Implementation: IMPLEMENTED · Exposure: PUBLIC (docs). See status labels. The kernel ABI is the set of typed contracts that every part of the Living Agent Architecture is built against. A contract defines the exact shape of one thing that crosses a boundary: a task, a policy decision, a lease, a receipt. Components agree on contracts, not on each other’s internals, which is what lets a model, a tool runtime or an executor be replaced without changing the agent. Package 1.0.0 is frozen as of 2026-09-30.

​
Architecture contract

​
Where it lives

The package contains 21 schema files defining 65 contracts. Each schema has a pinned $id under https://schemas.allternit.com/kernel/1.0.0/. MANIFEST.json holds the SHA-256 of every schema, registry, data and generated file.

​
Contract families

Deferred to a later minor version: DeploymentProfileV1, DatasetReceiptV1, PrimitivePackManifestV1 and DecisionBankManifestV1. Version 1.0.0 refers to these by opaque ID only.

​
The primitive registry

registry/primitives.json lists 191 primitive operation IDs. Each has a dotted ID (for example obs.read_file) and an upper-snake alias (READ_FILE). IDs are grouped by namespace: obs, dec, mut, ver, ctl, tool, route, ctx, state, plan, policy and mem. Each primitive may carry an execution class: In 1.0.0, 25 primitives carry a confirmed class. The remaining 166 are left unclassified (null) until each is confirmed.

​
Rules the contracts encode

Some architecture rules are enforced by the schemas themselves:
  • The completion decision is produced by the runtime or a verifier and is decided by the system. A model cannot be the decider.
  • A decision result with a gate answer never validates as a policy contract. A gate is a recommendation, not a verdict.
  • Every mutable field has a single owner. Agent state holds semantic truth; the work runtime ledger holds lifecycle, attempts, leases and campaigns. They reference each other by stable IDs and state versions and never mirror the same mutable value.
  • No vendor or model name appears in any schema, registry entry or data file. This is tested.

​
Versioning

​
Four version axes

Versions are tracked on four independent axes.

​
Additive and breaking changes

Frozen files are never edited in place.

​
Fail closed on unknown

Additive changes are safe only because receivers fail closed:
  • Every object is closed (additionalProperties: false). An unknown field is rejected.
  • An unknown enum value is rejected.
  • Optional data that a receiver may not understand travels in extensions, a map whose keys must start with x-. Every closed object carries it.
A component that receives something it does not understand refuses it. It does not guess.

​
Encodings

  • Hashes are sha256: followed by 64 lowercase hex characters.
  • Timestamps are RFC 3339 strings.

​
Other invariants

  • Receipts are append-only.
  • Every durable write increments a state version or records an explicit no-op.

​
Relationship to the Agency API

The Agency API is a public view over these contracts. API objects such as the attention request, artifact, network policy and execution environment are public projections of AttentionRequestV1, NodeOutputV1, NetworkAccessPolicyV1 and ExecutionEnvironmentV1. The API follows the same evolution rules: unknown request fields are rejected, and clients treat unknown enum values as not understood.

​
Field-level reference

Every definition and field is listed in the generated Kernel contracts reference.

​
Current implementation

The contracts, the primitive registry, the built-in completion data, generated TypeScript and Rust types and the schema-level conformance tests are on main. A frozen contract is a specification. It does not mean the component that implements it is built; each deep page states what is.

​
Availability

​
Developer relevance

​
Regenerate types

Generated TypeScript and Rust types are checked in. To reproduce them:
Requirements: python3, npx (Node.js), cargo with cargo-typify 0.8.0, and rustfmt.
The script bundles the schemas, writes generated/ts/kernel-abi.d.ts and generated/rust/src/generated.rs, and refreshes the file hashes in MANIFEST.json. On a clean checkout it produces no git diff.
The code generators cannot express cross-file references or conditional rules, so types are generated from a non-normative bundle with conditional keywords removed. Conditional rules are enforced by schema validation only. Validate against the schemas in schemas/, not against the generated types alone.

​
Run the conformance tests

The Python suite checks that:
  • every schema is itself valid and every $ref resolves;
  • each contract has a valid example that passes and at least one invalid example that fails;
  • unknown enum values and unknown fields are rejected;
  • extensions accepts only x- keys;
  • hash and timestamp encodings are enforced;
  • no vendor or model name appears;
  • the bug-fix completion policy does not allow partial completion;
  • the registry has the expected shape, and each mutable field has a single owner;
  • $id values are pinned and MANIFEST.json hashes match the files.
The Rust suite checks that every valid example round-trips through the generated serde types. These tests cover the contracts. A conformance suite for a running kernel is not built yet.

​
Workspace inspector

The shared Agency Kernel settings browser bundles the frozen schema documents alongside the contract metadata. allternit-ai/scripts/gen-kernel-abi.py projects the platform manifest, schemas, examples and primitive count into src/data/kernel-abi/contracts.json. Regenerate it with the platform spec/Contracts/kernel/v1 path and source commit when refreshing the bundled ABI. The inspector copies the complete schema with a reference to the selected definition; it does not mutate the frozen package.