thesmos

Why it exists

Every running system has to answer one question — who may do what? — and most answer it with a claim you have to trust: an access-control list, a token, a service that says yes. thesmos answers it the way the rest of the stack answers questions: with an account anyone can re-verify. It owns the authority vocabulary — the trust anchor (is_root, exactly one authority), the fact that carries its own warrant (signed_fact, signed with Ed25519), delegation (grant), and the one thing a rule may conclude (authorized) — together with the law that ties them together: the program that derives authorized from the root through a chain of grants, each gated by what it covers.

It is not a set of interfaces. The interfaces belong to logos — Theory, LeafVerifier, RuleAdmissibility. thesmos implements them, with real logic, as three cores (Go, Rust, TypeScript) pinned byte-for-byte by a shared conformance oracle.

A concrete example

A fact lives in the system as a signed_fact — a signer, a space, a predicate, and a body, carrying its own Ed25519 signature. To decide whether some request is authorized, thesmos builds the canonical proof: the cited signed facts, the grants that delegate authority from the root, and the covers_* clauses that say each grant actually reaches this op, predicate, and pattern. It then runs logos's check() over that derivation. The thesmos verify --authorize CLI does exactly this for a scenario and prints authorized, or reject: <code>: <detail> — a named reason like not_visible_in_projection when a cited fact isn't visible from the target space, never a silent denial.

Nothing here is taken on faith. thesmos never searches for the proof; it only checks one it is handed.

What it unlocks

Because thesmos invents no value model and no engine, it composes cleanly with the rest of the stack. A fact's body is an ontos value; a clause is a logos clause; admission is logos's check(). That keeps the law portable: the same authorization program, serialized once to canonical bytes, loads identically into all three cores.

The runtime that searches for authorization proofs — and stores the facts — is the sibling stele service, which drives logos's engine and applies thesmos's law as its check gate. thesmos is the law that runtime enforces. See where it sits in the stack.

What's next

The signature tier (tier-a) is the surface in production admission today. The freshness tier (tier-b) — whether every cited leaf is still active at a frontier — is split produces-vs-verifies: thesmos already ships the portable verifier (FreshnessVerifier over the active_leaf relation, with its merkle-inclusion-v1 proof primitive), while the active-set producer that emits signed heads stays in stele. The canonical production root is still a clearly-marked public placeholder; the real key is value-swapped in later via a key-generation ceremony in stele, with the format and every consuming mechanism unchanged.