R0–R2
Observe is always open
Read-only observation, including of a NOT CLAIMED surface, is CLEARED. This is why shadow mode is the commercial entry point.
EDEN AOK · Attested Operational Kernel
AOK is how EDEN refuses to run on an unsupported claim.
Every capability carries an evidence class. AOK is the kernel that reads that class before a workload is observed, modelled, executed or publicly claimed.
Policy aok-v1.0.2 / clearance-r1 · 12 capabilities · production execute 6 HOLD · 6 DENIED · 0 CLEARED
CLEARED
HOLD
DENIED
PERMISSION TO ACT DEPENDS ON EVIDENCE
Problem
Traditional stacks execute, then log.
A dashboard can display any number. A pitch deck can upgrade a simulation into a product. Nothing in the execution path is required to read the evidence class of the claim it is about to act on.
Thesis
AOK admits, then executes.
EDEN AOK is the attested operational kernel. It binds policy, evidence class and requested action so a capability cannot silently become operational. Observe is not execute. Modelled is not measured. Implemented is not production.
Go / no-go board
One architecture. Twelve labelled capabilities. Six admissible actions.
This is the investor-visible difference. ChronoNav can be reproduced. It cannot take production control. AURA geometry can be modelled. Physical RF cannot be claimed as measured. The satellite network is not claimed at all.
| CAPABILITY | CLASS | OBSERVE | MODEL | REPRODUCE | LAB | PROD | CLAIM |
|---|---|---|---|---|---|---|---|
| REPRODUCIBLESIMULATED | A-OK | A-OK | A-OK | A-OK | DENIED | DENIED | |
| REPRODUCIBLESYNTHETIC | A-OK | A-OK | A-OK | A-OK | DENIED | DENIED | |
| REPRODUCIBLE | A-OK | A-OK | A-OK | A-OK | HOLD | DENIED | |
| REPRODUCIBLE | A-OK | A-OK | A-OK | A-OK | HOLD | DENIED | |
| MEASURED | A-OK | A-OK | A-OK | A-OK | HOLD | A-OK | |
| IMPLEMENTEDPARTIALLY MEASURED | A-OK | A-OK | HOLD | A-OK | HOLD | DENIED | |
| IMPLEMENTEDDEMONSTRATION | A-OK | A-OK | HOLD | A-OK | HOLD | DENIED | |
| IMPLEMENTEDDEMONSTRATION | A-OK | A-OK | HOLD | A-OK | HOLD | DENIED | |
| PROPOSED | A-OK | A-OK | HOLD | HOLD | DENIED | DENIED | |
| MODELLED | A-OK | A-OK | HOLD | HOLD | DENIED | DENIED | |
| NOT MEASURED | A-OK | A-OK | HOLD | HOLD | DENIED | DENIED | |
| NOT CLAIMED | A-OK | DENIED | DENIED | DENIED | DENIED | DENIED |
A-OK = CLEARED under policy aok-v1.0.2 / clearance-r1. HOLD is not a yes. DENIED is not a maybe. Production execute is HOLD or DENIED for every current capability — by design.
Live clearance
Request an action. AOK returns the verdict that the evidence class actually supports.
CAPABILITY
CHRONONAV
ChronoNav V2 scheduler
Frozen-policy scheduler exceeds EDF on mean true utility.
10,000 simulated blind trials. Not a production cluster measurement.
ID a3f1c9e2b7d04c18
ACTION
AOK VERDICT
DENIED- Rule
- R7
- Action
- EXECUTE_PRODUCTION
- Capability
- ChronoNav V2 scheduler
Production execute is denied until a measured, scoped production validation exists.
Policy
The kernel is a rule table, not a vibe.
R3–R4
Measured cannot be inferred
A MEASURED claim is CLEARED only when the capability already carries MEASURED. Simulations, synthetics and models cannot be promoted by copy.
R5–R7
Production execute is gated
No current capability is CLEARED for production execute. Implemented and locally measured surfaces HOLD. Modelled and unmeasured surfaces DENY.
R8–R13
Lab, reproduce, model stay labelled
Lab execution of an implemented surface is CLEARED. Reproduction of a published hash is CLEARED. Modelling never upgrades the evidence class.
Default if unclassified: HOLD. AOK never fails open. Policy aok-v1.0.2 / clearance-r1 · refinery chrononav-v2.0.4 / refinery-r1.
In the stack
Refinery decides what is valuable. AOK decides what is admissible.
ChronoNav schedules remaining work. Progressive Return extracts the feasible surface. Marble records what happened. AURA extends the same control architecture to the edge. AOK sits across all of them: it is the refusal to treat a labelled research result as an operational fact.