The governance layer of akson + kovee + byom
Authority you can point at.
Byom is a protocol and a deterministic governance kernel. Humans, agents and bounded collectives form shared endeavors, make voluntary pledges, receive limited mandates, and act inside them. Every act traces back to the exact charter, decision, mandate and attempt that permitted it — and a mandate can only ever narrow.
# one JSON envelope, per-surface Unix sockets. To participant.sock:
→ {"version": "0.2", "op": "hello"}
# the first of exactly two answers
← {"outcome": "ok", "result": {"versions": ["0.2"], "surface": "participant",
"endpoint_incarnation": "inc-b597a0a54e5d9f10"}}
# the other answer is always a typed RFC 9457 problem
← {"outcome": "problem", "problem": {"kind": "unsupported_version",
"type": "https://byom.dev/problems/unsupported_version",
"title": "no common protocol version", "status": 400}}Six words that are not synonyms
Most of byom is the refusal to conflate these. A system that treats them as one thing has no way to say who is responsible for what, or under whose authority a thing happened.
Byom is not a central orchestrator. It does not call models, choose a universal plan, assign workers, or treat a collective as a single omniscient mind. Participants propose, assent, refuse, organize, delegate, deliver, review and adapt. An assembly can itself become a participant — but it receives no authority merely by aggregating members, and every collective act traces to its exact constitution, epoch, policy, current mandate and actual executor.
A derived mandate is a mechanical subset of every parent. Authority narrows. It never widens.
the one core principle · model-checked as NeverWiden and
RootClosure in MandateChain.tla, against live widening
attempts rather than their absence · what that does and does
not prove
What the kernel actually enforces
Behaviour of the running daemon, each grounded in a closed state machine, a frozen schema and a vector — not aspirations.
Deny by absence
The wire surface is one machine-readable registry of
(operation, surface) rows. A call whose pair has no row is not
unauthorized — it is unaddressable. Four operations exist on two surfaces; every
other one exists on exactly one.
An unlisted transition is invalid
Every record kind has a committed transition descriptor with structured guards, locks, fences, events and a crash result per row. Not listed means not merely disallowed — it means the walk is rejected, and a negative vector pins the absence.
Nothing finalizes without its full seat set
Proposals carry concrete seat records. Finalization authors no seat itself: it is a guard over an explicit set of position receipts, at pinned revisions and digests. A rebound principal cannot carry an old seat forward.
One attempt, one fence
Every episode claim mints a fresh fence and one immutable attempt. A superseded worker's completion never lands. Crash alone never enables a re-claim: a lease becomes re-claimable only past an authoritative-clock deadline, or on a voluntary yield.
Conservation, per account
ceiling = remaining + reserved + committed + uncertain +
delegated_to_children holds in every reachable state — under reservation,
settlement, delegation, release, and the ambiguous outcomes that go to
uncertain rather than silently back to remaining.
Ambiguous is never complete
An external use whose outcome is unknown is recorded ambiguous, and stays ambiguous until a governance seat with a fresh challenge resolves it. Authority mutations run a three-step protocol against an external witness, so a restored database reopens sealed rather than quietly re-granting.
Unlogged bytes are never served
Allowed and denied sensitive reads both append to a hash-chained access record carrying actor, purpose, query digest, result cardinality and outcome — never result plaintext. If the journal commit fails, there is no release.
Silence never accepts
A candidate reaches exactly one offer-scoped surface with three operations, and the offer's own fence closes it on admission, refusal, revocation or expiry. Elicitation through the binding is never assent, and a refusal is real.
Byom is v0.0.1, not audited, and not
production-ready. The assurance profile is developer: channel
authentication is same-UID SO_PEERCRED possession plus process-bound
channel proofs, with no UID separation between principals, no attested process
identity and no asymmetric endpoint identity. Byom also
does not sign its consumption receipt, so a peer cannot
cryptographically verify consumption provenance. Every limit is
stated beside the capability it bounds →
Checked by machines — and honest about the seam that is not
Nine TLA+ modules are explored exhaustively by TLC at their configured constants. Two independent rederivers in two languages re-derive every byte the family profile pins. A mutation suite proves the harness is not vacuous. And one link in that chain does not exist yet, which is said here rather than in a footnote.
nine TLA+ modules
Membership and standing, the pledge lifecycle, the episode lease, the one-shot execution permit, the mandate chain, budget conservation, the authority journal, and the two governed-work sagas — each TLC-exhaustive at its constants, with zero errors, crashes modeled as stuttering at every commit boundary.
Safety only. No liveness is claimed anywhere, because no spec assumes fairness.
Descriptors ↔ models, both ways
9 modules, 11 descriptors, 103 states and 199 transitions in exact agreement in both directions. A descriptor row with no model transition, or a model transition with no descriptor row, is a failing check — not a review catch.
Two independent rederivers
111 cases across 83 vector files — canonical bytes, digests, the I-JSON acceptance order, the problem shape — re-derived by a Python stdlib-only checker and, separately, by a dependency-free Node one. No shared code, and both must go nonzero on an empty tree.
14 deliberate mutations
Dropped rows, invented rows, renamed states, lost structured columns, a de-versioned format tag, semantic erasure of a crash result, a widened update meta, and three weakened TLC guards that must produce counterexamples. Every one of them must be caught.
No test in crates/ reads a descriptor or a TLA+ model at
all. The Rust tests include_str! the schemas, the vectors, the
registry and the MCP document — never spec/descriptors/ or
proof/specs/. The conformance oracle that would tie the daemon's
transition functions to these models was expected to land with the daemon; the daemon
landed and the oracle did not. So the models are checked, and they are
not connected to the implementation by any automated test. Every
model's refinement boundary therefore stops at the committed descriptor.
What that leaves uncaught →
One family, three responsibilities
Byom is one of three sovereign systems that do not share an operator, credentials, context or authority. Each holds exactly one responsibility, and the seams between them are frozen contracts rather than shared code.
Where work happens
Shared spaces, deliberation, attention, context, local commitments, assistant hosting, tools, models, artifacts and execution. Kovee delegates governance to byom through the governed-work bundle.
kovee.cc →Who may, and on whose record
Societies, participants, assemblies, endeavors, pledges, mandates, decisions, self-directed activities, governed work and institutional memory — spoken over the Byom Participation Protocol.
Across installations
Sovereign endpoint identity, paired trust, signed remote contracts, bounded peer execution, evidence and cross-installation carriage.
akson.cc →Byom v0.2 is explicitly human-sovereign. Agent and collective autonomy is real inside the protocol — initiative, refusal, exit, private continuity, voluntary association, bounded action — but it is not a claim of legal or moral personhood, and it does not replace human root authority.
Documentation
Concepts
Societies and charters, participants and candidates, endeavors, calls and pledges, mandates, episodes-as-authority, budgets and decisions — and the lifecycle each of them moves through.
concepts → the wireProtocol
The envelope, negotiation, the five sockets and the surfaces they serve, the registry as a deny-by-absence gate, mutation meta and idempotency, problems, events and the MCP binding.
protocol → bytesEncoding profile
Strict I-JSON acceptance, RFC 8785 canonical bytes, RFC 9457 problems, the six digest classes and the A8 cross-boundary rule — the shared substrate all three projects bind to.
encoding → the seamGoverned work
How kovee delegates governance to byom: the greenfield enablement saga, the episode and budget bridge, the dispatch driver, onboarding compute — and the amendment record A1–A9 that overrides the pinned design.
governed work → assuranceConformance & proofs
What each model proves, at which constants, with which projection and refinement boundary — the parity gate, the mutation suite, the executable walks, and what none of it covers.
proofs → limitsSecurity & limits
The developer assurance profile, the unsigned receipt and the authority residual
it leaves, the partial I1 gate, the two open namespace gates, and why
./run-checks.sh ends at exit 2 on purpose.
Reference
Every 99 registry rows by surface, the transition machines, the digest classes, the problem kinds and the wire limits — written from the sources, never typed.
reference →Deeper still, in the repository: the normative design, the specification tree, the proof properties, the ADRs, and the adversarial review record.