QuanuX Symphony

Important

Symphony is in active development. The repository contains operational foundations, metadata-only integrations, and proposal-only contract seeds; it is not an overall production release.

Identity

• QuanuX is the brand, ecosystem, and stewardship identity.
• Symphony is the open-source platform.

Architecture

Symphony is intentionally organized as a monorepo so maintainers and agentic tools can inspect canonical knowledge, implementation, integration boundaries, and validation evidence together. Deployment remains modular: runtime modules preserve independent lifecycle, identity, configuration, state, and version boundaries.

Root governance establishes shared invariants without turning the repository into one monolithic runtime or imposing platform-wide infrastructure, market-data, or order-flow assumptions.

Implemented Foundations

• qxctl is the Go-based Cobra/Viper administrative and query CLI. It implements repository inspection, contract inventory, authenticated SSIAG metadata queries, authenticated read-only STAV operations, exact engine binding and reconciliation, explicit idempotent login/refresh/logout knowledge-session transitions, and exact-installation SKVI, SCLV, SACV, SODV, and SSFV engine invocation with hard process deadlines and response verification.
• Symphony Secure Identity and Access Governance is an independently installable, cgo-free Go foundation with per-TOPS enrollment, exact local peer and endpoint trust, a metadata-only Unix-socket API, typed safe-metadata STAV production, and native launchd/systemd supervision. Credential use, policy mutation, provider execution, and secret delivery are not enabled.
• STAV Append Authority is an independently installable Go service with per-TOPS durable append-only ledgers, mutually authenticated local IPC, exact producer and reader grants, fsync-before-receipt durability, bounded read projections, startup verification and tail recovery, and native launchd/systemd supervision.
• STAV Protocol for Go is an authority-free Go library implementing the canonical STAV v1 codec, validation, digest, framing, and conformance rules.
• SSIAG macOS Keychain Provider is an independently buildable Swift metadata adapter implementing bounded hello, status, and capabilities operations. Operational Keychain access is deliberately disabled.
• Symphony Validator is a deterministic, read-only C++26 repository checker with a CMake build, line-oriented evidence, stable exit behavior, and extensive smoke fixtures. Structured projectors, qxctl mediation, CI wiring, and portable installation packaging remain deferred.
• Knowledge Vector Engine C++ Foundation implements authority-free bounded JSON process framing, SHA-256 digests, no-follow repository reads, deterministic snapshots, versioned packaging, receipts, and receipt-owned uninstall mechanics.
• Knowledge Session Coordinator is an independently installable C++26 process implementing bounded inspection, snapshot checks, explicit compatibility negotiation, durable per-worktree reconciliation, and SSIAG-authorized noncanonical authority epochs with dual-slot journals, idempotent compare-and-swap mutations, linked-session transitions, and evidence-based recovery. Vector invocation, observers, canonical apply, and Maestro docking remain disabled.
• SKVI Engine is an independently installable C++26 structural knowledge engine implementing deterministic inspect/check, caller-declared immutable proposals, and disposable digest-bound JSON projections. It cannot decide index membership or write canonical knowledge.
• SCLV Engine is an independently installable C++26 change-truth engine implementing deterministic ledger checks, provider-neutral v3 proposals, non-mutating closure recovery, disposable projections, and bounded local-Git and air-gapped evidence adapters. It cannot ratify, append, commit, or delete recovery journals.
• SACV Engine is an independently installable C++26 API-contract governance engine implementing bounded OpenAPI 3.2.0 JSON checks, deterministic compatibility diffs, caller-declared registry proposals, and disposable registry inventories. YAML entry documents fail closed until the separate parser gate; no endpoint, SDK, publication, generated binding, or canonical apply is implemented.
• SODV Engine is an independently installable C++26 release-publication governance engine implementing local append-only ledger checks, caller-supplied observation verification, provider-neutral release-record proposals, non-mutating interrupted-session recovery, and disposable release inventories. It performs no network access, creates no tags, declares no release complete, and exposes no canonical apply.
• SSFV Engine is an independently installable C++26 semantic-feature engine implementing structural and freshness-aware checks, content-addressed diffs, caller-declared proposals, and disposable deterministic graphs. Its first partial catalog records exactly the modular platform boundary, shared knowledge-vector engine foundation, and knowledge-session coordinator foundation; the engine does not decide feature-worthiness or write canonical truth.
• knowledge/ contains the canonical SKV surfaces currently established for source routing (SKVI), change truth (SCLV), API governance (SACV), publication governance (SODV), semantic feature truth (SSFV), SSIAG, STAV, and the cross-vector desired/observed/plan/applied/boot lifecycle contracts. The coordinator now implements report-only dependency-driven two-way planning over supplied evidence, so compatible component actions can be replanned around localized blockers without changing ordered safety phases. Canonical knowledge governs implementations; tools do not own canonical schemas.

First Runtime Set

The repository contains proposal-only Contract Quad seeds for node-troll, bus-troll, and hotpath-runtime. No executable implementation, installation readiness, or operational runtime capability is claimed for those modules.

Current Integration Boundary

SSIAG submits only typed, security-relevant safe metadata to the STAV append authority and never writes ledger files. qxctl authenticates the exact configured SSIAG and STAV endpoints before application exchange and performs no canonical mutation. It implements exact user-default engine selection, durable reconciliation, SSIAG-authorized session operations, and explicit host-event session convergence. For SKVI, SCLV, SACV, SODV, and SSFV, qxctl validates an exact inactive-undocked installation before invoking its bounded local process. The coordinator implements report-only lifecycle planning over complete caller-supplied desired/observed evidence, but qxctl lifecycle grammar, desired-profile persistence, configured-root observation, lifecycle journaling/recovery, package installation/uninstall, activation, Maestro docking, desired-state apply, and canonical apply are not implemented. SSFV coverage is explicitly partial and does not claim every implemented capability has been cataloged. The macOS provider reports metadata only. SACV's canonical registry remains empty: no remote HTTP API, SDK, live playground, or published OpenAPI description is currently claimed. SODV release observation remains caller-supplied: the engine does not contact Git hosts or package providers.

Releases and Documentation

Symphony releases will roll out module by module rather than waiting for a monolithic platform release. Each published module will carry its own version, compatibility boundary, and evidence; only artifacts actually published from the repository are releases.

The currently published source-module set is intentionally narrow:

• STAV Protocol for Go v0.2.0 is the current public protocol-kernel source module;
• STAV Append Authority v0.2.0 is the current public supervised service source module;
• STAV Append Authority v0.1.0 remains immutable historical release evidence for the pre-supervision boundary.

These are public Go source-module versions, not GitHub binary releases or a platform launch. qxctl, SSIAG, provider adapters, proposal-only runtime modules, SDKs, containers, and documentation sites are not claimed as released.

Repository contracts and implementation notes document the current development state. Robust operator, security, API, integration, and module documentation will accompany the official launch.

Root-Level Governance Role

The repository root establishes platform invariants and guarantees modular sovereignty. Implementations remain subordinate to their canonical contracts, and separately installable modules retain their own runtime authority and lifecycle.

Doctrine

• A troll is a bounded local resident of a Symphony runtime domain; the term describes runtime residency, not caller identity, intelligence, or authorization.
• node-troll represents the node and bus-troll manages an optional managed-bus residency boundary at the contract level only today.
• hotpath-runtime is the proposed native hot-path runtime substrate and is not a troll.
• Bus bypass remains valid when declared by deployment constraints; the presence of a bus contract does not make bus traversal mandatory.

Symphony authorizes supported operations from target-host ownership or granted permission, not from whether a caller is human, AI, a service, or another actor type. The host administrator controls configurable safeguards; protocol-integrity rules remain mandatory within supported tooling.

These statements describe the current canonical contract seeds, not implemented runtime capability.

Python Doctrine

Python is not required for remote native hot-path execution or the administrative spine. Optional isolated Python habitats may exist only when explicitly declared by a module or tool.

License

Symphony is licensed under the GNU Affero General Public License v3.0 only (AGPL-3.0-only). Without a separate written agreement, use, modification, distribution, and network deployment are governed by that license. For commercial licensing inquiries, contact licensing@quanux.org.