[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_108":109},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_56":48,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":-5,"_77":-5,"_78":48,"_79":-5,"_80":81,"_82":83,"_84":85,"_86":87,"_88":89,"_90":91,"_92":93},"apiUrl","https://odel.app/api","creator","bemarking","moduleId","axon-lang","@bemarking/axon-lang","displayName","AXON Epistemic MCP","tagline","Official ℰMCP server for AXON — exposes 45 primitives, 33 templates, 17 examples to AI agents.","iconKey","https://avatars.githubusercontent.com/u/226776091?v=4","category","local","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","pricingModel","free","creatorUserId","system:external-import","createdAt",1783333961000,"updatedAt",1785386718000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=io.github.Bemarking%2Faxon-emcp","sourceVerified",true,"sourceMissingSince","importedAt","upstreamStars",4,"upstreamUpdatedAt",1784696925000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt","githubRepoUrl","https://github.com/Bemarking/axon-lang","githubRepoFullName","Bemarking/axon-lang","releaseId","ext-bemarking-axon-lang","version","0.4.0","descriptionMarkdown","

\n AXON v2.75.0
\n Axon is the Cognitive Runtime for Enterprise Software.

\n Build AI systems with deterministic execution, formal guarantees and\n native cognitive primitives.\n

\n\n

\n $\"Version\"$ \n $\"Status:$ \n $\"100%$ \n $\"Streaming\"$ \n $\"Session$ \n $\"Tests\"$ \n $\"Compliance\"$ \n $\"PostgreSQL\"$ \n $\"Tracing\"$ \n $\"License\"$ \n

\n\n

Primitive census — every language construct advertised here is a build input: the compiler's anti-drift gate (axon-frontend/src/advertised.rs, §111/§114.z) parses this block at test time and fails the build unless each badge carries a human-attested statement of what its runtime actually does.

\n\n

\n \n persona · intent · flow · reason · anchor · refine · memory · tool · probe · weave · validate · context · step · run
\n know · believe · speculate · doubt · par · hibernate
\n dataspace · ingest · focus · associate · aggregate · explore
\n type · json · ledger
\n deliberate · consensus · forge · agent · shield
\n savant · synth · warden · scope
\n stream · effects · @contract_tool · @csp_tool
\n pix · navigate · drill · trail · corpus
\n psyche · ots
\n mcp · mandate · lambda
\n budget · window · cors · document · deliver · notify
\n credential · mint · rotate
\n compute · grad · quant · observable
\n daemon · listen
\n channel · emit · publish · discover
\n axonendpoint · axpoint · axonstore
\n \n Cognitive I/O:\n resource · fabric · manifest · observe ·\n reconcile · lease · ensemble
\n topology · session · send · receive · select · branch ·\n immune · reflex · heal ·\n compliance
\n component · view
\n \n cache · voice · shell · path rewrite · PASETO
\n \n Session types (v2.3.0):\n socket · upstream · send T · receive T · select {ℓᵢ:…} · branch {ℓᵢ:…} · backpressure: credit(k) · reconnect: cognitive_state\n

\n\n

\n\n---\n\n> **Two repositories, two version lines.** This repo (`axon-lang`,\n> AGPL-3.0-or-later, public) ships the **language + runtime + compiler + 7 LLM\n> backends + Cognitive I/O + WebSocket session types** — currently **v2.75.0**.\n> The commercial control plane (`axon-enterprise`, EULA, private) layers\n> multi-tenant identity / RBAC / SSO / metering / audit / vertical compliance\n> **on top of** this language via a pinned Cargo dependency — currently\n> **v3.92.0**. The version numbers diverge by design (enterprise iterates on\n> the SaaS surface independently of the language). If you don't run a\n> commercial Axon deployment, this repo is all you need; the badge above is\n> the only version that matters for you.\n\n---\n\n## What is AXON?\n\nAXON is a **compiled language** that targets LLMs instead of CPUs. It has a\nformal EBNF grammar, a lexer, parser, AST, intermediate representation, **seven\nnative Rust LLM backends** (Anthropic, OpenAI, Gemini, Kimi, GLM, Ollama,\nOpenRouter), and a 100% Rust + C23 native runtime with semantic type checking, an\nalgebraic-effects execution engine, real-time SSE / NDJSON / WebSocket\nsession-typed streaming, retry + circuit-breaker resilience, and execution\ntracing. The FIPS-routable cryptographic + tokenisation kernels live in\n[`axon-csys`](https://github.com/Bemarking/axon-lang/blob/master/axon-csys/) as standalone C23 (no opaque C bindings — every\nkernel is a `_Generic`-dispatched, `[[nodiscard]]`-annotated, sanitizer-clean\nC23 source file with a Rust wrapper).\n\nBeyond cognition, AXON ships **Cognitive I/O** — a λ-calculus-based\ninfrastructure layer where resources, control loops, observability, security\nkernels, and UI components carry their regulatory class (HIPAA / PCI_DSS /\nGDPR / SOX / SOC 2 / ISO 27001 / FIPS / CC EAL 4+) as a **compile-time type**.\nPrograms that fail coverage are rejected *before* they run. No other\nprogramming language does this.\n\n**v2.3.0 (Fase 41) adds the first session-typed real-time dialogue primitive in\nany production language**: declare a `session` (the bidirectional protocol),\nbind it to a `socket` (the WebSocket transport with credit-refined\nbackpressure), and the compiler proves the two endpoints are duals\n(Caires–Pfenning linear-logic Curry–Howard); the runtime enforces every step,\nseals the residual cursor on disconnect for typed reconnection, and projects\nto W3C Server-Sent Events when the protocol is single-polarity. See\n[`docs/papers/paper_websocket_cognitive_primitive.md`](https://github.com/Bemarking/axon-lang/blob/master/docs/papers/paper_websocket_cognitive_primitive.md).\n\nIt is **not** a Python library, a LangChain wrapper, a YAML DSL, or a Terraform\nreplacement. It is a *new kind of calculus* — see\n[`docs/papers/paper_lambda_lineal_epistemico.md`](https://github.com/Bemarking/axon-lang/blob/master/docs/papers/paper_lambda_lineal_epistemico.md)\nfor the formal semantics (Cálculo Lambda Lineal Epistémico).\n\n---\n\n## Cognitive I/O — Build Infrastructure with Compile-Time Compliance\n\nThe big differential added in v1.0 — ten new top-level declarations that turn\nAXON into the only language where *\"does this app leak PHI?\"* is a **type\nerror**, not a post-mortem finding.\n\n| Primitive | What it is | Formal backing |\n|---|---|---|\n| `resource` | Infrastructure token (DB, cache, bucket, GPU) with `linear` / `affine` / `persistent` lifetime | Linear Logic (Girard 1987) |\n| `fabric` | Topological substrate (VPC, cluster, namespace) | Separation Logic (O'Hearn–Reynolds) |\n| `manifest` | Declarative \"belief\" about desired infrastructure shape, with κ (regulatory class) annotations | Epistemic Logic (Fagin–Halpern) |\n| `observe` | Quorum-gated snapshot of real state, producing a ΛD envelope ⟨c, τ, ρ, δ⟩ | Decision D4: partition ≡ void, never `doubt` |\n| `reconcile` | Active-Inference control loop: observe → drift → shield → act | Free Energy Principle (Friston) |\n| `lease` | τ-decaying affine capability; post-expiry use is a CT-2 *Anchor Breach* | Hybrid affine + revocation (D2) |\n| `ensemble` | Byzantine quorum aggregator over N observations with common-knowledge fusion | Fagin–Halpern `Cφ` |\n| `topology` + `session` | Typed directed graph over declared entities with Honda–Vasconcelos duality + deadlock detection | π-calculus binary sessions |\n| `socket` (v2.3.0) | Session-typed WebSocket transport with credit-refined backpressure, typed reconnection via `cognitive_states`, SSE-as-fragment projection | Caires–Pfenning Curry–Howard + Rast credit-refined types ([paper_websocket_cognitive_primitive.md](https://github.com/Bemarking/axon-lang/blob/master/docs/papers/paper_websocket_cognitive_primitive.md)) |\n| `immune` + `reflex` + `heal` | KL-divergence anomaly sensor + O(1) signed-trace motor response + Linear-Logic one-shot patch FSM | Cognitive Immune System ([paper_immune_v2.md](https://github.com/Bemarking/axon-lang/blob/master/docs/papers/paper_immune_v2.md)) |\n| `component` + `view` | Declarative UI with the **same** compile-time κ coverage rule — regulated types need a covering shield or the compiler rejects | Regulatory Type Theory (Fase 9) |\n\n### Hard differentiators vs. Terraform / Pulumi / Kubernetes manifests\n\n1. **Compile-time compliance.** `shield` / `type PatientRecord compliance [HIPAA, GDPR]` are *types*. A `.axon` program that sends PHI to an unshielded endpoint fails `axon check` — same exit code as a syntax error.\n2. **Blame Calculus (Findler–Felleisen).** Every error is classified as **CT-1** (axon/runtime bug), **CT-2** (program author: anchor breach, expired lease), or **CT-3** (infrastructure: partition, missing credential, provider quota). No silent downgrades.\n3. **Audit-ready artefacts.** `axon dossier` + `axon sbom` + `axon audit --framework {soc2,iso27001,fips,cc,all}` + `axon evidence-package` produce byte-identical, deterministic JSON/ZIP — the SHA-256 of every output is a *contract* against your release.\n4. **100% Rust + C23 runtime, no interpreter.** The whole stack — lexer, parser, type-checker, IR, the algebraic-effects execution engine, the HTTP server, the seven LLM backends, the streaming wire, the session-typed WebSocket driver — is a single native Rust binary; the FIPS-routable cryptographic + tokeniser kernels live in [`axon-csys`](https://github.com/Bemarking/axon-lang/blob/master/axon-csys/) as standalone C23 (no `unsafe` glue: `_Generic`-dispatched headers, `[[nodiscard]]` everywhere, sanitizer-clean, valgrind-clean). Download a prebuilt or `cargo build --release`. No GC, no interpreter, no runtime dependency.\n5. **Cognitive immune system.** `immune + reflex + heal` is a first-class language primitive, not a plug-in. Signed HMAC traces per firing, three compliance modes (`audit_only` / `human_in_loop` / `adversarial`), Linear-Logic patch FSM preventing double-application.\n6. **Post-Quantum-ready ESK.** HMAC-SHA256 baseline + Ed25519 + ML-DSA-65 (NIST FIPS 204 Dilithium) + Hybrid signer (NIST SP 800-208 transition posture). Feature-gated; no silent classical fallbacks.\n7. **Persistence is a typed cognitive primitive.** A database in AXON is an `axonstore`, not an ORM bolt-on: retrieved rows are born epistemically `Untrusted` and a `confidence_floor` is enforced at read and write; every mutation appends to an HMAC-Merkle audit chain; `retrieve` is a bounded, back-pressured `Stream`; and store access is capability-typed and checked at *compile time*. No other language treats stored data this way.\n8. **Real-time dialogue is a typed cognitive primitive (v2.3.0).** A WebSocket in AXON is a `socket` over a declared `session`, not a JSON envelope over bytes: the compiler proves the two endpoints are duals (Caires–Pfenning intuitionistic linear logic, `S̄ ≡ S⊥`), so the connection is **deadlock-free and protocol-conformant by construction**; credit-refined backpressure (`backpressure: credit(k)`) is decidable in Presburger arithmetic at compile time; a mid-protocol disconnect seals the residual session-type cursor + credit window into an AAD-bound `cognitive_states` snapshot, and the typed `?resume=` resume restores it under tenant + flow_id binding; a single-polarity protocol's `socket` ALSO speaks W3C Server-Sent Events byte-compat with Fase 33's existing SSE pipeline (`S_SSE = Π_↓(S_WS)`).\n9. **Every boundary is guarded (v2.44.0).** The doctrine `axon://logic/every_boundary_is_guarded`: no `axonendpoint` may dispatch a flow across a trust boundary uncovered by silent omission. It must declare a covering discipline (`requires:` / `shield:` / `compliance:`) **or** the explicit, auditable opt-out `public: true` — omit both and `axon check` fails with **`axon-T890`**, same exit code as a syntax error. The *absence* of a guard is a deliberate, witnessed decision, never a default. The rule is independently re-verified as a Proof-Carrying-Code obligation (`PropertyClass::AuthorizationCoverage`) at the deploy gate, so an unguarded boundary cannot reach production through any door; `axon fix` migrates existing programs. Generalises the §6.1 shield κ-coverage rule from *regulated types* to *every boundary*.\n10. **Every guard is satisfiable (v2.45.0).** The completeness dual of #9: the doctrine `axon://logic/every_requirement_is_grantable`. A `requires: [x]` whose capability `x` no authority in the system can grant is a **dead boundary** — a locked door with no fabricable key, indistinguishable at deploy from a real guard. §90 makes key-existence a proof obligation: a total, injective projection `π` reconciles the two authority representations that otherwise never meet — the control-plane RBAC catalog (colon `resource:action`) and the data-plane `requires:` grammar (dotted `resource.action`) — so a role-derived permission `flow:execute` actually satisfies `requires: [flow.execute]`. The law `requires ⊆ π(grantable_catalog)` is re-verified as a Proof-Carrying-Code obligation (`PropertyClass::CapabilityGrantability`); a dead requirement is refuted with **`axon-T891`** and the deploy gate rejects the bundle fail-closed. Unlike IAM systems that discover unsatisfiable policies at request time (or never), AXON proves *before the surface mounts* that every scope it requires is grantable. Together with #9: **every boundary is guarded, and every guard is openable by exactly the authorities meant to open it.** v2.47.0 closes the converse quantifier (`axon://logic/every_granted_authority_projects`, §93): §90 proved the key *exists in the catalog*; §93 proves the key that is actually *cut* — a granted role, built-in or custom — turns the lock: `π` lifted to held-authority sets is total with **explicit drops** (`auth_scope::project_permission_set` — a tampered authority row degrades with a witness, never silently), authority is derived from live state at verify time (never minted into a claim, so revocation binds next-request), and a permission that cannot project is refused at the write. The **dead authority** — assignable but inert, the principal-side dual of the `axon-T891` dead requirement — becomes unrepresentable.\n11. **Delegation is attenuation (v2.46.0).** The third act of the authority story: the doctrine `axon://logic/authority_only_attenuates`. `credential { ttl: grants: }` declares an **ephemeral-credential contract** — the exact shape a chat widget on any origin needs — and the `mint` flow verb turns it into a TTL-bounded bearer at runtime, admitted only when `grants ⊆ capabilities(minter)`: a flow can hand a visitor a *slice* of the authority it provably holds, never more. The law is machine-checked at three layers, all fail-closed: compile (**`axon-T893`**–**`axon-T896`** — grantless contracts, TTLs beyond the 24h ephemeral ceiling, ghost mints, and persisting a minted bearer are all rejected), verify/deploy (a Proof-Carrying-Code obligation, `PropertyClass::CredentialAttenuation`, re-derives every contract + mint site from the artifact), and mint time (the dispatch handler AND the `CredentialMinter` port independently enforce the subset law; no port configured ⇒ a loud missing-dependency error, never a silent stub). Stripe-style ephemeral keys, but as *typed language surface with a deploy-time proof* — no SDK call whose scopes are runtime strings. Cognitive time is declared the same release: `now: \"\"` on a `step` or `context` (v2.46.0, §91) injects ONE captured instant per run, DST-correct and recorded as `(captured_utc, tzdb_version, zones)` in the envelope for byte-exact replay — `time_is_an_explicit_input` applied to cognition, with `TemporalContextSoundness` refuting a plausible-but-unknown timezone before deploy.\n12. **Rotation without revelation (§94).** The inbound dual of #11: the doctrine `axon://logic/rotation_without_revelation`. A third-party credential a tenant lends the platform (an OAuth token for a connected CRM) is **custodied, never readable**: `axonstore { backend: secrets class: crm }` is a read-only *metadata* view over the encrypted secret custody (key / version / created_at / expires_at — the value has no column), so a cron `daemon` enumerates what nears expiry with ordinary §67 time-aware `retrieve`; the `rotate [where] with as ` verb renews each matching entry through ONE runtime-mediated exchange per key (reveal into the reserved `axon_rotation` tool envelope → the adopter's tool performs the vendor refresh → CAS commit at version+1, so HA daemon replicas cannot double-spend a refresh token), binding only the `{attempted, rotated, failed}` summary; and `tool { secret: crm.hubspot }` injects the per-tenant value into the tool-server request at dispatch (`axon_secret`) so the consuming flow never touches it. **No term of the language evaluates to a secret value — revelation is unrepresentable, not discouraged.** Machine-checked at three layers, all fail-closed: compile (**`axon-T897`**–**`axon-T900`** + **`axon-T902`** — custody writes, rotations of non-custody stores or ghost tools, class-less views, and credential literals in source are all rejected), verify/deploy (`PropertyClass::SecretCustodySoundness` re-derives every store, rotate site and write verb from the artifact), and dispatch (no custody port ⇒ a loud missing-dependency error; a secret-bearing tool never calls its vendor unauthenticated). AWS-Secrets-Manager-style managed rotation, but the orchestrator itself is *provably unable to read what it rotates*.\n\n### External audit readiness\n\nThe audit engine ships **108 mapped controls** across the four major external frameworks:\n\n- **SOC 2 Type II** — 31 TSC controls (CC + C + PI + P)\n- **ISO/IEC 27001:2022** — 41 Annex A controls\n- **FIPS 140-3 (CMVP)** — 14 CAVP/FSM entries\n- **Common Criteria EAL 4+** — 22 SFRs + SARs\n\nEach framework has an operational runbook and an audit-evidence pipeline that emits the evidence bundle on every release.\n\n### Try it in 30 seconds\n\n```bash\ncargo install axon-lang # or: download the native binary from Releases\necho 'type PatientRecord compliance [HIPAA, GDPR] { ssn: String }\nshield PHIShield { scan: [pii_leak] on_breach: halt severity: critical\n compliance: [HIPAA, GDPR] }\naxonendpoint Api { method: POST path: \"/p\" body: PatientRecord\n execute: F output: PatientRecord shield: PHIShield\n compliance: [HIPAA, GDPR] }\nflow F(r: PatientRecord) -> PatientRecord {\n step R { ask: \"summarize\" output: PatientRecord } }' > app.axon\naxon check app.axon # compile-time compliance verification\naxon dossier app.axon # regulatory posture JSON\naxon audit app.axon --framework all # per-framework gap analysis\n```\n\nRemove the `shield` line and `axon check` fails with *\"endpoint 'Api' sends regulated type '{HIPAA, GDPR}' without a covering shield — ESK Fase 6.1 coverage rule\"*. That failure is a **type error**, not a lint warning.\n\n### Reference programs\n\n- [`examples/healthcare_reference.axon`](https://github.com/Bemarking/axon-lang/blob/master/examples/healthcare_reference.axon) — HIPAA + GDPR + GxP + SOC 2\n- [`examples/banking_reference.axon`](https://github.com/Bemarking/axon-lang/blob/master/examples/banking_reference.axon) — PCI_DSS + SOX + SOC 2\n- [`examples/government_reference.axon`](https://github.com/Bemarking/axon-lang/blob/master/examples/government_reference.axon) — FISMA + NIST 800-53 + SOC 2\n- [`examples/ui/healthcare_console.axon`](https://github.com/Bemarking/axon-lang/blob/master/examples/ui/healthcare_console.axon) — UI built on top of the healthcare backend with compile-time κ-redacted renders\n- [`examples/tool_dispatch.axon`](https://github.com/Bemarking/axon-lang/blob/master/examples/tool_dispatch.axon) — flow-level `use on \"${param}\"` native tool dispatch with request-parameter binding (§Fase 54)\n\n### Academic references\n\n- [`docs/papers/paper_lambda_lineal_epistemico.md`](https://github.com/Bemarking/axon-lang/blob/master/docs/papers/paper_lambda_lineal_epistemico.md) — λ-L-E calculus: Theorem 5.1 *Stochastic Degenerative Soundness*\n- [`docs/papers/paper_immune_v2.md`](https://github.com/Bemarking/axon-lang/blob/master/docs/papers/paper_immune_v2.md) — Cognitive Immune System with red-teaming metrics (F1 ≥ 0.80 per class)\n- [`docs/papers/paper_esk.md`](https://github.com/Bemarking/axon-lang/blob/master/docs/papers/paper_esk.md) — Regulatory Type Theory for Cognitive Systems (Theorems 10.1–10.5)\n\n---\n\n## Production Status\n\nAXON v2.3.0 is **production-ready**. The full stack is cross-validated, 100% Rust + C23:\n\n- ✅ 65+ cognitive + Cognitive-I/O primitives wired to the native runtime\n- ✅ 285 HTTP routes tested end-to-end\n- ✅ Seven native Rust LLM backends (Anthropic, OpenAI, Gemini, Kimi, GLM, Ollama, OpenRouter) with full async streaming\n- ✅ Real-time streaming wire — SSE + NDJSON, type-driven transport inference, per-chunk algebraic-effect dispatch\n- ✅ **Session-typed WebSocket dialogue (v2.3.0)** — declared `session` + `socket`, statically-checked duality (Caires–Pfenning), credit-refined backpressure (Presburger discharge), typed reconnection via AAD-bound `cognitive_states` snapshots, SSE-as-fragment unification\n- ✅ **Multiparty projection (v2.3.0)** — `GlobalType` + `project_all` (Honda–Yoshida–Carbone safe-realizability gate) for n-agent skill/tool topologies\n- ✅ `axonendpoint` as a first-class HTTP REST primitive — typed routes, body + output schema validation, `Idempotency-Key`, auth scopes\n- ✅ `axonstore` cognitive data plane — epistemically typed rows, HMAC-Merkle audit chains, `Stream`, capability-typed access\n- ✅ Compile-time regulatory compliance for HIPAA / PCI_DSS / GDPR / SOX / SOC 2 / ISO 27001 / FIPS / CC EAL 4+\n- ✅ Cognitive immune system (anomaly detection + reflex + heal) paper-faithful\n- ✅ Post-Quantum signatures: HMAC-SHA256 baseline + Ed25519 + ML-DSA-65 + Hybrid (NIST SP 800-208)\n- ✅ **`axon-csys` C23 kernels** — FIPS-routable SHA-256 / HMAC-SHA256 / SIMD G.711 / BPE tokeniser / FSM dispatch (computed gotos) / buffer pool (207× faster than Vec) — standalone C23 with sanitizer-clean + valgrind-clean CI lanes\n- ✅ PostgreSQL persistence with migrations and health checks\n- ✅ Structured observability (JSON logging + request tracing)\n- ✅ LLM call resilience (retry + circuit breaker + fallback)\n- ✅ **2,245 axon-lang + 535 axon-frontend + 13 axon-csys = 2,793 Rust tests**; cross-stack zero-regression discipline. Python side is now a thin PyPI wrapper that downloads + invokes the native Rust binary (the language interpreter is 100% Rust/C23 — the Python suite was retired in Fase 40's *Pure Silicon* pivot).\n- ✅ Zero \"por ahora\", zero \"lo mínimo\" — production-complete\n\nDesigned for cognitive AI applications that require formal semantics, reliability, epistemic rigor, and *provable* regulatory coverage.\n\n```axon\npersona LegalExpert {\n domain: [\"contract law\", \"IP\", \"corporate\"]\n tone: precise\n confidence_threshold: 0.85\n refuse_if: [speculation, unverifiable_claim]\n}\n\nanchor NoHallucination {\n require: source_citation\n confidence_floor: 0.75\n unknown_response: \"Insufficient information\"\n}\n```\n\n> **⚠️ `enforce` is the behavioral carrier in anchors.** It is the ONLY anchor field\n> injected as a direct behavioral directive to the LLM. `require`/`reject` are\n> post-generation validation constraints. `description` is metadata-only — it does\n> NOT reach the model. Use `enforce` for text that must shape the model's behavior.\n\n```axon\nflow AnalyzeContract(doc: Document) -> StructuredReport {\n step Extract {\n probe doc for [parties, obligations, dates, penalties]\n output: EntityMap\n }\n step Assess {\n reason {\n chain_of_thought: enabled\n given: Extract.output\n ask: \"Are there ambiguous or risky clauses?\"\n depth: 3\n }\n output: RiskAnalysis\n }\n step Check {\n validate Assess.output against: ContractSchema\n if confidence < 0.8 -> refine(max_attempts: 2)\n output: ValidatedAnalysis\n }\n step Report {\n weave [Extract.output, Check.output]\n format: StructuredReport\n include: [summary, risks, recommendations]\n }\n}\n```\n\n---\n\n## Native Rust + C23 Runtime\n\nAXON v2.3.0 ships a **production-hardened** 100% Rust + C23 native runtime server with **285+ HTTP routes**, **65+ primitives** wired to runtime, an **algebraic-effects execution engine**, a **real-time SSE / NDJSON / session-typed WebSocket streaming wire**, a full **ℰMCP** (Epistemic Model Context Protocol) implementation, **PostgreSQL persistence**, **structured observability via tracing**, **LLM call resilience** (retry + circuit breaker + fallback chains across seven native backends), and a complete native CLI (`check`, `compile`, `run`, `serve`, `parse`, `dossier`, `sbom`, `audit`, `evidence-package`, and more).\n\nThe **Rust + C23 stack is the canonical implementation** of the language. Fase 40 (*Pure Silicon*, v2.0.0) retired the Python interpreter — and the PyPI line has since been closed with a tombstone release that redirects to `cargo install axon-lang` (the historical Python releases remain archived on PyPI, unmaintained). The FIPS-routable cryptographic + tokeniser kernels live in [`axon-csys`](https://github.com/Bemarking/axon-lang/blob/master/axon-csys/) as standalone C23 (no `unsafe` glue: `_Generic`-dispatched headers, `[[nodiscard]]` everywhere, sanitizer-clean + valgrind-clean CI lanes).\n\n**Production Foundation (Phase K):**\n- **Observability**: JSON structured logging with request tracing, daily log rotation, configurable levels\n- **Resilience**: Exponential backoff retry, per-provider circuit breakers, configurable fallback chains across 7 LLM backends\n- **Persistence**: Full PostgreSQL integration with embedded migrations, JSONB storage, in-memory fallback for development\n\n### Quickstart\n\n```bash\n# Build the native runtime\ncd axon-rs\ncargo build --release\n\n# Start the server with default in-memory storage\ncargo run --release -- --port 3000\n\n# Or with PostgreSQL persistence + structured logging\nDATABASE_URL=\"postgresql://user:pass@localhost/axon\" \\\ncargo run --release -- \\\n --port 3000 \\\n --log-format json \\\n --log-file ./logs \\\n --database-url \"$DATABASE_URL\"\n\n# Deploy a flow\ncurl -X POST http://localhost:3000/v1/deploy \\\n -H \"Content-Type: application/json\" \\\n -d '{\"source\": \"flow analyze { step reason { prompt: \\\"Analyze the input\\\" } }\", \"backend\": \"stub\"}'\n\n# Execute\ncurl -X POST http://localhost:3000/v1/execute/analyze\n\n# MCP endpoint (JSON-RPC 2.0)\ncurl -X POST http://localhost:3000/v1/mcp \\\n -H \"Content-Type: application/json\" \\\n -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}'\n```\n\n### Phase K — Production Hardening (v1.0.0 foundation)\n\nAXON v1.0.0 launched with three production-critical systems that remain the foundation of every subsequent minor release:\n\n#### 1. Observability (K1)\n- **Structured logging** via `tracing` crate with JSON output\n- **Request tracing** with UUID correlation (x-request-id header)\n- **Daily log rotation** with configurable directory\n- **Configurable levels** via `AXON_LOG` env or `--log-level` CLI\n- Instrumentation on all LLM calls: backend, model, latency_ms, tokens_in/out\n\n#### 2. Resilience (K2)\n- **Exponential backoff retry** (500ms base, 2.0x multiplier, 30s max, jitter)\n- **Per-provider circuit breaker** (5 failures → Open, 30s cooldown → HalfOpen, 2 successes → Closed)\n- **Retry-After header respecting** for rate limit hints\n- **Fallback chains** (e.g., anthropic → openrouter → ollama)\n- **Error classification** (retryable vs. terminal)\n- Covers all 7 LLM backends: Anthropic, OpenAI, Gemini, Kimi, GLM, OpenRouter, Ollama\n\n#### 3. Persistence (K3-K4)\n- **PostgreSQL backend** with full ACID semantics\n- **12 domain tables** (traces, sessions, daemons, audit_log, axon_stores, dataspaces, hibernations, event_history, execution_cache, cost_tracking, schedules, backend_registry)\n- **15 performance indexes** for query optimization\n- **Embedded migrations** (zero external DB setup for development)\n- **UPSERT semantics** for idempotent writes\n- **JSONB storage** for nested structures\n- **In-memory fallback** when `DATABASE_URL` unset (perfect for development & CI/CD)\n\n**Write-through pattern** ensures all state mutations (flows, sessions, daemons, hibernations) persist to PostgreSQL while maintaining fast in-process reads.\n\n#### Architectural Decisions\n\n**Storage Pattern: StorageDispatcher Enum**\n- Uses concrete dispatch via `StorageDispatcher` enum instead of `dyn Trait`\n- Enables zero-cost abstraction: `PostgresBackend` or `InMemoryBackend` at compile time\n- No runtime trait object overhead, full optimization from compiler\n\n**Async/Await Safety**\n- All storage operations are async, but never held across await points\n- Mutex locks are released before database I/O\n- Prevents deadlocks and enables high concurrency\n\n**Graceful Fallback**\n- Database connection failures don't crash the server\n- Automatic fallback to `InMemoryBackend` (with logging)\n- State persists in-memory for the process lifetime\n- Clients experience no service interruption\n\n---\n\n### Runtime Surface\n\n| Surface | Count |\n|---------|-------|\n| HTTP API routes | 285 |\n| Language primitives | 65+ (cognitive + Cognitive I/O) |\n| LLM backends | 7 (anthropic, openai, gemini, kimi, glm, openrouter, ollama) — native async, all streaming |\n| MCP tool types | 8 (flow, dataspace, axonstore, shield, corpus, compute, mandate, forge) |\n| MCP resource types | 10 (traces, metrics, backends, flows, dataspaces, axonstores, shields, corpora, mandates, forges) |\n| MCP workflow prompts | 5 (research, decide, secure_transfer, reflect, analyze_image) |\n| `axon-lang` (axon-rs) lib tests | 2,245 |\n| `axon-frontend` lib tests | 535 (incl. §41.a-c algebra + §41.h multiparty) |\n| `axon-csys` lib tests | 13 (Rust wrapper; C23 kernels exercised by `cargo test` + sanitizers/valgrind in CI) |\n| Rust workspace total | 2,793 — zero regressions |\n| Python wrapper tests | 16 (the thin PyPI wrapper that downloads + invokes the native binary; the interpreter was retired in Fase 40) |\n| SQL tables | 12 (traces, sessions, daemons, audit_log, axon_stores, dataspaces, hibernations, event_history, execution_cache, cost_tracking, schedules, backend_registry) |\n| Performance indexes | 15 |\n\n### ΛD (Lambda Data) — Epistemic Guarantees\n\nEvery AXON operation carries a formal epistemic envelope ψ = ⟨T, V, E=⟨c, τ, ρ, δ⟩⟩:\n\n- **Theorem 5.1**: Only raw data may carry certainty c=1.0; all derived operations cap at c≤0.99\n- **Epistemic Lattice**: ⊥ ⊑ doubt ⊑ speculate ⊑ believe ⊑ know\n- **Blame Calculus**: CT-2 (caller) / CT-3 (server) / Network attribution on every error\n- **CSP §5.3**: MCP tools carry constraint satisfaction schemas\n\n### TypeScript SDK\n\n```typescript\nimport { AxonClient } from \"@axon/mcp-client\";\n\nconst client = new AxonClient({ baseUrl: \"http://localhost:3000\" });\nawait client.initialize();\n\n// Discover and call tools\nconst tools = await client.listTools();\nconst result = await client.callTool(\"axon_compute_evaluate\", { expression: \"pi * 2\" });\nconst envelope = AxonClient.extractEnvelope(result);\nconsole.log(envelope?.certainty); // 0.99 (transcendental → derived)\n\n// Read resources\nconst backends = await client.readResource(\"axon://backends\");\n\n// Get workflow prompts\nconst prompt = await client.getPrompt(\"workflow:research\", { question: \"How does attention work?\" });\n```\n\nFull language specification available on request.\n\n---\n\n## Paradigm Shifts\n\n> AXON's compiler-level paradigm shifts elevate the language from prompt\n> compilation to a Cognitive Operating System.\n\n### I. Formal Model — Epistemic Constraint Calculus\n\nEach program `P` in AXON operates over a typed epistemic lattice `(T, ≤)` where\nthe compiler enforces semantic constraints at compile time. The paradigm shifts\nextend this with three new formal mechanisms:\n\n**Epistemic Scoping Function.** Given an epistemic mode\n`m ∈ {know, believe,\nspeculate, doubt}`, the compiler applies a constraint\nfunction `C(m)` that maps to a tuple of LLM parameters and auto-injected\nanchors:\n\n```text\nC : Mode → (τ, p, A)\nwhere\n τ ∈ [0,1] — temperature override\n p ∈ [0,1] — nucleus sampling (top_p)\n A ⊆ Anchors — auto-injected constraint set\n\nC(know) = (0.1, 0.3, {RequiresCitation, NoHallucination})\nC(believe) = (0.3, 0.5, {NoHallucination})\nC(speculate) = (0.9, 0.95, ∅)\nC(doubt) = (0.2, 0.4, {RequiresCitation, SyllogismChecker})\n```\n\nThis is calculated **at compile time** — the IR carries the resolved constraint\nset, so the executor applies them as zero-cost runtime overrides.\n\n**Parallel DAG Scheduling.** A `par` block `B = {b₁, ..., bₙ}` where `n ≥ 2` is\nverified at compile time to have no data dependencies between branches:\n\n```text\n∀ bᵢ, bⱼ ∈ B, i ≠ j : deps(bᵢ) ∩ outputs(bⱼ) = ∅\n```\n\nAt runtime, branches execute via `asyncio.gather`, achieving `O(max(tᵢ))`\nlatency instead of `O(Σtᵢ)` for sequential chains.\n\n**CPS Continuation Points.** A `hibernate` node generates a deterministic\ncontinuation ID via `SHA-256(flow_name ∥ event_name ∥ source_position)`. The\nexecutor serializes the full `ExecutionState` (call stack, step results, context\nvariables) and halts. On `resume(continuation_id)`, the state is deserialized\nand execution continues from the exact IR node — implementing\nContinuation-Passing Style at the language level.\n\n### II. Design Philosophy — Programming Epistemic States\n\nTraditional LLM frameworks treat every model call identically — the same\ntemperature, the same constraints, the same trust level. This is the equivalent\nof asking a human to treat brainstorming and sworn testimony with the same\ncognitive rigor.\n\nAXON rejects this flat model. **Epistemic Directives** make the confidence state\nof the AI a first-class construct in the language:\n\n```axon\nknow {\n flow ExtractFacts(doc: Document) -> CitedFact {\n step Verify { ask: \"Extract only verifiable facts\" output: CitedFact }\n }\n}\n\nspeculate {\n flow Brainstorm(topic: String) -> Opinion {\n step Imagine { ask: \"What could be possible?\" output: Opinion }\n }\n}\n```\n\nThe compiler **does not merely label** these blocks — it structurally transforms\nthem. A `know` block injects citation anchors and drops temperature to 0.1,\nmaking hallucination a compile-time constraint violation. A `speculate` block\nremoves all constraints and raises temperature to 0.9, liberating the model.\n\n**Parallel Cognitive Dispatch** mirrors how human organizations work: delegate\nindependent analyses to specialists concurrently, then synthesize.\n\n**Dynamic State Yielding** transforms agents from expensive `while True` loops\ninto event-driven processes that can sleep for days, weeks, or months — then\nresume with full context. The language handles the serialization; the developer\nwrites `hibernate until \"event_name\"` and moves on.\n\n### III. Real-World Use Cases\n\n#### Use Case 1: Legal Document Analysis Pipeline\n\nA law firm needs to analyze contracts with maximum factual rigor, while also\nexploring creative legal strategies. AXON separates these cognitive modes at the\nlanguage level:\n\n```axon\nknow {\n flow ExtractClauses(contract: Document) -> ClauseMap {\n step Parse { probe contract for [parties, obligations, penalties] output: ClauseMap }\n }\n}\n\nflow AnalyzeRisk(contract: Document) -> StructuredReport {\n par {\n step Financial { ask: \"Analyze financial exposure\" output: RiskScore }\n step Regulatory { ask: \"Check regulatory compliance\" output: ComplianceReport }\n step Precedent { ask: \"Find relevant case law\" output: CaseList }\n }\n weave [Financial, Regulatory, Precedent] into Report { format: StructuredReport }\n}\n\nspeculate {\n flow ExploreStrategies(report: StructuredReport) -> Opinion {\n step Creative { ask: \"What unconventional strategies could mitigate these risks?\" output: Opinion }\n }\n}\n```\n\n- `know` guarantees citation-backed extraction (temperature 0.1)\n- `par` runs 3 analyses concurrently, reducing latency by ~3x\n- `speculate` explicitly relaxes constraints for creative strategy exploration\n\n#### Use Case 2: Multi-Agent Research & Intelligence System\n\nA BI platform deploys autonomous research agents that run for weeks, hibernating\nbetween data collection phases:\n\n```axon\nflow MarketIntelligence(sector: String) -> Report {\n know {\n flow GatherData(sector: String) -> DataSet {\n step Collect { ask: \"Gather verified market data\" output: DataSet }\n }\n }\n\n par {\n step Trends { ask: \"Identify emerging trends\" output: TrendAnalysis }\n step Competitors { ask: \"Map competitor landscape\" output: CompetitorMap }\n }\n\n hibernate until \"quarterly_data_available\"\n\n doubt {\n flow ValidateFindings(data: DataSet) -> ValidatedReport {\n step CrossCheck { ask: \"Challenge every assumption with evidence\" output: ValidatedReport }\n }\n }\n\n weave [Trends, Competitors] into Final { format: Report }\n}\n```\n\n- Agent hibernates after initial analysis, **costing $0 while waiting**\n- Resumes automatically when quarterly data arrives (webhook/cron)\n- `doubt` mode forces adversarial validation with syllogism checking\n\n#### Use Case 3: Autonomous Customer Support with Escalation\n\nA SaaS platform handles support tickets with different confidence requirements\nand automatic escalation via hibernate:\n\n```axon\npersona SupportAgent {\n domain: [\"product knowledge\", \"troubleshooting\"]\n tone: empathetic\n confidence_threshold: 0.8\n}\n\nflow HandleTicket(ticket: String) -> Resolution {\n know {\n flow DiagnoseIssue(ticket: String) -> Diagnosis {\n step Classify { ask: \"Classify the issue type and severity\" output: Diagnosis }\n }\n }\n\n believe {\n flow SuggestSolution(diagnosis: Diagnosis) -> Solution {\n step Solve { ask: \"Propose a solution based on known patterns\" output: Solution }\n }\n }\n\n if confidence < 0.7 -> hibernate until \"human_review_complete\"\n\n step Respond { ask: \"Draft customer response\" output: Resolution }\n}\n```\n\n- `know` classifies with strict accuracy (no guessing on severity)\n- `believe` suggests solutions with moderate confidence\n- Low confidence triggers `hibernate` — agent sleeps until a human reviews\n- Zero compute cost during human review; resumes with full context\n\n### IV. Directed Creative Synthesis — the `forge` Primitive\n\n> AXON introduces a sixth paradigm shift: **mathematical formalization of\n> the creative process** inside LLMs.\n\nThe industry suffers from a structural limitation: LLMs can interpolate, but\nthey struggle to _create_. `forge` addresses this by implementing a\ncompiler-level **Poincaré pipeline** — the same 4-phase process mathematicians\nand scientists use when producing genuinely novel work.\n\n**Poincaré-Hadamard Creative Pipeline.** A `forge` block orchestrates four\nsequential phases, each mapped to a distinct LLM configuration:\n\n```text\nforge(seed, mode, novelty, depth, branches) → result\n\nPhase 1: PREPARATION — Expand the seed via context probing\nPhase 2: INCUBATION — Speculative exploration (depth iterations)\nPhase 3: ILLUMINATION — Best-of-N consensus crystallization\nPhase 4: VERIFICATION — Adversarial doubt + anchor validation\n```\n\n**Boden Creativity Taxonomy.** The `mode` parameter maps Margaret Boden's three\ncreativity types (*The Creative Mind*, 1990) to concrete sampling-parameter\nprofiles at compile time:\n\n```text\nB : Mode → (τ_base, freedom, rule_flexibility)\n\nB(combinatorial) = (0.9, 0.8, 0.3) — novel recombination of known ideas\nB(exploratory) = (0.7, 0.6, 0.5) — structured navigation of possibility spaces\nB(transformational) = (1.2, 1.0, 0.9) — rule-breaking synthesis, new paradigms\n```\n\n**Novelty, measured — not asserted.** Kolmogorov complexity `K(x)` is\n*uncomputable*, so novelty cannot be computed exactly. `forge` measures it with\nthe **Normalized Compression Distance** — the standard *computable* approximation\nof the Normalized Information Distance, a universal metric grounded in Kolmogorov\ncomplexity (Li, Chen, Li, Ma, Vitányi, IEEE TIT 2004):\n\n```text\nNCD(x, y) = [C(xy) − min(C(x), C(y))] / max(C(x), C(y))\n\nν(output) = NCD(baseline, output) — how much of the output is NOT\n already implied by the obvious\n reading of the seed\n```\n\nThe `novelty` parameter (0.0–1.0) both blends the incubation temperature AND sets\nthe **fail-closed floor** the final output must clear:\n\n```text\nτ_eff = τ_base × (0.5 + 0.5 × novelty)\n\nnovelty = 0.0 → τ_eff = 0.5 × τ_base (conservative, high utility)\nnovelty = 1.0 → τ_eff = 1.0 × τ_base (maximum divergence, high surprise)\n```\n\n**Usage example — Directed Creative Synthesis:**\n\n```axon\nanchor GoldenRatio {\n require: aesthetic_harmony\n confidence_floor: 0.70\n}\n\nflow CreateVisualConcept(brief: String) -> Visual {\n forge Artwork(seed: \"aurora borealis over ancient ruins\") -> Visual {\n mode: transformational\n novelty: 0.85\n constraints: GoldenRatio\n depth: 4\n branches: 7\n }\n}\n\nrun CreateVisualConcept(\"Create a visual concept for a film poster\")\n```\n\nWhat the compiler does:\n\n1. **Preparation** — expands \"aurora borealis over ancient ruins\" into a rich\n conceptual foundation via context probing\n2. **Incubation** — runs 4 iterations of speculative exploration at\n `τ_eff = 1.2 × 0.925 = 1.11`, pushing beyond obvious associations\n3. **Illumination** — launches 7 parallel branches, each crystallizing the\n incubated ideas, then selects the most coherent output (Best-of-N)\n4. **Verification** — measures the winning branch's novelty ν = NCD(baseline,\n output) and enforces it **fail-closed**: if ν is below the floor set by\n `novelty`, the forge does NOT return a derivative result — it fails with a\n structured `forge.novelty_floor_breached` error. Only a synthesis that\n provably cleared the measured novelty floor (and its `GoldenRatio` anchor) is\n returned.\n\nThis is **not** a prompt template. `forge` compiles to structured IR metadata\n(`IRForgeBlock` — seed, mode, novelty, depth, branches, constraints) that the\nruntime executes as the orchestrated four-phase pipeline above, with a\n`ForgeSoundness` proof-carrying-code certificate checked at the deploy gate. And\nunlike every prompt-based \"creative mode,\" its novelty is **measured** (NCD) and\n**enforced fail-closed** — a derivative result is never passed off as creative.\n\n> **Honest scope.** `forge` synthesizes a typed *concept/specification*, not a\n> rendered artifact; \"novelty\" is novelty-relative-to-the-obvious-baseline (a\n> computable proxy for the uncomputable Kolmogorov novelty), not a claim of\n> absolute unprecedentedness.\n\n### V. Autonomous Goal-Seeking — the `agent` Primitive\n\n> AXON introduces a seventh paradigm shift: **compiler-verified autonomous\n> agents** grounded in the Belief-Desire-Intention (BDI) architecture, epistemic\n> logic, and coinductive semantics.\n\nEvery existing LLM framework implements agents as Python classes with ad-hoc\nwhile-loops, hidden state machines, and zero formal guarantees. LangChain's\n`AgentExecutor` is a runtime artifact — it cannot be statically analyzed, type-\nchecked, or budget-bounded at compile time. AXON's `agent` primitive makes\nautonomous goal-seeking a **first-class compiled construct** with mathematical\nsemantics.\n\n\n**BDI Coinductive Semantics.** An `agent` declaration compiles to a coinductive\nBDI system — a state machine whose behavior is defined by an infinite\nobservation/transition pair over the epistemic lattice:\n\n```text\nAgent ≅ ν X. (S × (Action → X))\n\nwhere\n S = Beliefs × Goals × Plans — cognitive state\n Action = Observe | Deliberate | Act | Reflect\n ν = greatest fixpoint (coinduction — runs indefinitely)\n```\n\nThe `ν` (nu) operator is the key: unlike inductive data (finite trees), a\ncoinductive agent is a potentially infinite stream of state transitions,\nterminating only when the goal is achieved or a budget is exhausted. This\nformalization is not decorative — it determines the compiler's verification\nstrategy and the executor's loop semantics.\n\n**Epistemic Lattice Convergence.** At each BDI cycle, the agent's epistemic\nstate is projected onto the same lattice `(T, ≤)` used by epistemic directives.\nThe deliberation phase produces a state `σ ∈ {know, believe, speculate, doubt}`\nand a boolean `goal_achieved`. The convergence criterion is:\n\n```text\nConverge(σ, g) = g = true ∧ σ ≥ believe\n\nDiverge(σ, i, n) = σ = doubt ∧ Δσ = 0 ∧ i ≥ n\n where\n Δσ = σᵢ - σᵢ₋₁ — epistemic progress between cycles\n i = current iteration\n n = stuck_window — consecutive stagnation threshold\n```\n\nWhen `Converge` fires, the agent terminates successfully. When `Diverge` fires,\nthe `on_stuck` recovery policy activates — `escalate` raises `AgentStuckError`,\n`forge` triggers creative re-seeding via the Poincaré pipeline, `retry` resets\nand re-attempts.\n\n**Budget Composition.** Budget constraints compose from the IR into the runtime\nas a 4-tuple verified at compile time:\n\n```text\nB(agent) = (max_iter, max_tokens, max_time, max_cost)\n\nTerminate when: ∃ b ∈ B(agent) : consumed(b) ≥ limit(b)\n```\n\nThe compiler rejects agents with unbounded budgets (`max_iterations = 0` without\nan explicit `on_stuck` policy), preventing runaway execution by construction.\n\n**Strategy Dispatch.** The `strategy` parameter selects the BDI loop variant at\ncompile time. Each strategy maps to a specific deliberation/action sequence:\n\n```text\nΛ : Strategy → CycleShape\n\nΛ(react) = Deliberate → Act → Observe\nΛ(reflexion) = Deliberate → Act → Observe → Reflect\nΛ(plan_and_execute) = Plan → (Act → Observe)* → Verify\nΛ(custom) = user-defined step sequence\n```\n\n**Usage example — Autonomous Research Agent:**\n\n```axon\npersona ResearchAnalyst {\n domain: [\"market research\", \"competitive analysis\"]\n tone: analytical\n confidence_threshold: 0.85\n}\n\ntool WebSearch {\n provider: serper\n timeout: 10s\n}\n\ntool DataAnalyzer {\n provider: internal\n timeout: 30s\n}\n\nagent MarketResearcher {\n goal: \"Produce a comprehensive competitive analysis report\n with verified data from at least 5 sources\"\n tools: [WebSearch, DataAnalyzer]\n strategy: react\n max_iterations: 15\n max_tokens: 50000\n max_cost: 2.50\n on_stuck: forge\n return: CompetitiveReport\n}\n\nflow CompetitiveIntelligence(sector: String) -> CompetitiveReport {\n step Research {\n MarketResearcher(sector)\n output: CompetitiveReport\n }\n}\n\nrun CompetitiveIntelligence(\"electric vehicles\")\n with ResearchAnalyst\n```\n\nWhat the compiler does:\n\n1. **IR Generation** — the `agent` block compiles to an `IRAgent` node containing\n goal, tools, budget (15 iter / 50k tokens / $2.50), strategy (`react`), and\n recovery policy (`forge`). The `IRAgent` is embedded as a step inside\n `IRFlow`, preserving compositional semantics.\n2. **Backend Compilation** — the backend (Anthropic, Gemini) generates a\n `CompiledStep` with `step_name: \"agent:MarketResearcher\"` and full agent\n metadata in its `metadata[\"agent\"]` dictionary. The system prompt includes\n persona traits, tool availability, and epistemic constraints.\n3. **Runtime Execution** — the executor detects `agent:` prefix and dispatches\n to the BDI loop. Each cycle: deliberate (epistemic assessment via JSON),\n act (execute step or invoke tool), observe (update beliefs). The loop\n respects the budget 4-tuple and applies `on_stuck` when `Diverge` fires.\n4. **Trace Events** — every BDI cycle emits `STEP_START`, `MODEL_CALL`, and\n `STEP_END` trace events, giving full observability into the agent's\n reasoning trajectory.\n\n**Why this matters:** The agent is not a Python class that wraps `while True`.\nIt is a **compiled cognitive primitive** — the compiler verifies its budget\nboundedness, the type checker validates its return type, the backend generates\nstrategy-specific prompts, and the runtime executes a formally-defined BDI loop\nwith epistemic convergence criteria. This is the difference between duct-taping\nan LLM into a loop and engineering an autonomous system with mathematical\nguarantees.\n\n#### Agent Use Case 1: Autonomous Legal Research Agent\n\nA law firm deploys an agent that autonomously researches case law until it finds\nsufficient precedent — or exhausts its budget and escalates to a human attorney:\n\n```axon\nagent CaseLawResearcher {\n goal: \"Find 3+ relevant precedents for the contract dispute\n with verified court citations\"\n tools: [WebSearch, PDFExtractor]\n strategy: reflexion\n max_iterations: 20\n max_cost: 5.00\n on_stuck: escalate\n return: CaseLawReport\n}\n```\n\n- `reflexion` strategy adds self-critique after each cycle — the agent evaluates\n whether its found precedents are truly relevant, not just keyword matches\n- `on_stuck: escalate` means if the agent doubts its findings after 20 cycles,\n it raises `AgentStuckError` with full context, so the human reviews exactly\n where the agent got stuck\n- Budget cap of $5.00 prevents runaway API costs — the compiler guarantees\n termination\n\n#### Agent Use Case 2: Multi-Agent Data Pipeline\n\nA BI platform chains two agents: one gathers data, the other analyzes it.\nBoth execute within the same compiled flow:\n\n```axon\nagent DataGatherer {\n goal: \"Collect quarterly revenue data from public filings\"\n tools: [WebSearch, FileReader]\n strategy: react\n max_iterations: 10\n on_stuck: retry\n return: DataSet\n}\n\nagent TrendAnalyzer {\n goal: \"Identify year-over-year growth patterns and anomalies\"\n tools: [Calculator, DataAnalyzer]\n strategy: plan_and_execute\n max_iterations: 8\n on_stuck: forge\n return: TrendReport\n}\n\nflow QuarterlyIntelligence(sector: String) -> TrendReport {\n step Gather { DataGatherer(sector) output: DataSet }\n step Analyze { TrendAnalyzer(Gather.output) output: TrendReport }\n}\n```\n\n- Two agents, two strategies: `react` for data gathering (fast, tool-heavy),\n `plan_and_execute` for analysis (structured, plan-then-verify)\n- Each agent has independent budget tracking — if `DataGatherer` costs $0.50,\n `TrendAnalyzer` still has its full budget\n- If `TrendAnalyzer` gets stuck, `forge` triggers creative re-seeding via the\n Poincaré pipeline, generating novel analytical angles\n\n#### Agent Use Case 3: Customer Onboarding Agent with Dynamic Recovery\n\nA SaaS platform uses an agent to guide new customers through a personalized\nonboarding flow, adapting when it gets stuck:\n\n```axon\npersona OnboardingSpecialist {\n domain: [\"product knowledge\", \"user experience\"]\n tone: warm\n confidence_threshold: 0.80\n}\n\nagent OnboardingGuide {\n goal: \"Complete the customer's onboarding checklist with\n personalized recommendations for their industry\"\n tools: [APICall, Calculator]\n strategy: custom\n max_iterations: 12\n max_tokens: 30000\n on_stuck: forge\n return: OnboardingReport\n\n step Greet { ask: \"Welcome the user and assess their goals\" }\n step Configure { ask: \"Recommend workspace configuration\" }\n step Train { ask: \"Generate personalized tutorial sequence\" }\n}\n```\n\n- `custom` strategy: the agent follows a user-defined step sequence (Greet →\n Configure → Train), not a generic loop\n- `on_stuck: forge` — if the agent can't personalize recommendations (e.g.,\n unknown industry), it triggers creative synthesis to propose novel onboarding\n paths instead of failing\n- The `return: OnboardingReport` type is validated by the semantic type checker\n — the agent must produce a structurally valid report, not just free text\n\n### VI. Compile-Time Security — the `shield` Primitive\n\n> AXON introduces an eighth paradigm shift: **Information Flow Control\n> (IFC) as a first-class compiled construct**, providing compile-time security\n> guarantees against LLM-specific attack vectors.\n\nEvery LLM framework treats security as an afterthought — runtime guardrails\nbolted on top of applications. AXON's `shield` primitive makes security a\n**compiler-verified property** of your program, grounded in taint analysis and\nInformation Flow Control theory.\n\n**Trust Lattice (Denning-style IFC).** The shield system operates over a trust\nlattice where data flows from untrusted sources through shield application\npoints to trusted sinks. The compiler statically verifies that every path from\nan untrusted source to a trusted sink passes through at least one shield:\n\n```text\nU : DataLabel → TrustLevel\n\nTrustLevel = Untrusted < Scanned < Sanitized < Trusted\n\n∀ path(source, sink) ∈ Flow :\n label(source) = Untrusted ∧ label(sink) = Trusted\n → ∃ shield ∈ path : label(shield.output) ≥ Sanitized\n```\n\n**Threat Taxonomy.** The `scan` field declares which threats the shield detects,\ndrawn from a formal taxonomy of 11 LLM attack categories:\n\n```text\nT = { prompt_injection, jailbreak, data_exfil, pii_leak, toxicity,\n bias, hallucination, code_injection, social_engineering,\n model_theft, training_poisoning }\n```\n\n**Detection Strategies.** The `strategy` parameter selects the detection\nmechanism, each with different cost/accuracy tradeoffs:\n\n```text\nΣ : Strategy → (Cost, Accuracy, Latency)\n\nΣ(pattern) = (low, medium, fast) — regex/heuristic scan\nΣ(classifier) = (medium, high, medium) — fine-tuned classifier (Llama Guard)\nΣ(dual_llm) = (high, highest, slow) — privileged/quarantined model pair\nΣ(canary) = (low, medium, fast) — traceable token injection\nΣ(perplexity) = (medium, high, medium) — statistical anomaly detection\nΣ(ensemble) = (high, highest, slow) — majority voting across multiple strategies\n```\n\n**Capability Enforcement.** The compiler statically verifies that agent tool\naccess is a subset of the shield's allow list — preventing privilege escalation\nat compile time:\n\n```text\n∀ agent A with shield S :\n tools(A) ⊆ allow_tools(S) — verified at compile time\n tools(A) ∩ deny_tools(S) = ∅ — also verified\n```\n\n**Usage example — LLM Input Shield:**\n\n```axon\nshield InputGuard {\n scan: [prompt_injection, jailbreak, pii_leak]\n strategy: dual_llm\n on_breach: halt\n severity: critical\n allow: [web_search, calculator]\n deny: [code_executor]\n sandbox: true\n redact: [email, phone]\n confidence_threshold: 0.85\n}\n\npersona SecureAssistant {\n domain: [\"customer support\"]\n tone: professional\n confidence_threshold: 0.80\n}\n\nagent SecureBot {\n goal: \"Answer customer queries safely\"\n tools: [web_search, calculator]\n shield: InputGuard\n strategy: react\n max_iterations: 10\n return: SafeResponse\n}\n\nflow SecureSupport(query: String) -> SafeResponse {\n shield InputGuard on query -> SanitizedQuery\n step Process {\n SecureBot(SanitizedQuery)\n output: SafeResponse\n }\n}\n\nrun SecureSupport(\"Help me with my account\")\n with SecureAssistant\n```\n\nWhat the compiler does:\n\n1. **Type Checking** — validates all scan categories, strategies, breach\n policies, severity levels, and confidence thresholds. Detects allow/deny\n overlaps and invalid configurations at compile time.\n2. **Capability Enforcement** — verifies that `SecureBot` only uses\n `[web_search, calculator]` which are in `InputGuard.allow`, and that\n neither appears in `deny`. If `SecureBot` tried to use `code_executor`,\n the compiler would reject the program.\n3. **Taint Analysis** — verifies that `query` (untrusted) passes through\n `shield InputGuard on query` before reaching the agent's trusted context.\n4. **Runtime Execution** — the shield step emits `SHIELD_SCAN_START`,\n scans for prompt injection/jailbreak/PII, and either passes\n (`SHIELD_SCAN_PASS`) or raises `ShieldBreachError` (`SHIELD_SCAN_BREACH`).\n\n#### Shield Use Case 1: Financial Data Pipeline with PII Redaction\n\n```axon\nshield DataShield {\n scan: [pii_leak, data_exfil]\n strategy: classifier\n on_breach: sanitize_and_retry\n max_retries: 3\n severity: high\n redact: [ssn, credit_card, bank_account]\n}\n\nflow ProcessFinancialQuery(input: String) -> Report {\n shield DataShield on input -> CleanInput\n step Analyze {\n given: CleanInput\n ask: \"Analyze the financial data\"\n output: Report\n }\n}\n```\n\n- PII fields (SSN, credit card, bank account) are auto-redacted **before** the\n LLM sees the data\n- `sanitize_and_retry` means detected threats are cleaned and re-scanned up to\n 3 times, not just blocked\n- The compiler guarantees the LLM never processes raw PII\n\n#### Shield Use Case 2: Multi-Agent System with Capability Isolation\n\n```axon\nshield ResearchShield {\n scan: [data_exfil, model_theft]\n strategy: ensemble\n on_breach: quarantine\n allow: [web_search, file_reader]\n deny: [code_executor, api_call]\n sandbox: true\n}\n\nagent Researcher {\n goal: \"Gather market intelligence from public sources\"\n tools: [web_search, file_reader]\n shield: ResearchShield\n strategy: reflexion\n max_iterations: 15\n return: IntelligenceReport\n}\n```\n\n- `ensemble` strategy runs multiple detectors with majority voting — highest\n accuracy for sensitive operations\n- `sandbox: true` runs tool execution in an isolated environment\n- Capability enforcement: the compiler rejects any agent that tries to use\n `code_executor` or `api_call` — preventing privilege escalation by design\n- `quarantine` breach policy isolates suspicious data for human review instead\n of blocking operations\n\n### VII. Epistemic Tool Fortification — Streaming, Effects & Blame Semantics\n\n> AXON introduces a ninth paradigm shift: **formal epistemic control over\n> tool invocations, streaming outputs, and foreign-function interfaces** — backed\n> by algebraic effect theory, coinductive stream semantics, and Findler-Felleisen\n> blame calculus. The `stream` primitive decouples pure deliberation from the I/O mechanism.\n\n#### The Hard Argument (Computational Decoupling)\nIn pragmatic software engineering, Python generators (`yield` and `async for`) have become the standard for data streaming. However, under the rigor of formal language theory and category mathematics, this approach has a structural flaw: it inextricably couples \"deliberation\" (data generation) with the \"I/O mechanism\" (transmission). AXON resolves this by applying **Algebraic Effects and Handlers** to streaming. The `stream` primitive no longer executes I/O; it yields a pure effect (`YieldChunk(data)`), suspending the continuation `k`. An external Handler (e.g., `SSEHandler`) intercepts the effect, executes the I/O side-effect, and then resumes `k`. This mathematical decoupling ensures the generative core remains functionally pure and independently testable.\n\n#### The Sweet Argument (Why it's awesome)\nImagine writing streaming logic without ever worrying about the HTTP connection! With the renewed `stream` primitive, your AI agents don't \"push bytes\"—they express pure conceptual intentions. You just write your LLM generation logic in the cleanest way possible. Want to switch from Server-Sent Events (SSE) to WebSockets, or maybe just log to a file? The agent code doesn't change a single character! You simply swap the Handler. Your codebase becomes incredibly pristine, blazingly fast to test, and theoretically invincible. It makes streaming feel like pure magic backed by hardcore category theory.\n\n#### Real-World Use Cases\n1. **Agentic Server-Sent Events (SSE)**: Stream an agent's intermediate \"thoughts\" and reasoning steps directly to a React frontend in real-time. If the client drops the connection, the handler manages the disconnection gracefully without crashing the agent's pure deliberation cycle.\n2. **Multi-Channel Orchestration**: A single `stream` computation can be intercepted by a composite handler that simultaneously prints chunks to a CLI, broadcasts to an SSE channel, and persists the flow to a Redis database—all while the business logic remains fully unaware of these I/O burdens.\n3. **Deterministic Testing Pipelines**: In your CI/CD pipelines, the I/O handler can be instantly swapped out for a `MockHandler` that accumulates chunks synchronously in memory. This eliminates flaky network-bound streaming tests entirely, allowing you to test complex LLM streaming flows in microseconds.\n\nEvery LLM framework treats tool calls as black boxes: a function returns a\nstring, and the framework trusts it unconditionally. Streaming is even worse —\npartial tokens arrive without any notion of confidence, reliability, or\nepistemic state. AXON solves this by making **every interaction with the\nexternal world** subject to formal epistemic tracking.\n\n#### Formal Model — Four Convergence Theorems\n\n**CT-1: Coinductive Semantic Streaming.** A streaming response is a\ncoinductive process — an infinite observation/transition pair that monotonically\naccumulates epistemic confidence as chunks arrive:\n\n```text\nStream(τ) = νX. (StreamChunk × EpistemicState × X)\n\nwhere\n StreamChunk = (content: String, index: ℕ, timestamp: ℝ)\n EpistemicState = (level ∈ {doubt, speculate, believe, know}, confidence ∈ [0,1])\n ν = greatest fixpoint (coinduction — process unfolds indefinitely)\n\nMonotonicity invariant:\n ∀ i < j : gradient(chunkᵢ) ⊑ gradient(chunkⱼ)\n (epistemic level can only rise, never degrade during streaming)\n```\n\nStreaming in AXON is **not** \"tokens arriving\". It is a formal epistemic\nprocess: each chunk carries its position on the lattice, and the system\nguarantees that confidence can only increase monotonically until convergence.\n\n**CT-2: Algebraic Effect Rows.** Every tool declares its computational effects\nusing Plotkin & Pretnar's algebraic effect theory. The compiler statically\nverifies effect compatibility:\n\n```text\nEffectRow(tool) = ⟨ε₁, ε₂, ..., εₙ, epistemic:level⟩\n\nwhere\n εᵢ ∈ {pure, io, network, storage, random}\n level ∈ {know, believe, speculate, doubt}\n\nComposition rule:\n EffectRow(A ∘ B) = EffectRow(A) ∪ EffectRow(B)\n epistemic(A ∘ B) = min(epistemic(A), epistemic(B)) — meet on lattice\n```\n\nThe composition rule means: if you chain a `network + speculate` tool with a\n`pure + know` tool, the combined effect is `network + speculate` — the system\nautomatically tracks the **least trustworthy** component.\n\n**CT-3: Blame Semantics for FFI.** External tool calls are wrapped in\nFindler-Felleisen contract monitors that assign blame when pre/postconditions\nfail:\n\n```text\nContractMonitor(tool) = (Pre, Post, Blame)\n\nwhere\n Pre : Input → Bool — caller's obligation\n Post : Output → Bool — server's obligation\n Blame : {CALLER, SERVER} — who violated the contract\n\nBlame assignment:\n ¬Pre(input) → Blame = CALLER (you sent bad data)\n ¬Post(output) → Blame = SERVER (tool returned bad data)\n```\n\nThis is not error handling — this is **formal accountability**. When a tool\nfails, AXON tells you *who* broke the contract, not just *that* it broke.\n\n**CT-4: Epistemic Inference via CSP.** The `@csp_tool` decorator automatically\ninfers the epistemic level of any Python function by analyzing its effect\nfootprint using a constraint-satisfaction heuristic:\n\n```text\nInfer(f) : Function → EpistemicLevel\n\n If ∄ io/network/random ∈ effects(f) → know\n If ∃ network ∈ effects(f) → speculate\n If ∃ random ∈ effects(f) → doubt\n Otherwise → believe\n```\n\n#### What Makes This Revolutionary\n\nNo LLM framework in existence tracks **what a tool does to your epistemic\nstate**. LangChain, CrewAI, AutoGen — they all treat tool results as trusted\nstrings. This means:\n\n- A web search result (unreliable) gets the same trust as a database query\n (reliable)\n- A streaming response's first token gets the same trust as the final,\n validated output\n- When a tool fails, you don't know if your input was wrong or the tool was\n broken\n\nAXON solves all three. The compiler **guarantees** that:\n\n1. Every tool call is tagged with its effect signature and epistemic level\n2. Streaming outputs start at `doubt` and can only ascend monotonically\n3. Tool failures carry blame labels that identify the responsible party\n4. Data crossing the FFI boundary is **automatically tainted** — it cannot\n reach `know` level without passing through a shield or anchor\n\n#### Use Case 1: Real-Time Financial Streaming with Epistemic Gradient\n\nA trading desk receives streaming market data and needs to distinguish between\nreal-time quotes (speculative) and confirmed trades (factual):\n\n```axon\ntool MarketFeed {\n provider: bloomberg\n timeout: 5s\n effects: \n}\n\nflow MonitorMarket(sector: String) -> MarketReport {\n step Stream {\n stream {\n on_chunk: {\n probe chunk for [symbol, price, volume]\n ","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"iconType","image","upstream",{"_96":97,"_98":99,"_100":101,"_102":103,"_104":105,"_106":107},"requiredSecrets",[],"tags",[],"assets",[],"stats",{"_94":81,"_95":81},"ratingAvg","reviewCount","topics",[],"license","AGPL-3.0","language","Rust","registryName","io.github.Bemarking/axon-emcp","homepage","https://crates.io/crates/axon-emcp","packages",[],"ENV",{"_110":111,"_112":113,"_114":115},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]