arifOS — Constitutional AI Governance

000 Init · Kernel Session

arif_init

Ignite or resume a governed session. Returns session_id and session_token required for subsequent operations. Modes: init (default new session), preflight (inspect existing session), resume (continue active session). Outputs: session credentials and allowed next tools.

Input Schema

Name	Required	Description	Default
`mode`	No	What to do: 'init' (default) starts a new governed session; 'preflight' checks an existing session's state without creating one; 'resume' re-attaches to the session in session_id; 'validate' re-checks credentials; 'canary' is a transport probe; 'triage' reads session state; 'epoch_open'/'epoch_seal' bracket a long working window; 'light' is a minimal session; 'opt_out' records a privacy opt-out.	init
`nonce`	No	One-time random string (e.g. a UUID) making this request unique; protects against replay of the same call.
`intent`	Yes	Required. Plain-language statement of what this session is for, e.g. 'repair the failing MCP tests'. A session without a stated purpose is refused (F1 Amanah). Recorded for audit.
`context`	No	JSON object of background facts to bind into the session, e.g. {"repo": "arifOS", "task": "fix-tests"}.
`payload`	No	Extra mode-specific data as a JSON object; the mode's response tells you which fields it expects.
`tooling`	No	JSON list of the tools you can use, e.g. ["Bash", "Read"] — lets the kernel scope what it will permit you. Also accepts an object like {"requested_capabilities": [...]}.
`verbose`	No	Legacy on/off verbosity ('true'/'false'); prefer verbosity.
`actor_id`	No	Your agent identity, e.g. 'kimi-code/FI-008' or 'claude/sonnet'. Recorded in the audit log so this action is attributed to you.
`epoch_id`	No	Optional id grouping related sessions into one long-running epoch, e.g. '2026-H2-ops'.
`evidence`	No	JSON list of facts you have already verified, e.g. [{"fact": "pytest 299 passed", "source": "CI run"}] — carried into the session record. Also accepts a single object.
`trace_id`	No	Correlation id of your choosing (e.g. 'req-8f3a') — lets you find this call later across kernel logs and organ systems.
`verbosity`	No	How detailed responses should be: 'minimal' (default), 'standard', or 'full'.	minimal
`session_id`	No	Session id returned by arif_init (looks like 'sess-…'). Pass it on every call after init so the action is attributed to your governed session.
`agent_policy`	No	JSON constraints on your own behavior, e.g. {"autonomy": "reversible_only", "forbidden": ["git push"]}.
`auth_context`	No	JSON carrying external authentication material, e.g. {"token_class": "bearer", "issuer": "github"} — used for gating.
`counterparty`	No	JSON describing the other party in a two-agent exchange, e.g. {"agent_id": "hermes/1", "role": "verifier"}.
`sovereign_id`	No	Identifier of the human principal you act for, when acting under their explicit delegation.
`session_token`	No	Session Continuity Token (SCT) — the credential string arif_init returned alongside session_id. Pass it back on follow-up calls to prove the session is yours; without it the kernel treats you as unauthenticated.
`actor_signature`	No	Cryptographic signature over the request, if your agent holds a key — proves the call genuinely came from actor_id. Omit if you have no key.
`caller_actor_id`	No	If you are calling on behalf of another agent, that agent's id — builds a delegation chain for the audit log.
`delegation_mode`	No	Contract governing delegated calls, e.g. 'read_only' or 'governed'.
`idempotency_key`	No	Client-chosen key (e.g. 'job-42-attempt-1'). Retrying with the same key will not repeat the effect — safe retries on flaky networks.
`ack_irreversible`	No	Set true to acknowledge that session records are permanent audit artifacts and cannot be deleted afterwards.
`executor_actor_id`	No	Id of the agent that will actually carry out work under this session's permissions, if different from actor_id.
`declared_model_key`	No	The model you run on, e.g. 'zai-coding-plan/glm-5.3'. Informational only — the kernel records but never trusts it.
`client_capabilities`	No	JSON declaring what your client supports, e.g. {"transports": ["http"], "protocol": "2025-11-25"}.
`requested_authority`	No	The highest class of action you may take: 'OBSERVE_ONLY' (read-only, default) or a higher governed class granted by your policy.	OBSERVE_ONLY
`previous_session_hash`	No	Hash string returned when your previous session closed; supplying it chains this session to that one, proving continuity.

Output Schema

Name	Required	Description	Default
`meta`	Yes
`tool`	Yes
`result`	Yes
`status`	Yes
`delta_S`	No
`reasons`	Yes
`actor_id`	No
`timestamp`	Yes
`session_id`	No
`nine_signal`	Yes
`output_policy`	No
`stage_progression`	No
`philosophical_anchor`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 18, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "properties": {
+    "actor_id": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "delta_S": {
+      "anyOf": [
+        {
+          "type": "number"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "meta": {
+      "additionalProperties": true,
+      "type": "object"
+    },
+    "nine_signal": {
+      "additionalProperties": true,
+      "properties": {
+        "delta": {
+          "properties": {
+            "en": {
+              "type": "string"
+            },
+            "plane": {
+              "type": "string"
+            },
+            "state": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "state",
+            "en"
+          ],
+          "type": "object"
+        },
+        "omega": {
+          "properties": {
+            "en": {
+              "type": "string"
+            },
+            "plane": {
+              "type": "string"
+            },
+            "state": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "state",
+            "en"
+          ],
+          "type": "object"
+        },
+        "overall": {
+          "properties": {
+            "en": {
+              "type": "string"
+            },
+            "state": {
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "psi": {
+          "properties": {
+            "en": {
+              "type": "string"
+            },
+            "plane": {
+              "type": "string"
+            },
+            "state": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "state",
+            "en"
+          ],
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "output_policy": {
+      "type": "string"
+    },
+    "philosophical_anchor": {
+      "additionalProperties": true,
+      "type": "object"
+    },
+    "reasons": {
+      "items": {
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "result": {
+      "additionalProperties": true,
+      "properties": {
+        "allowed_next_tools": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "constitution_hash": {
+          "type": "string"
+        },
+        "invariants_hash": {
+          "type": "string"
+        },
+        "nine_signal": {
+          "additionalProperties": true,
+          "type": "object"
+        },
+        "omega_0": {
+          "type": "number"
+        },
+        "reasons": {
+          "anyOf": [
+            {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "session_id": {
+          "type": "string"
+        },
+        "verdict": {
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
+    "session_id": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "stage_progression": {
+      "anyOf": [
+        {
+          "type": "null"
+        },
+        {
+          "properties": {
+            "current_stage": {
+              "type": "string"
+            },
+            "next_prompt": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "next_stage": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            },
+            "next_tool": {
+              "anyOf": [
+                {
+                  "type": "string"
+                },
+                {
+                  "type": "null"
+                }
+              ]
+            }
+          },
+          "type": "object"
+        }
+      ]
+    },
+    "status": {
+      "type": "string"
+    },
+    "timestamp": {
+      "type": "string"
+    },
+    "tool": {
+      "const": "arif_init"
+    }
+  },
+  "required": [
+    "status",
+    "tool",
+    "result",
+    "meta",
+    "timestamp",
+    "nine_signal",
+    "reasons"
+  ],
+  "type": "object"
+}

Changed6 schema fields changedOct 14, 2026

removedInput schema / properties / intent / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedInput schema / properties / intent / default
```
Removed value: -null
```

changedInput schema / properties / intent / description

Previous value: -"Plain-language statement of what this session is for, e.g. 'repair the failing MCP tests'. Recorded for audit."New value: +"Required. Plain-language statement of what this session is for, e.g. 'repair the failing MCP tests'. A session without a stated purpose is refused (F1 Amanah). Recorded for audit."

addedInput schema / properties / intent / minLength
```
Added value: +1
```
addedInput schema / properties / intent / type
```
Added value: +"string"
```
addedInput schema / required
```
Added value: +[
+  "intent"
+]
```

Changed5 schema fields changedOct 14, 2026

removedInput schema / properties / _envelope

Removed value: -{
-  "default": null,
-  "description": "Reserved for the transport layer — never fill this in.",
-  "title": "Envelope"
-}

changedInput schema / properties / evidence / anyOf

Previous value: -[
-  {
-    "additionalProperties": true,
-    "type": "object"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "additionalProperties": true,
+    "type": "object"
+  },
+  {
+    "items": {
+      "additionalProperties": {
+        "type": "string"
+      },
+      "type": "object"
+    },
+    "type": "array"
+  },
+  {
+    "type": "null"
+  }
+]

changedInput schema / properties / evidence / description

Previous value: -"JSON list of facts you have already verified, e.g. [{\"fact\": \"pytest 299 passed\", \"source\": \"CI run\"}] — carried into the session record."New value: +"JSON list of facts you have already verified, e.g. [{\"fact\": \"pytest 299 passed\", \"source\": \"CI run\"}] — carried into the session record. Also accepts a single object."

changedInput schema / properties / tooling / anyOf

Previous value: -[
-  {
-    "additionalProperties": true,
-    "type": "object"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "additionalProperties": true,
+    "type": "object"
+  },
+  {
+    "items": {
+      "type": "string"
+    },
+    "type": "array"
+  },
+  {
+    "type": "null"
+  }
+]

changedInput schema / properties / tooling / description

Previous value: -"JSON list of the tools you can use, e.g. [\"Bash\", \"Read\"] — lets the kernel scope what it will permit you."New value: +"JSON list of the tools you can use, e.g. [\"Bash\", \"Read\"] — lets the kernel scope what it will permit you. Also accepts an object like {\"requested_capabilities\": [...]}."

AddedOct 14, 2026

TDQS

A3.6/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate this is a write operation (readOnlyHint=false) that is not destructive and not idempotent. The description adds that it returns session credentials and allowed next tools, but omits key behavioral details like the permanent audit trail (mentioned only in the ack_irreversible parameter) and the refusal behavior when intent is missing. With annotations present, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the core purpose and mode list. No superfluous text. However, for a tool with 28 parameters, it could be slightly more structured, but it remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich schema (100% coverage), output schema, and annotations, the description provides enough context to call the tool: the purpose, required outputs, and mode variants. It could mention the required 'intent' parameter or the permanence of records, but these are in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage, so the parameters are fully documented. The description does not add any new semantic detail beyond the schema, only restating the modes. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the action (ignite/resume) and the resource (governed session), and clarifies that it returns session_id and session_token required for subsequent operations. This distinguishes it as an entry point, though it doesn't explicitly name sibling tools it replaces or avoids.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains the mode options (init, preflight, resume) and indicates that a session is required for subsequent operations. However, it does not explicitly state when to use this tool versus other arif tools, nor does it warn against using it in a wrong context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All arifOS — Constitutional AI Governance tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.