What travels — envelopes move information

People often land on this page because the diagrams look clean — and still wonder what is actually moving. The answer is the envelope.

Real-world source of the idea. Paper mail: a letter carries a message; the envelope is the boundary and the addressing. In computing, HTTP requests, message-bus events, and gRPC calls are the same pattern — metadata + payload crossing a trust boundary. SECS hardens that pattern: the payload may only contain signals the decision needs; identity keys are structurally excluded, not merely “discouraged by policy.”

How an envelope is created. Almost never inside the substrate itself. An adaptor sits next to the real system (robot controller, WMS, clinic device gateway, labour-hire roster). It reads sensors and business events, strips forbidden fields, packages allowlisted signals, and often signs a certificate that binds that vertical’s doctrine. A human may fill a UI; the machine still only sees the envelope.

Robotics soak example. A manufacturing cell runs under load for hours. Torque, temperature, cycle count, and e-stop state are continuous signals. Those are not “who is logged into the HMI.” The adaptor builds an envelope each window. If the packet is well-formed and doctrine-aligned, the substrate can emit a governed decision (continue soak / hold cell / require human override). If identity leaks or required signals are missing, the packet is annihilated — the robot does not get a half-approved command.

You can practice building envelopes on the Sovereign Terminal (briefing included) or The Game. Same gate as production adaptors on secs-sovereign.fly.dev.

What this achieves in the real world

Architecture is not the product. The product is predictable, auditable action under pressure.

In short: envelopes move the information the decision needs; the constitution decides whether that information may become action; extinction returns the substrate to purity so the next cycle does not inherit half-state.

System Layers

Every envelope’s signal travels one path, top to bottom. External sources hit a physics-only perimeter; the Go Atom kernel dispatches; the TypeScript runtime runs the collapse chain; governance and topology bound what may change; the neurotrophic slow path observes without blocking.

flowchart TB
    EXT["External World"] --> PERIM["Perimeter / Connector"]
    PERIM --> ATOM["Atom kernel — Go"]
    ATOM --> PIPE["Collapse pipeline α ν λ ρ ε"]
    PIPE --> GOV["Governance G₀…G₄ + topology"]
    GOV --> NEURO["Neurotrophic slow path A–E"]
    NEURO -.->|"bounded feedback"| PIPE
    PIPE --> ADP["Adaptors STABLE / VOLATILE"]
    ADP --> EXT

    classDef layer fill:#141820,stroke:#00B2FF,color:#e0e2e8
    class EXT,PERIM,ATOM,PIPE,GOV,NEURO,ADP layer
                        

flowchart TB
    subgraph EXT["External World"]
        RT["Real-time streams"]
        SIM["Simulation / test"]
        HUM["Human overrides"]
        DOM["Domain systems"]
    end
    subgraph BOUNDARY["Ingress — physics only"]
        PERIM["Perimeter Engine"]
    end
    RT --> PERIM
    SIM --> PERIM
    HUM --> PERIM
    DOM --> PERIM
    PERIM -->|"admissible sparks"| CONN["Connector / Atom"]

    classDef ext fill:#161920,stroke:#00B2FF,color:#e0e2e8
    classDef gate fill:#1a2418,stroke:#48e662,color:#dfffe5
    class EXT ext
    class BOUNDARY,PERIM gate
                        

flowchart LR
    subgraph INGRESS["Connector"]
        CONN["Connector Atom"]
        IDBAN["13 forbidden fields stripped"]
    end
    subgraph ATOM["Atom kernel — Go"]
        BOOT["Load doctrine"]
        DISP["Dispatch · 7.05 ns/op"]
    end
    subgraph RUNTIME["Substrate — TypeScript"]
        SUB["Spark · Accept · Route · React · Extinguish · Emit"]
    end
    CONN --> IDBAN --> BOOT --> DISP --> SUB

    classDef go fill:#1a1f14,stroke:#48e662,color:#e0e2e8
    classDef ts fill:#141820,stroke:#00B2FF,color:#e0e2e8
    class ATOM,BOOT,DISP go
    class RUNTIME,SUB ts
                        

Collapse Pipeline

Plain language: the envelope arrives (Spark). The gate checks whether it is allowed at all (α). If yes, the payload is made well-formed (ν), sent down exactly one path (λ), reacted on (ρ), then wiped clean so nothing sticky remains (ε). Finally a signed proof is emitted. If any constitutional check fails, the packet is vetoed — annihilated, not queued for a softer second try.

Operators: Spark through Emit — the same emit chain as Sovereign. Greek operators (ανλρε) name the irreversible transforms inside Accept–Extinguish. Each signal traverses once and exits as resolved output, governance proof, or structural veto.

flowchart LR
    SPARK["Spark in"] --> ALPHA["α Admissibility"]
    ALPHA -->|pass| NU["ν Validation"]
    ALPHA -->|veto| V1["v₁…v₆ partition"]
    NU --> LAM["λ Routing"]
    LAM --> RHO["ρ Reaction"]
    RHO --> EPS["ε Extinction"]
    EPS --> EMIT["Emit proof"]

    classDef pipe fill:#121820,stroke:#00B2FF,color:#e0e2e8
    classDef veto fill:#2a1212,stroke:#FF5E00,color:#ffd8c8
    class SPARK,ALPHA,NU,LAM,RHO,EPS,EMIT pipe
    class V1 veto
                        

Diagram above is the canonical path; hover each step for operator-level detail.

C² = C — collapse is a projection.
C¹⁻ ∄ — irreversible at every stage.
Vetoed signals are structurally impossible, not filtered or retried.

Exhaustive Veto Partition

Per the Collapse Algebra and Governance Veto Matrix: six classes partition every inadmissible input. No unclassified failures. Severity lattice v₅ ≻ v₁ ≻ v₄ ≻ v₃ ≻ v₂ ≻ v₆. Full definitions on the Glossary.

Governance Filtration

Constitutional layers. Each inherits constraints from below. Doctrine loaded at boot, immutable at runtime. No runtime self-modification of governance rules. G₀–G₄ here follows the SECS hierarchy (Principles → Algebra → SAC Axioms → Surface → Envelopes); the six veto classes above are the exhaustive partition at the admissibility gate, not a four-way summary.

flowchart TB
    subgraph GOV["Governance filtration G₀ ⊆ G₁ ⊆ G₂ ⊆ G₃ ⊆ G₄"]
        G0["G₀ Principles"] --> G1["G₁ Algebra"] --> G2["G₂ Axioms"] --> G3["G₃ Surface"] --> G4["G₄ Envelopes"]
    end
    subgraph SURFACES["Runtime surfaces"]
        FROZEN["Constraint surface — FROZEN"]
        MUTABLE["Adaptation surface — MUTABLE"]
    end
    subgraph TOPO["Topology seed graph"]
        S1["Seed A"] <-->|"governed adjacency"| S2
        S2 <-->|"governed adjacency"| S3["Seed C"]
    end
    G4 --> FROZEN
    FROZEN -.->|"bounds"| MUTABLE
    FROZEN --> TOPO

    classDef gov fill:#1f1814,stroke:#FF5E00,color:#e0e2e8
    classDef topo fill:#141820,stroke:#00B2FF,color:#e0e2e8
    class GOV,G0,G1,G2,G3,G4,FROZEN gov
    class MUTABLE,TOPO,S1,S2,S3 topo
                        

Example: FROZEN — HOSTILE classifications require human override before release. MUTABLE — anomalyThreshold may be tuned within adaptor bounds, not bypassed.

Neurotrophic Layer — Governed Adaptation Live Jun 2026

The neurotrophic layer sits above the fast path and observes its output. It never interrupts the fast path. It learns from it, adapts parameters within bounds, and feeds changes back — but the fast path continues running unchanged through every adaptation cycle. Phase E (meta-learning & integration) shipped and live-wired — see Observed adaptation. Browser compute: collapse propagation · compute demos.

flowchart TB
    subgraph FAST["Fast path — collapse pipeline"]
        FP["α → ν → λ → ρ → ε — unchanged during adaptation"]
    end
    subgraph SLOW["Slow path — neurotrophic layer"]
        A["Phase A Homeostasis"] --> B["Phase B Plasticity"] --> C["Phase C Fault repair"]
        C --> D["Phase D Temporal learning"] --> E["Phase E Meta-learning"]
    end
    FP -->|"observe metrics"| A
    E -->|"bounded feedback"| MUTABLE["Adaptation surface"]
    MUTABLE -.->|"never blocks"| FP

    classDef fast fill:#121820,stroke:#00B2FF,color:#e0e2e8
    classDef slow fill:#1a2418,stroke:#48e662,color:#e0e2e8
    class FAST,FP fast
    class SLOW,A,B,C,D,E,MUTABLE slow
                        

External Verticals

Industry adaptors connect over HTTP only — the substrate never forks per vertical. STABLE/VOLATILE profiles, the adaptor diagram, compliance proofs, and per-vertical configuration live on Vertical Surfaces. Governed workflow walkthroughs are on Workflow Demos.

Observability — Dual-Lane Cockpit

Two independent cockpits. Same KPI set. Different data sources. Zero shared state. Stable lane is for governed production traffic; Volatile lane is for exploratory or high-variance environments where wider timing surfaces are intentional.

Structural Properties

End-to-End Path

Ingress through adaptation — one traversal. Collapse operators are detailed above; this is the full cycle including kernel dispatch and slow-path feedback.