SETTLEMENT FLOW
The same six steps for a wallet send, an ID presentation, an OTA confirm, a permission grant. Skip a step and the action does not settle.
Wallet send, ID present, OTA confirm, permission change. The app talks to a HAL — never directly to KSL or ASR.
If mode is CRITICAL_LOCKDOWN, the call short-circuits to LsiaVetoed before any byte is parsed. No exception path. KURAL 22 enforced at the top.
The HAL writes an audit entry into the append-only chain. If the emit fails (disk full, partition read-only, hash mismatch), the chain returns Error and the action stops here.
The action's canonical bytes are signed by the master key inside the secure element. ML-DSA-87 + Ed25519 hybrid where applicable. The private bytes never leave.
DSL returns Settled with the signature, the ASR receipt hash and the LSIA mode snapshot. The app receives a proof, not just a yes.
If the action is one the federation cares about (suspect IP cluster, spoofed alert attempt), GCI publishes hashed pattern + /24 prefix + amount bucket. Raw payload stays on device.
THE THIRTEEN
/api/ksl/*Master key sealed in the secure element. ML-DSA-87 signatures. Private bytes never cross userspace — only a fingerprint surfaces. kslctl exposes counters and rotation jobs.
KURAL 18 — every critical action signed or aborted.
/api/immunity/*247 kernel + syscall hooks watched live. State machine NORMAL → DEGRADED → SAFE → CRITICAL LOCKDOWN. In LOCKDOWN every sovereign write is short-circuited to LsiaVetoed before it reaches the engine.
KURAL 22 — CRITICAL_LOCKDOWN overrides everything.
/api/tup/*Every OTA carries a manifest signed by Release + Security + Ops + Compliance officers. M-of-N quorum, role coverage, binary SHA-256 verified twice — controller + agent defense-in-depth. Reject is fail-closed.
KURAL 20 — no deploy without TUP. No --skip-checks.
/api/asr/*Every important decision (signature, permission, policy, update) is appended to a hash-chained log on a write-once partition. Tamper any entry and the chain visibly breaks at next boot attest.
Hash-chained · append-only · forensic-grade.
/api/settlement/*The only path apps can sign through. Audit emit must succeed before KSL signs; if the audit fails, the signature never happens. Settled = signed + approved + proven. No settled-without-trail path.
Apps cannot raise daily limits by tampering memory.
/api/gce/*Cross-node state drift detection. Compares engine heads across federation peers and degrades automatically when drift exceeds tolerance. Disagreement triggers degraded, not a silent merge.
Diverge cleanly. Never silently converge.
/api/gci/*Privacy-preserving pattern federation. Only hashed signals, /24 IP prefixes and amount-bucketed events leave the device. Raw payloads, emails, user ids — never leave.
KURAL 23 — only hashed/bucketed patterns leave.
/api/lrm/*Store-and-forward DTN transport across LoRa multi-hop, Wi-Fi Aware, Bluetooth mesh and UWB. Bandwidth scheduled per peer. Persists across reboots. Press Edition keeps mesh telemetry up before the launcher.
SOS lane stays open in CRITICAL_LOCKDOWN.
/api/sat/*Cospas-Sarsat distress beacon, Iridium short-burst data, Starlink Direct-to-Cell, 3GPP NTN. SOS routes through whichever path is healthiest — auto-failover, no menu.
Carrier-independent emergency, no SIM required.
/api/lssa/*10-layer architecture from hardware root-of-trust through trust graph. Boot pipeline + AVB + LyDos trusted update + on-device attestation. Each layer signs the next.
Any boot-chain break → SAFE mode automatic.
/api/cc/*SGX / SEV measurement-sealed secrets. Sensitive computations are sealed to a measurement; if the OS image changes, the seal opens to a different policy and the secret stays sealed.
Secret-bound-to-measurement, not to user.
/api/{ledger,finance}/*Double-entry ledger with per-transaction proof. Wallet (M243) routes every send through DSL HAL: ASR emit first → KSL sign second. Audit fails ⇒ signing aborts.
Daily limit enforced by HAL, not by app code.
/api/bus/*Cell-broadcast (AFAD WEA, EU-Alert, J-Alert) is signature-verified before it reaches the lock screen. On-device signed push channel — notifications cannot be spoofed and survive GMS absence.
Government alerts pass signature gate or drop.
DESIGN PROPERTIES
Every engine watches the others. If one is silenced, the rest stop writing. If one falsely signs, the chain catches it at the next boot attest.
When verification breaks, the answer is reject. No --skip-checks flag exists. No silent fallback to SQLite when PG :5434 is missing. No retry on signature mismatch.
The ASR hash chain is the only timeline that matters. Every other engine can be derived, re-derived, or sacrificed — the chain cannot.
KURAL 23 — GCI only shares hashed patterns, /24 IP prefixes, amount buckets. Email, raw IP, user id, payload — never leave the device. Enforced at the engine boundary, not by config.
115 sovereign routes are documented in /api. Engines ship as private Rust crates under sovereign-templates/.