Whitepaper/cgae v1.0.0

START_HERE.md

@@ -1,231 +1,235 @@
-# **START HERE — What Keon Is and Why It Exists**  
+# START HERE
 
-## OMEGA Whitepaper
+## Keon: Governance Substrate for Verifiable AI Execution
 
-- **OMEGA Governed Execution Whitepaper (Markdown):** [omega-docs/whitepapers/omega-governed-execution.md](https://github.com/omega-brands/omega-docs/blob/main/whitepapers/omega-governed-execution.md)
-- **OMEGA Governed Execution Whitepaper (PDF):** [omega-docs/assets/whitepapers/omega-governed-execution.pdf](https://github.com/omega-brands/omega-docs/blob/main/assets/whitepapers/omega-governed-execution.pdf)
+Keon is not an AI system.
 
-**Keon turns AI-triggered actions into court-defensible, independently verifiable proof — before a single line of code ever runs in production.**
+It does not generate plans.
+It does not execute workflows.
+It does not reason with LLMs.
 
-**30-second summary**  
-Keon is the **governance and forensic substrate** for AI-assisted systems where decisions cause real execution.
+Keon governs execution.
 
-It enforces policy **before execution**, records **explicit authority**, and produces **verifiable evidence packs** that survive audit, investigation, e-discovery, and courtroom scrutiny.
+Specifically, it governs:
 
-> **Execution proposes. Governance decides. Receipts prove.**
+* Whether actions are authorized
+* Under which policy and version
+* Within which tenant and authority boundary
+* With what verifiable evidence
+* And, when applicable, how human-facing expression complies with declared behavioral policy
+
+If governance is missing, ambiguous, or unverifiable — execution does not occur.
 
 ---
 
-## The problem Keon solves
+# The Problem Keon Solves
 
-AI has crossed from advisory → **operational**.
+AI systems increasingly trigger actions with material consequence:
 
-Today AI systems:
+* Infrastructure deployment
+* Account modification
+* Automated enforcement
+* Policy execution
+* Customer-facing decisions
 
-- deploy infrastructure
-- modify accounts & permissions
-- trigger workflows
-- make decisions with legal / financial / safety consequences
+Most governance approaches focus on:
 
-Most “AI governance” tools stop at:
+* Logging
+* Monitoring
+* Prompt controls
+* After-the-fact review
 
-- prompt safety
-- alignment
-- real-time monitoring
-- post-hoc logs
+Keon addresses a different class of problem:
 
-They collapse when the real questions arrive months or years later:
+> How do you prove that an AI-assisted action was authorized, policy-compliant, and executed under accountable authority — long after it occurred?
 
-> *Who authorized this change?*  
-> *Under which ratified policy version?*  
-> *What exact evidence was evaluated?*  
-> *Can this decision be independently reproduced and verified?*
+This is a forensics problem.
 
-That’s **not observability**.  
-That’s a **forensics & accountability gap**.
+Not observability.
+Not alignment.
+Forensics.
 
 ---
 
-## What Keon actually is
+# The Governance Boundary
+
+Keon sits between intent and execution.
+
+**Intent → Authorization → Receipt → Execution → Evidence**
 
-Keon is the **decision governance layer** between intent and execution.
+Every governed action produces:
 
-It enforces one mechanical boundary:
+* An explicit authorization decision
+* A cryptographic receipt
+* A deterministic record
+* A verifiable evidence artifact
 
-**Decision → Authorization → Receipt → Execution → Evidence**
+Execution systems cannot bypass this boundary.
+
+---
 
-Every governed action must produce:
+# Operational Governance
 
-- explicit authorization decision
-- cryptographic receipt
-- tamper-evident audit trail
-- verifiable **evidence pack** suitable for forensic review
+Operational governance ensures:
 
-No valid receipt? → **No execution**.
+* Intent is explicit and canonicalized
+* Policy is enforced before execution
+* Authority is cryptographically bound
+* Artifacts are deterministic and immutable
+* Evidence is independently verifiable
 
-```mermaid
-flowchart LR
-    A[AI / System Proposal] --> B[Keon Authorization]
-    B -->|Valid Receipt| C[Execution Allowed]
-    B -->|No / Invalid Receipt| D[Execution Blocked]
-    C --> E[Evidence Pack Sealed]
-    style B fill:#d32f2f,stroke:#fff,stroke-width:2px
-```
+Logs describe what happened.
 
+Keon proves whether it was allowed.
 
 ---
 
-## What Keon is **not**
+# Behavioral Governance
 
-Keon stays narrow by design. It does **not**:
+As AI systems increasingly communicate directly with humans, governance must extend beyond action into expression.
 
-- reason with LLMs
-- generate plans / workflows
-- initiate actions
-- execute anything
-- replace your compliance program
-- pretend to be a lawyer
+Keon supports governance of human-facing expression under declared Behavioral Policy.
 
-Keon exists to make **execution provable** — full stop.
+Behavioral governance may include:
 
----
+* Declared archetype constraints
+* Lexical and structural framing rules
+* Emotional calibration bounds
+* Agency preservation requirements
+* Fail-closed enforcement modes
 
-## Governed execution — the core mental model
+Human-facing output may pass through a Behavioral Evaluation Gate before exposure.
 
-- AI outputs = **requests**, never commands
-- Execution = **fail-closed** by default
-- Authority = **explicit & attributable**, never implied
-- Evidence = **first-class deliverable**
+Behavioral evaluation may produce receipts that bind expression to policy version and execution context.
 
-This model lets organizations answer the questions regulators, auditors, lawyers, and incident responders actually ask:
+Governance therefore applies to both:
 
-- Who approved this?
-- Under what policy version?
-- What was the evidence at decision time?
-- What would have happened if auth failed?
-- Can a third party verify the entire chain?
+* What systems do
+* How they present themselves while doing it
 
 ---
 
-## Evidence Packs — digital forensics by design
+# Separation of Powers
+
+Keon is a governance substrate.
 
-The atomic unit of truth in Keon is the **Evidence Pack**.
+Execution systems:
 
-Each pack is a tamper-evident bundle containing:
+* Propose actions
+* Request authorization
+* Execute only when receipted
 
-- **Decision** — what was requested
-- **Policy** — what governed evaluation
-- **Authority** — who/what approved it
-- **Execution** — what actually ran
-- **Proof** — cryptographic receipts chaining everything
+Keon:
 
-Properties:
+* Evaluates policy
+* Issues receipts
+* Records deterministic evidence
+* Enables independent verification
 
-- human-readable JSON + binary receipts
-- machine-verifiable signatures
-- immutable once sealed
-- long-term retention ready
-- exportable for legal / audit use
+Keon does not execute.
 
-Sealed packs live in the **Keon Evidence Vault** (append-only).
+Execution systems do not self-authorize.
+
+This separation prevents silent privilege escalation and unverifiable action.
 
 ---
 
-## Digital forensics & post-incident reconstruction
+# Lifecycle Governance
+
+Keon governs more than individual decisions.
 
-Keon artifacts let investigators reconstruct:
+It governs lifecycle events:
 
-- Proposed decision
-- Governing policy snapshot
-- Authorization chain (human or system)
-- Execution timeline
-- Evidence evaluated at decision time
-- Alternate outcomes under different auth conditions
+* Governed Birth (entity creation under explicit authority)
+* Governed Death (receipt-bound termination with lineage)
+* Governed Automation (policy-triggered actions with fail-closed semantics)
 
-Designed for environments where **explainability must last years**, not just real-time dashboards.
+Lifecycle governance ensures no entity exists, changes state, or terminates without attributable authority.
 
 ---
 
-## Lifecycle governance — birth, death, and automation
+# Evidence Model
 
-Keon doesn't only govern point-in-time decisions. It governs the **full lifecycle** of autonomous digital entities.
+Keon produces:
 
-**Governed Birth** — Entity creation requires explicit authority. Every entity begins with a receipt-bound genesis event. No entity exists without a governed creation record.
+* Cryptographically bound receipts
+* Deterministic manifests
+* Verifiable evidence packs
+* Tamper-evident artifact chains
 
-**Governed Death** — Revocation and termination produce immutable lineage. No death without birth (prevents phantom entities). No double-death (prevents state corruption). Receipt chains link creation → termination with no gaps.
+Evidence is portable.
 
-**Governed Automation** — Policies can trigger automatic governance actions, but always with accountability:
+Verification does not require trust in the operator.
 
-- Severity gradation: RECOMMEND → AUTO_REVOKE → AUTO_TERMINATE
-- Human gate enforcement for irreversible actions
-- Cooldown periods to prevent policy flapping
-- Fail-closed: ambiguous or incomplete context defaults to NO_ACTION
-- Full attribution: policy ID, version, automation flag, and trigger events
+---
+
+# Who Should Read This Repository
+
+This repository is designed for:
 
-> *Machines may act automatically — but Keon can always prove why, under whose authority, and with what limits.*
+* Platform engineers
+* AI infrastructure teams
+* Security and compliance professionals
+* Digital forensic investigators
+* Audit and risk teams
+* Legal and investigative functions
+
+If your system may be examined under audit, regulatory review, or litigation, this model is relevant.
 
 ---
 
-## Governance surfaces
+# How to Navigate This Repository
 
-### Keon Control (human governance surface)
+Recommended order:
 
-Cross-system view for:
+1. **Conceptual Foundation**
 
-- policy lifecycle
-- receipt & evidence exploration
-- audit console
-- forensic review
-- compliance oversight
+   * Governance model
+   * Separation of powers
+   * Receipt architecture
 
-Iron rule:  
-**Keon never executes. Keon decides. Applications observe — they never govern.**
+2. **Whitepapers**
 
----
+   * Cryptographically Governed AI Execution (CGAE)
+   * Canonical documentation
 
-## Relationship to governed systems (e.g. OMEGA)
+3. **Lifecycle Governance**
 
-Keon does **not** run code.
+   * Birth
+   * Death
+   * Automation
 
-Governed runtimes integrate Keon to:
+4. **Proof Campaigns**
 
-- request authorization
-- receive decisions + obligations
-- emit receipts
-- preserve evidence packs
-- prove compliance later
+   * Sealed artifacts
+   * Verification harnesses
+   * Independent reproducibility
 
-> **Keon decides.  
-> Governed systems execute.  
-> Receipts prove.**
+5. **UI and Governance Interfaces**
+
+   * Courtroom
+   * Evidence export
+   * Auditor walkthrough
+
+If a claim cannot be traced to code, a tag, or a proof artifact, treat it as incomplete.
 
 ---
 
-## Choose your path
+# What This Repository Is Not
 
-| Goal                              | Time       | Start here                                                   |
-|-----------------------------------|------------|--------------------------------------------------------------|
-| Understand Keon quickly           | 5–10 min   | This page                                                    |
-| Grasp the full architecture       | 15–30 min  | [CGAE v1.0.0 (canonical whitepaper)](./docs/whitepapers/cgae/v1.0.0.md) |
-| Explore the full whitepaper library | 30 min     | [Whitepapers index (canonical + archive)](./docs/whitepapers/index.md) |
-| Verify every public claim         | 30–60 min  | [Claims Registry](./canon/CLAIMS_REGISTRY.yaml) [KS-EVIDENCE-004] |
-| See real production usage         | 30+ min    | [OMEGA](https://github.com/m0r6aN/omega-docs)                |
-| Audit / forensic deep-dive        | 1–2 hrs    | [Proof maps + sealed Evidence Packs](./EVIDENCE/README.md)   |
-| Verify proven capabilities        | 15–30 min  | [Proof Campaign Status](https://github.com/m0r6aN/omega-docs/blob/main/REPORT/PROOFS/PROOF_CAMPAIGN_STATUS.md) |
+This is not:
 
+* A marketing site
+* A feature list
+* A philosophical alignment manifesto
+
+It is documentation for a governance substrate designed to make execution and expression provable.
 
 ---
 
-## Design principles (non-negotiable)
+# One-Line Summary
 
-- Proof over promises
-- Explicit authority over implicit trust
-- Fail-closed by default
-- Determinism over heuristics
-- Forensic defensibility over narrative comfort
+Keon makes execution and human-facing AI behavior provable — before, during, and after action.
 
 ---
 
-**One-line truth**
-
-> **Keon makes execution provable — from creation through termination, even when lawyers and regulators are watching.**

content/evidence-packs/v1/README.md

@@ -0,0 +1,17 @@
+# Evidence Pack Samples (v1)
+
+Canonical downloadable sample Evidence Packs for the website tour.
+
+- `evidence-pack.v1.latest.zip`: website download target (always current)
+- `evidence-pack.v1.YYYY-MM-DD.zip`: immutable dated snapshot(s)
+- `manifest.json`: mirror of the downloadable evidence-pack manifest (`manifestVersion = "1"`)
+- `checksums.txt`: mirror of generated downloadable artifact checksums
+- `signer-public-key.b64`: public key used to verify pack attestations
+- `trust-bundle.json`: trust bundle used for AuthorizationValid verification
+
+Notes:
+- The ZIP sample is generated from `EvidencePackService.CreateAsync(...)`.
+- It is wrapped in the minimal legacy attested manifest shape (`version = "v1"`) so the current verifier can validate it end-to-end.
+- `manifestVersion = "1"` remains present in the verifier-visible `manifest.json` as the downloadable evidence-pack schema signal.
+
+Last refreshed: 2026-02-26