CivOS
Protected Local Substrate
Ring −1 // Hardware-abstracted substrate
Protected local substrate operating beneath the visible application layer. It is designed to sustain power resilience, sensor continuity, survival behavior, and fail-closed device operation when ordinary software assumptions break down. It is the on-device substrate the rest of the stack depends on.
- Ring −1 / secure enclave assumptions
- Iron Lung degradation protocol
- No data exfiltration; identity-free survival
TSARO
Threat Engine & Oracle
Deterministic safe-set computation // Binary admissibility // Threat oracle
TSARO is the threat engine and oracle: it formalizes deterministic safe sets and enforces binary admissibility — ADMIT or HALT, with no probability weighting. Every threat assessment in the stack is TSARO's output. It is not grouped with SOS or SSI — it is the foundational oracle they depend on.
- Safe set monotonically contracts, never expands under threat
- UNKNOWN state → immediate transition to halt
- Sole source of threat-state truth for all layers above
SOS
Sovereign Emergency Protection
Local-first // Coercion-aware // Multi-transport mesh
Sovereign emergency communications and civilian protection. Local-first operation survives infrastructure collapse. Coercion-resistant escalation paths. Multi-transport mesh: BLE, UWB, WiFi NAN, LoRa, LEO satellite. Consumes TSARO threat state and NICOLE evidence integrity — it does not duplicate their function.
- Protection survives network and infrastructure failure
- Covert and silent escalation are first-class modes
- Evidence chain preserved through NICOLE, not duplicated
SSI
Sovereign Safety Intelligence
Physiological load // Hazard proximity // Career-long biological accounting
Physics-first biometric load monitoring, hazard recognition, and career-long biological accounting for high-load occupational contexts. Applies TSARO safe-set logic to biomechanical and physiological domains. Data remains athlete-governed — institutional access is bounded, purposeful, and revocable.
- Session-bounded — no persistent injury profile shared by default
- Vector-only output — no diagnostic labels, no adjectives
- Silence is a first-class signal when data is uncertain
NICOLE
Cryptographic Lifecycle
Key separation // Evidence integrity // Cryptographic expiration
LAKANA's key separation, evidence integrity, and protected data-lifecycle layer. Expired protected data is designed to become permanently unrecoverable through irreversible cryptographic invalidation rather than ordinary file deletion — structural privacy, not policy privacy.
- Split-key sovereignty across distinct trust roles
- Manufacturer zero-knowledge: no escrow path exists
- Specified for future open auditable standardization pathways as appropriate
W-X / WX-Ag
Environmental Truth
Atmospheric // Agronomic // TTL-bounded physics claims
Deterministic truth pipeline for atmospheric, geological, acoustic, and electromagnetic domains. WX-Ag extends to soil, canopy, and agronomic machinery. Active Entropy decays stale variables to UNKNOWN rather than holding last-known state. Truth Isolation prohibits any directive output.
- Cannot emit "evacuate," "unsafe," or any behavioral directive
- Stale claim decays to UNKNOWN — not last-known value
- Planned field-validation pathway identified for 2026
S-V2X / S-V2K
Resilient Transport Continuity
Resilient continuity // Identity-minimized transport // RF-silence posture
S-V2X and S-V2K describe LAKANA's resilient transport continuity posture across degraded conditions. S-V2K remains a distinct, identity-minimized kinetic subset for present-state motion sharing when necessary. Under hostile conditions, the transport layer is designed to collapse toward silent or minimally identifying operation.
- S-V2K remains distinct from broader transport continuity functions
- Silent transport posture is a first-class protective mode
- Continuity is designed to minimize durable identifiers
UEI
User Exo Interface
Constitutional interaction mediation // Cognitive sovereignty // Presentation only
Canonical rendering layer mediating how information is presented to the user while preserving cognitive sovereignty. UEI can impose bounded interaction governance and user-protective interface constraints, but it governs presentation only — it may never modify truth-layer output or reinterpret physical claims.
- Interaction is bounded by constitutional presentation rules
- User-protective mediation cannot become a command authority
- Presentation logic cannot authorize lower-layer safety actuation
PSAI
Personal Sovereign AI — Cognitive Sovereignty Stack
Standalone system: TSARO + NICOLE + UEI // Personal cognitive sovereignty // No physical actuation, ever
PSAI is a standalone sovereign system — the composition of TSARO (threat oracle), NICOLE (cryptographic sovereignty), and UEI (cognitive interface) operating together as a personal AI that sees one human deeply, lawfully, and privately. It provides capability parity with surveillance-scale AI without adopting surveillance methods. PSAI possesses intelligence without authority; UEI possesses authority without intelligence. This separation is absolute.
- PSAI = TSARO + NICOLE + UEI — the cognitive sovereignty triad
- Advisory only — may never actuate physical systems or override safety layers
- User holds the termination key — sovereignty includes the right to silence