Authoring Boundary
Layers: L1-L2
Preparing deterministic execution surface.
Restoring policy context, topology constraints, and proof pipeline metadata.
Validate
Route
Seal
Restoring policy context, topology constraints, and proof pipeline metadata.
Validate
Route
Seal
Architecture is separated on purpose so trust admission, execution control, and proof handling remain explicit and auditable.
Authoring Boundary
Layers: L1-L2
Trust Boundary
Layers: L3
Execution Boundary
Layers: L4-L6
Authoring Boundary
Compiler / DSL Layer
Bundle and Signing Layer
Trust Boundary
Citadel / Verifier Layer
Execution Boundary
Runtime Kernel Layer
API / Integration Layer
Hardware Mapping Layer
System control path
Input -> Admission -> Runtime -> Commit -> Proof
Responsibility: Transform domain logic into canonical runtime representation.
Boundary: Authoring boundary
Output: Canonical workload bundle
Responsibility: Canonicalize payloads and attach verification metadata.
Boundary: Authoring boundary
Output: Signed bundle and identity context
Responsibility: Apply admission policy and trust checks before execution.
Boundary: Trust boundary
Output: Verified workload admission
Responsibility: Execute topology-constrained workloads with bounded runtime.
Boundary: Execution boundary
Output: Deterministic runtime state
Responsibility: Expose stable contract surfaces for integrators and operators.
Boundary: Execution boundary
Output: Controlled API response
Responsibility: Align runtime model with hardware-oriented deployment paths.
Boundary: Execution boundary
Output: Hardware-compatible execution model
L1-L2 define how logic is authored, canonicalized, and signed before admission.
Layer scope: L1-L2
L3 controls identity, policy, and trust admission before workload can execute.
Layer scope: L3
L4-L6 govern runtime behavior, proof path, API contract, and hardware alignment.
Layer scope: L4-L6
Workload enters as canonical bundle.
Policy and trust checks decide if runtime can proceed.
Topology-constrained execution begins with bounded budget.
Accepted result crosses controlled finalization boundary.
Signed metadata enables verification and replay consistency.
Admission policy and trust context are isolated before runtime starts.
Runtime cannot bypass topology, budget, or control boundaries.
Commit and proof outputs remain verifiable through a controlled path.