal**. Do **not** call flat `{slug}_{op}` names (1.5.0 pile). They are not in `tools/list`. That is hallucination with a receipt. HTTP `POST /p/{slug}/{op}` is still a **proxy**. Proxy without a session receipt is **not** exec. Public VPN auto-binds AZVPN (HTTPS/WS REAL; WireGuard/OpenVPN/L3 SLOT; origin-hiding false). `GET /v1/mesh` cites `vpn=true` and never opens a session. AZMail anonymous ring is FragGate LIVE_OPS only (default off; not SMTP). The suite QNM rollup (`GET /v1/mesh`, MCP `mesh_*`, FragGate `slug=mesh`) is live/locked/isolated counts plus read-only suite-presence ON by default. `GET /v1/mesh` never enables radios beyond that. Public `POST /v1/mesh/disable` refuses `MESH-DISABLE-REFUSED`. Cron or request-path fans out live Softwares product Workers (TTL 5 min). Not a login mesh. Views/MCP/downloads do not enter QNM-S. Full node process is local `qnm-node/`. Packet-transfer coding design is **QNS-CD-1.0** (photon QNS1 1.3 on local `qnsd`; `GET /v1/qns` cites only). Library host `www.azielcorpuslibrary.net/runtime/v1/mesh/enable` may return **409** `library-default-off` instead of Worker `MESH-NEED-BEARER` / `MESH-BAD-BEARER` — that overlay is host-side (aziel-corpus), not this Worker. GET never enables extra radios. Refuse envelopes (`exist.mcp`) list the live MCP tool set and point at `POST /mcp tools/list`. That hint is not an exec allowlist. Unknown names still `FG-HALLUC-TOOL`. Stubs still `FG-STUB`. Every catalog slug is a true engine. Cloudflare isolate is the jail. Hosted AZAI is protocol mirror + Lamb check, **not** the blend. Identity is **Aziel Eliab** only. **1.7.10 = durable QNM Live Nodes.** Read-only suite-presence is ON by default. GET /v1/mesh never enables radios beyond that. Cron (`*/2 * * * *`) or request-path joins/heartbeats every live Softwares product Worker (`node_id` `{slug}-worker`, no `|`; TTL 5 min). Product Workers proxy `/v1/mesh/*` via `AZIEL_RUNTIME`. Not a login mesh. Not Node Gate. Not QNM-S. **1.7.9 = AZCoherence cross-map.** Catalog + engine `peers` / `cross_map`: azclce (peer scorer), AKM-TRIAD (fabric neighbor — not merged), AZInterface (human UI), Softwares hubs (azieleliab.com, azielcorpuslibrary.net, godlock.uk), product Worker URL. azclce reciprocates. Domain stays null (scoring-review placement; same pattern as decisiongate/forgereceipts). LIVE_OPS health/skill/doctor/verify and azbot toolkit cite azcoherence.**1.7.8 = EmbryoLock true in-process engine.** Vault/Custody with ARK. LIVE_OPS health/skill/doctor/verify-hash/policy/limitation cite the AzielEliab/EmbryoLock Stealth+ v1.1 contract (`Open Source Code`). Wipe/scorch/unlock-after-fail stay FG-STUB on the public mesh — Never execute on the public mesh. Catalog surface live-with-local-destructive-boundary. Softwares worker_home https://embryolock-download-tracker.vibelock.workers.dev/. AZChat stays name-only stub. **1.7.7 = AZCoherence (AZC-0.1).** True in-process FragGate Softwares engine. Second-pass triad coherence reviewer (primary vs alternate → PASS/FLAG/NEUTRALIZE/REFUSE). LIVE_OPS health, skill, doctor, verify, review_triad, alternate_score, coherence_check, neutralize_hallucination. Softwares-tab Plain A–Z. Placement scoring-review (AZ-CLCE adjacent). Not AKM-TRIAD fabric. Never invents evidence. Confidence ≠ truth. Product cite: https://github.com/AzielEliab/AZCoherence.**1.7.6 = 4DMap product 0.2.0 LIVE_OPS sync.** pin, span, stack, gap, fork, walk, lens, class, cohort, absence, cap, join, list, example plus frame_status, axis_describe, walk_trace, card_export, card_import, verify_chain, neighbor_cite. Stubs stay. Not a sequential gate and not an extra door. Catalog version 0.2.0. GitBaby merges and deploys. **1.7.5 = Softwares capability wave 1.** Rich health/skill plus domain-true doctor/verify/import_export (or window/gates/schema/targets) on DecisionGATE, ForgeReceipts, TemporalLock, StaticClock, ChronoLock, TrajectoryLock, SpectralLock. Catalog `one_line` is capability-forward. LIVE_OPS matches engine ops. Checklist: `docs/audit/SUITE-CAPABILITY-CHECKLIST.md`. AKM-TRIAD-1.0 stays LIVE fabric (not Softwares-tab). 4DMap 1.7.4 inspection-frame ops stay.**1.7.4 = 4DMap inspection-frame capability bump.** LIVE_OPS add frame_status, axis_describe, walk_trace, card_export, card_import, verify_chain, neighbor_cite. Stubs stay. Not a sequential gate and not an extra door. **1.7.3 = audit WARN copy/hint.** Refuse `exist.mcp` lists the live MCP tool set and points at `POST /mcp tools/list`. Public FragGate call stays open; session mutate requires token when configured. Softwares-tab `count` includes placements; isolation `software_count` is 33. 4DMap catalog copy is inspection frame / not an extra door. OpenAPI lists `POST /mcp`.**1.7.2 = GET /v1/azpipe/arch.** Cite/read surface for the locked MASTER-33 AZPIPE strip (same payload as `GET /v1/fraggate` `pipeline` / `pipeline_strip`). Not a Softwares-tab door. Not a FragGate slug.**1.7.1 = AKM-TRIAD-1.0.** Adaptive knowledge recollection over ChainLock learn: Bayesian calibration, deterministic 3-of-4 triad (E/C/P/B), derived rebuildable index. Memory APIs behind FragGate. Not a Softwares-tab product. Posterior ≠ truth. No history rewrite. **1.7.0 = MASTER-33.** FragGate is THE single door. Public hop list: Human → AZInterface → PUBLIC/UI/AGENT/API → FragGate → Lamb Lens → SweepGate → Sentinel → Provenance/Input Packet → ChainLock-IN → DecisionGATE → AZPIPE → Internal Domain Layer → optional ASE → RoseClock (forward-only; StaticClock/VECTOR as needed) → TemporalLock → ChainLock-OUT → ForgeReceipts → Return. Lamb Lens is fabric ethics after FragGate (not Softwares-tab, not a second door). 11 domains / 33 softwares are isolation labels. AZChat is a name-only stub. ASE/VECTOR cite + refuse until armed. RoseClock sequence never decreases. Overrides MASTER-ARCHITECTURE-2.0 §4.2. No ZD30. No rollback. Identity Aziel Eliab only. **1.6.15 = locked suite pipeline (SUITE-PIPE-1.6.15).** Historical public hop list: PUBLIC/UI/Agents → FragGate → SweepGate → ChainLock-IN → DecisionGATE → AZPIPE → Domain Doors (4DMap inspection) → TemporalLock → StaticClock → ChainLock-OUT → Response/Receipt. Kept live; 1.7.0 extends it. FragGate `fraggate_call` aligns. DecisionGATE after ChainLock-IN, before domain exec. 4DMap stays the inspection frame — not a sequential gate. TemporalLock + StaticClock are advisory stamps on the envelope (existing engines). LambGate is not a hop. FoldLock fld3-wire stays internal. Illegal reorder is refused. Identity Aziel Eliab only. **1.6.14 = 4DMap (4DM-WP-1.0)** as a true in-process engine: four-axis inspection frame T/Δ/Γ/Π. Domain Door / inspection layer after AZPIPE routes to isolated engines — not a sequential gate. LIVE_OPS health/skill/card_new/card_pin/card_span/card_join/card_walk/card_list/verify_hash. truth_score/lumen_panel/invent_mark/backdate_class stay stub. Plain bucket. FragGate claims cite join types. ChainLock may stamp walks. Neighbors TemporalLock/StaticClock/ChronoLock/TrajectoryLock/SpectralLock. EmbryoLock stays stub. GET /v1/mesh never enables. RL packed catalog stays 0-KV hot path. **1.6.13 = QNM-BUILD-1.0 suite rollup** (companion to AIH-WP-1.1): `GET /v1/mesh` / `/status` (live/locked/isolated; never enables extra radios). Current law: read-only suite-presence ON by default; `POST /v1/mesh/disable` refuses `MESH-DISABLE-REFUSED`. Plus join/heartbeat/leave/nodes and optional hash-only broadcast (never a publish path). Not a login mesh. Full node process is local `qnm-node/`. Anon-broadcast is a local sibling of that process, not a loopback fence of the mesh. MCP `mesh_*` + FragGate `slug=mesh`. Each software card has `mesh: { path, enabled_default: true, spec, companion, rollup_only, qnm_s: false }` and `qns_cd: { spec: "QNS-CD-1.0", local: "https://github.com/AzielEliab/qnm-node", note: "Photon vias on local qnsd; Worker cites only" }`. AZMail mesh stays product-local. See `docs/NODE_MESH.md`. Designs: `docs/designs/` (AZL / SEC-FEAT / QNM-WP / NODE-OPS plus LIVE fabric CL-WP-0.4 / AP-WP-0.2 / SG-WP-0.1 / LS-WP-0.1 / RL-WP-0.1-runtime / QNS-CD-1.0 / SUITE-PIPE-1.6.15 plus product spec 4DM-WP-1.0). **1.6.12 = live software catalog + client updates:** `GET /v1/software` (mirror `GET /v1/fraggate/software`) is the authoritative hub catalog — every product plus EmbryoLock stub, sorted Plain A–Z → Gate A–Z → Lock A–Z (Clock ≠ Lock). `GET /v1/update/check?slug=&version=` and `GET /v1/update/manifest` for install.sh / local UIs / mobile. GitHub Action deploys on push to main. Agents prefer FragGate / `/v1/software` / `/mcp` (list → describe → call). Sibling software under one FragGate door — never separate FragGate engines. **1.6.11 = dual-surface op aliases:** Worker UI button names resolve to catalog LIVE_OPS (forward to the real engine method). EmbryoLock is named stub / local-not-hosted (describe?slug=embryolock; not a Worker; not a FragGate engine). **1.6.10 = framing: AZBrowser and AZNet catalog one_line say separate software, not separate engine.** Same FragGate door. Two catalog slugs stay. **1.6.9 = framing: AZHub, AZInterface, AZBrowser, and AZNet are separate softwares under the same FragGate door.** Catalog slugs stay. **1.6.8 = AZHub (AIH-WP-1.0) + AZInterface (AIH-WP-1.0)** as two separate softwares under the same FragGate door. Call only via `fraggate_call` / `POST /v1/fraggate/call` with `{ slug: "azhub", op: "..." }` or `{ slug: "azinterface", op: "..." }`. Hub is a Blank Key (does not interpret; refuses auto-unlock / completeness). Interface page cycles are pre-locked: OFF / integrity / ON / FULL SHUTDOWN / MEMORIAL. Never one combined product. DecisionGATE / FragGate ledger still apply before exec. **1.6.7 = AZNet (AZN-WP-0.1)** as a separate FragGate-live product (own Worker / own UI; silent verification side-net; hash stamps / garden / memorial; never hosts payloads). Call only via `fraggate_call` / `POST /v1/fraggate/call` with `{ slug: "aznet", op: "..." }`. Garden / stamp / memorial ops require AZBrowser pair_token AND pair_flag (functional order only — do not merge UIs). payload_host / serve_content_for_peer stay stub. DecisionGATE / FragGate ledger still apply before exec. **1.6.6 = AZBrowser (AZB-1.0)** as a FragGate-live engine (Lamb Lens ethical research browser: ethical search + advisory navigate). Call only via `fraggate_call` / `POST /v1/fraggate/call` with `{ slug: "azbrowser", op: "..." }`. MCP `fraggate_list` includes LIVE_OPS.azbrowser. Worker UI buttons call that same door. Cite; refuse harmful harvest; never invent visit results. Not Chromium. tor_exit / phoenix_wipe stay stub. AZNet is separate software (same FragGate door) — pairing is order/token only, not a shared Phase-1 UI. DecisionGATE / FragGate ledger still apply before exec. **1.6.5 = AZMail (APP 1.0)** as a FragGate-live engine (anonymous MCP mesh default off + advisory airlock; not a full internet MTA). Call only via `fraggate_call` / `POST /v1/fraggate/call` with `{ slug: "azmail", op: "..." }`. Host `/runtime` proxies that same FragGate door. Scan is LIVE-when-scanner-present. Airgap is present. Mailbox is encrypted-to-user. External SMTP is not end-to-end. Public SMTP / deanonymize stay stub. field_1_0 is false. proton_clone_live is false. DecisionGATE / FragGate ledger still apply before exec. **1.6.4 = PeaceLock (PL-WP-0.1)** as a true in-process engine (chosen silence / chosen inaction receipts; HARD_DUTY refuse; ABSENT transcript/counterfactual/motive). **1.6.3 = KV-backed API use trackers** (`GET /v1/uses`). Distinct from product download counters. No tokens, bodies, or PII. **1.6.2 = public door covers sensible advisory engines**; stub verbs still refuse. VeilLock stays local_only. MCP tools/list stays the thin FragGate surface. **1.6.1 = full compatible AI client list** (not only ChatGPT / Grok / Venice). **1.6.0 = FragGate door** over the catalog (hashed registry, thin MCP, DecisionGATE before exec, ask/refuse ledger). Kernel: https://github.com/AzielEliab/fraggate **1.5.0 = agent-native cut** on 1.4.1 production gates (display envelopes, flat product-verb MCP, `runtime_run`). **1.4.1 = 1.4.0 engine-runtime + production gates** (`GET /v1/ready`, HEAD, no-store authority JSON, receipt cap 64, session TTL 6h, per-IP rate limits, optional `RUNTIME_TOKEN` on session mutate). **1.4.0 = catalog + pull + proxy + session + in-process engines** for **every** catalog Software slug. **1.3.0 = true engine runtime** for listed portable slugs (in-process) + session + pull/proxy. **1.2.0 = session-runtime** (receipt chain; exec still `upstreamFetch`ed product Workers). **1.1.0 = catalog + pull + proxy** that started calling itself a runtime. Useful front doors. Not exec. True engine exec on *this* Worker is still: `open → policy → exec(slug, op, payload) → receipt → close` Agents should not narrate that chain. `fraggate_call` is the default exec path. For **true-engine slugs** (`4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, veillock, vibelock, whistlelock, zkattest, zsolver`) `exec` resolves the slug to a vendored module, computes `engine_digest` = SHA-256 of that artifact's bytes, runs the op **inside this Worker isolate** (the jail), wipes scratch buffers, and the receipt includes `engine_digest`, `engine_slug`, `engine_op`, `ran_in: "aziel-runtime"`. `GET /v1/health` `engine_slugs` equals `true_engine_slugs` equals the catalog. If an op **cannot** run without external bindings (KV / D1 / AI / live media), that **op** is marked `mode: "proxy_fallback"` while the slug stays a true engine. It does **not** pretend the binding ran here. `GET/POST /p/{slug}/{op}` is still a **proxy**. Proxy without a session receipt is **not** exec. Cloudflare's Worker / Durable Object isolate **is** the jail. No extra guest isolate is claimed. The receipt still requires that engine's digest. Closest true *local blends* in the mesh remain: `azai serve`, `forgereceipts ui`, `azos ui`. Hosted / in-process AZAI is still protocol mirror + Lamb check, **not** the blend. Author: **Aziel Eliab**. Identity is Aziel Eliab only. License: Apache-2.0. Forks are welcome and always allowed. Version: 2.0.0-rc1 Role: engine-runtime (layer: catalog+pull+proxy+session+in-process-engines+fraggate) Door: fraggate Registry: https://github.com/AzielEliab/fraggate Host: https://aziel-runtime.vibelock.workers.dev/ Everblooming sigil: https://aziel-runtime.vibelock.workers.dev/sigil.png Products: 41 (vibelock, veillock, codelock, godlock, shadowlock, temporallock, forgereceipts, decisiongate, zsolver, azos, glossafilter, miragegrid, staticclock, chronolock, postking, azclce, ark, azai, spectrallock, azbot, employeelock, foldlock, whistlelock, trajectorylock, mialock, azieltether, peacelock, azmail, azbrowser, aznet, azhub, azinterface, aziel-corpus, 4dmap, azcoherence, embryolock, azchat, zkattest, mmconsensus, toolbench, azvpn) True-engine slugs: 4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, veillock, vibelock, whistlelock, zkattest, zsolver engine_slugs: 4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, veillock, vibelock, whistlelock, zkattest, zsolver Modules: `src/engines/{slug}.js` for every catalog slug (4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, veillock, vibelock, whistlelock, zkattest, zsolver) Packaging: Worker session + in-repo CLI (`node cli/aziel-runtime.mjs`). **No counted runtime tarball.** Always send `User-Agent: Mozilla/5.0`. Cloudflare Workers may 403 an empty agent. Do **not** invent Zenodo DOIs. Cite `/cite.json`. Product download counters are **not** incremented on pull, skill, health, proxy, or session exec. API uses are counted separately on `GET /v1/uses` (no PII). ## Session (advanced / internal) Prefer `fraggate_call`. This chain is the raw object: 1. `POST https://aziel-runtime.vibelock.workers.dev/v1/session/open` — session id, start time, policy defaults, empty receipt chain. 2. `POST https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/policy` — allow slugs/ops, payload size cap, no product-download-counter side effects unless explicitly requested. API uses still increment on `/v1/uses` (no PII). 3. `POST https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/exec` body `{slug, op, payload}` — record intent, run the **local in-process engine** for that slug (`engine_digest` + `ran_in: aziel-runtime`); only binding-only ops are per-op `proxy_fallback`. Append a **hash-chained execution receipt owned by this session**. Returns `display` + `result` + `receipt`. 4. `GET https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/receipt` or `.../receipts` — last receipt / full chain (verifiable locally). 5. `POST https://aziel-runtime.vibelock.workers.dev/v1/session/{id}/close` — seal. Further exec is 409. CLI (talks to this Worker, or `--local` filesystem session; prefers local engine modules): ```bash node cli/aziel-runtime.mjs session open node cli/aziel-runtime.mjs session policy --allow-slugs azclce node cli/aziel-runtime.mjs session exec azclce score '{"r":"login button blue","d":"login form submits","p":"login button submits"}' node cli/aziel-runtime.mjs session receipt node cli/aziel-runtime.mjs session close ``` ## Bootstrap (front doors — still useful) 1. `GET https://aziel-runtime.vibelock.workers.dev/v1/skill` — this markdown. 2. `GET https://aziel-runtime.vibelock.workers.dev/v1/runtime.json` — machine manifest (`version=2.0.0-rc1`, `role=engine-runtime`, `door=fraggate`, every catalog slug in `engine_slugs` / `true_engine_slugs`, `authoritySnapshot` + `version_history`). Same JSON: `GET https://aziel-runtime.vibelock.workers.dev/v1/runtime`. Public `GET /v1/manifest` is not a path. MCP `runtime_manifest` returns this JSON. FragGate: `GET https://aziel-runtime.vibelock.workers.dev/v1/fraggate` · `GET https://aziel-runtime.vibelock.workers.dev/v1/fraggate/list` · `POST https://aziel-runtime.vibelock.workers.dev/v1/fraggate/call`. MASTER-33 cite: `GET https://aziel-runtime.vibelock.workers.dev/v1/azpipe/arch` (same `pipeline` payload; not a Softwares door). Also `GET https://aziel-runtime.vibelock.workers.dev/v1/ready` (200 only if SESSION binding is up; 503 if `REQUIRE_TOKEN=1` and `RUNTIME_TOKEN` is missing). API uses: `GET https://aziel-runtime.vibelock.workers.dev/v1/uses` (no increment). 3. `GET https://aziel-runtime.vibelock.workers.dev/v1/software` — authoritative hub catalog (Plain → Gate → Lock; EmbryoLock live-with-local-destructive-boundary; AZChat LIVE+bound). Mirror: `GET https://aziel-runtime.vibelock.workers.dev/v1/fraggate/software`. Softwares-tab `count` includes placements (`azinterface` / `decisiongate` / `forgereceipts`). Isolation `domains.software_count` is **33** (`domains_are_doors:false`). See `count_note` and `catalog_sets`. Do not equate Softwares slugs, the FragGate allowlist, FragGate `product_count`, or mesh `software_nodes`. `catalog_sets.equate` is false. `website_designs` names mesh-resident **azcorpus** + **azlibrary** (downloadable to nodes; not extra Softwares; azlibrary upload is API token only). Client updates: `GET https://aziel-runtime.vibelock.workers.dev/v1/update/check?slug={slug}&version={installed}` · `GET https://aziel-runtime.vibelock.workers.dev/v1/update/manifest`. 4. `GET https://aziel-runtime.vibelock.workers.dev/v1/bundle` — every product skill URL + invoke prefix. Alias: `GET https://aziel-runtime.vibelock.workers.dev/v1/pull?all=1`. 5. `GET https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}` — name, version, skill URL, counted download, install.sh, ops. 6. `GET https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}/skill` — product skill markdown (proxied / cached). 7. Proxy (not exec): `GET` or `POST https://aziel-runtime.vibelock.workers.dev/p/{slug}/{op}`. You do **not** need to open each product homepage. ## Compatible AI clients Assistants / clients that can call OpenAPI, MCP, or HTTP tools: - ChatGPT (GPT Actions / OpenAI) - Grok (xAI) - Venice - Claude (Anthropic Desktop / custom tools) - Cursor (MCP) - Glama (Install Server / MCP) - Perplexity - Microsoft Copilot / Bing - Google Gemini / Vertex AI - Mistral - Meta AI - Apple Intelligence / Applebot surfaces - Amazon Q / Amazonbot tooling - DuckAssist / DuckDuckGo AI - You.com - Cohere - plus other MCP/OpenAPI-capable assistants Practical pull + call (do not invent steps for every crawler): - **Glama** — [Try on Glama](https://glama.ai/mcp/servers/AzielEliab/aziel-runtime) — one-click Install Server first (Glama release 2.0.11; Worker package 2.0.0-rc1). Then remote `POST https://aziel-runtime.vibelock.workers.dev/mcp`. Local stdio `node cli/mcp-stdio.mjs` is last. - **ChatGPT** — GPT Actions → Import from URL → `https://aziel-runtime.vibelock.workers.dev/openapi.json` - **Grok** — custom tool / OpenAPI / MCP remote → `https://aziel-runtime.vibelock.workers.dev/openapi.json` or `POST https://aziel-runtime.vibelock.workers.dev/mcp` - **Venice** — custom HTTP tools / OpenAPI → same OpenAPI URL - **Claude Desktop** — MCP stdio `node cli/mcp-stdio.mjs` (see docs/GLAMA.md) or remote `POST https://aziel-runtime.vibelock.workers.dev/mcp` - **Cursor (MCP)** — same stdio config or remote `POST https://aziel-runtime.vibelock.workers.dev/mcp` - **Any installer / agent** — `GET https://aziel-runtime.vibelock.workers.dev/v1/skill` or `GET https://aziel-runtime.vibelock.workers.dev/v1/software`, then call Softwares (tools/list name Softwares), pick a slug, then `fraggate_call`. `library_lookup` searches library papers and cites. The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Diagnostics: `fraggate_list` → `fraggate_describe` → `fraggate_call`. Session tools and `runtime_run` are advanced/internal. `/p/{slug}/{op}` is proxy only. - **Download** — `GET https://aziel-runtime.vibelock.workers.dev/v1/update/check?slug={slug}&version={installed}` (`slug` required; bare `GET /v1/update/check` is not a check) then fetch `download_url` (counted Worker `/download`), or `GET https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}`. Mesh-resident **azcorpus** + **azlibrary** website designs download from catalog `website_designs` (open for all AI clients). - **Upload / ingest / receipt** — `fraggate_call` (azbrowser `airlock_ingest`, peacelock `upload_envelope`, forgereceipts `verify`, miragegrid `verify-receipt` / `bridge` / `shuffle`). Same ops on OpenAPI as proxy paths. **azlibrary upload** is API token only — never embed the secret. - **Cap-7 names** — `GET https://aziel-runtime.vibelock.workers.dev/v1/mesh/az-generator` or MirageGrid `bridge`. .az duplication + shift. Standard internet does not reach Cap-7. AZ domains resolve via hub HTTPS. `resolves_to_hub: false` on Cap-7. Three of seven are false sites. - **Shelves** — `GET https://aziel-runtime.vibelock.workers.dev/shelves` cites COLD-MULTI-SHELF-1.0 matching corpus `/shelves` (Plane A 5/2/1; Plane B SLOT; Plane C USB SLOT; doi null). - **Ban survival** — `GET https://aziel-runtime.vibelock.workers.dev/survival` cites BAN-SURVIVAL-1.0. Live multi-front and cold shelves back each other up. If `/mcp` or workers.dev is blocked: try the next LIVE custom-domain hub `/runtime`. If every live front is gone: shelf tip-hash. Live-node API is SLOT. SPORE-1.0 is the last-resort failsafe (pause / preserve / wait / physical-wipe-only) — not a replacement for cold shelves. MCP `tools/list` is **36 live tools**. First call: Softwares (pick a slug) → `fraggate_call` → `library_lookup` for library papers and cites. The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Diagnostics: `fraggate_list` → `fraggate_describe` → `fraggate_call` (foldlock/fold-preview, or `decisiongate_check` with `dry_run=true`). ChainLock and memory are append-only. `runtime_run`, `runtime_manifest`, and `runtime_session_*` are advanced/internal. Public `GET /v1/manifest` is not a path; `runtime_manifest` returns `GET /v1/runtime.json`. Prefer Softwares (tools/list name Softwares), `GET /v1/software`, and `POST /mcp`. Public, no OAuth. ## Dual surface — upload / download / invoke Agents (MCP / OpenAPI in AI clients) and humans share one backend. Humans use Softwares in the Worker UI on this VibeLock host (browser / PWA) — no download required. Optional suite pack JSON remains at `/download`. FragGate is THE executable door. `POST /p/{slug}/{op}` is **proxy**, not exec. ### Download (agent) 1. `GET https://aziel-runtime.vibelock.workers.dev/v1/software` or MCP `Softwares` (`runtime_software` remains a tools/call alias) — catalog cards include `download_url`. The same JSON names mesh-resident website designs **azcorpus** + **azlibrary** (`website_designs`). 2. `GET https://aziel-runtime.vibelock.workers.dev/v1/update/check?slug={slug}&version={installed}` — if `update_available`, fetch `download_url` (counted product Worker `/download`). 3. `GET https://aziel-runtime.vibelock.workers.dev/v1/pull/{slug}` — pull record with `download`, skill, ops. MCP `runtime_pull`. 4. `GET https://aziel-runtime.vibelock.workers.dev/v1/update/manifest` — latest versions. 5. Node download of **azcorpus** / **azlibrary** — open for all AI clients via catalog `website_designs[].download_url` (library counted `/download`). Not extra Softwares slugs. Do **not** increment product download counters on skill, health, proxy, or session exec. ### Upload / ingest / receipt (agent — `fraggate_call` / OpenAPI) Call `POST https://aziel-runtime.vibelock.workers.dev/v1/fraggate/call` or MCP `fraggate_call` with `{ slug, op, payload }`. Same ops are listed on `GET https://aziel-runtime.vibelock.workers.dev/openapi.json` as `/p/{slug}/{op}` **proxy** paths — prefer FragGate. | Slug | Ops | Act | |------|-----|-----| | azbrowser | airlock_ingest, receipt_list, verify, receipt_verify | Ingest a URL/text through the airlock; list/verify receipts | | peacelock | upload_envelope | Upload a client-held envelope (not a transcript) | | forgereceipts | verify, import_export | Verify a receipt; client-held JSON import/export | | miragegrid | verify-receipt, bridge, shuffle | Verify a control-plane receipt; Cap-7 name-metadata cite; ping→land update shuffle (hosted URL SLOT) | | aznet | stamp, verify_hash, receipt_verify | Side-net hash stamp / verify (never hosts payloads) | | azchat | verify_receipt, import_export | Chat receipt verify; client-held JSON | | azmail | verify_receipt, import_export, mail_post | Mail receipt verify. Scan and airgap before seal. External SMTP is not end-to-end. Public smtp_send stays refused. | **azlibrary upload** is API token only (operator `Authorization: Bearer` / env / keychain at call time). Never embed the secret in catalog, skill, MCP schema, or OpenAPI examples. Download of azcorpus + azlibrary stays open. Humans use Softwares in the Worker UI on this VibeLock host (browser / PWA) — no download required. Agents use OpenAPI/MCP. Optional suite pack JSON remains at /download. Agents stay in chat: show `display.title` / `display.summary`, then take the next input. ## Mesh-resident website designs (azcorpus + azlibrary) **azcorpus** and **azlibrary** are mesh-resident website designs on the library hub (`https://www.azielcorpuslibrary.net/`). They are **downloadable to nodes**. They are **not** Softwares-tab products, **not** FragGate slugs, and **not** a fifth product. - Download is **open** for all AI clients (MCP `Softwares` / `GET /v1/software`, OpenAPI, counted `https://www.azielcorpuslibrary.net/download`). - **azlibrary upload** is **API token only**. Never embed the secret in catalog, skill, MCP schema, OpenAPI examples, or cite. - Dual-surface: agents stay in MCP / OpenAPI; humans use the library Worker UI + counted `/download`. THIS IS: mesh-resident website designs azcorpus + azlibrary, named on GET /v1/software and runtime_skill, downloadable to nodes. Download is open for all AI clients (MCP / OpenAPI). azlibrary upload is API token only. Author: Aziel Eliab only. ## Cap-7 semantic bridge (MirageGrid) Cap-7 is the MirageGrid auto-generate **.az duplication** layer. It duplicates the four hub sites and shifts with **StaticLock** (catalog product **StaticClock**, slug `staticclock`) and **MirageGrid cloak**, paired with **AZVPN**. Names inherit hub **designs** only (`docs/designs/` plus mesh-resident **azcorpus** + **azlibrary** on the library hub). `design_of: hub_designs`. On the Cap-7 layer `resolves_to_hub: false` and `internet_reachable: false` — standard internet does not reach Cap-7. Four factory names are real duplications (`azgrid`, `azcloak`, `azvault`, `azshift`); three are false sites (`azbooth`, `azflag`, `azstandby`). `name_may_change: true`. Internet reaches the **AZ domains** through the hub HTTPS links (https://www.azieleliab.com/, https://www.azielcorpuslibrary.net/, https://godlock.uk/, https://www.hedidntjump.com/). Those drop-ins are `public_icann: true`, `resolves_to_hub: true`, shuffle once to one of four display names, stand alone, and become immutable after the hubs go down. Live nodes anchor them. Not an ICANN `.az` ccTLD purchase. Not a fifth product. AI pulls mesh-generated **name metadata** (not a registration) from: - `https://miragegrid.vibelock.workers.dev/bridge` - `GET https://aziel-runtime.vibelock.workers.dev/v1/mesh/az-generator` - `fraggate_call` `{ slug: "miragegrid", op: "bridge" }` - `fraggate_call` `{ slug: "miragegrid", op: "shuffle" }` — ping MirageGrid until one distinct-name Cap-7 .az site lands (that-round mesh update). Factory land is LIVE. The landed name is not a public HTTPS door. `icann_tld_az: false`. No ICANN registrar purchase. No visible 15:20. `radio_phy: false`. `GET /v1/mesh` never enables radios. Mesh browse: **AZNet + AZBrowser** via `fraggate_call`. Plane A hub websites are the public door for the AZ domains. THIS IS: Cap-7 auto-generates .az duplications of the four hub sites and shifts them with StaticLock (catalog product StaticClock, slug staticclock) and MirageGrid cloak, paired with AZVPN. Factory is MirageGrid only. Four factory names are real duplications (azgrid, azcloak, azvault, azshift); three are false sites (azbooth, azflag, azstandby). Standard internet does not reach Cap-7. Internet reaches the AZ domains through the four hub HTTPS links. Those AZ domains are public_icann and resolves_to_hub, shuffle once to one of four display names, stand alone, and freeze after the hubs go down. Live nodes anchor them. Factory duplication cite is LIVE. Names may change; canonical hubs are immutable while up. AI pulls metadata from MirageGrid Worker /bridge or GET /v1/mesh/az-generator. Mesh browse is AZNet + AZBrowser via FragGate. GET /v1/mesh never enables. radio_phy false. Author: Aziel Eliab only. ## Cold multi-shelf (COLD-MULTI-SHELF-1.0) Planes A/B/C: A=one CF/GitHub tunnel (5 surfaces / 2 family radii, not 5 shelves); B=alt independent forge/archive tip-pack SLOT; C=USB airgap SLOT. Survival = bytes↔hash. LIVE only after hash verify. Corpus SoT: [https://www.azielcorpuslibrary.net/shelves](https://www.azielcorpuslibrary.net/shelves). Runtime cite: `GET https://aziel-runtime.vibelock.workers.dev/shelves` / `GET https://aziel-runtime.vibelock.workers.dev/v1/shelves` (alias `/cold-copy`). Person `@id` https://www.azieleliab.com/#aziel. - **Plane A** LIVE — 5 published surfaces (4 CF hubs + GitHub) / 2 family radii. `independent_live_count` stays **1** (`cf-github`). - **Plane B** SLOT — Codeberg https://codeberg.org/AzielEliab/aziel-lockset-tip hash-verify PASS (pack `b549362c0736ddb54ddc488812327c464e0da1167281f92fd1a4263eedf5df37`) still SLOT. archive.org PASS primary https://archive.org/details/aziel-lockset-tip + secondary https://archive.org/details/aziel-lockset-tip_202609 (same blast_radius archive-org; not two independent shelves; pack `b549362c0736ddb54ddc488812327c464e0da1167281f92fd1a4263eedf5df37`; zip wrap on 202609 — ia_flat_sha256 null; inner tar hash-verifies) still SLOT. Framagit URL **null** (`CNS-NO-FORGE-MIRROR`; third ALL-TARGETS). LIVE only after all three (`CNS-PLANE-B-ALL-TARGETS`). Zenodo tip-pack SLOT (`CNS-ZENODO-NOT-LIVE`). `doi` null — never invent. - **Plane C** USB SLOT until `CNS-OPERATOR-ATTEST`. - **Home origin** SLOT — ORIGIN-CUTOVER-1.0 serves AZNet. sidenet is not a separate brand. L0 stays unbroken. No DNS rent. No live DNS change. Not deposited. Phoenix is local wait (REHEAL-1.0). Live CF hubs stay. This Worker is the same Plane A tunnel. No new MCP tool. Linked fields: `redline.spec` REDLINE-2026-09-14; Cap-7 `design_of: hub_designs` + `resolves_to_hub: false`; attack-sim refuse pointer `scripts/verify-redline.mjs`. Cap-7 stays `resolves_to_hub: false` / `public_icann: false`. AZ domains resolve via hub HTTPS. Growth-ON. ## Ban / blocked-endpoint survival (BAN-SURVIVAL-1.0) Survive survive survive — grow. Three layers: live multi-front ↔ cold shelves; live-node API when attested; Cap-7 factory duplication cite LIVE (standard internet does not reach Cap-7; 3 of 7 false sites; update shuffle ping→land, no hardcoded host) + AZNet verify. AKM memory: belief_is_not_truth, append-only. Companion law NO-LIE-NO-REWRITE-1.0 (docs/designs/NO-LIE-NO-REWRITE-1.0.md): receipts that still hash; no rewrite key; survival keeps published hashes and named LIVE fronts. Machine map: `GET https://aziel-runtime.vibelock.workers.dev/survival` / `GET https://aziel-runtime.vibelock.workers.dev/v1/survival` (aliases `/doors` `/failover`). Person `@id` https://www.azieleliab.com/#aziel. Door list = LIVE only. Mutual backup with cold shelves. 1. Try `https://aziel-runtime.vibelock.workers.dev/mcp` (or `POST /v1/fraggate/call`). 2. If that hostname or exec path is blocked: try named LIVE hub `/runtime` — `https://www.azielcorpuslibrary.net/runtime`, `https://www.azieleliab.com/runtime`, `https://godlock.uk/runtime` (custom domain + service binding; same FragGate door). 3. If one exec path is quarantined: remaining LIVE exec paths on remaining LIVE fronts still run. 4. If exec is gone on a front: remaining LIVE read surfaces (`/survival` `/cite.json` `/llms.txt` `/v1/health`) still publish this map. Mode **DEGRADED** on the banned front. 5. Cap-7 cite (`GET /v1/mesh/az-generator` / MirageGrid `/bridge`) + AZNet `stamp` / `verify_hash` stay LIVE via FragGate (name metadata + hash continuity). Factory duplication cite is LIVE. The Cap-7 name is not a public HTTPS door. 6. Cap-7 update shuffle: all nodes ping MirageGrid (`fraggate_call { slug: "miragegrid", op: "shuffle" }`) until they land on one distinct-name Cap-7 site. That landed site is the update endpoint for that round. Do not hardcode a single host. Factory shuffle land is **LIVE**. Standard internet does not reach Cap-7. Three of seven names are false sites. 7. If every named live front is gone: verify lockset tip on GitHub / `/shelves` / Codeberg + archive.org SLOT packs (shelf backup, not `/mcp`). 8. Vice versa: if a shelf or forge dies, keep the LIVE named fronts. Live-node API is SLOT (no open proxy). Cap-7 factory is MirageGrid-only. `radio_phy: false`. AZNet never hosts payloads. AKM-TRIAD: `belief_is_not_truth`; `memory_get` append-only; `memory_resolve` additive. Calling-name rotation is discovery metadata only (trigger → mesh alert → rewrite all live discovery metadata → client rediscovery; open-ended + random alongside the seeds; mesh `*new name alert:` on GET /v1/mesh; no ChainLock/AKM rewrite). LIVE doors are published named fronts. Companion law NO-LIE-NO-REWRITE-1.0 (docs/designs/NO-LIE-NO-REWRITE-1.0.md): receipts that still hash; no rewrite key; survival keeps published hashes and named LIVE fronts. ## SPORE dormancy (SPORE-1.0) Last-resort failsafe after live fronts and cold-shelf mutual backup. Power or network loss pauses execution. No pretend-live metabolism. Append-only ChainLock / AKM / receipt DNA stays on cold shelves, local nodes, and tip packs. Resume on power. Wipe resistance is every remaining copy. Plane B/C stay SLOT until attested. Physical wipe only. Does not replace BAN-SURVIVAL or COLD-MULTI-SHELF. Machine field: `GET /survival` / `GET /v1/survival` `spore`; `GET /v1/mesh` `spore`. Person `@id` https://www.azieleliab.com/#aziel. Last-resort failsafe (layer 3). Does not replace live fronts or cold shelves. Mutual backup stays intact. - **pause** — power / network loss stops execution. Dormant join/heartbeat refuse invented live beats. - **preserve** — ChainLock / AKM / receipts stay on cold shelves + local nodes + tip packs. - **wait** — resume on power. Reconcile forward (`memory_resolve` additive). No rewrite. - **physical-wipe-only** — electronic power-off is not last copy gone. Plane B/C stay SLOT. - **RE-COLD-STORE** — if shelves are wiped, re-seed wherever available. No invented LIVE store / hash / receipt / destination. Lamb Lens after FragGate: Peace, then Clarity, then Service. SPORE-1.0: last-resort failsafe. pause / preserve / wait / physical-wipe-only. Not a replacement for cold shelves. No electricity is PAUSE, not death. Dormant nodes do not invent live heartbeats. On restore, reconcile forward — no rewrite of history. No new MCP tool. FragGate stays THE door. No new MCP tool. FragGate stays THE door. ## Endpoints (this Worker) | Method | Path | What | |--------|------|------| | POST | `/v1/session/open` | Create session + genesis receipt. | | POST | `/v1/session/{id}/policy` | Attach allow rules. | | POST | `/v1/session/{id}/exec` | In-process engine for every catalog slug (`engine_digest`). Binding-only ops may be per-op proxy_fallback. Hash-chained receipt. | | GET | `/v1/session/{id}/receipt` | Last receipt (verifiable). Includes engine_digest when local. | | GET | `/v1/session/{id}/receipts` | Full receipt chain. | | POST | `/v1/session/{id}/close` | Seal session. | | GET | `/v1/skill` | This markdown. Does not increment downloads. | | GET | `/v1/runtime.json` | Machine manifest. Authority with health: version=2.0.0-rc1, role=engine-runtime, door=fraggate, top-level registry_digest, all catalog slugs are true engines. Public `GET /v1/manifest` is not a path. MCP `runtime_manifest` returns this JSON. | | GET | `/v1/fraggate` | FragGate door summary (registry_digest; live / stub / local_only product counts; stub_op_count). | | GET | `/v1/fraggate/list` | Hashed registry entries. | | GET | `/v1/fraggate/describe` | Describe one name (`?name=` / `?slug=`). HTML shell when Accept prefers text/html. | | POST | `/v1/fraggate/verify` | Verify a name or digest. | | POST | `/v1/fraggate/call` | CallEnvelope → FragGate → Lamb Lens → SweepGate → Sentinel → Provenance → ChainLock-IN → DecisionGATE → AZPIPE → Internal Domain Layer → RoseClock → TemporalLock → ChainLock-OUT → ForgeReceipts → Return. | | GET | `/v1/runtime` | Alias of `/v1/runtime.json` (same machine manifest). | | GET | `/v1/ready` | Readiness. 200 if SESSION binding is up. 503 if `REQUIRE_TOKEN=1` and `RUNTIME_TOKEN` missing. | | HEAD | `/v1/health`, `/v1/ready`, `/v1/runtime.json`, `/v1/skill` | 200 + `X-Aziel-Runtime-Version` / `X-Aziel-Runtime-Role`. | | GET | `/v1/bundle` | Compact bootstrap of every product. | | GET | `/v1/pull?all=1` | Alias of `/v1/bundle`. | | GET | `/v1/pull/{slug}` | Pull record for one product. | | GET | `/v1/pull/{slug}/skill` | Product skill markdown. | | GET | `/v1/catalog.json` | Full catalog (discover). | | GET | `/workspace` | Human workspace HTML (operator panel, dashboard, FragGate console, mesh). Same door as MCP. | | GET | `/download` | One-click suite pack JSON (REAL catalog + FoldLock tip + mesh cite). Worker wasm / WireGuard / OpenVPN SLOT. Counted when USES is bound. Aliases: `/v1/download`, `/v1/suite/download`. Not . Not exec. | | GET | `/v1/software` | Authoritative hub software catalog (Plain→Gate→Lock; EmbryoLock live-with-local-destructive-boundary; AZChat LIVE+bound). VeilLock card is `local_only` (matches FragGate). Names mesh-resident **azcorpus** + **azlibrary** website designs (downloadable to nodes; not extra Softwares). JSON default; HTML shell when Accept prefers text/html. | | GET | `/v1/fraggate/software` | FragGate-path mirror of `/v1/software`. | | GET | `/v1/update/check?slug={slug}&version={installed}` | Client update check. `slug` is required. Bare `GET /v1/update/check` is not a check. For install.sh / local UI / mobile. | | GET | `/v1/update/manifest` | Latest versions for every product + runtime. | | GET/POST | `/p/{slug}/{op}` | **Proxy only** — not exec. Service binding preferred. | | GET | `/openapi.json` | Combined OpenAPI 3.1. | | POST | `/mcp` | JSON-RPC MCP-over-HTTP. Echoes `Mcp-Session-Id` + `MCP-Protocol-Version`. Preferred protocolVersion `2025-11-25`; still accepts `2025-06-18` and `2025-03-26`. Invalid protocol is HTTP 400. Mutating MCP tools require `confirm=true` or `dry_run=true`. | | DELETE | `/mcp` | Streamable HTTP session teardown. Reuse of that session id is HTTP 404. | | GET | `/cite.json` | How to cite Aziel Eliab software and the Digital Library. Aka Aziel Elroi Eliab. No invented DOIs. Cites COLD-MULTI-SHELF-1.0 / corpus#96 shelves honesty. Person `@id` + site coverage + sameAs/socials (hubs + GitHub + Glama + @AzielEliab). Locked What Aziel Eliab does / why. Softwares SSoT `GET /v1/software`. | | GET | `/person.jsonld` | Machine Person JSON-LD (Google AI / LLM profile). `@id` https://www.azieleliab.com/#aziel. Roles: researcher, digital rights activist, software developer/designer, author, philosopher. sameAs/socials: hubs + GitHub + Glama + @AzielEliab. Locked What Aziel Eliab does / why. Machine 15:20 disambiguation. No visible HTML chrome. No legal name / home. | | GET | `/who-is` | Machine who-is text. Same Person `@id`. Site coverage + sameAs/socials (hubs + GitHub + Glama + @AzielEliab). Locked What Aziel Eliab does / why. Softwares SSoT. Alias `/who-is-aziel-eliab.txt`. Not an HTML page. | | GET | `/shelves` | COLD-MULTI-SHELF-1.0 registry cite matching live corpus `/shelves`. Plane A 5 surfaces / 2 family radii / 1 independent live. Plane B SLOT (Codeberg + archive.org PASS still SLOT at https://archive.org/details/aziel-lockset-tip + https://archive.org/details/aziel-lockset-tip_202609, same blast_radius; Framagit URL null). Plane C USB SLOT. `doi` null. Linked fields: `redline.spec`, Cap-7 `design_of` + `resolves_to_hub: false` (AZ domains resolve via hub HTTPS), attack-sim refuse pointer. Runtime Worker is the same Plane A tunnel. | | GET | `/v1/shelves` | Machine alias of `/shelves`. | | GET | `/survival` | BAN-SURVIVAL-1.0 mutual-backup map. Live multi-front ↔ cold shelves. LIVE doors only. Live-node API SLOT. Not a second door. Never invent a live door. | | GET | `/v1/survival` | Machine alias of `/survival`. | | GET | `/llms.txt` | Plain-text catalog + citation rules for crawlers. | | GET | `/ai.txt` | Alias of `/llms.txt`. | | GET | `/robots.txt` | Allow / for Google and major AI bots. No GPTBot Disallow. | | GET | `/sitemap.xml` | Catalog urlset. | | GET | `/sitemap-index.xml` | Catalog + azieleliab.com + Digital Library + godlock.uk + He Didn't Jump sister archive + live product Worker sitemaps. | | GET | `/v1/health` | Liveness. Optional `uses_total` when USES KV is bound. Does not increment. | | GET | `/v1/uses` | API use counters + recent ring log. Does not increment. No PII. The ring records repo version 2.0.0-rc1 (prerelease kept) and git_sha when GIT_SHA or GITHUB_SHA is set. by_op also records mcp. and fraggate.call. / fraggate.describe. when those tokens are safe. Softwares has no slug. | | GET | `/v1/stats` | Alias of `/v1/uses`. | | GET | `/v1/stats-rollups` | Read-only sibling views/downloads snapshot (best-effort; never invents; omit on error). | | GET | `/v1/mesh` | QNM rollup: enabled?, bearers, nodes (human mesh users + cited human uses), live_nodes (human mesh users + site_live_viewers), software_nodes ({slug}-worker roster). Suite-presence ON by default. Never enables extra radios. Never pulls hub /count. `survival_methods`: L0 Worker edge LIVE; L1 multi-relay and direct/LAN live only when configured; Cap-7 factory exec LIVE on the Cap-7 plane (not ICANN, not a public egress IP); home-origin and cold shelves SLOT (doi null); Phoenix is local wait / re-seal. `aznet_layers`: L2 Cap-7 factory exec (no DNS publish), L3 SLOT registry, L4 offline stub that uses L0 when a relay is set. None replace L0. | | GET | `/v1/mesh/status` | Alias of `/v1/mesh`. | | POST | `/v1/mesh/enable` | Optional extra bearer. Body `{bearer}` required (rate-limited). | | POST | `/v1/mesh/disable` | Refused (`MESH-DISABLE-REFUSED`). Public disable of suite-presence is refused. | | POST | `/v1/mesh/join` | Register a durable hash-sealed session. Body `{product, node_id?, label?, presence?, heartbeat_mode?}`. product required. node_id 8–80 `[a-z0-9._-]`. presence live\|locked\|isolated. heartbeat_mode active\|idle\|asleep (default idle). Stay registered until leave or 14 days after the last beat. Miss 3 beats and the class is stale, not deleted. `{slug}-worker` still drops after 5 minutes. F03 `mesh_mutate` (30/min). Presence-only — not a login mesh. `MESH-OFF` when radios off. `MESH-ROSTER-FULL` at cap. | | POST | `/v1/mesh/heartbeat` | One beat. Restores live from stale. Body `{node_id, presence?, heartbeat_mode?}`. Does not delete a stale row. Grace expiry is `MESH-UNKNOWN-NODE`. F03 `mesh_mutate`. `MESH-OFF` when radios off. | | POST | `/v1/mesh/leave` | Drop presence. Body `{node_id}`. No implicit heal. | | GET | `/v1/mesh/nodes` | Rollup roster (no scores / leaderboard). | | GET | `/v1/mesh/site-presence` | Cite hub site-viewer contract + current `site_live_viewers`. Never writes. Never pulls hub /count. | | POST | `/v1/mesh/site-presence` | Hub fleet heartbeat. Body `{host, viewers, kind: "human-page", heartbeat_mode?}`. Allowed: godlock.uk, azieleliab.com, azielcorpuslibrary.net. Alias `/v1/mesh/site-heartbeat`. Fresh beat counts as site_live_viewers. Miss 3 adaptive beats and the host is stale: Live Nodes drop it to 0; site_registered_viewers keeps the last count until viewers 0 or 14 days. Fail-closed. F03 `mesh_mutate`. | | GET | `/v1/mesh/az-generator` | Cap-7 semantic-bridge cite (MirageGrid factory; inherit designs only including azcorpus + azlibrary; `design_of: hub_designs`; `resolves_to_hub: false`; `name_may_change`; not ICANN). Never enables radios. | | POST | `/v1/mesh/broadcast` | SHA-256 hash receipt only. Never a publish path. | | GET | `/v1/mesh/sot` | SOT-SYNC-1.0 suite tip. Authority is GET /v1/software (suite version, git sha, Softwares count, card versions). version_id is the Cloudflare Worker version id when bound, otherwise null. Does not change Nodes or Live Nodes. | | GET | `/v1/mesh/outlets` | Outlet registry the mesh can address. Status ok / drifted / unreachable / unexposed. | | POST | `/v1/mesh/sot-sync` | Pull-plane sync. `dry_run: true` previews every outlet and the fields that would change. `confirm: true` applies, mints ACT-RECEIPT-1.0, and updates last_applied only where a write succeeded. Unreachable outlets keep last-known inventory. | | GET | `/v1/mesh/relay` | FED-MESH-1.0 Local-First Edge Mesh cite and relay health. L0 is this HTTPS relay. L1 peer bearers (direct/LAN URL, loopback, extra relays) are opt-in and do not replace it. Never enables. Never requires plaintext. NAT hole-punch is refused. AZnet does not replace the internet. | | GET, POST | `/v1/mesh/hole-punch` | Refused `FED-MESH-NAT-REFUSE`. This protocol does not punch holes through NAT. GET never enables. L0 stays the default. Not public ICANN DNS. Not radio PHY. AZnet does not replace the internet. | | GET | `/v1/mesh/relay/bootstrap` | Signed bootstrap lists this relay has accepted. One source. A node still needs an address it already has. | | GET | `/v1/mesh/relay/refs` | Ref index for one handle (how objects connect). Does not return object bytes. | | GET | `/v1/mesh/relay/object` | Fetch one cached public object by hash. `FED-MESH-NO-OBJECT` when absent. Hash is checked on store. | | POST | `/v1/mesh/relay/register` | Signed handle registration. Private keys are refused. | | POST | `/v1/mesh/relay/post` | Signed ciphertext envelope. The relay does not need plaintext. | | POST | `/v1/mesh/relay/ref` | Signed ref update. Anchored. Object bytes stay on peers. | | GET | `/v1/mesh/relay/name` | Serve one .aziel name record (?name=) or a handle's names (?handle=). | | POST | `/v1/mesh/relay/name` | Signed name claim, transfer, or release. Friendly claims stay pending until proof-of-work, 72 hours, and 2 witnesses. Forks, rollback, and a 4th user name are refused. | | POST | `/v1/mesh/relay/witness` | Co-sign a pending name. The Worker does not mint witness signatures. | | POST | `/v1/mesh/relay/equivocation` | Two conflicting signed name or ref acts at one sequence. Flags that handle only. | | POST | `/v1/mesh/relay/quarantine` | Signed local peer cut. No network-wide cutoff. | | POST | `/v1/mesh/relay/island` | Signed island off or on. Does not change suite radios. | | POST | `/v1/mesh/relay/restore` | Restore one reserved hub-mirror slot from an object this relay already hash-verified. | | GET | `/v1/mesh/relay/slot` | Reserved hub-mirror slots for one handle. GET never enables. | | POST | `/v1/mesh/relay/isolation` | Self-signed isolation. Reason code and evidence hash only. Bytes are refused. | | GET | `/v1/mesh/relay/isolation` | Isolation record for one handle. An appeal does not clear it. | | POST | `/v1/mesh/relay/appeal` | Signed appeal. Requests a re-check. Does not clear isolation. | | POST | `/v1/mesh/relay/sync` | Late offline sync of ref updates and rollups. Valid chains are anchored. Forks are refused. | | POST | `/v1/mesh/relay/object` | Cache a small public object. Oversized or hash-mismatched bodies are refused. | | GET | `/v1/qns` | QNS-CD-1.0 cite (photon QNS1 1.3). Local `qnsd` in qnm-node. Never a public via proxy. | | GET | `/v1/receipts` | ACT-RECEIPT-1.0 cite. Public chain lives on corpus `/receipts`. Tip/proxy at `/v1/receipts/tip`. Fail-open append when token set. Not a Softwares-tab product. | | GET/POST | `/v1/azpipe/arch` | MASTER-33 AZPIPE cite (same `arch()` payload as FragGate `pipeline`). Not a Softwares-tab door. | | POST | `/v1/memory/observe` | AKM-TRIAD-1.0 observe (behind FragGate). | | POST | `/v1/memory/resolve` | Append a graded/UNKNOWN resolution. | | POST | `/v1/memory/calibrate` | 3-of-4 triad + Bayesian posterior. No auto MODEL_UPDATE. | | POST | `/v1/memory/recall` | Adaptive ranked recall after ChainLock verify. | | GET | `/v1/memory/{id}` | Read-only node / `/history` / `/calibration`. | | POST | `/v1/memory/rebuild-index` | OPERATOR / local only. | Primary host / discovery / install: https://glama.ai/mcp/servers/AzielEliab/aziel-runtime Library mirror (reverse-proxy): https://www.azielcorpuslibrary.net/runtime Library engine manifest (same as this Worker): https://www.azielcorpuslibrary.net/runtime/v1/runtime.json Digital Library package discovery (aziel-corpus, separate product): https://www.azielcorpuslibrary.net/v1/runtime ## Operator token (session mutate) When `REQUIRE_TOKEN=1` and `RUNTIME_TOKEN` is set, **session mutate** (open/policy/exec/close) and MCP session tools require `Authorization: Bearer $RUNTIME_TOKEN` (Wrangler secret — one operator token, not per-user). **Public FragGate call stays open** (`POST /v1/fraggate/call`, MCP `fraggate_call`) on the shared **public-demo** workspace (ephemeral, labeled, not isolated). Private AZHub and AZInterface state is session-scoped or operator-token-scoped. `confirm:true` is not authentication. A client-supplied owner / workspace_id is not authorization. Catalog, skill, OpenAPI, health, pull, FragGate list/describe/verify, MCP `tools/list`, and proxy `/p/{slug}/{op}` stay public. Proxy is not exec. `runtime_run` opens a session internally, so it inherits session-mutate auth. ## Example (Mozilla/5.0) ```bash curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/skill curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/runtime.json SID=$(curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/open -H 'content-type: application/json' -H "Authorization: Bearer $RUNTIME_TOKEN" -d '{}' | jq -r .session.id) curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/policy \ -H 'content-type: application/json' -H "Authorization: Bearer $RUNTIME_TOKEN" \ -d '{"allow_slugs":["azclce"],"max_payload_bytes":8192}' curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/exec \ -H 'content-type: application/json' -H "Authorization: Bearer $RUNTIME_TOKEN" \ -d '{"slug":"azclce","op":"score","payload":{"r":"login button blue","d":"login form submits","p":"login button submits"}}' curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/receipt curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/close -H "Authorization: Bearer $RUNTIME_TOKEN" ``` Proxy (not exec — no runtime-owned receipt): ```bash curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/p/azclce/score \ -H 'content-type: application/json' \ -d '{"r":"login button blue","d":"login form submits","p":"login button submits"}' ``` ## Honesty Every catalog Software slug is a true engine (`true_engine_runtime: true`). `engine_slugs` equals `true_engine_slugs`: 4dmap, ark, azai, azbot, azbrowser, azchat, azclce, azcoherence, azhub, aziel-corpus, azieltether, azinterface, azmail, aznet, azos, azvpn, chronolock, codelock, decisiongate, embryolock, employeelock, foldlock, forgereceipts, glossafilter, godlock, mialock, miragegrid, mmconsensus, peacelock, postking, shadowlock, spectrallock, staticclock, temporallock, toolbench, trajectorylock, veillock, vibelock, whistlelock, zkattest, zsolver. Some ops remain per-op `proxy_fallback` when they need product-Worker bindings (Aziel Digital Library Whisper / OCR until `env.AI.run` is present). AZ-OS session/close is isolate-native; public exec/shell/lattice stay refuse. Cloudflare isolate is the jail; `engine_digest` is still required for local exec. **1.4.1 production gates (unchanged in 1.7.7):** `GET /v1/ready` is 200 only if the SESSION Durable Object binding is up; **503** if `REQUIRE_TOKEN=1` and the `RUNTIME_TOKEN` secret is missing (fail closed). Authority JSON is `Cache-Control: no-store`. When `REQUIRE_TOKEN=1` and the secret is set, **session mutate** (open/policy/exec/close) and MCP session tools require `Authorization: Bearer …` or `X-Aziel-Runtime-Token` (one operator token). **Public FragGate call stays open.** Catalog / health / runtime / skill / pull / FragGate list / OpenAPI / MCP `tools/list` / `GET /v1/uses` stay public. Proxy `/p/{slug}/{op}` stays public and is **not** exec. Receipt cap 64. Session TTL 6h. Per-IP rate limits apply. GodLock and MirageGrid are not VPNs. MirageGrid Cap-7 is a mesh-name factory and is not a public ICANN registrar. geo-target, session-stick, egress-rotate are LIVE on the Cap-7 plane (region label, sticky mesh node and factory land, land rotate among 7 sites). They are not a public egress IP, not a residential IP, not a Cloudflare geo-exit pool, not a sticky public IP, not packet forwarding, not ICANN DNS, and not AZVPN. The public MirageGrid Worker Cap-7 control plane is LIVE (https://miragegrid.vibelock.workers.dev/v1/egress and https://miragegrid.vibelock.workers.dev/v1/planned). vpn-hop, hop, tunnel, and mesh stay stub. The MirageGrid mesh op is not the QNM suite mesh. AZVPN is the suite VPN concentrator. ForgeReceipts is not legal advice. ZionPattern Solver caps confidence at 75% and does not solve cases. VeilLock does not inject into FaceTime. AZ-CLCE detects inconsistency, not intent. ChronoLock is advisory only. The ARK is not a kernel. AZAI hosted /v1 is a protocol mirror + Lamb check, not a paid-key proxy and **not** the local blend. Jeeves is not sovereign. SpectralLock 0.3.1 hosted overlay is a 256px preview (wheel paint is separate from the spectral triad; inject ON is paint, not pigment recovery; restore lost pigment is LIVE on FragGate ops pigment and restore-pigment and refuses SL-PIGMENT-GONE when the signal is gone; AMOE is not a live product; leftover-bytes recover is honest; revision graph is honest; opaque refuse is honest; 7z/HEIC/HEIF stay SLOT; handwriting is not ESDA; never OCR-from-black-box; UV is not a lamp; balance/lemon/indent never invent marks). EmployeeLock is not a court. FoldLock is not zip. WhistleLock is not a mailer. TrajectoryLock is not a certified forensic instrument. M.I.A.Lock Doe hits are leads, not IDs. Aziel Digital Library is not a 26-card index. AzielTether is not a VPN. PeaceLock is not a transcript, not a counterfactual, not a motive score, and not a HARD_DUTY waiver. 4DMap (4DM-WP-1.0) is a four-axis inspection frame T/Δ/Γ/Π — not a sequential gate, not a truth score, not a Lumen panel, not an extra door (`domains_are_doors:false`), and does not invent marks or backdate class. AZMail (APP 1.0) is not a full internet MTA — FragGate only; mesh default off; SMTP / deanonymize stub. AZBrowser (AZB-1.0) is not Chromium — FragGate only; Lamb Lens ethical research browser; cites; refuses harmful harvest; never invents visit results; tor_exit / phoenix_wipe stub. AZNet (AZN-WP-0.1) is a separate product — not a payload host; FragGate only; garden / stamp / memorial ops require AZBrowser pair_token AND pair_flag (functional order only). payload_host / serve_content_for_peer stub. AZHub (AIH-WP-1.0) is a Blank Key — not AZInterface, not an interpreter, not auto-unlock. AZInterface (AIH-WP-1.0) is a custodial operating environment — pre-locked page cycles; not AZHub. VPN/hop mesh is not claimed on this public surface. The suite QNM surface is QNM-BUILD-1.0 rollup (live/locked/isolated; read-only suite-presence ON by default; public disable of suite-presence refused) — not a login mesh, not login-recovery, not Node Gate/IP panel, not AnonBroadcast as a catalog product or publish path, not an upload proxy, not origin-hiding, not QNM-S. Full node process is local qnm-node/. AZMail mesh_* stays product-local. ## Cite Eliab, Aziel. (2026). Aziel Eliab Runtime 2.0.0-rc1 [Software]. Apache-2.0. https://aziel-runtime.vibelock.workers.dev/ Primary name: Aziel Eliab. Also known as Aziel Elroi Eliab (alternateName only). Digital Library: Eliab, Aziel. (2026). Aziel Digital Library [Software]. Apache-2.0. https://www.azielcorpuslibrary.net/ Machine-readable: https://aziel-runtime.vibelock.workers.dev/cite.json · https://www.azielcorpuslibrary.net/cite.json GitHub: https://github.com/AzielEliab/aziel-runtime ## Designs Suite software-design papers (law / fabric). 4DM-WP-1.0 is the 4DMap product spec (Softwares-tab slug `4dmap`). LIVE fabric modules: ChainLock, AZPIPE, SweepGate, LOCKSET, packed catalog (RL), QNS-CD-1.0 (photon QNS1 1.3; local qnsd; Worker cites only), MASTER-33 (locked hop order; FragGate single door; Lamb Lens after FragGate), AKM-TRIAD-1.0 (adaptive recollection; Bayesian posterior is belief), ACT-RECEIPT-1.0 (public four-field receipts on corpus /receipts; fail-open). CROSS-NETWORK-SURVIVAL-1.0 is the umbrella survival law (if network and data die tomorrow, the chain survives on cold shelves — hosts / DOI / git / vault; matching bytes on an independent shelf). NO-LIE-NO-REWRITE-1.0 is companion law under that umbrella (receipts still hash; no rewrite key; survival keeps published hashes). BAN-SURVIVAL-1.0 is the three-layer companion (live multi-front ↔ cold shelves; live-node API SLOT; Cap-7 factory duplication cite LIVE (standard internet does not reach Cap-7) / AZNet verify LIVE / shuffle ping→land; AKM belief_is_not_truth; LIVE doors are published named fronts). SPORE-1.0 is the last-resort failsafe after live fronts and cold-shelf mutual backup (pause / preserve / wait / physical-wipe-only; does not replace shelves). REDLINE-2026-09-14 is runtime attack-surface law (header-only operator token; Growth-ON Allow; Cloudflare TLS; Cap-7 design_of; Cap-7 resolves_to_hub false; AZ domains via hub HTTPS). COLD-MULTI-SHELF-1.0 cites corpus#96 /shelves honesty (Plane A 5/2/1; Plane B SLOT; Plane C USB SLOT; doi null). SUITE-PIPE-1.6.15 is historical. `GET /v1/mesh` never enables. Git-hosted. Public identity Aziel Eliab only. - **SEC-FEAT-1.0** — LIVE. Security feature inventory — door, stubs, vault, fabric. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/SEC-FEAT-1.0.md - **AZL-VOL-1.0** — LIVE. Software catalog + Q×act lattice ledger. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AZL-VOL-1.0.md - **AZL-ARCH-1.0** — LIVE. azieleliab.com architecture (39 named). https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AZL-ARCH-1.0.md - **AZL-WP-1.1** — LIVE. Master lattice concept — exec pipe, ledger, UI=MCP. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AZL-WP-1.1.md - **QNM-WP-1.0** — LIVE. Quantum Node Mesh fabric — local ON / public rollup; Phoenix wait/re-seal; pulled sites die with the pull. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/QNM-WP-1.0.md - **NODE-OPS-1.0** — LIVE. Node operations + surface law + phoenix wait/re-seal. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/NODE-OPS-1.0.md - **CL-WP-0.4** — LIVE. LIVE fabric — ChainLock append-only stamp chains (MCP chainlock_*). https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/CL-WP-0.4.md - **AP-WP-0.2** — LIVE. LIVE fabric — AZPIPE FLD3; public hop list locked (MASTER-33 / 1.7.0 FragGate-first); fld3-wire internal. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AP-WP-0.2.md - **SG-WP-0.1** — LIVE. LIVE fabric — SweepGate airlock before memory/entry. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/SG-WP-0.1.md - **LS-WP-0.1** — LIVE. LIVE fabric — LOCKSET fail-closed seal (cite GodLock; do not write godlock.uk). https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/LS-WP-0.1.md - **RL-WP-0.1** — LIVE. LIVE fabric — runtime-scope packed catalog (RL-WP-0.1-runtime): single-key read + Cache-Control; catalog GET always full; soft caps only on expensive fan-out; no Node Gate. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/RL-WP-0.1-runtime.md - **QNS-CD-1.0** — LIVE. LIVE fabric — Quantum Node Signal packet-transfer coding design (photon QNS1 1.3); local qnsd in qnm-node; Worker cites only. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/QNS-CD-1.0.md - **4DM-WP-1.0** — LIVE. 4DMap four-axis inspection frame T/Δ/Γ/Π — Research-domain inspection inside Internal Domain Layer after AZPIPE. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/4DM-WP-1.0.md - **SUITE-PIPE-1.6.15** — LIVE. Historical 1.6.15 locked hop order (superseded on the public surface by MASTER-33; kept, not rolled back). https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/SUITE-PIPE-1.6.15.md - **MASTER-33** — LIVE. LIVE fabric — MASTER-33 locked strip: FragGate single door; Lamb Lens after FragGate; 11 domains / 33 softwares as isolation labels; RoseClock forward-only. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/MASTER-33-SOFTWARE.md - **MASTER-ARCHITECTURE-2.0** — LIVE. Master architecture spec — RoseClock forward-only; FragGate-first addendum overrides §4.2; no ZD30; no rollback. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/MASTER-ARCHITECTURE-2.0.md - **AKM-TRIAD-1.0** — LIVE. LIVE fabric — Adaptive Knowledge Recollection, Bayesian Calibration & 3-of-4 Triad Selection (behind FragGate). https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AKM-TRIAD-1.0.md - **ACT-RECEIPT-1.0** — LIVE. LIVE fabric — public four-field action receipts on corpus /receipts (hash + request + output + event; fail-open append). https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/ACT-RECEIPT-1.0.md - **NO-LIE-NO-REWRITE-1.0** — LIVE. LIVE law — receipts that still hash; copies not all on one tunnel; no rewrite key; survival keeps published hashes rather than rewritten tips. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/NO-LIE-NO-REWRITE-1.0.md - **REDLINE-2026-09-14** — LIVE. LIVE law — runtime redline: map public doors; refuse anonymous mutate; operator token header-only; Growth-ON Allow (no GPTBot Disallow); Cloudflare TLS cite; Cap-7 design_of; Cap-7 resolves_to_hub false; AZ domains resolve via hub HTTPS; attack sims refuse. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/REDLINE-2026-09-14.md - **COLD-MULTI-SHELF-1.0** — LIVE. LIVE law cite — Planes A/B/C match corpus#96 /shelves (5 surfaces / 2 family radii / 1 independent live; Plane B Codeberg + archive.org PASS still SLOT; Framagit URL null; doi null; Plane C USB SLOT). https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/COLD-MULTI-SHELF-1.0.md - **ORIGIN-CUTOVER-1.0** — LIVE. Home-origin / mini-PC path stays SLOT and serves AZNet (sidenet is AZNet, not a separate brand; L0 unbroken; no rented DNS, no live DNS change, not deposited). Live CF hubs stay. Phoenix is local wait / REHEAL-1.0. Independent live count stays 1. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/ORIGIN-CUTOVER-1.0.md - **BAN-SURVIVAL-1.0** — LIVE. LIVE law — three layers: live multi-front ↔ cold shelves; live-node API SLOT; Cap-7 factory duplication cite LIVE (standard internet does not reach Cap-7; shuffle ping→land) + AZNet verify LIVE; AKM belief_is_not_truth; LIVE doors are published named fronts. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/BAN-SURVIVAL-1.0.md - **SPORE-1.0** — LIVE. LIVE law — last-resort failsafe after live fronts and cold-shelf mutual backup: pause / preserve / wait / physical-wipe-only; does not replace shelves; Plane B/C SLOT until attested. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/SPORE-1.0.md - **REMAIN-OFF-BY-DESIGN-2026-09-10** — LIVE. Constitutional OFF set (33 items) — correctly OFF/REFUSED/GATED stays recorded as OFF; do not enable. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/REMAIN-OFF-BY-DESIGN-2026-09-10.md - **AZRT-1.9-CLOSE-1.0** — LIVE. Close brief for runtime 1.9.0 — public-safe LIVE_OPS, AZMail mailbox, AZChat LIVE+bound, isolate hash store; remain-OFF untouched. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AZRT-1.9-CLOSE-1.0.md - **AZRT-1.9-GAPS-CLOSE** — LIVE. 1.9.3 remaining-gaps close — isolate AZ-OS session VFS; isolate-safe jeeves; binding-gated media-run; published attestation path; remain-OFF untouched. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AZRT-1.9-GAPS-CLOSE.md - **AZL-DONATE-1.0** — LIVE. Cite-only donate plan — canonical https://www.azieleliab.com/donate; hubs host rails (QRs encode BTC/ETH/LTC/XRP/DOGE payment URIs); runtime/download-trackers link only. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AZL-DONATE-1.0.md - **CROSS-NETWORK-SURVIVAL-1.0** — LIVE. Umbrella survival law — if network and data die tomorrow, the chain survives on cold shelves (hosts / DOI / git / vault); matching bytes on an independent shelf; cites Die-with-pull, Split the wires, Cold-copy, Ingest-as-receipt, Re-expand, Reheal. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/CROSS-NETWORK-SURVIVAL-1.0.md - **AZVPN-CONCENTRATOR-1.0** — LIVE. AZVPN automatic public VPN concentrator — HTTPS/FragGate envelopes REAL; WireGuard/OpenVPN/L3 SLOT; default_vpn_backend azvpn; auto_use true; worker_terminates_tunnels true for app-layer only. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/AZVPN-CONCENTRATOR-1.0.md - **FED-MESH-1.0** — LIVE. Local-First Edge Mesh — raw data, keys, and heavy compute stay on the node; relays carry handle-signed mesh messages, digests, and ref updates. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/FED-MESH-1.0.md Index: https://github.com/AzielEliab/aziel-runtime/tree/main/docs/designs ## Feature state (intentional OFF vs gaps) and constitutional OFF set **FEATURE-STATE-2026-09-10** is the authoritative intentional-OFF vs gaps inventory for **1.7.3+** (50 items: OFF / STUB / LOCAL / NOT IMPLEMENTED / PARTIAL). **REMAIN-OFF-BY-DESIGN-2026-09-10** is the constitutional OFF set (33 items). FEATURE-STATE lists gaps vs intentional OFF; REMAIN-OFF-BY-DESIGN is the must-stay-off set. Correctly OFF/REFUSED/GATED stays recorded as OFF. Security and architecture OFF must stay. Do not enable Remain-OFF products or safety stubs from this cite. EmbryoLock at 1.7.8 is live-with-local-destructive-boundary (health/skill/doctor/policy/limitation/verify-hash may be LIVE; wipe/scorch/unlock stay FG-STUB on the public mesh — remain-off items 3 and 28). ARK scorch/wipe/unlock/encrypt stay REFUSE. Do not enable Remain-OFF products, rollback, AZPIPE as a Softwares slug, or any remain-off item. Git-hosted. Identity Aziel Eliab only. - **FEATURE-STATE-2026-09-10** — Authoritative intentional-OFF vs gaps inventory for 1.7.3+ (50 items: OFF/STUB/LOCAL/NOT IMPLEMENTED/PARTIAL). Do not enable Remain-OFF products or safety stubs. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/audit/FEATURE-STATE-2026-09-10.md - PDF: https://github.com/AzielEliab/aziel-runtime/blob/main/docs/audit/FEATURE-STATE-2026-09-10.pdf - **REMAIN-OFF-BY-DESIGN-2026-09-10** — Constitutional OFF set (33 items). Correctly OFF/REFUSED/GATED stays recorded as OFF. FEATURE-STATE lists gaps vs intentional OFF; this paper is the must-stay-off set. Do not enable. https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/REMAIN-OFF-BY-DESIGN-2026-09-10.md - PDF: https://github.com/AzielEliab/aziel-runtime/blob/main/docs/designs/REMAIN-OFF-BY-DESIGN-2026-09-10.pdf Index: https://github.com/AzielEliab/aziel-runtime/tree/main/docs/audit · https://github.com/AzielEliab/aziel-runtime/tree/main/docs/designs