Independent Python prototype | v0.1.0 alpha
An AI that Waits.
Its core, the Sigil Kernel, is a test-backed v0.1.0 alpha that governs AI work before the model sees context: scoped data, consent checks, bounded cadence, audit evidence, and fail-closed behavior. That before stage is the foundation of a broader direction: governance across the full lifecycle of AI work — before model exposure, during observable output, and after side effects are proposed. Only the before stage is built today. For reviewers, the control surface is mapped to the NIST AI RMF as alignment and evidence, not certification. The manifesto explains the broader view behind Rose Sigils: why AI needs runtime containment, not just faster models.
Why the boundary matters
A model receives broad context, generates an answer, and only then do filters or monitors try to catch what went wrong. That posture is fragile when the workflow touches customer records, account signals, approvals, legal documents, or regulated data.
Govern the request before model exposure. The Sigil Kernel narrows context through SCOPE, classifies meaning through RUNE, checks consent through OATH, bounds cadence through CYCLE, and builds a Prepared Advisory View instead of handing the model the full environment.
NIST AI RMF alignment — not certification
For reviewers who speak in AI risk-management language, the Sigil Kernel maps its proof surface to the four NIST AI RMF functions before asking them to learn the internal seat vocabulary. This is alignment and evidence — not certification, compliance, or audit. The full map, with named limits, is public in docs/NIST_AI_RMF_MAPPING.md.
The Sigil Pact, Genesis boot binding, T-0 seam, version model, and amendment ceremony define who may authorize change, when the kernel must halt, and how public claims stay tied to proof.
SCOPE, RUNE, OATH, CYCLE, PAV, REDLINE, and tenant containers translate a request into bounded sources, meaning, consent, cadence, exclusions, and model-facing context before exposure.
TRACE, the acceptance runner, coverage, the claim matrix, the reverse Pact-code map, and cold verification turn governed behavior into reproducible evidence instead of trust-me language.
WARD, OATH, CYCLE, Safe-Stop, REDLINE redaction, and SEAL give the kernel explicit ways to narrow, refuse, recover, or amend rather than letting the model improvise past a boundary.
The governing law
The Sigil Pact is the open-source governing law the kernel runs, not a policy PDF it files away. Section 0 is bound to startup by a Genesis hash: if the governing text does not match what the kernel booted with, ordinary requests do not proceed. Authority, claim discipline, and amendment all derive from it.
The eight seats enforce the Sigil Pact on every governed request. It is code the runtime obeys, not guidance it hopes for.
Section 0 integrity is checked against a Genesis hash at boot. If it does not match, the kernel fails closed rather than running under unknown law.
Changes move through a governed SCRIBE / SEAL ceremony, not an ad-hoc edit. Amending the law is itself a controlled, recorded act.
The law that governs the system is open to read in the repository. The constitution is not hidden from the governed.
Architecture — governed by The Sigil Pact
The Sigil Kernel is governed by an open-source code of law, The Sigil Pact. It defines eight seats, the Eight Sigils, each holding one authority type that no other seat may assume. Subsystems serve the seats but hold no authority of their own, and the model is the least privileged component in the system: it informs, it does not rule.
Operational seats active in every governed request
Routes governed tasks and halts on integrity failure.
Declares bounded data access for a task.
Classifies meaning against governed vocabulary.
Checks recorded consent for action classes.
Bounds cadence and reports per-domain load.
Writes tamper-evident evidence; supports cold verification.
Pipeline zones same seats, placed where they act in the request path
Sigil Pact seats active only when The Sigil Pact itself changes
Drafts and stages constitutional revisions. Cannot seal.
Ratifies reviewed amendments through ceremony, under T-0.
Subsystems serve the seats; hold no authority. Lowercase by design — they are not seats.
Execution state machine.
Prepared Advisory View builder.
Hub topology and walls.
Isolated governed context.
Persistence and round-trip.
External model adapter.
Current proof surface
The current implementation includes scoped data access, PAV construction, consent gates, Safe-Stop recovery, hash-chained TRACE records with cold verification, tenant and container isolation, and a governed offline demo mode.
Reproduce the baseline with python tests/test_all.py. Claim mapping lives in docs/claim_matrix.md.
Public boundary: this site shows the release-safe evidence surface. Private working notes and unpromoted experiments stay outside the public site; they appear here only after a scoped recut, review, and green gates.
Governed claims
The Sigil Kernel holds its own claims to the standard it holds AI workflows to: no claim outruns its proof.
Rose Sigils control surface
The public alpha implements the before window; during and after are roadmap. The broader Rose Sigils direction is to govern the observable lifecycle of AI work — before, during, and after — without claiming access to hidden model thinking.
Decide what the workflow may see and what authority exists before a model is asked to answer.
Watch observable output or action streams as they form, then narrow, pause, or halt when governed boundaries are crossed.
Keep the kernel active around the actions an agent proposes — side effects, audit receipts, recovery, and long-running obligations. Agency is not authorization.
Direction — not yet built
v0.1.0 is the Sigil Kernel, governing before model exposure. Future Sigils carry the same law outward — to observable output as it streams, to the actions agents propose before they execute, and to larger multi-tenant deployments — each a bounded, audited surface under one shared law. Advisors may assess and shape those proposals; only the gates authorize. Specifics are shared directly with partners and collaborators rather than detailed here.
Beyond v0.1.0: anchoring the hash-chained audit trail to an independent external source, so tamper-evidence does not rest on trusting the host. The hashing is real today; external anchoring and cryptographic identity are not yet built, and not claimed.
Manifesto
The Sigil Kernel is not another engine. It is a runtime boundary for governing what powerful systems can touch, what evidence they leave, and where human authority remains intact.
In 1977, Renault rolled out the RS01 with a turbocharged 1.5-liter V6. The car was mocked as the Yellow Teapot because it kept returning to the pits steaming. It made roughly 500 horsepower in a field where naturally aspirated 3.0-liter engines were still treated as the proven choice. Within four years, the grid was chasing turbocharging.
By 1986, BMW's M12/13 was producing more than 1,400 horsepower in qualifying trim from a four-cylinder block with road-car roots. Boost pressures exceeded 5.5 bar. The engines were so overstressed that they could be built for a single flying lap, and drivers described the power delivery like a switch: nothing, then an explosive surge that could break traction instantly.
The era ended because capability had outrun the chassis, the tracks, the economics, and the safety model around it. The FIA banned turbocharged engines for 1989. Ingenuity had not failed. The surrounding control structure had fallen behind.
You do not put brakes on a race car so it can drive slow. You put brakes on a race car so it can drive fast.
AI is entering its own turbo era: stronger models, faster agents, more tool access, and more autonomy. Many systems perform well in three-lap demos and fail under sustained operational load because deterministic gates, audit receipts, and recovery paths are improvised after the fact. The Sigil Kernel treats that as a structural problem: containment belongs in the runtime before the model is asked to answer, then extends toward observable output streams and governed side effects.
The older security lineage tells the software-side version of the Turbo Era story. When computing systems became shared, networked, and too consequential to trust every process by instinct, security moved toward mediators: kernels, reference monitors, policy gates, least privilege, and audit.
Rose Sigil Systems did not invent the security kernel, the reference monitor, zero trust, or capability security. The honest claim is narrower: it independently converged on those principles and applies them to the LLM and agent runtime boundary.
The older lineage has durable requirements: complete mediation, tamper resistance, and verifiability. The Sigil Kernel maps those instincts onto the AI boundary through an always-invoked request path, Section 0 integrity checks, a bounded tier model, cold verification, and a claim matrix that ties documented assertions back to tests.
The Turbo Era explains why containment becomes necessary. The reference monitor explains what containment has to be: a mediator that is always invoked, hard to bypass, and inspectable after the fact.
The value is not in claiming to be first. It is in independently landing on a structure that serious security people already recognize as durable, then making that structure visible at the AI workflow boundary.
The model is not the product's authority. Governance is the product: the runtime mediator, the policy gate, the audit surface, and the recovery path. Alignment by disposition asks the model to behave. Alignment by construction changes what the model is allowed to touch.
Open-source · building in public
The Sigil Kernel is an open-source governance kernel that treats the model as a subordinate advisor, not an authority: context is narrowed before exposure, consent and cadence are checked, and every governed step leaves hash-chained evidence anyone can re-run.
It is alpha, and all of it is public — the code, the law, and the proof. If you work near AI governance as a builder, an operator, a researcher, or a potential partner, read it, test it, or reach out.