The trust kernel every AI operation must pass through.

AISOS is not a model and not a wrapper. It is a mediation boundary: eleven semantic calls, a trust-label algebra, deny-by-default admission control, prompt and output firewalls, argument-bound capabilities and a hash-chained evidence ledger. The question stops being which model you use and becomes whether your AI application runs on AISOS.

Mediate a request Author policy

Active bundle

core.baseline.v4

Bundle digest

650c3af1caf5c50d

Kernel calls

Attested endpoints

6/7

Mediated requests

this session

Refusals

operations that did not occur

Ledger records

chain intact

Live endpoints

real upstream inference

Kernel boundary — the eleven semantic calls

sem_open

sem_spawn

sem_ingest

sem_infer

sem_retrieve

sem_recall

sem_remember

sem_invoke

sem_verify

sem_emit

sem_close

No AI operation exists outside these calls. Anything that bypasses them is, by definition, outside the trust boundary and is refused at the gate.

Governing principles

deny

P1
Deny by default
Absent an explicit permit rule whose label floor is satisfied, the operation does not occur.
P2
Data is never instruction
Retrieved text enters at I0 and cannot be promoted into instruction position by its own content.
P3
Label arithmetic, not guesswork
Integrity falls, confidentiality rises. Injection becomes an arithmetic violation, not a detection gamble.
P4
Every verdict is accountable
Policy id, rule, object, label path, remediation and bundle digest — sealed into an append-only chain.