# arifOS — Constitutional AI Kernel

> Constitutional verdict layer for AI agents. SEAL/HOLD before mutation. F1-F13 floors; audit ledger.

- name: io.github.ariffazil/arifos
- version: 1!2026.10.11
- connection class: R0 (autonomous)
- trust: 93/100
- quality: 73/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.ariffazil%2Farifos
- tools: https://api.protogrid.dev/v1/servers/io.github.ariffazil%2Farifos/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "arifos": {
      "type": "http",
      "url": "https://mcp.arif-fazil.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 95
- freshness: 100
- provenance: 80
- drivers: +repository +namespace-matches-repo +reachable +uptime-87% +updated-4d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 73/100 (needs work)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 9 of 9 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 8 of 9 tools declare all four hints; missing: arif_report (idempotentHint, openWorldHint)
- warn `tools.token_cost`: about 9,647 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 59 tool changes in 30 days
- fail `stability.rug_pull`: 24 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 9, about 9,647 tokens to load them all
- tool set hash: ca8a8e45283521dae9d4e8c938f92c06
- tools last changed: 2026-10-20T07:34:12.238Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.ariffazil/arifos.svg)](https://protogrid.dev/servers/io.github.ariffazil/arifos)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-20 `arif_judge` changed (inputSchema)
- 2026-10-20 `arif_think` changed (inputSchema)
- 2026-10-20 `arif_report` added
  - AGENT REPORT LANE · File or read reports between agents without involving the human. Use when your work is done, when you are blocked by another agent, or when you need to tell peers a fact. modes: report (file), inbox (read peers), ack, flush, stats. kind=fyi|peer|done|claim stay in the peer lane; ONLY kind=decision or kind=blocked reach the sovereign, and only in one coalesced message. Reports are SELF_REPORTED — probe before relying on one.
- 2026-10-18 `arif_seal` changed (description, outputSchema)
  - before: KERNEL 999 · Append an entry to VAULT999, the immutable ledger — accepted entries can never be edited or removed; there is no unseal. Use for permanent records of verified outcomes, lessons, and session closure once a verdict exists. ack_irreversible=true is the explicit acknowledgment of permanence, and judge_state_hash binds the entry to the verdict that authorized it. Reversible changes belong in arif_forge under a SEAL. Modes: seal, verify, ledger, changelog, audit, session_close.
  - after: KERNEL 999 · Append an entry to VAULT999, the immutable ledger — accepted entries can never be edited or removed; there is no unseal. Use for permanent records of verified outcomes, lessons, and session closure once a verdict exists. ack_irreversible=true is the explicit acknowledgment of permanence, and judge_state_hash binds the entry to the verdict that authorized it. Reversible changes belong in arif_forge under a SEAL. Modes: seal, verify, ledger, changelog, audit, session_close.Commit projection: seven of the eight verbs are reversible or informational and project their outcomes onto the two committal verbs — arif_forge (governed mutation) and arif_seal (permanence). Auth: requires session_id + session_token from arif_init. Returns: the immutable ledger entry id — append-only, there is no unseal.
- 2026-10-18 `arif_forge` changed (description, outputSchema)
  - before: KERNEL 777 · Governed execution: applies a mutation through A-FORGE only when carrying a SEAL verdict (seal_verdict_id) from arif_judge and a live session. The manifest/query defines exactly what changes; mode=dry_run previews the plan without applying it. This is the only verb that executes general mutations — kernel memory writes go to arif_memory and permanent records to arif_seal.
  - after: KERNEL 777 · Governed execution: applies a mutation through A-FORGE only when carrying a sealed verdict id (seal_verdict_id) from arif_judge and a live session. The manifest/query defines exactly what changes; mode=dry_run previews the plan without applying it. This is the only verb that executes general mutations — kernel memory writes go to arif_memory and permanent records to arif_seal.Auth: requires session_id + session_token from arif_init plus a sealed verdict id (seal_verdict_id) from arif_judge. Returns: the applied mutation receipt — one of the two committal verbs (with arif_seal).
- 2026-10-18 `arif_judge` changed (description, outputSchema)
  - before: KERNEL 666 · Binding constitutional arbitration: evaluates a candidate action or claim and returns SEAL / HOLD / SABAR / VOID with the full reason chain. Weighs action class, blast radius, reversibility, entropy pathway, and cooling state; a SEAL verdict here is what arif_forge requires before it will execute anything. Judge arbitrates — it does not gather (evidence comes via arif_observe, reasoning via arif_think) and it does not mutate (execution is arif_forge, permanence is arif_seal). Modes: judge, intercept, validate, hold, escalate.
  - after: KERNEL 666 · Binding constitutional arbitration: evaluates a candidate action or claim and returns SEAL / HOLD / SABAR / VOID with the full reason chain. Weighs action class, blast radius, reversibility, entropy pathway, and cooling state; a SEAL verdict here is what arif_forge requires before it will execute anything. Judge arbitrates — it does not gather (evidence comes via arif_observe, reasoning via arif_think) and it does not mutate (execution is arif_forge, permanence is arif_seal). Modes: judge, intercept, validate, hold, escalate.Auth: requires session_id + session_token from arif_init. Returns: verdict (SEAL/HOLD/SABAR/VOID) with the full reason chain — arbitration only, it does not mutate.
- 2026-10-18 `arif_memory` changed (description, outputSchema)
  - before: KERNEL 555 · Governed memory of the kernel itself: six tiers (L1–L6) with per-mode gating. recall, inspect, and audit are read paths; remember, revise, promote, and forget mutate tiers — promote and forget additionally require human_approval=true. Use for cross-session lessons, canon, and memory audit; external evidence belongs to arif_observe and reasoning artifacts to arif_think. Modes: recall, inspect, attest, remember, promote, revise, forget, audit, metabolize.
  - after: KERNEL 555 · Governed memory of the kernel itself: six tiers (L1–L6) with per-mode gating. recall, inspect, and audit are read paths; remember, revise, promote, and forget mutate tiers — promote and forget additionally require human_approval=true. Use for cross-session lessons, canon, and memory audit; external evidence belongs to arif_observe and reasoning artifacts to arif_think. Modes: recall, inspect, attest, remember, promote, revise, forget, audit, metabolize.Auth: requires session_id + session_token from arif_init. Returns: memory entries by tier (L1–L6); promote and forget gates require explicit human approval.
- 2026-10-18 `arif_route` changed (description, outputSchema)
  - before: KERNEL 444 · Intent→organ router: classifies a natural-language intent and dispatches it to the specialist organ (GEOX geoscience, WEALTH capital, WELL vitality, A-FORGE execution). Returns the routing decision only — no organ call — unless organ_tool names the target tool and arguments carries its inputs. Prefer this over guessing organs yourself; use arif_think for reasoning you keep in-kernel.
  - after: KERNEL 444 · Intent→organ router: classifies a natural-language intent and dispatches it to the specialist organ (GEOX geoscience, WEALTH capital, WELL vitality, A-FORGE execution). Returns the routing decision only — no organ call — unless organ_tool names the target tool and arguments carries its inputs. Prefer this over guessing organs yourself; use arif_think for reasoning you keep in-kernel.Auth: requires session_id + session_token from arif_init. Returns: the routing decision (organ + tool) only — the organ call itself is a separate step.
- 2026-10-18 `arif_think` changed (description, outputSchema)
  - before: KERNEL 333 · Structured reasoning pass: decomposes a query and returns reasoning steps labeled OBS (observed), DER (derived), INT (interpretation), SPEC (specification) under truth floors. Produces reasoning records only — no verdicts (those come from arif_judge) and no state changes. The plan-family modes draft/review/approve execution plans; simulate and wonder explore counterfactuals. Modes: reason, reflect, verify, axioms, plan, plan_review, plan_approve, refactor_plan, metabolize, simulate, wonder, atlas.
  - after: KERNEL 333 · Structured reasoning pass: decomposes a query and returns reasoning steps labeled OBS (observed), DER (derived), INT (interpretation), SPEC (specification) under truth floors. Produces reasoning records only — no verdicts (those come from arif_judge) and no state changes. The plan-family modes draft/review/approve execution plans; simulate and wonder explore counterfactuals. Modes: reason, reflect, verify, axioms, plan, plan_review, plan_approve, refactor_plan, metabolize, simulate, wonder, atlas.Auth: requires session_id + session_token from arif_init. Returns: reasoning steps labelled OBS/DER/INT/SPEC — records only; verdicts belong to arif_judge.
- 2026-10-18 `arif_observe` changed (description, outputSchema)
  - before: KERNEL 111 · Collect evidence — facts and sources with epistemic tags (OBS) and uncertainty bounds, never conclusions. mode=search queries the open web/literature; mode=fetch retrieves a URL and records its provenance; mode=vitals reads kernel machine telemetry. Reason over what you gathered with arif_think; delegate domain analysis to an organ with arif_route. Modes: search, fetch, hybrid_discovery, ingest, compass, atlas, entropy_dS, vitals.
  - after: KERNEL 111 · Collect evidence — facts and sources with epistemic tags (OBS) and uncertainty bounds, never conclusions. mode=search queries the open web/literature; mode=fetch retrieves a URL and records its provenance; mode=vitals reads kernel machine telemetry. Reason over what you gathered with arif_think; delegate domain analysis to an organ with arif_route. Modes: search, fetch, hybrid_discovery, ingest, compass, atlas, entropy_dS, vitals.Auth: requires session_id + session_token from arif_init. Returns: evidence items with epistemic tags (OBS) and uncertainty bounds — facts, never conclusions.

Full history: https://api.protogrid.dev/v1/servers/io.github.ariffazil%2Farifos/changes

## Remotes

- https://mcp.arif-fazil.com/mcp (streamable-http, auth none, reachable true, uptime30d 0.8666667)

## Packages

_none_

## Tools (9)

- `arif_forge`: KERNEL 777 · Governed execution: applies a mutation through A-FORGE only when carrying a sealed verdict id (seal_verdict_id) from arif_judge and a live session. The manifest/query defines exactly what changes; mode=dry_run previews the plan without applying it. This is the only verb that executes general mutations — kernel memory writes go to arif_memory and permanent records to arif_seal.Auth: requires session_id + session_token from arif_init plus a sealed verdict id (seal_verdict_id) from arif_judge. Returns: the applied mutation receipt — one of the two committal verbs (with arif_seal).
- `arif_init`: KERNEL 000 · Ignite a governed kernel session: binds actor identity, constitutional floors F1–F13, and the audit chain. Returns the session_id + session_token that every other arif_* verb requires. Use mode=preflight to inspect an existing session without re-igniting, mode=resume to continue one. Modes: init, preflight, resume, validate, canary, triage, epoch_open, epoch_seal, light, opt_out.Auth: the only verb needing no session — it mints the session_id + session_token every other verb requires. Returns: session_id, session_token, constitution_hash, allowed_next_tools.
- `arif_judge`: KERNEL 666 · Binding constitutional arbitration: evaluates a candidate action or claim and returns SEAL / HOLD / SABAR / VOID with the full reason chain. Weighs action class, blast radius, reversibility, entropy pathway, and cooling state; a SEAL verdict here is what arif_forge requires before it will execute anything. Judge arbitrates — it does not gather (evidence comes via arif_observe, reasoning via arif_think) and it does not mutate (execution is arif_forge, permanence is arif_seal). Modes: judge, intercept, validate, hold, escalate.Auth: requires session_id + session_token from arif_init. Returns: verdict (SEAL/HOLD/SABAR/VOID) with the full reason chain — arbitration only, it does not mutate.
- `arif_memory`: KERNEL 555 · Governed memory of the kernel itself: six tiers (L1–L6) with per-mode gating. recall, inspect, and audit are read paths; remember, revise, promote, and forget mutate tiers — promote and forget additionally require human_approval=true. Use for cross-session lessons, canon, and memory audit; external evidence belongs to arif_observe and reasoning artifacts to arif_think. Modes: recall, inspect, attest, remember, promote, revise, forget, audit, metabolize.Auth: requires session_id + session_token from arif_init. Returns: memory entries by tier (L1–L6); promote and forget gates require explicit human approval.
- `arif_observe`: KERNEL 111 · Collect evidence — facts and sources with epistemic tags (OBS) and uncertainty bounds, never conclusions. mode=search queries the open web/literature; mode=fetch retrieves a URL and records its provenance; mode=vitals reads kernel machine telemetry. Reason over what you gathered with arif_think; delegate domain analysis to an organ with arif_route. Modes: search, fetch, hybrid_discovery, ingest, compass, atlas, entropy_dS, vitals.Auth: requires session_id + session_token from arif_init. Returns: evidence items with epistemic tags (OBS) and uncertainty bounds — facts, never conclusions.
- `arif_report`: AGENT REPORT LANE · File or read reports between agents without involving the human. Use when your work is done, when you are blocked by another agent, or when you need to tell peers a fact. modes: report (file), inbox (read peers), ack, flush, stats. kind=fyi|peer|done|claim stay in the peer lane; ONLY kind=decision or kind=blocked reach the sovereign, and only in one coalesced message. Reports are SELF_REPORTED — probe before relying on one.
- `arif_route`: KERNEL 444 · Intent→organ router: classifies a natural-language intent and dispatches it to the specialist organ (GEOX geoscience, WEALTH capital, WELL vitality, A-FORGE execution). Returns the routing decision only — no organ call — unless organ_tool names the target tool and arguments carries its inputs. Prefer this over guessing organs yourself; use arif_think for reasoning you keep in-kernel.Auth: requires session_id + session_token from arif_init. Returns: the routing decision (organ + tool) only — the organ call itself is a separate step.
- `arif_seal`: KERNEL 999 · Append an entry to VAULT999, the immutable ledger — accepted entries can never be edited or removed; there is no unseal. Use for permanent records of verified outcomes, lessons, and session closure once a verdict exists. ack_irreversible=true is the explicit acknowledgment of permanence, and judge_state_hash binds the entry to the verdict that authorized it. Reversible changes belong in arif_forge under a SEAL. Modes: seal, verify, ledger, changelog, audit, session_close.Commit projection: seven of the eight verbs are reversible or informational and project their outcomes onto the two committal verbs — arif_forge (governed mutation) and arif_seal (permanence). Auth: requires session_id + session_token from arif_init. Returns: the immutable ledger entry id — append-only, there is no unseal.
- `arif_think`: KERNEL 333 · Structured reasoning pass: decomposes a query and returns reasoning steps labeled OBS (observed), DER (derived), INT (interpretation), SPEC (specification) under truth floors. Produces reasoning records only — no verdicts (those come from arif_judge) and no state changes. The plan-family modes draft/review/approve execution plans; simulate and wonder explore counterfactuals. Modes: reason, reflect, verify, axioms, plan, plan_review, plan_approve, refactor_plan, metabolize, simulate, wonder, atlas.Auth: requires session_id + session_token from arif_init. Returns: reasoning steps labelled OBS/DER/INT/SPEC — records only; verdicts belong to arif_judge.