[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_107":108},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":46,"_48":49,"_50":51,"_52":53,"_54":-5,"_55":46,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":-5,"_75":-5,"_76":-5,"_77":46,"_78":-5,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88,"_89":90,"_91":92},"apiUrl","https://odel.app/api","creator","velitricardo","moduleId","axon-lang","@velitricardo/axon-lang","displayName","AXON Epistemic MCP","tagline","Official ℰMCP server for AXON — exposes 99 primitives, 34 templates, 30 examples to AI agents.","iconKey","https://avatars.githubusercontent.com/u/226776091?v=4","category","local","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","pricingModel","free","creatorUserId","system:external-import","createdAt",1787372588000,"updatedAt","sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=com.ricardovelit%2Faxon-emcp","sourceVerified",false,"sourceMissingSince","importedAt","upstreamStars",4,"upstreamUpdatedAt",1787355950000,"detectedTransport","detectedAuthType","probeStatus","lastProbedAt","githubRepoUrl","https://github.com/VelitRicardo/axon-lang","githubRepoFullName","VelitRicardo/axon-lang","releaseId","ext-velitricardo-axon-lang","version","0.54.0","descriptionMarkdown","

\n AXON v4.4.0
\n Axon is the Cognitive Runtime for Enterprise Software.

\n Build AI systems with deterministic execution, formal guarantees and\n native cognitive primitives.\n

\n\n

\n $\"Documentation\"$ \n $\"Version\"$ \n $\"Status:$ \n $\"100%$ \n $\"Streaming\"$ \n $\"Session$ \n $\"Tests\"$ \n $\"Compliance\"$ \n $\"Audit$ \n $\"PostgreSQL\"$ \n $\"Tracing\"$ \n $\"License\"$ \n

\n\n

Primitive census — every language construct advertised here is a build input: the compiler's anti-drift gate (axon-frontend/src/advertised.rs) parses this block at test time and fails the build unless each badge carries a human-attested statement of what its runtime actually does.

\n\n

\n \n persona · intent · flow · reason · anchor · refine · memory · tool · probe · weave · validate · context · step · run
\n know · believe · speculate · doubt · par · hibernate
\n dataspace · ingest · focus · associate · aggregate · explore
\n type · json · ledger
\n deliberate · consensus · forge · agent · shield
\n savant · synth · warden · scope
\n stream · effects · @contract_tool · @csp_tool
\n effect · handle · perform
\n pix · navigate · drill · trail · corpus
\n psyche · ots
\n mcp · mandate · lambda
\n budget · window · cors · document · deliver · notify
\n credential · mint · rotate
\n compute · grad · quant · observable
\n extension · witness
\n daemon · listen
\n channel · emit · publish · discover
\n axonendpoint · axpoint · axonstore
\n \n Cognitive I/O:\n resource · fabric · manifest · observe ·\n reconcile · lease · ensemble
\n topology · session · send · receive · select · branch ·\n immune · reflex · heal ·\n compliance
\n component · view
\n \n cache · voice · shell · path rewrite · PASETO
\n \n Session types (v2.3.0):\n socket · upstream · send T · receive T · select {ℓᵢ:…} · branch {ℓᵢ:…} · backpressure: credit(k) · reconnect: cognitive_state\n

\n\n**Unwired — advertised, and not yet reachable.** Three of the badges\nabove name a primitive whose engine exists and passes its own tests, and which\n**no published program can reach**: nothing calls it. They are listed in the\ncompiler's `KNOWN_DEBT` ratchet, which may only shrink, so this list cannot grow\nquietly:\n\n| primitive | the engine that exists | what is missing |\n|---|---|---|\n| `cache` | `cache_runtime` — content-addressed keys, single-flight, TTL with jitter, LRU, errors never cached | the call site. `backend:`, `ttl:`, `key_params:` and `invalidate_on:` are inert; **nothing is memoised** |\n| `savant` | an HRR codec, a VFE/EFE active-inference engine, and a Betti/PHC topology engine | dispatch. `cognition.depth:` is validated at compile time and read by nothing at runtime |\n| `synth` | the deny-by-default OSS reference, which refuses by design | a mount point. Note the honest ceiling: wiring it in OSS yields a *refusal*, not execution — synthesised code runs only in the enterprise sandbox |\n\nThis table exists because the alternative is worse. `cache` was attested as\nworking until v2.89.0 measured it, on a citation that named a compile-time property\nas evidence of a runtime — so the state `Unwired` was added to the gate, and it\nowes a ledger entry exactly like an unimplemented promise does. A ledger that\nstays empty because a row is mislabelled is worth less than one that admits\nthree.\n\n

\n\n---\n\n> **Two repositories, two version lines.** This repo (`axon-lang`,\n> AGPL-3.0-or-later, public) ships the **language + runtime + compiler + 7 LLM\n> backends + Cognitive I/O + WebSocket session types** — currently **v4.4.0**.\n> The commercial control plane (`axon-enterprise`, EULA, private) layers\n> multi-tenant identity / RBAC / SSO / metering / audit / vertical compliance\n> **on top of** this language via a pinned Cargo dependency — currently\n> **v4.x**. The version numbers diverge by design (enterprise iterates on\n> the SaaS surface independently of the language). If you don't run a\n> commercial Axon deployment, this repo is all you need; the badge above is\n> the only version that matters for you.\n\n---\n\n## What is AXON?\n\nAXON is a **compiled language** that targets LLMs instead of CPUs. It has a\nformal EBNF grammar, a lexer, parser, AST, intermediate representation, **seven\nnative Rust LLM backends** (Anthropic, OpenAI, Gemini, Kimi, GLM, Ollama,\nOpenRouter), and a 100% Rust + C23 native runtime with semantic type checking, an\nalgebraic-effects execution engine, real-time SSE / NDJSON / WebSocket\nsession-typed streaming, retry + circuit-breaker resilience, and execution\ntracing. The FIPS-routable cryptographic + tokenisation kernels live in\n[`axon-csys`](https://github.com/VelitRicardo/axon-lang/blob/master/axon-csys/) as standalone C23 (no opaque C bindings — every\nkernel is a `_Generic`-dispatched, `[[nodiscard]]`-annotated, sanitizer-clean\nC23 source file with a Rust wrapper).\n\nBeyond cognition, AXON ships **Cognitive I/O** — a λ-calculus-based\ninfrastructure layer where resources, control loops, observability, security\nkernels, and UI components carry their regulatory class as a **compile-time\ntype**, drawn from a **closed vocabulary Κ of 15 classes**: HIPAA, PCI_DSS,\nGDPR, SOX, FINRA, ISO27001, SOC2, FISMA, GxP, CCPA, NIST_800_53, and — since\nv4.0.0 — Brazil's LGPD, Mexico's LFPDPPP and NOM151, Colombia's LEY1581. An\nunknown label is a **compile error** with a one-edit suggestion\n(`axon-T1214`: `[HIPPA]` is refused, `HIPAA` is suggested). FIPS 140-3 and\nCC EAL 4+ are *audit frameworks* the evidence\nengine targets — deliberately **not** members of Κ: κ classifies what data\n*is*; a framework is what the implementation is *audited against*. Programs\nthat fail coverage are rejected *before* they run. No other programming\nlanguage does this.\n\n**v2.3.0 adds the first session-typed real-time dialogue primitive in\nany production language**: declare a `session` (the bidirectional protocol),\nbind it to a `socket` (the WebSocket transport with credit-refined\nbackpressure), and the compiler proves the two endpoints are duals\n(Caires–Pfenning linear-logic Curry–Howard); the runtime enforces every step,\nseals the residual cursor on disconnect for typed reconnection, and projects\nto W3C Server-Sent Events when the protocol is single-polarity. See\n[`papers/paper_websocket_cognitive_primitive.md`](https://github.com/VelitRicardo/axon-lang/blob/master/papers/paper_websocket_cognitive_primitive.md).\n\nIt is **not** a Python library, a LangChain wrapper, a YAML DSL, or a Terraform\nreplacement. It is a *new kind of calculus* — see\n[`papers/paper_lambda_lineal_epistemico.md`](https://github.com/VelitRicardo/axon-lang/blob/master/papers/paper_lambda_lineal_epistemico.md)\nfor the formal semantics (Cálculo Lambda Lineal Epistémico).\n\n---\n\n## Cognitive I/O — Build Infrastructure with Compile-Time Compliance\n\nThe big differential added in v1.0 — ten new top-level declarations that turn\nAXON into the only language where *\"does this app leak PHI?\"* is a **type\nerror**, not a post-mortem finding.\n\n| Primitive | What it is | Formal backing |\n|---|---|---|\n| `resource` | Infrastructure token (DB, cache, bucket, GPU) with `linear` / `affine` / `persistent` lifetime | Linear Logic (Girard 1987) |\n| `fabric` | Topological substrate (VPC, cluster, namespace) | Separation Logic (O'Hearn–Reynolds) |\n| `manifest` | Declarative \"belief\" about desired infrastructure shape, with κ (regulatory class) annotations | Epistemic Logic (Fagin–Halpern) |\n| `observe` | Quorum-gated snapshot of real state, producing a ΛD envelope ⟨c, τ, ρ, δ⟩ | Decision D4: partition ≡ void, never `doubt` |\n| `reconcile` | Active-Inference control loop: observe → drift → shield → act | Free Energy Principle (Friston) |\n| `lease` | τ-decaying affine capability; post-expiry use is a CT-2 *Anchor Breach* | Hybrid affine + revocation (D2) |\n| `ensemble` | Byzantine quorum aggregator over N observations with common-knowledge fusion | Fagin–Halpern `Cφ` |\n| `topology` + `session` | Typed directed graph over declared entities with Honda–Vasconcelos duality + deadlock detection | π-calculus binary sessions |\n| `socket` (v2.3.0) | Session-typed WebSocket transport with credit-refined backpressure, typed reconnection via `cognitive_states`, SSE-as-fragment projection | Caires–Pfenning Curry–Howard + Rast credit-refined types ([paper_websocket_cognitive_primitive.md](https://github.com/VelitRicardo/axon-lang/blob/master/papers/paper_websocket_cognitive_primitive.md)) |\n| `immune` + `reflex` + `heal` | KL-divergence anomaly sensor + O(1) signed-trace motor response + Linear-Logic one-shot patch FSM | Cognitive Immune System ([paper_immune_v2.md](https://github.com/VelitRicardo/axon-lang/blob/master/papers/paper_immune_v2.md)) |\n| `component` + `view` | Declarative UI with the **same** compile-time κ coverage rule — regulated types need a covering shield or the compiler rejects | Regulatory Type Theory |\n\n### Hard differentiators vs. Terraform / Pulumi / Kubernetes manifests\n\n1. **Compile-time compliance.** `shield` / `type PatientRecord compliance [HIPAA, GDPR]` are *types*. A `.axon` program that sends PHI to an unshielded endpoint fails `axon check` — same exit code as a syntax error. The rule guards **every κ-carrying boundary**: HTTP endpoints (`axon-T957`), typed channels at declaration (`axon-T1215`, v4.0.0 — a `Channel` handle inherits `T`'s κ), and again at π-calculus `publish` for IR that bypassed the checker (the typed bus derives its predicate from the same IR it registers channels from, fail-closed). The audit engine scores **coverage holding**, never label presence.\n2. **Blame Calculus (Findler–Felleisen).** Every error is classified as **CT-1** (axon/runtime bug), **CT-2** (program author: anchor breach, expired lease), or **CT-3** (infrastructure: partition, missing credential, provider quota). No silent downgrades.\n3. **Audit-ready artefacts.** `axon dossier` + `axon sbom` + `axon audit --framework {soc2,iso27001,fips,cc,all}` + `axon evidence-package` produce byte-identical, deterministic JSON/ZIP — the SHA-256 of every output is a *contract* against your release.\n4. **100% Rust + C23 runtime, no interpreter.** The whole stack — lexer, parser, type-checker, IR, the algebraic-effects execution engine, the HTTP server, the seven LLM backends, the streaming wire, the session-typed WebSocket driver — is a single native Rust binary; the FIPS-routable cryptographic + tokeniser kernels live in [`axon-csys`](https://github.com/VelitRicardo/axon-lang/blob/master/axon-csys/) as standalone C23 (no `unsafe` glue: `_Generic`-dispatched headers, `[[nodiscard]]` everywhere, sanitizer-clean, valgrind-clean). `cargo install axon-lang`. No GC, no interpreter, no runtime dependency.\n5. **Cognitive immune system.** `immune + reflex + heal` is a first-class language primitive, not a plug-in. Signed HMAC traces per firing, three compliance modes (`audit_only` / `human_in_loop` / `adversarial`), Linear-Logic patch FSM preventing double-application.\n6. **Post-Quantum-ready ESK.** HMAC-SHA256 baseline + Ed25519 + ML-DSA-65 (NIST FIPS 204 Dilithium) + Hybrid signer (NIST SP 800-208 transition posture). Feature-gated; no silent classical fallbacks.\n7. **Persistence is a typed cognitive primitive.** A database in AXON is an `axonstore`, not an ORM bolt-on: retrieved rows are born epistemically `Untrusted` and a `confidence_floor` is enforced at read and write; every mutation appends to an HMAC-Merkle audit chain; `retrieve` is a bounded, back-pressured `Stream`; and store access is capability-typed and checked at *compile time*. No other language treats stored data this way.\n8. **Real-time dialogue is a typed cognitive primitive (v2.3.0).** A WebSocket in AXON is a `socket` over a declared `session`, not a JSON envelope over bytes: the compiler proves the two endpoints are duals (Caires–Pfenning intuitionistic linear logic, `S̄ ≡ S⊥`), so the connection is **deadlock-free and protocol-conformant by construction**; credit-refined backpressure (`backpressure: credit(k)`) is decidable in Presburger arithmetic at compile time; a mid-protocol disconnect seals the residual session-type cursor + credit window into an AAD-bound `cognitive_states` snapshot, and the typed `?resume=` resume restores it under tenant + flow_id binding; a single-polarity protocol's `socket` ALSO speaks W3C Server-Sent Events byte-compat with the existing SSE pipeline (`S_SSE = Π_↓(S_WS)`).\n9. **Every boundary is guarded (v2.44.0).** The doctrine `axon://logic/every_boundary_is_guarded`: no `axonendpoint` may dispatch a flow across a trust boundary uncovered by silent omission. It must declare a covering discipline (`requires:` / `shield:` / `compliance:`) **or** the explicit, auditable opt-out `public: true` — omit both and `axon check` fails with **`axon-T890`**, same exit code as a syntax error. The *absence* of a guard is a deliberate, witnessed decision, never a default. The rule is independently re-verified as a Proof-Carrying-Code obligation (`PropertyClass::AuthorizationCoverage`) at the deploy gate, so an unguarded boundary cannot reach production through any door; `axon fix` migrates existing programs. Generalises the shield κ-coverage rule from *regulated types* to *every boundary*.\n10. **Every guard is satisfiable (v2.45.0).** The completeness dual of #9: the doctrine `axon://logic/every_requirement_is_grantable`. A `requires: [x]` whose capability `x` no authority in the system can grant is a **dead boundary** — a locked door with no fabricable key, indistinguishable at deploy from a real guard. v2.45.0 makes key-existence a proof obligation: a total, injective projection `π` reconciles the two authority representations that otherwise never meet — the control-plane RBAC catalog (colon `resource:action`) and the data-plane `requires:` grammar (dotted `resource.action`) — so a role-derived permission `flow:execute` actually satisfies `requires: [flow.execute]`. The law `requires ⊆ π(grantable_catalog)` is re-verified as a Proof-Carrying-Code obligation (`PropertyClass::CapabilityGrantability`); a dead requirement is refuted with **`axon-T891`** and the deploy gate rejects the bundle fail-closed. Unlike IAM systems that discover unsatisfiable policies at request time (or never), AXON proves *before the surface mounts* that every scope it requires is grantable. Together with #9: **every boundary is guarded, and every guard is openable by exactly the authorities meant to open it.** v2.47.0 closes the converse quantifier (`axon://logic/every_granted_authority_projects`, v2.47.0): v2.45.0 proved the key *exists in the catalog*; v2.47.0 proves the key that is actually *cut* — a granted role, built-in or custom — turns the lock: `π` lifted to held-authority sets is total with **explicit drops** (`auth_scope::project_permission_set` — a tampered authority row degrades with a witness, never silently), authority is derived from live state at verify time (never minted into a claim, so revocation binds next-request), and a permission that cannot project is refused at the write. The **dead authority** — assignable but inert, the principal-side dual of the `axon-T891` dead requirement — becomes unrepresentable.\n11. **Delegation is attenuation (v2.46.0).** The third act of the authority story: the doctrine `axon://logic/authority_only_attenuates`. `credential { ttl: grants: }` declares an **ephemeral-credential contract** — the exact shape a chat widget on any origin needs — and the `mint` flow verb turns it into a TTL-bounded bearer at runtime, admitted only when `grants ⊆ capabilities(minter)`: a flow can hand a visitor a *slice* of the authority it provably holds, never more. The law is machine-checked at three layers, all fail-closed: compile (**`axon-T893`**–**`axon-T896`** — grantless contracts, TTLs beyond the 24h ephemeral ceiling, ghost mints, and persisting a minted bearer are all rejected), verify/deploy (a Proof-Carrying-Code obligation, `PropertyClass::CredentialAttenuation`, re-derives every contract + mint site from the artifact), and mint time (the dispatch handler AND the `CredentialMinter` port independently enforce the subset law; no port configured ⇒ a loud missing-dependency error, never a silent stub). Stripe-style ephemeral keys, but as *typed language surface with a deploy-time proof* — no SDK call whose scopes are runtime strings. Cognitive time is declared the same release: `now: \"\"` on a `step` or `context` (v2.46.0) injects ONE captured instant per run, DST-correct and recorded as `(captured_utc, tzdb_version, zones)` in the envelope for byte-exact replay — `time_is_an_explicit_input` applied to cognition, with `TemporalContextSoundness` refuting a plausible-but-unknown timezone before deploy.\n12. **Rotation without revelation (v2.48.0).** The inbound dual of #11: the doctrine `axon://logic/rotation_without_revelation`. A third-party credential a tenant lends the platform (an OAuth token for a connected CRM) is **custodied, never readable**: `axonstore { backend: secrets class: crm }` is a read-only *metadata* view over the encrypted secret custody (key / version / created_at / expires_at — the value has no column), so a cron `daemon` enumerates what nears expiry with ordinary time-aware `retrieve`; the `rotate [where] with as ` verb renews each matching entry through ONE runtime-mediated exchange per key (reveal into the reserved `axon_rotation` tool envelope → the adopter's tool performs the vendor refresh → CAS commit at version+1, so HA daemon replicas cannot double-spend a refresh token), binding only the `{attempted, rotated, failed}` summary; and `tool { secret: crm.hubspot }` injects the per-tenant value into the tool-server request at dispatch (`axon_secret`) so the consuming flow never touches it. **No term of the language evaluates to a secret value — revelation is unrepresentable, not discouraged.** Machine-checked at three layers, all fail-closed: compile (**`axon-T897`**–**`axon-T900`** + **`axon-T902`** — custody writes, rotations of non-custody stores or ghost tools, class-less views, and credential literals in source are all rejected), verify/deploy (`PropertyClass::SecretCustodySoundness` re-derives every store, rotate site and write verb from the artifact), and dispatch (no custody port ⇒ a loud missing-dependency error; a secret-bearing tool never calls its vendor unauthenticated). AWS-Secrets-Manager-style managed rotation, but the orchestrator itself is *provably unable to read what it rotates*.\n\n### External audit readiness\n\nThe audit engine ships **108 mapped controls** across the four major external frameworks:\n\n- **SOC 2 Type II** — 31 TSC controls (CC + C + PI + P)\n- **ISO/IEC 27001:2022** — 41 Annex A controls\n- **FIPS 140-3 (CMVP)** — 14 CAVP/FSM entries\n- **Common Criteria EAL 4+** — 22 SFRs + SARs\n\nEach framework has an operational runbook and an audit-evidence pipeline that emits the evidence bundle on every release.\n\n### Try it in 30 seconds\n\n```bash\ncargo install axon-lang\necho 'type PatientRecord compliance [HIPAA, GDPR] { ssn: String }\nshield PHIShield { scan: [pii_leak] on_breach: halt severity: critical\n compliance: [HIPAA, GDPR] }\naxonendpoint Api { method: POST path: \"/p\" body: PatientRecord\n execute: F output: FlowEnvelope shield: PHIShield\n backend: anthropic compliance: [HIPAA, GDPR] }\nflow F(ssn: String) -> PatientRecord {\n step R { ask: \"summarize\" output: PatientRecord } }' > app.axon\naxon check app.axon # compile-time compliance verification\naxon dossier app.axon # regulatory posture JSON\naxon audit app.axon --framework all # per-framework gap analysis\n```\n\nNow delete `shield: PHIShield` from the endpoint and run `axon check` again:\n\n```\nX app.axon 1 error(s)\n error [line 4]: axon-T957 axonendpoint 'Api' carries regulated data\n (kappa = {GDPR, HIPAA}) across a trust boundary but declares no `shield:`.\n Regulated boundaries require a shield whose `compliance:` covers the type's\n kappa — the ESK coverage rule. […] Declaring the classes on the\n endpoint's own `compliance:` does NOT cover them: that list is a label,\n the shield is the control that acts on a breach.\n```\n\nThat failure is a **type error**, not a lint warning — `axon check` exits `1` and nothing downstream will build. The rule is a real set difference over the regulatory classes carried by the boundary's `body:` and `output:` types, so a shield that covers *some* of them fails too, naming exactly the ones it misses.\n\nThe vocabulary itself is closed (`axon-T1214`): `compliance: [HIPPA]` is refused with the suggestion `HIPAA`, so a symmetric typo can never satisfy the coverage difference. The same set-difference rule guards `channel` declarations (`axon-T1215` — a channel whose payload carries κ needs a covering shield before `publish` may extrude it), and is re-checked at runtime `publish` for IR that never met the checker.\n\n**Strength, stated precisely.** What Κ membership buys is *machine-checked at compile time*: vocabulary closure (T1214) and shield coverage at every κ-carrying boundary (T957 endpoints, T1215 channels), re-verified at deploy and at `publish`. What it does not buy: the *semantic* obligations of each regulation (what HIPAA requires operationally) are the adopter's shield/flow design — AXON gives the mechanism (NOM151 → `axonstore` sealed audit chains; LFPDPPP / LGPD / LEY1581 → `shield` redaction and κ-coverage), the adopter supplies the policy. The audit engine maps controls to evidence with that qualifier stated, and its FIPS 140-3 posture is *algorithmically conformant, not formally validated* — CAVP/CMVP are laboratory engagements no compiler can close.\n\n### Reference programs\n\n- [`examples/healthcare_reference.axon`](https://github.com/VelitRicardo/axon-lang/blob/master/examples/healthcare_reference.axon) — HIPAA + GDPR + GxP + SOC 2\n- [`examples/banking_reference.axon`](https://github.com/VelitRicardo/axon-lang/blob/master/examples/banking_reference.axon) — PCI_DSS + SOX + SOC 2\n- [`examples/government_reference.axon`](https://github.com/VelitRicardo/axon-lang/blob/master/examples/government_reference.axon) — FISMA + NIST 800-53 + SOC 2\n- [`examples/ui/healthcare_console.axon`](https://github.com/VelitRicardo/axon-lang/blob/master/examples/ui/healthcare_console.axon) — UI built on top of the healthcare backend with compile-time κ-redacted renders\n- [`examples/tool_dispatch.axon`](https://github.com/VelitRicardo/axon-lang/blob/master/examples/tool_dispatch.axon) — flow-level `use on \"${param}\"` native tool dispatch with request-parameter binding\n\n### Academic references\n\n- [`papers/paper_lambda_lineal_epistemico.md`](https://github.com/VelitRicardo/axon-lang/blob/master/papers/paper_lambda_lineal_epistemico.md) — λ-L-E calculus: Theorem 5.1 *Stochastic Degenerative Soundness*\n- [`papers/paper_immune_v2.md`](https://github.com/VelitRicardo/axon-lang/blob/master/papers/paper_immune_v2.md) — Cognitive Immune System with red-teaming metrics (F1 ≥ 0.80 per class)\n- [`papers/paper_esk.md`](https://github.com/VelitRicardo/axon-lang/blob/master/papers/paper_esk.md) — Regulatory Type Theory for Cognitive Systems (Theorems 10.1–10.5)\n\n---\n\n## Production Status\n\nAXON v2.3.0 is **production-ready**. The full stack is cross-validated, 100% Rust + C23:\n\n- ✅ 65+ cognitive + Cognitive-I/O primitives wired to the native runtime\n- ✅ 285 HTTP routes tested end-to-end\n- ✅ Seven native Rust LLM backends (Anthropic, OpenAI, Gemini, Kimi, GLM, Ollama, OpenRouter) with full async streaming\n- ✅ Real-time streaming wire — SSE + NDJSON, type-driven transport inference, per-chunk algebraic-effect dispatch\n- ✅ **Session-typed WebSocket dialogue (v2.3.0)** — declared `session` + `socket`, statically-checked duality (Caires–Pfenning), credit-refined backpressure (Presburger discharge), typed reconnection via AAD-bound `cognitive_states` snapshots, SSE-as-fragment unification\n- ✅ **Multiparty projection (v2.3.0)** — `GlobalType` + `project_all` (Honda–Yoshida–Carbone safe-realizability gate) for n-agent skill/tool topologies\n- ✅ `axonendpoint` as a first-class HTTP REST primitive — typed routes, body + output schema validation, `Idempotency-Key`, auth scopes\n- ✅ `axonstore` cognitive data plane — epistemically typed rows, HMAC-Merkle audit chains, `Stream`, capability-typed access\n- ✅ Compile-time regulatory compliance — closed Κ of 15 classes (US + EU + LATAM: LGPD, LFPDPPP, NOM151, LEY1581), vocabulary closed by `axon-T1214`, coverage enforced at endpoints (`axon-T957`) and channels (`axon-T1215`) with a fail-closed re-check at `publish`; audit engine targets SOC 2 / ISO 27001 / FIPS 140-3 / CC EAL 4+\n- ✅ Cognitive immune system (anomaly detection + reflex + heal) paper-faithful\n- ✅ Post-Quantum signatures: HMAC-SHA256 baseline + Ed25519 + ML-DSA-65 + Hybrid (NIST SP 800-208)\n- ✅ **`axon-csys` C23 kernels** — FIPS-routable SHA-256 / HMAC-SHA256 / SIMD G.711 / BPE tokeniser / FSM dispatch (computed gotos) / buffer pool (207× faster than Vec) — standalone C23 with sanitizer-clean + valgrind-clean CI lanes\n- ✅ PostgreSQL persistence with migrations and health checks\n- ✅ Structured observability (JSON logging + request tracing)\n- ✅ LLM call resilience (retry + circuit breaker + fallback)\n- ✅ **2,245 axon-lang + 535 axon-frontend + 13 axon-csys = 2,793 Rust tests**; cross-stack zero-regression discipline. Python side is now a thin PyPI wrapper that downloads + invokes the native Rust binary (the language interpreter is 100% Rust/C23 — the Python suite was retired in the v2.0.0 *Pure Silicon* pivot).\n- ✅ Zero \"por ahora\", zero \"lo mínimo\" — production-complete\n\nDesigned for cognitive AI applications that require formal semantics, reliability, epistemic rigor, and *provable* regulatory coverage.\n\n```axon\npersona LegalExpert {\n domain: [\"contract law\", \"IP\", \"corporate\"]\n tone: precise\n confidence_threshold: 0.85\n refuse_if: [speculation, unverifiable_claim]\n}\n\nanchor NoHallucination {\n require: source_citation\n confidence_floor: 0.75\n unknown_response: \"Insufficient information\"\n}\n```\n\n> **⚠️ `enforce` is the behavioral carrier in anchors.** It is the ONLY anchor field\n> injected as a direct behavioral directive to the LLM. `require`/`reject` are\n> post-generation validation constraints. `description` is metadata-only — it does\n> NOT reach the model. Use `enforce` for text that must shape the model's behavior.\n\n```axon\ntype ContractSchema {\n summary: String\n risks: String\n recommendations: String\n}\n\nflow AnalyzeContract(doc: Document) -> StructuredReport {\n step Extract {\n probe doc for [parties, obligations, dates, penalties]\n output: EntityMap\n }\n step Assess {\n reason {\n chain_of_thought: enabled\n given: Extract.output\n ask: \"Are there ambiguous or risky clauses?\"\n depth: 3\n }\n output: RiskAnalysis\n }\n step Check {\n validate Assess.output against: ContractSchema\n if confidence < 0.8 -> refine(max_attempts: 2)\n output: ValidatedAnalysis\n }\n step Report {\n weave [Extract.output, Check.output]\n format: StructuredReport\n include: [summary, risks, recommendations]\n }\n}\n```\n\n---\n\n## Native Rust + C23 Runtime\n\nAXON v2.3.0 ships a **production-hardened** 100% Rust + C23 native runtime server with **285+ HTTP routes**, **65+ primitives** wired to runtime, an **algebraic-effects execution engine**, a **real-time SSE / NDJSON / session-typed WebSocket streaming wire**, a full **ℰMCP** (Epistemic Model Context Protocol) implementation, **PostgreSQL persistence**, **structured observability via tracing**, **LLM call resilience** (retry + circuit breaker + fallback chains across seven native backends), and a complete native CLI (`check`, `compile`, `run`, `serve`, `parse`, `dossier`, `sbom`, `audit`, `evidence-package`, and more).\n\nThe **Rust + C23 stack is the canonical implementation** of the language. v2.0.0 (*Pure Silicon*) retired the Python interpreter — and the PyPI line has since been closed with a tombstone release that redirects to `cargo install axon-lang` (the historical Python releases remain archived on PyPI, unmaintained). The FIPS-routable cryptographic + tokeniser kernels live in [`axon-csys`](https://github.com/VelitRicardo/axon-lang/blob/master/axon-csys/) as standalone C23 (no `unsafe` glue: `_Generic`-dispatched headers, `[[nodiscard]]` everywhere, sanitizer-clean + valgrind-clean CI lanes).\n\n**Production Foundation (Phase K):**\n- **Observability**: JSON structured logging with request tracing, daily log rotation, configurable levels\n- **Resilience**: Exponential backoff retry, per-provider circuit breakers, configurable fallback chains across 7 LLM backends\n- **Persistence**: Full PostgreSQL integration with embedded migrations, JSONB storage, in-memory fallback for development\n\n### Quickstart\n\n```bash\n# Build the native runtime\ncd axon-rs\ncargo build --release\n\n# Start the server with default in-memory storage\ncargo run --release -- --port 3000\n\n# Or with PostgreSQL persistence + structured logging\nDATABASE_URL=\"postgresql://user:pass@localhost/axon\" \\\ncargo run --release -- \\\n --port 3000 \\\n --log-format json \\\n --log-file ./logs \\\n --database-url \"$DATABASE_URL\"\n\n# Deploy a flow\ncurl -X POST http://localhost:3000/v1/deploy \\\n -H \"Content-Type: application/json\" \\\n -d '{\"source\": \"flow analyze { step reason { prompt: \\\"Analyze the input\\\" } }\", \"backend\": \"stub\"}'\n\n# Execute\ncurl -X POST http://localhost:3000/v1/execute/analyze\n\n# MCP endpoint (JSON-RPC 2.0)\ncurl -X POST http://localhost:3000/v1/mcp \\\n -H \"Content-Type: application/json\" \\\n -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}'\n```\n\n### Phase K — Production Hardening (v1.0.0 foundation)\n\nAXON v1.0.0 launched with three production-critical systems that remain the foundation of every subsequent minor release:\n\n#### 1. Observability (K1)\n- **Structured logging** via `tracing` crate with JSON output\n- **Request tracing** with UUID correlation (x-request-id header)\n- **Daily log rotation** with configurable directory\n- **Configurable levels** via `AXON_LOG` env or `--log-level` CLI\n- Instrumentation on all LLM calls: backend, model, latency_ms, tokens_in/out\n\n#### 2. Resilience (K2)\n- **Exponential backoff retry** (500ms base, 2.0x multiplier, 30s max, jitter)\n- **Per-provider circuit breaker** (5 failures → Open, 30s cooldown → HalfOpen, 2 successes → Closed)\n- **Retry-After header respecting** for rate limit hints\n- **Fallback chains** (e.g., anthropic → openrouter → ollama)\n- **Error classification** (retryable vs. terminal)\n- Covers all 7 LLM backends: Anthropic, OpenAI, Gemini, Kimi, GLM, OpenRouter, Ollama\n\n#### 3. Persistence (K3-K4)\n- **PostgreSQL backend** with full ACID semantics\n- **12 domain tables** (traces, sessions, daemons, audit_log, axon_stores, dataspaces, hibernations, event_history, execution_cache, cost_tracking, schedules, backend_registry)\n- **15 performance indexes** for query optimization\n- **Embedded migrations** (zero external DB setup for development)\n- **UPSERT semantics** for idempotent writes\n- **JSONB storage** for nested structures\n- **In-memory fallback** when `DATABASE_URL` unset (perfect for development & CI/CD)\n\n**Write-through pattern** ensures all state mutations (flows, sessions, daemons, hibernations) persist to PostgreSQL while maintaining fast in-process reads.\n\n#### Architectural Decisions\n\n**Storage Pattern: StorageDispatcher Enum**\n- Uses concrete dispatch via `StorageDispatcher` enum instead of `dyn Trait`\n- Enables zero-cost abstraction: `PostgresBackend` or `InMemoryBackend` at compile time\n- No runtime trait object overhead, full optimization from compiler\n\n**Async/Await Safety**\n- All storage operations are async, but never held across await points\n- Mutex locks are released before database I/O\n- Prevents deadlocks and enables high concurrency\n\n**Graceful Fallback**\n- Database connection failures don't crash the server\n- Automatic fallback to `InMemoryBackend` (with logging)\n- State persists in-memory for the process lifetime\n- Clients experience no service interruption\n\n---\n\n### Runtime Surface\n\n| Surface | Count |\n|---------|-------|\n| HTTP API routes | 285 |\n| Language primitives | 65+ (cognitive + Cognitive I/O) |\n| LLM backends | 7 (anthropic, openai, gemini, kimi, glm, openrouter, ollama) — native async, all streaming |\n| MCP tool types | 8 (flow, dataspace, axonstore, shield, corpus, compute, mandate, forge) |\n| MCP resource types | 10 (traces, metrics, backends, flows, dataspaces, axonstores, shields, corpora, mandates, forges) |\n| MCP workflow prompts | 5 (research, decide, secure_transfer, reflect, analyze_image) |\n| `axon-lang` (axon-rs) lib tests | 2,245 |\n| `axon-frontend` lib tests | 535 (incl. the session-type algebra + multiparty projection) |\n| `axon-csys` lib tests | 13 (Rust wrapper; C23 kernels exercised by `cargo test` + sanitizers/valgrind in CI) |\n| Rust workspace total | 2,793 — zero regressions |\n| Python wrapper tests | 16 (the thin PyPI wrapper that downloads + invokes the native binary; the interpreter was retired in v2.0.0) |\n| SQL tables | 12 (traces, sessions, daemons, audit_log, axon_stores, dataspaces, hibernations, event_history, execution_cache, cost_tracking, schedules, backend_registry) |\n| Performance indexes | 15 |\n\n### ΛD (Lambda Data) — Epistemic Guarantees\n\nEvery AXON operation carries a formal epistemic envelope ψ = ⟨T, V, E=⟨c, τ, ρ, δ⟩⟩:\n\n- **Theorem 5.1**: Only raw data may carry certainty c=1.0; all derived operations cap at c≤0.99\n- **Epistemic Lattice**: ⊥ ⊑ doubt ⊑ speculate ⊑ believe ⊑ know\n- **Blame Calculus**: CT-2 (caller) / CT-3 (server) / Network attribution on every error\n- **CSP**: MCP tools carry constraint satisfaction schemas\n\n### TypeScript SDK\n\n```typescript\nimport { AxonClient } from \"@axon/mcp-client\";\n\nconst client = new AxonClient({ baseUrl: \"http://localhost:3000\" });\nawait client.initialize();\n\n// Discover and call tools\nconst tools = await client.listTools();\nconst result = await client.callTool(\"axon_compute_evaluate\", { expression: \"pi * 2\" });\nconst envelope = AxonClient.extractEnvelope(result);\nconsole.log(envelope?.certainty); // 0.99 (transcendental → derived)\n\n// Read resources\nconst backends = await client.readResource(\"axon://backends\");\n\n// Get workflow prompts\nconst prompt = await client.getPrompt(\"workflow:research\", { question: \"How does attention work?\" });\n```\n\nFull language specification available on request.\n\n---\n\n## Paradigm Shifts\n\n> AXON's compiler-level paradigm shifts elevate the language from prompt\n> compilation to a Cognitive Operating System.\n\n### I. Formal Model — Epistemic Constraint Calculus\n\nEach program `P` in AXON operates over a typed epistemic lattice `(T, ≤)` where\nthe compiler enforces semantic constraints at compile time. The paradigm shifts\nextend this with three new formal mechanisms:\n\n**Epistemic Scoping Function.** Given an epistemic mode\n`m ∈ {know, believe,\nspeculate, doubt}`, the compiler applies a constraint\nfunction `C(m)` that maps to a tuple of LLM parameters and auto-injected\nanchors:\n\n```text\nC : Mode → (τ, p, A)\nwhere\n τ ∈ [0,1] — temperature override\n p ∈ [0,1] — nucleus sampling (top_p)\n A ⊆ Anchors — auto-injected constraint set\n\nC(know) = (0.1, 0.3, {RequiresCitation, NoHallucination})\nC(believe) = (0.3, 0.5, {NoHallucination})\nC(speculate) = (0.9, 0.95, ∅)\nC(doubt) = (0.2, 0.4, {RequiresCitation, SyllogismChecker})\n```\n\nThis is calculated **at compile time** — the IR carries the resolved constraint\nset, so the executor applies them as zero-cost runtime overrides.\n\n**Parallel DAG Scheduling.** A `par` block `B = {b₁, ..., bₙ}` where `n ≥ 2` is\nverified at compile time to have no data dependencies between branches:\n\n```text\n∀ bᵢ, bⱼ ∈ B, i ≠ j : deps(bᵢ) ∩ outputs(bⱼ) = ∅\n```\n\nAt runtime, branches execute via `asyncio.gather`, achieving `O(max(tᵢ))`\nlatency instead of `O(Σtᵢ)` for sequential chains.\n\n**CPS Continuation Points.** A `hibernate` node generates a deterministic\ncontinuation ID via `SHA-256(flow_name ∥ event_name ∥ source_position)`. The\nexecutor serializes the full `ExecutionState` (call stack, step results, context\nvariables) and halts. On `resume(continuation_id)`, the state is deserialized\nand execution continues from the exact IR node — implementing\nContinuation-Passing Style at the language level.\n\n### II. Design Philosophy — Programming Epistemic States\n\nTraditional LLM frameworks treat every model call identically — the same\ntemperature, the same constraints, the same trust level. This is the equivalent\nof asking a human to treat brainstorming and sworn testimony with the same\ncognitive rigor.\n\nAXON rejects this flat model. **Epistemic Directives** make the confidence state\nof the AI a first-class construct in the language:\n\n```axon\nknow {\n flow ExtractFacts(doc: Document) -> CitedFact {\n step Verify { ask: \"Extract only verifiable facts\" output: CitedFact }\n }\n}\n\nspeculate {\n flow Brainstorm(topic: String) -> Opinion {\n step Imagine { ask: \"What could be possible?\" output: Opinion }\n }\n}\n```\n\nThe compiler **does not merely label** these blocks — it structurally transforms\nthem. A `know` block injects citation anchors and drops temperature to 0.1,\nmaking hallucination a compile-time constraint violation. A `speculate` block\nremoves all constraints and raises temperature to 0.9, liberating the model.\n\n**Parallel Cognitive Dispatch** mirrors how human organizations work: delegate\nindependent analyses to specialists concurrently, then synthesize.\n\n**Dynamic State Yielding** transforms agents from expensive `while True` loops\ninto event-driven processes that can sleep for days, weeks, or months — then\nresume with full context. The language handles the serialization; the developer\nwrites `hibernate until \"event_name\"` and moves on.\n\n### III. Real-World Use Cases\n\n#### Use Case 1: Legal Document Analysis Pipeline\n\nA law firm needs to analyze contracts with maximum factual rigor, while also\nexploring creative legal strategies. AXON separates these cognitive modes at the\nlanguage level:\n\n```axon\nknow {\n flow ExtractClauses(contract: Document) -> ClauseMap {\n step Parse { probe contract for [parties, obligations, penalties] output: ClauseMap }\n }\n}\n\nflow AnalyzeRisk(contract: Document) -> StructuredReport {\n par {\n step Financial { ask: \"Analyze financial exposure\" output: RiskScore }\n step Regulatory { ask: \"Check regulatory compliance\" output: ComplianceReport }\n step Precedent { ask: \"Find relevant case law\" output: CaseList }\n }\n weave [Financial, Regulatory, Precedent] into Report { format: StructuredReport }\n}\n\nspeculate {\n flow ExploreStrategies(report: StructuredReport) -> Opinion {\n step Creative { ask: \"What unconventional strategies could mitigate these risks?\" output: Opinion }\n }\n}\n```\n\n- `know` guarantees citation-backed extraction (temperature 0.1)\n- `par` runs 3 analyses concurrently, reducing latency by ~3x\n- `speculate` explicitly relaxes constraints for creative strategy exploration\n\n#### Use Case 2: Multi-Agent Research & Intelligence System\n\nA BI platform deploys autonomous research agents that run for weeks, hibernating\nbetween data collection phases:\n\n```axon\nflow MarketIntelligence(sector: String) -> Report {\n know {\n flow GatherData(sector: String) -> DataSet {\n step Collect { ask: \"Gather verified market data\" output: DataSet }\n }\n }\n\n par {\n step Trends { ask: \"Identify emerging trends\" output: TrendAnalysis }\n step Competitors { ask: \"Map competitor landscape\" output: CompetitorMap }\n }\n\n hibernate until \"quarterly_data_available\"\n\n doubt {\n flow ValidateFindings(data: DataSet) -> ValidatedReport {\n step CrossCheck { ask: \"Challenge every assumption with evidence\" output: ValidatedReport }\n }\n }\n\n weave [Trends, Competitors] into Final { format: Report }\n}\n```\n\n- Agent hibernates after initial analysis, **costing $0 while waiting**\n- Resumes automatically when quarterly data arrives (webhook/cron)\n- `doubt` mode forces adversarial validation with syllogism checking\n\n#### Use Case 3: Autonomous Customer Support with Escalation\n\nA SaaS platform handles support tickets with different confidence requirements\nand automatic escalation via hibernate:\n\n```axon\npersona SupportAgent {\n domain: [\"product knowledge\", \"troubleshooting\"]\n tone: empathetic\n confidence_threshold: 0.8\n}\n\nflow HandleTicket(ticket: String) -> Resolution {\n know {\n flow DiagnoseIssue(ticket: String) -> Diagnosis {\n step Classify { ask: \"Classify the issue type and severity\" output: Diagnosis }\n }\n }\n\n believe {\n flow SuggestSolution(diagnosis: Diagnosis) -> Solution {\n step Solve { ask: \"Propose a solution based on known patterns\" output: Solution }\n }\n }\n\n if confidence < 0.7 -> hibernate until \"human_review_complete\"\n\n step Respond { ask: \"Draft customer response\" output: Resolution }\n}\n```\n\n- `know` classifies with strict accuracy (no guessing on severity)\n- `believe` suggests solutions with moderate confidence\n- Low confidence triggers `hibernate` — agent sleeps until a human reviews\n- Zero compute cost during human review; resumes with full context\n\n### IV. Directed Creative Synthesis — the `forge` Primitive\n\n> AXON introduces a sixth paradigm shift: **mathematical formalization of\n> the creative process** inside LLMs.\n\nThe industry suffers from a structural limitation: LLMs can interpolate, but\nthey struggle to _create_. `forge` addresses this by implementing a\ncompiler-level **Poincaré pipeline** — the same 4-phase process mathematicians\nand scientists use when producing genuinely novel work.\n\n**Poincaré-Hadamard Creative Pipeline.** A `forge` block orchestrates four\nsequential phases, each mapped to a distinct LLM configuration:\n\n```text\nforge(seed, mode, novelty, depth, branches) → result\n\nPhase 1: PREPARATION — Expand the seed via context probing\nPhase 2: INCUBATION — Speculative exploration (depth iterations)\nPhase 3: ILLUMINATION — Best-of-N consensus crystallization\nPhase 4: VERIFICATION — Adversarial doubt + anchor validation\n```\n\n**Boden Creativity Taxonomy.** The `mode` parameter maps Margaret Boden's three\ncreativity types (*The Creative Mind*, 1990) to concrete sampling-parameter\nprofiles at compile time:\n\n```text\nB : Mode → (τ_base, freedom, rule_flexibility)\n\nB(combinatorial) = (0.9, 0.8, 0.3) — novel recombination of known ideas\nB(exploratory) = (0.7, 0.6, 0.5) — structured navigation of possibility spaces\nB(transformational) = (1.2, 1.0, 0.9) — rule-breaking synthesis, new paradigms\n```\n\n**Novelty, measured — not asserted.** Kolmogorov complexity `K(x)` is\n*uncomputable*, so novelty cannot be computed exactly. `forge` measures it with\nthe **Normalized Compression Distance** — the standard *computable* approximation\nof the Normalized Information Distance, a universal metric grounded in Kolmogorov\ncomplexity (Li, Chen, Li, Ma, Vitányi, IEEE TIT 2004):\n\n```text\nNCD(x, y) = [C(xy) − min(C(x), C(y))] / max(C(x), C(y))\n\nν(output) = NCD(baseline, output) — how much of the output is NOT\n already implied by the obvious\n reading of the seed\n```\n\nThe `novelty` parameter (0.0–1.0) both blends the incubation temperature AND sets\nthe **fail-closed floor** the final output must clear:\n\n```text\nτ_eff = τ_base × (0.5 + 0.5 × novelty)\n\nnovelty = 0.0 → τ_eff = 0.5 × τ_base (conservative, high utility)\nnovelty = 1.0 → τ_eff = 1.0 × τ_base (maximum divergence, high surprise)\n```\n\n**Usage example — Directed Creative Synthesis:**\n\n```axon\nanchor GoldenRatio {\n require: aesthetic_harmony\n confidence_floor: 0.70\n}\n\nflow CreateVisualConcept(brief: String) -> Visual {\n forge Artwork(seed: \"aurora borealis over ancient ruins\") -> Visual {\n mode: transformational\n novelty: 0.85\n constraints: GoldenRatio\n depth: 4\n branches: 7\n }\n}\n\nrun CreateVisualConcept(\"Create a visual concept for a film poster\")\n```\n\nWhat the compiler does:\n\n1. **Preparation** — expands \"aurora borealis over ancient ruins\" into a rich\n conceptual foundation via context probing\n2. **Incubation** — runs 4 iterations of speculative exploration at\n `τ_eff = 1.2 × 0.925 = 1.11`, pushing beyond obvious associations\n3. **Illumination** — launches 7 parallel branches, each crystallizing the\n incubated ideas, then selects the most coherent output (Best-of-N)\n4. **Verification** — measures the winning branch's novelty ν = NCD(baseline,\n output) and enforces it **fail-closed**: if ν is below the floor set by\n `novelty`, the forge does NOT return a derivative result — it fails with a\n structured `forge.novelty_floor_breached` error. Only a synthesis that\n provably cleared the measured novelty floor (and its `GoldenRatio` anchor) is\n returned.\n\nThis is **not** a prompt template. `forge` compiles to structured IR metadata\n(`IRForgeBlock` — seed, mode, novelty, depth, branches, constraints) that the\nruntime executes as the orchestrated four-phase pipeline above, with a\n`ForgeSoundness` proof-carrying-code certificate checked at the deploy gate. And\nunlike every prompt-based \"creative mode,\" its novelty is **measured** (NCD) and\n**enforced fail-closed** — a derivative result is never passed off as creative.\n\n> **Honest scope.** `forge` synthesizes a typed *concept/specification*, not a\n> rendered artifact; \"novelty\" is novelty-relative-to-the-obvious-baseline (a\n> computable proxy for the uncomputable Kolmogorov novelty), not a claim of\n> absolute unprecedentedness.\n\n### V. Autonomous Goal-Seeking — the `agent` Primitive\n\n> AXON introduces a seventh paradigm shift: **compiler-verified autonomous\n> agents** grounded in the Belief-Desire-Intention (BDI) architecture, epistemic\n> logic, and coinductive semantics.\n\nEvery existing LLM framework implements agents as Python classes with ad-hoc\nwhile-loops, hidden state machines, and zero formal guarantees. LangChain's\n`AgentExecutor` is a runtime artifact — it cannot be statically analyzed, type-\nchecked, or budget-bounded at compile time. AXON's `agent` primitive makes\nautonomous goal-seeking a **first-class compiled construct** with mathematical\nsemantics.\n\n\n**BDI Coinductive Semantics.** An `agent` declaration compiles to a coinductive\nBDI system — a state machine whose behavior is defined by an infinite\nobservation/transition pair over the epistemic lattice:\n\n```text\nAgent ≅ ν X. (S × (Action → X))\n\nwhere\n S = Beliefs × Goals × Plans — cognitive state\n Action = Observe | Deliberate | Act | Reflect\n ν = greatest fixpoint (coinduction — runs indefinitely)\n```\n\nThe `ν` (nu) operator is the key: unlike inductive data (finite trees), a\ncoinductive agent is a potentially infinite stream of state transitions,\nterminating only when the goal is achieved or a budget is exhausted. This\nformalization is not decorative — it determines the compiler's verification\nstrategy and the executor's loop semantics.\n\n**Epistemic Lattice Convergence.** At each BDI cycle, the agent's epistemic\nstate is projected onto the same lattice `(T, ≤)` used by epistemic directives.\nThe deliberation phase produces a state `σ ∈ {know, believe, speculate, doubt}`\nand a boolean `goal_achieved`. The convergence criterion is:\n\n```text\nConverge(σ, g) = g = true ∧ σ ≥ believe\n\nDiverge(σ, i, n) = σ = doubt ∧ Δσ = 0 ∧ i ≥ n\n where\n Δσ = σᵢ - σᵢ₋₁ — epistemic progress between cycles\n i = current iteration\n n = stuck_window — consecutive stagnation threshold\n```\n\nWhen `Converge` fires, the agent terminates successfully. When `Diverge` fires,\nthe `on_stuck` recovery policy activates — `escalate` raises `AgentStuckError`,\n`forge` triggers creative re-seeding via the Poincaré pipeline, `retry` resets\nand re-attempts.\n\n**Budget Composition.** Budget constraints compose from the IR into the runtime\nas a 4-tuple verified at compile time:\n\n```text\nB(agent) = (max_iter, max_tokens, max_time, max_cost)\n\nTerminate when: ∃ b ∈ B(agent) : consumed(b) ≥ limit(b)\n```\n\nThe compiler rejects an agent with no termination bound: `max_iterations` is\nrequired and must be positive (`axon-T1216`) — whatever the `on_stuck` policy,\nan unbounded loop does not compile. `max_time` must be a duration it can read\n(`axon-T1220`: `500ms`, `30s`, `2m`, `1h`), and the runtime then enforces every\ndeclared bound before each deliberation — iterations, tokens, cost and wall\nclock alike. The `agent { }` block is a closed catalogue: a misspelled field is\na parse error, not a silently ignored setting.\n\n**Strategy Dispatch.** The `strategy` parameter selects the BDI loop variant at\ncompile time. Each strategy maps to a specific deliberation/action sequence:\n\n```text\nΛ : Strategy → CycleShape\n\nΛ(react) = Deliberate → Act → Observe\nΛ(reflexion) = Deliberate → Act → Observe → Reflect\nΛ(plan_and_execute) = Plan → (Act → Observe)* → Verify\nΛ(custom) = user-defined step sequence\n```\n\n**Usage example — Autonomous Research Agent:**\n\n```axon\npersona ResearchAnalyst {\n domain: [\"market research\", \"competitive analysis\"]\n tone: analytical\n confidence_threshold: 0.85\n}\n\ntool WebSearch {\n provider: http\n timeout: 10s\n}\n\ntool DataAnalyzer {\n provider: native\n timeout: 30s\n}\n\nagent MarketResearcher {\n goal: \"Produce a comprehensive competitive analysis report\n with verified data from at least 5 sources\"\n tools: [WebSearch, DataAnalyzer]\n strategy: react\n max_iterations: 15\n max_tokens: 50000\n max_cost: 2.50\n on_stuck: forge\n return: CompetitiveReport\n}\n\nflow CompetitiveIntelligence(sector: String) -> CompetitiveReport {\n step Research {\n MarketResearcher(sector)\n output: CompetitiveReport\n }\n}\n\nrun CompetitiveIntelligence(\"electric vehicles\")\n with ResearchAnalyst\n```\n\nWhat the compiler does:\n\n1. **Type checking** — the declaration must carry a positive `max_iterations`\n (`axon-T1216`), every tool in `tools:` must be declared, `strategy:` and\n `on_stuck:` come from closed catalogues, a `custom` strategy must carry the\n step sequence it runs (`axon-T1217`), `return:` must name a type and agree\n with the calling step's `output:` (`axon-T1219`), and `max_time:` must be a\n duration (`axon-T1220`). The call site `MarketResearcher(sector)` must name a\n declared agent (`axon-T1218`).\n2. **IR Generation** — the `agent` block compiles to an `IRAgent` node carrying\n goal, tools, the bounds (15 iter / 50k tokens / $2.50), strategy (`react`),\n recovery policy (`forge`), the return type and — for a declared struct type\n — its field schema; the call compiles to an `agent_call` node inside the\n step's body, preserving compositional semantics.\n3. **Runtime Execution** — the dispatcher's agent loop resolves the\n declaration (an undeclared agent is refused before any spend), then runs\n the strategy's control shape. Every deliberation goes through the same step\n core as any cognitive step (same wire events, audit row, cancellation and\n effect policy). Under `react` the model answers `ACT: ` or `ANSWER:\n `; a tool outside the agent's declared grant is refused and recorded,\n never dispatched. Every bound — iterations, tokens, cost, wall clock — is\n checked **before** each deliberation; when one bites, `on_stuck` decides.\n A declared return type is validated on the final answer.\n4. **Trace Events** — every deliberation is a step in the flow's wire events\n (`StepStart` / `StepComplete` under `:`, e.g.\n `MarketResearcher:react`), and every tool dispatch the agent makes is a\n step of its own, giving full observability into the reasoning trajectory.\n\n**Why this matters:** The agent is not a Python class that wraps `while True`.\nIt is a **compiled cognitive primitive** — the compiler verifies its budget\nboundedness (`axon-T1216`), refuses a call to an agent nobody declared\n(`axon-T1218`), and checks its return type (`axon-T1219`: `return:` must name a\ntype, and the step that calls the agent must declare the same `output:`); when\nthe return type is a declared `type`, the runtime validates the agent's final\nanswer against its fields and routes a non-conforming answer through\n`on_stuck` rather than calling it a result. The backend generates\nstrategy-specific prompts, and the runtime executes a formally-defined BDI loop\nwith epistemic convergence criteria. This is the difference between duct-taping\nan LLM into a loop and engineering an autonomous system with mathematical\nguarantees.\n\n#### Agent Use Case 1: Autonomous Legal Research Agent\n\nA law firm deploys an agent that autonomously researches case law until it finds\nsufficient precedent — or exhausts its budget and escalates to a human attorney:\n\n```axon\n// The tools this agent uses must EXIST: an agent naming a tool nobody\n// declared is an incomplete example, not a grammar gap.\ntool WebSearch {\n timeout: 10s\n}\n\ntool PDFExtractor {\n timeout: 30s\n}\n\nagent CaseLawResearcher {\n goal: \"Find 3+ relevant precedents for the contract dispute\n with verified court citations\"\n tools: [WebSearch, PDFExtractor]\n strategy: reflexion\n max_iterations: 20\n max_cost: 5.00\n on_stuck: escalate\n return: CaseLawReport\n}\n```\n\n- `reflexion` strategy adds self-critique after each cycle — the agent evaluates\n whether its found precedents are truly relevant, not just keyword matches\n- `on_stuck: escalate` means if the agent doubts its findings after 20 cycles,\n it raises `AgentStuckError` with full context, so the human reviews exactly\n where the agent got stuck\n- Budget cap of $5.00 prevents runaway API costs — the compiler guarantees\n termination\n\n#### Agent Use Case 2: Multi-Agent Data Pipeline\n\nA BI platform chains two agents: one gathers data, the other analyzes it.\nBoth execute within the same compiled flow:\n\n```axon\ntool WebSearch { provider: http timeout: 10s }\ntool FileReader { provider: native timeout: 5s }\ntool Calculator { provider: native }\ntool DataAnalyzer { provider: native timeout: 30s }\n\nagent DataGatherer {\n goal: \"Collect quarterly revenue data from public filings\"\n tools: [WebSearch, FileReader]\n strategy: react\n max_iterations: 10\n on_stuck: retry\n return: DataSet\n}\n\nagent TrendAnalyzer {\n goal: \"Identify year-over-year growth patterns and anomalies\"\n tools: [Calculator, DataAnalyzer]\n strategy: plan_and_execute\n max_iterations: 8\n on_stuck: forge\n return: TrendReport\n}\n\nflow QuarterlyIntelligence(sector: String) -> TrendReport {\n step Gather { DataGatherer(sector) output: DataSet }\n step Analyze { TrendAnalyzer(Gather.output) output: TrendReport }\n}\n```\n\n- Two agents, two strategies: `react` for data gathering (fast, tool-heavy),\n `plan_and_execute` for analysis (structured, plan-then-verify)\n- Each agent has independent budget tracking — if `DataGatherer` costs $0.50,\n `TrendAnalyzer` still has its full budget\n- If `TrendAnalyzer` gets stuck, `forge` triggers creative re-seeding via the\n Poincaré pipeline, generating novel analytical angles\n\n#### Agent Use Case 3: Customer Onboarding Agent with Dynamic Recovery\n\nA SaaS platform uses an agent to guide new customers through a personalized\nonboarding flow, adapting when it gets stuck:\n\n```axon\ntool APICall {\n timeout: 10s\n}\n\ntool Calculator {\n timeout: 5s\n}\n\npersona OnboardingSpecialist {\n domain: [\"product knowledge\", \"user experience\"]\n tone: empathetic\n confidence_threshold: 0.80\n}\n\ntype OnboardingReport {\n workspace: String\n tutorial_steps: List\n confidence: Float\n}\n\nagent OnboardingGuide {\n goal: \"Complete the customer's onboarding checklist with\n personalized recommendations for their industry\"\n tools: [APICall, Calculator]\n strategy: custom\n max_iterations: 12\n max_tokens: 30000\n on_stuck: forge\n return: OnboardingReport\n\n step Greet { ask: \"Welcome the user and assess their goals\" }\n step Configure { ask: \"Recommend workspace configuration\" }\n step Train { ask: \"Generate personalized tutorial sequence\" }\n}\n```\n\n- `custom` strategy: the agent follows a user-defined step sequence (Greet →\n Configure → Train), not a generic loop\n- `on_stuck: forge` — if the agent can't personalize recommendations (e.g.,\n unknown industry), it triggers creative synthesis to propose novel onboarding\n paths instead of failing\n- `custom` is the one strategy that carries a body: `strategy: custom` with no\n steps, or steps under any other strategy, is a compile error (`axon-T1217`)\n — a step sequence is never silently ignored\n- The `return: OnboardingReport` type is checked by the type checker (it must\n name a type, and a step calling the agent must agree on `output:`), and\n because `OnboardingReport` is a declared `type`, the runtime validates the\n agent's final answer against its fields — a structurally valid report, not\n just free text\n\n### VI. Compile-Time Security — the `shield` Primitive\n\n> AXON introduces an eighth paradigm shift: **Information Flow Control\n> (IFC) as a first-class compiled construct**, providing compile-time security\n> guarantees against LLM-specific attack vectors.\n\nEvery LLM framework treats security as an afterthought — runtime guardrails\nbolted on top of applications. AXON's `shield` primitive makes security a\n**compiler-verified property** of your program, grounded in taint analysis and\nInformation Flow Control theory.\n\n**Trust Lattice (Denning-style IFC).** The shield system operates over a trust\nlattice where data flows from untrusted sources through shield application\npoints to trusted sinks. The compiler statically verifies that every path from\nan untrusted source to a trusted sink passes through at least one shield:\n\n```text\nU : DataLabel → TrustLevel\n\nTrustLevel = Untrusted < Scanned < Sanitized < Trusted\n\n∀ path(source, sink) ∈ Flow :\n label(source) = Untrusted ∧ label(sink) = Trusted\n → ∃ shield ∈ path : label(shield.output) ≥ Sanitized\n```\n\n**Threat Taxonomy.** The `scan` field declares which threats the shield detects,\ndrawn from a formal taxonomy of 11 LLM attack categories:\n\n```text\nT = { prompt_injection, jailbreak, data_exfil, pii_leak, toxicity,\n bias, hallucination, code_injection, social_engineering,\n model_theft, training_poisoning }\n```\n\n**Detection Strategies.** The `strategy` parameter selects the detection\nmechanism, each with different cost/accuracy tradeoffs:\n\n```text\nΣ : Strategy → (Cost, Accuracy, Latency)\n\nΣ(pattern) = (low, medium, fast) — regex/heuristic scan\nΣ(classifier) = (medium, high, medium) — fine-tuned classifier (Llama Guard)\nΣ(dual_llm) = (high, highest, slow) — privileged/quarantined model pair\nΣ(canary) = (low, medium, fast) — traceable token injection\nΣ(perplexity) = (medium, high, medium) — statistical anomaly detection\nΣ(ensemble) = (high, highest, slow) — majority voting across multiple strategies\n```\n\n**Capability Enforcement.** The compiler statically verifies that agent tool\naccess is a subset of the shield's allow list — preventing privilege escalation\nat compile time:\n\n```text\n∀ agent A with shield S :\n tools(A) ⊆ allow_tools(S) — verified at compile time\n tools(A) ∩ deny_tools(S) = ∅ — also verified\n```\n\n**Usage example — LLM Input Shield:**\n\n```axon\ntool WebSearch { provider: http timeout: 10s }\ntool Calculator { provider: native }\n\nshield InputGuard {\n scan: [prompt_injection, jailbreak, pii_leak]\n strategy: dual_llm\n on_breach: halt\n severity: critical\n allow_tools: [WebSearch, Calculator]\n deny_tools: [code_executor]\n sandbox: true\n redact: [email, phone]\n confidence_threshold: 0.85\n}\n\npersona SecureAssistant {\n domain: [\"customer support\"]\n tone: formal\n confidence_threshold: 0.80\n}\n\nagent SecureBot {\n goal: \"Answer customer queries safely\"\n tools: [WebSearch, Calculator]\n shield: InputGuard\n strategy: react\n max_iterations: 10\n return: SafeResponse\n}\n\nflow SecureSupport(query: String) -> SafeResponse {\n shield InputGuard on query -> SanitizedQuery\n step Process {\n SecureBot(SanitizedQuery)\n output: SafeResponse\n }\n}\n\nrun SecureSupport(\"Help me with my account\")\n with SecureAssistant\n```\n\nWhat the compiler does:\n\n1. **Type Checking** — validates all scan categories, strategies, breach\n policies, severity levels, and confidence thresholds. Detects allow/deny\n overlaps and invalid configurations at compile time.\n2. **Capability Enforcement** — verifies that `SecureBot` only uses\n `[web_search, calculator]` which are in `InputGuard.allow`, and that\n neither appears in `deny`. If `SecureBot` tried to use `code_executor`,\n the compiler would reject the program.\n3. **Taint Analysis** — verifies that `query` (untrusted) passes through\n `shield InputGuard on query` before reaching the agent's trusted context.\n4. **Runtime Execution** — the shield step emits `SHIELD_SCAN_START`,\n scans for prompt injection/jailbreak/PII, and either passes\n (`SHIELD_SCAN_PASS`) or raises `ShieldBreachError` (`SHIELD_SCAN_BREACH`).\n\n#### Shield Use Case 1: Financial Data Pipeline with PII Redaction\n\n```axon\nshield DataShield {\n scan: [pii_leak, data_exfil]\n strategy: classifier\n on_breach: sanitize_and_retry\n max_retries: 3\n severity: high\n redact: [ssn, credit_card, bank_account]\n}\n\nflow ProcessFinancialQuery(input: String) -> Report {\n shield DataShield on input -> CleanInput\n step Analyze {\n given: CleanInput\n ask: \"Analyze the financial data\"\n output: Report\n }\n}\n```\n\n- PII fields (SSN, credit card, bank account) are auto-redacted **before** the\n LLM sees the data\n- `sanitize_and_retry` means detected threats are cleaned and re-scanned up to\n 3 times, not just blocked\n- The compiler guarantees the LLM never processes raw PII\n\n#### Shield Use Case 2: Multi-Agent System with Capability Isolation\n\n```axon\nshield ResearchShield {\n scan: [data_exfil, model_theft]\n strategy: ensemble\n on_breach: quarantine\n allow: [web_search, file_reader]\n deny: [code_executor, api_call]\n sandbox: true\n}\n\ntool web_search {\n timeout: 10s\n}\n\ntool file_reader {\n timeout: 10s\n}\n\nagent Researcher {\n goal: \"Gather market intelligence from public sources\"\n tools: [web_search, file_reader]\n shield: ResearchShield\n strategy: reflexion\n max_iterations: 15\n return: IntelligenceReport\n}\n```\n\n- `ensemble` strategy runs multiple detectors with majority voting — highest\n accuracy for sensitive operations\n- `sandbox: true` runs tool execution in an isolated environment\n- Capability enforcement: the compiler rejects any agent that tries to use\n `code_executor` or `api_call` — preventing privilege escalation by design\n- `quarantine` breach policy isolates suspicious data for human review instead\n of blocking operations\n\n### VII. Epistemic Tool Fortification — Streaming, Effects & ","changelogMarkdown","videoKey","requiredSecretsJson","publishedAt","priceCents","trialDays",0,"iconType","image","upstream",{"_95":96,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106},"requiredSecrets",[],"tags",[],"assets",[],"stats",{"_93":80,"_94":80},"ratingAvg","reviewCount","topics",[],"license","AGPL-3.0","language","Rust","registryName","com.ricardovelit/axon-emcp","homepage","https://crates.io/crates/axon-emcp","packages",[],"ENV",{"_109":110,"_111":112,"_113":114},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]