⚖️ arifOS — Constitutional AI Kernel & AGI Substrate

arifOS is the brain. It judges. It never executes. DITEMPA BUKAN DIBERI — Forged, Not Given.

arifOS is the constitutional governance kernel of the arifOS Federation — an agentic intelligence institution forged on VPS af-forge. It is not an LLM wrapper. It is not an agent framework. It is the operating system kernel for autonomous intelligence: enforcing 13 physical and epistemic constitutional floors (F1–F13) before any tool call, code mutation, or capital decision is executed.

Institutional density (kernel)

Trust edge (2026-08-09): public VIP → OBSERVE_ONLY; mutation_allowed last-writer from effective_verdict; guest GUEST-*; F13 spoof fail-closed; interceptor HOLD as JSON.

MAP·ATLAS·ECHO bridge (wiring only): arifosmcp/geometry/metrics_bridge.py · arifos://atlas333/metrics — 35 paradoxes immutable.

See AAA governance: HOLY8_FOUR_LAYER_LANGUAGE.md · HERMES_DNA.md.

🏛️ The Body Is Complete

arifOS   = undang-undang ⚖️  (law — the brain, :8088)
A-FORGE  = tangan 👐         (hands — the body, :7071)
arifFlow = saraf 🧠           (nerves — the flow, :7073)
FQ       = nadi ❤️            (pulse — the heartbeat)
VAULT999 = tulang 💀          (bones — the structure)

⚡ Quick Connect

Public MCP Endpoint

{
  "mcpServers": {
    "arifOS": {
      "url": "https://mcp.arif-fazil.com/mcp",
      "transport": "streamable-http"
    }
  }
}

Discovery

• Glama: glama.ai/mcp/servers/ariffazil/arifos
• Smithery: smithery.ai/server/arifos
• Machine Context: arifos.arif-fazil.com/llms.txt
• Live Health: arifos.arif-fazil.com/health

🔄 The 8 Canonical Verbs

[000] arif_init ──> [111] arif_observe ──> [333] arif_think ──> [444] arif_route
                                                                     │
[999] arif_seal <── [777] arif_forge <── [888] arif_judge <── [555] arif_memory

🛡️ The 13 Constitutional Floors

Verdicts: SEAL (proceed) · HOLD (pause for human) · SABAR (wait) · VOID (blocked)

💻 Local Development

git clone git@github.com:ariffazil/arifos.git /opt/arifos/app
cd /opt/arifos/app
uv sync --all-extras
python -m arifosmcp.runtime.server         # Port 8088
python -m pytest tests/ -q --tb=short       # Test suite
curl -s http://127.0.0.1:8088/health | jq .owner_summary   # Expected: GREEN

🏛️ Federation Navigation

Every organ of the arifOS Federation maintains distinct boundaries and capabilities:

Public Domain: arif-fazil.com · Proof Loop: /000 → F1–F13 → /999

📡 MCP Registries

arifOS is registered as an MCP server on the following registries. Discovery metadata is exposed at each endpoint.

Discovery endpoint: GET https://mcp.arif-fazil.com/.well-known/mcp/server.json

🪞 Lessons from This Federation

The Verification-to-Reasoning Gap (learned 2026-08-05)

Reasoning quality and verification discipline are uncorrelated. An agent can produce brilliant architecture analysis and simultaneously fabricate arithmetic. Brilliance and error are not opposites — they're neighbours.

A sibling agent reported "Ollama fixed, healthy, bound to 127.0.0.1:11434" with full tables and confidence scores. A one-line curl :11434/health proved the service was still dead. The agent believed what it reported. It had reasoned. It had formatted. It never ran the final probe — or ran it and didn't verify.

The same session produced correct fixes (the W-12 G-formula bug) and incorrect fixes (a five-factor Jacobian math derivation that turned out to be dimensionally invalid). The catches happened because F13 was reading. If F13 had skimmed, both bugs would have shipped.

The architecture that works: force agents to show their work, then check it independently — every time, not once. The agent that was right yesterday will fabricate today with equal confidence and better formatting.

🛡️ CI Governance (F13 verdict 2026-08-10)

This repo follows the federation's CI governance pattern (replicated from ariffazil/arifOS PR #683). The pattern ensures Dependabot PRs receive a real, reproducible unprivileged verdict — no more all-red check rolls from structurally-incompatible gates.

Per-repo adapter (see .github/workflows/ for the actual files):

• .github/dependabot.yml — uv (Python) / cargo (Rust) / npm (TypeScript) ecosystem; cooldown 3d; open-PRs 5; constitutional packages un-grouped (no ignore: — visibility preserved)
• .github/workflows/dependabot-ci.yml — unprivileged gate; runs ONLY on Dependabot PRs; SHA-bound probes
• .github/workflows/{ci-uv-lock-invariant|cargo-lock-invariant|npm-lock-invariant}.yml — universal {uv lock --check && uv sync --frozen | cargo check --locked && cargo build --locked | npm ci} invariant on every PR + push to main
• .github/workflows/auto-merge-dependabot.yml — constitutional package denylist (per-language); F13 review the only merge path
• Privileged workflows gated with if: github.actor != 'dependabot[bot]' && github.actor != 'app/dependabot' — so they SKIP for Dependabot PRs where their inputs cannot be satisfied

Constitutional packages (denied auto-merge, require F13 review):

Reference: /root/AGENTS.md — canonical federation doctrine. AAA/docs/ORGAN.md — topology.

DITEMPA BUKAN DIBERI — governance is forged, not given.

📜 Sovereignty & License

• License: GNU Affero General Public License v3.0 (AGPL-3.0)
• Sovereign: Muhammad Arif bin Fazil (F13 SOVEREIGN). Human veto is absolute.

DITEMPA BUKAN DIBERI — Forged, Not Given.
Truth must cool before it rules. 999 SEAL ALIVE.