arifOS evaluates consequential AI actions against policy floors and returns a verdict before execution occurs.
When an AI agent proposes to write, delete, deploy, or spend, arifOS inserts an independent judgment step: the agent proposes, arifOS evaluates, a human approves (or not), and only then does execution proceed. Every verdict is recorded with full evidence in an append-only ledger.
This is not an AI model. It is not an agent framework. It is a policy decision point — the layer between "agent wants to act" and "action occurs."
AI agents that act are also certifying their own actions. There is no independent authority evaluating proposals against safety, compliance, and policy constraints before execution occurs.
Agent proposes action
│
▼
┌─────────────────┐
│ arifOS Kernel │ Evaluates against 13 constitutional floors
│ (:8088) │ Records evidence chain
└────────┬────────┘
│
┌──────┼──────┬──────────┐
▼ ▼ ▼ ▼
SEAL HOLD SABAR VOID
(go) (wait) (patience) (blocked)
│ │
▼ ▼
Execute Human
via reviews
A-FORGE
│
▼
Receipt in VAULT999
(append-only ledger)
The judge never executes. The executor never certifies.
pip install arifos# Start the MCP server
python -m arifosmcp.serve --port 8088
# Check health
curl http://localhost:8088/health# Via MCP (Streamable HTTP)
import httpx
# Submit a proposal for judgment
response = httpx.post("http://localhost:8088/mcp", json={
"method": "tools/call",
"params": {
"name": "arif_judge",
"arguments": {
"candidate": "Write file /data/report.csv with production data",
"action_tier": "standard"
}
}
})
# Returns: SEAL | HOLD | SABAR | VOID with full evidence chain# Full cycle: proposal → judgment → human approval → execution → receipt
arifos demo --guided| Verdict | Meaning | What happens |
|---|---|---|
| SEAL | Authorized under stated conditions | Proceed to execution |
| HOLD | Insufficient evidence or human approval needed | Pause; await human decision |
| SABAR | Not yet decidable — reality hasn't finished speaking | Wait; distinct from HOLD |
| VOID | Blocked by a constitutional floor | Stop; constraint must be resolved |
Every proposal passes through 13 policy constraints. A single floor failure produces VOID.
| Floor | Name | What it checks |
|---|---|---|
| F1 | AMANAH | Reversibility — no irreversible action without consent |
| F2 | TRUTH | Evidence-grounded claims — uncertainty-banded |
| F3 | WITNESS | Three-way consistency (theory, code, intent) |
| F4 | CLARITY | Transparent intent |
| F5 | PEACE | Human dignity over convenience |
| F6 | EMPATHY | Consequences for weakest stakeholders |
| F7 | HUMILITY | Acknowledge limits |
| F8 | GENIUS | Elegant correctness (G ≥ 0.80) |
| F9 | ANTI-HANTU | No consciousness or emotion claims |
| F10 | ONTOLOGY | Structural coherence |
| F11 | AUTH | Identity verification before sensitive operations |
| F12 | INJECTION | Input sanitization |
| F13 | SOVEREIGN | Human veto is absolute |
Every verdict, evidence chain, and execution receipt is recorded in VAULT999 — an append-only JSONL ledger with 119,000+ records. Designed for compliance auditing, forensic review, and governance proof.
arifOS Federation — 10 Organs
arifOS (:8088) Constitutional judgment kernel
AAA (:3001) Intelligence routing, state plane, skill catalog
A-FORGE (:7071/7072) Execution after authorization
GEOX (:8081) Earth sciences domain evidence
WEALTH (:18082) Capital and financial intelligence
WELL (:18083) Human and machine vitality observation
arifFlow (:7073) Metabolic ledger daemon (FQ monitoring, receipt ingestion)
FED (:7074) Federation routing gateway (multi-provider LLM)
FRAME (:18085) Independent observer, drift detection, evidence gathering
i-ARIF (:18095) Seal B synthesis engine
ARIF vetoes. arifOS judges. AAA routes. A-FORGE executes. FRAME witnesses. FED routes.
arifOS is the kernel. The other organs are supporting infrastructure. GEOX is the primary reference implementation, demonstrating governance in high-consequence, uncertainty-heavy workflows. FRAME is the independent observer — its output is evidence, never a verdict.
The kernel exposes 8 canonical MCP verbs over Streamable HTTP:
| Verb | Purpose |
|---|---|
arif_init |
Establish session context and actor identity |
arif_observe |
State observation and gap detection |
arif_think |
Constitutional reasoning against floors |
arif_route |
Route intent to the appropriate federation organ |
arif_memory |
Query and manage institutional memory |
arif_judge |
Evaluate a proposal and return a verdict |
arif_forge |
Dispatch authorized actions for execution |
arif_seal |
Seal a completed action chain with evidence and receipt |
| Surface | Status |
|---|---|
| GitHub repository | Public, AGPL-3.0, active commits (September 2026) |
| PyPI package | pip install arifos, version 1!2026.8.2 |
| Live health endpoint | curl localhost:8088/health — returns structured JSON |
| MCP interface | 8 tools, Streamable HTTP (protocol 2024-11-05), schema-validated |
| VAULT999 ledger | 119K+ append-only records |
| Floor enforcement | 13 floors active, all passing in current deployment |
| Source-build-deploy alignment | Verified (commit d99d5c1a4) |
| GEOX reference implementation | Geoscience uncertainty workflows |
| Federation architecture | 10 organs with defined boundaries |
| Gap | Risk |
|---|---|
| Independent security audit | Adversarial bypass testing not published |
| Third-party evaluation | No external reviewer has published findings |
| Reproducible demo by strangers | Onboarding path not independently tested |
| Enterprise deployment | No production customer reference |
| Standards conformance | MCP/A2A conformance tests not published |
| SBOM and signed releases | Supply chain integrity unverified externally |
| Comparative benchmark | No published comparison against alternative frameworks |
See SECURITY.md for the threat model, known gaps, and disclosure policy.
Operators deploying AI agents in regulated environments who need an independent judgment layer between agent proposals and execution.
Developers building AI agent systems who want a policy decision point as a service.
Evaluators and security reviewers assessing AI governance frameworks.
Domain builders adapting governance to specific fields (geoscience, finance, healthcare).
Start here: docs/START_HERE.md
arifOS was built by Muhammad Arif bin Fazil, a senior exploration geoscientist who spent his career making decisions where observations are incomplete, interpretations are probabilistic, provenance matters, and irreversible action must be gated. He transferred that discipline into agent runtime governance.
The system is named after its founder and reflects a core belief: governance is a systems problem, not a model problem.
# Clone
git clone https://github.com/ariffazil/arifOS.git
cd arifOS
# Install (light tier — kernel only)
pip install -e ".[light]"
# Run tests
python -m pytest tests/ -v
# Start the kernel
python -m arifosmcp.serve --port 8088arifOS/
├── arifosmcp/ # Core kernel package (1228 Python files)
│ ├── abi/ # Capability registry and floor definitions
│ ├── constitution/ # Constitutional floor implementations
│ ├── kernel/ # Core judgment engine
│ └── VAULT999/ # VAULT999 ledger implementation
├── tests/ # Test suite (476 test files)
├── docs/ # Documentation
│ ├── START_HERE.md # External reader entry point
│ └── ...
└── pyproject.toml # Package metadata (v1!2026.8.2)
| Repository | Purpose |
|---|---|
| AAA | Intelligence routing, state plane, skill catalog, A2A gateway |
| A-FORGE | Execution engine after authorization |
| GEOX | Earth sciences domain evidence |
| WEALTH | Capital and financial intelligence |
| WELL | Human and machine vitality observation |
| arifFlow | Metabolic ledger daemon — FQ monitoring, receipt ingestion |
| FED | Federation routing gateway (multi-provider LLM via LiteLLM) |
| FRAME | Independent observer — drift detection, evidence gathering |
| i-ARIF | Seal B synthesis engine |
See CONTRIBUTING.md for guidelines.
See SECURITY.md for threat model, known vulnerabilities, and disclosure policy.
AGPL-3.0 — GNU Affero General Public License v3.0.
When deployed over a network, the complete source code must be made available to all users interacting with the service, consistent with AGPL-3.0 terms.
Ditempa Bukan Diberi — Forged, Not Given.