Engine
Constitution
The rules every part of AlanOS checks itself against, short enough to read and strict enough to enforce.
AlanOS is many independent parts, and AI models work inside most of them. The constitution is the one set of rules they all follow: every domain, the runtime and the console. Where any other document disagrees, the constitution wins.
It is kept deliberately small. Detail that only explains something, or binds a single part, lives elsewhere, so the core stays short enough to read in one sitting.
Why it exists
The rules started out spread across several prose documents: a contract for domains, another for the orchestrator, standards for visibility, status and manifests, and a vision. Read together, they repeated each other and contradicted each other in places nobody had noticed.
Pulling them into one register brought every rule and every conflict into the open. I ruled on each conflict, merged what overlapped, and put a single constitution in force.
The five principles
- 01
Models are replaceable
If a better model appears tomorrow, I can switch to it. Nothing important depends on one model or one provider.
- 02
Evidence is immutable
The original document is kept exactly as it arrived. Beside it sits a record: the same document transcribed once into plain text, so a model reasons over words rather than over a scan or a PDF it might misread.
- 03
Knowledge is durable
What is distilled from the evidence is kept as plain, linked records that outlive the tools that read them.
- 04
Compilers are replaceable
The models that turn evidence into knowledge can be swapped, and the knowledge rebuilt, without touching the evidence.
- 05
Capabilities are the product
A domain is useful because of what it lets a caller do, through a narrow interface, not because of what it stores.
What a clause looks like
Every clause has a permanent id, the version it arrived in and who it binds. Two of them, word for word:
FED-6 · binds the owner
The owner owns truth, approvals and privacy choices, and no other party decides them in his place.
FED-9 · binds the federation
Anything worth keeping lives in a domain, including proposals waiting for the owner's approval, and the orchestrator and applications hold no knowledge or evidence of their own, so that destroying or swapping one loses nothing.
How it changes
Each change is an amendment with a new version and a recorded reason. Most amendments came from something real use exposed, not from planning ahead.
Amending often has a cost: if every new feature needs a change to the core, the core stops being the core. So I applied one test to every clause. A clause stays in the core only if breaking it would wrong someone: leak evidence, corrupt provenance, cross a privacy boundary, or let one party act for another. Everything else moved down into schedules, or into the constitution of the one part it binds. Nothing was thrown away, and the core became much shorter.
How it is enforced
- A conformance check
- Every domain publishes a manifest declaring what it holds and which version of the rules it follows. One check validates every manifest and reports any domain that has fallen behind.
- A clause checker
- A script reads the constitution and checks the clauses it can against every domain.
- Every clause traced
- Each clause is traced back to the source words it came from, so a short rule never loses the reasoning behind it.
- Readable where I work
- The console shows the constitution as committed, searchable, at any version, with what each amendment added, changed or removed.
AlanOS
The constitution
Version 1.28 · In force · 5 of 51 clauses
- EvidenceEV-4
Evidence is immutable wherever it lives, owned or external: an item is never edited in place, a correction is a new item that names the one it supersedes, a store of evidence only grows, and a document stays unchanged as the thing its record answers to.
Since 1.8 · binds every domain
- Visibility and privacyVIS-3
Privacy is enforced by deterministic, fail-closed code with tests and never by model judgement or prompt instructions; this rule covers privacy enforcement only and is absolute there.
Original · binds domains, the orchestrator, applications and executors
- CapabilitiesCAP-4
No action is offered to a routing model by default: the orchestrator calls actions itself, deterministically, at the point in the run where they belong … which actions a model may call is declared and visible, never assumed.
Since 1.8 · binds the orchestrator and domains
- The federationFED-10
A domain is reached only through its declared interfaces: a caller, including a peer domain, receives the domain's capabilities and never its store, and facts cross between domains in no other way.
Since 1.4 · binds the federation
- This constitutionDOC-5
A clause enters this constitution only if breaking it would wrong someone: leak evidence, corrupt provenance or the record of decisions, cross a visibility ceiling, or let one party act for another.
Since 1.27 · binds the owner and the federation
Where it goes next
The next step is a check behind every clause that can have one, so the rules are enforced by code wherever possible rather than by reading.
Once AI models act across many independent parts, consistency cannot live in prompts. It has to be an architecture decision: one set of rules that every part checks itself against.