Chimera documentation

Portal built with mdBook. From the repo root:

mdbook build docs/
# output: docs/book/

See SUMMARY.md for the full table of contents (ADRs 0001–0024, RFCs 0001–0007, guides).

Guide: Local mesh setup

Prerequisites

• Rust stable (rustup)
• Windows, macOS, or Linux on the same L2/LAN (UDP multicast)

Bootstrap two nodes

# Terminal A
cargo run -- --name alpha --tcp-bind 0.0.0.0:7400 --quic-bind 0.0.0.0:7401 --demo-slices 4 --no-tui

# Terminal B (different ports)
cargo run -- --name beta --tcp-bind 0.0.0.0:7402 --quic-bind 0.0.0.0:7403 --no-tui

With TUI (default): omit --no-tui, press Tab to switch Topology / ChimeraFS / ChimeraMEM / Agents, q to quit.

Intent-driven job

cargo run -- --no-tui --intent "name=preview latency<200ms privacy=local render=hd slices=6"

Data directory

Default ./data holds pipeline chunks, ChimeraFS CAS blocks, and checkpoints.

Guide: Custom Wasm guests

ABI

Export from your module:

Input layout

[u64 seed][u32 count][u32 pad][f32 × count]

Output layout

[u64 checksum][u32 count][u32 pad][f32 × count]

Build the sample guest

cargo build -p chimera-guest --release --target wasm32-unknown-unknown

Artifact: target/wasm32-unknown-unknown/release/chimera_guest.wasm

Run with custom module

cargo run -- --wasm path/to/module.wasm --demo-slices 2 --no-tui

If --wasm is omitted, Chimera loads an embedded WAT demo kernel.

Guide: Chimera Nano-Kernel targets

Host (Windows)

cargo test -p chimera-nano-kernel
cargo run -p chimera-nano-kernel --example host_boot

Bare-metal check (no_std core only)

rustup target add thumbv7em-none-eabihf riscv32imac-unknown-none-elf x86_64-unknown-uefi
cargo check -p chimera-nano-kernel --no-default-features --target thumbv7em-none-eabihf
cargo check -p chimera-nano-kernel --no-default-features --features cortex-m --target thumbv7em-none-eabihf

Scaffolding honesty

Linker scripts / PACs for real boards are out of scope for this phase.

Contributing

Thanks for helping grow the Chimera mesh.

Workflow

1. Fork & branch from main.
2. cargo fmt && cargo clippy -- -D warnings (when clippy is available).
3. cargo test && cargo check.
4. Open a PR with a clear summary + test plan.

Design rules

• Prefer postcard + BLAKE3 over ad-hoc formats.
• Never starve control frames for bulk I/O.
• Keep Windows default builds free of FUSE / userfaultfd / ZK / ML deps (feature-gate them).
• Document architectural choices as ADRs under docs/adr/.

Brand

Follow brand/brand.md. Palette: void #0A0A0C, cyan #00F0FF, amber #FFB800.

Security

Do not commit secrets. Report vulnerabilities privately when possible. Mesh demos use self-signed QUIC certs — not production PKI.

ADR-0001: QUIC transport for the Chimera mesh

Status

Accepted

Context

Nodes must exchange control frames (heartbeats, reclaim, ownership) and bulk payloads (CAS blocks, DSM pages, Wasm snapshots) without a central broker. TCP alone stalls control under bulk load; HTTP overlays add latency.

Decision

Use Quinn/QUIC as the primary mesh transport with TCP framed postcard as a reliable fallback. Classify streams as Control / Compute / Bulk so heartbeats are never starved by asset streaming.

Consequences

• Self-signed TLS certs via rcgen for LAN/mesh demos (replace with pinned PKI for production).
• ALPN chimera.
• Postcard length-prefixed frames on both transports.

ADR-0002: Wasmtime sandbox for untrusted compute

Status

Accepted

Context

Peers execute untrusted job slices. Native plugins are unsafe across trust boundaries and ABIs.

Decision

Compile payloads to WebAssembly and execute in Wasmtime with fuel metering and store memory limits. Guest ABI: chimera_alloc / chimera_dealloc / chimera_execute.

Consequences

• Cross-platform binaries (Windows/Linux/macOS).
• Live migration checkpoints linear memory + fuel; call-stack IP is not fully portable — resume re-enters guest with checkpoint_offset (documented limitation).
• Demo guest lives in examples/guest; embedded WAT fallback ships for zero-setup demos.

ADR-0003: Content-addressed chunking (ChimeraFS)

Status

Accepted

Context

Large datasets must stream across peers with integrity and cache reuse.

Decision

Slice assets into BLAKE3-addressed blocks, form a Merkle DAG per asset, advertise holders via a gossip-indexed DHT, and expose a VirtualMount VFS (FUSE optional on Unix).

Consequences

• Verify-on-ingest, trust-in-cache thereafter.
• LRU RAM cache + mmap-backed disk blocks.
• Prefetch hooks warm dependencies before Wasm starts.
• Windows builds do not require FUSE.

ADR-0004: DSM memory fabric (ChimeraMEM)

Status

Accepted

Context

Shared working sets and live Wasm migration need a unified address space without kernel RDMA.

Decision

Implement a portable soft page-table DSM over QUIC. Linux may enable userfaultfd behind --features userfaultfd. Consistency knobs: CRDT regions (vector clocks, G-Counter, OR-Set) vs ownership leases for linearizable pages. Tiering: HotRam → PeerCache → ColdFs (+ GPU hints).

Consequences

• Works on Windows for demos.
• Page faults fetch over bulk streams; control plane stays prioritized.
• Migration packetizes linear memory (XOR deltas available for similar pages).

ADR-0005: Intent-driven agent orchestrator

Status

Accepted

Context

Operators want declarative jobs (“latency<200ms privacy=local render=hd”) and self-healing under thermal/congestion pressure.

Decision

Each node runs a rule-based scoring agent on a telemetry ring buffer (<1ms decisions). Intents compile into Wasm task plans + ChimeraMEM page budgets. Economy layer issues ed25519 + BLAKE3 compute receipts; optional --features zk-receipts stubs ZK proofs without default heavy deps.

Consequences

• No mandatory ML/ZK build cost on Windows.
• Pre-emptive migration when healing pressure rises.
• Receipt verification gates acceptance of completed slices.

ADR-0006: Chimera Nano-Kernel (CNK)

Status

Accepted (Phase 6)

Context

Chimera must eventually run beyond desktop OS hosts — UEFI appliances, microcontrollers, and other silicon — while sharing framing, determinism, and security with the mesh.

Decision

Introduce chimera-nano-kernel (cnk/): a #![no_std] + alloc core with:

• block-pool allocator, postcard framing, deterministic TxLog, softfloat/fixed-point
• wasmi interpreter tier (feature) vs host Wasmtime JIT
• smoltcp sim framing (feature) — not QUIC-over-smoltcp
• ML-KEM/ML-DSA hybrid handshake (feature)
• host shim for Windows tests; UEFI/Cortex-M/RISC-V stubs only

Consequences

• Workspace stays green on Windows with default host features.
• Bare-metal targets verified via cargo check --no-default-features --target ….
• Real firmware boots remain future work (documented honestly).

ADR-0007: Post-quantum hybrid mesh handshake

Status

Accepted

Context

Classical ed25519 receipts (Phase 4) and QUIC/TLS (Phase 1) are not quantum-resistant. NIST ML-KEM / ML-DSA provide pure-Rust options that build on Windows without C toolchains.

Decision

Add an application-layer hybrid envelope (cnk::security):

1. ML-KEM-768 encapsulation → shared secret
2. ML-DSA-65 signature over transcript
3. Lightweight handshake puzzle (leading-zero SHA3) for anti-amplification
4. Peer rate limits + reputation scoring

Transport TLS/QUIC remains classical for Quinn today. Document migration path: when stacks support hybrid KEM in TLS 1.3, fold CNK secrets into that.

Consequences

• Works on Windows now.
• Not a full TLS replacement — envelope authenticity + PQ shared secret binding.
• Puzzle difficulty capped for demos (≤16 bits).

ADR-0008: Deterministic execution & replay

Status

Accepted

Context

Fault isolation and neighbor recovery require bit-stable state transitions across heterogeneous CPUs.

Decision

• Append-only BLAKE3-chained TxLog for task mutations; recovery = verify + replay.
• Immutable sealed memory regions in CNK.
• Consensus math prefers Q16.16 FixedPoint; SoftF32 canonicalizes NaN/−0 but is not claimed bit-identical across all FPUs for long chains.
• Degradation policy downsamples / forces fixed-point on low-RAM / no-FPU profiles instead of dropping tasks.

Consequences

• Host tests prove replay recovery.
• Cross-arch float consensus should use FixedPoint, not host f32 sin chains.

ADR-0009: OpenTelemetry & Prometheus observability

Status

Accepted

Context

Enterprise operators need mesh health, task throughput, and latency visibility without drowning nodes in telemetry.

Decision

• Prometheus text exposition at /metrics (always with mgmt feature).
• OpenTelemetry OTLP export behind --features otel + --otlp-endpoint.
• Default trace sample ratio 5% (ParentBased + TraceIdRatioBased) targeting <2% CPU overhead at typical load.
• Spans on critical paths: task.execute, HTTP management, transport classes.

Consequences

Default builds stay lean. Full OTEL stack is opt-in.

ADR-0010: Management API, RBAC, and SDKs

Status

Accepted

Context

Operators need declarative control of intents, assets, join tokens, and audit without SSH into nodes.

Decision

• Axum REST API under /v1/* + embedded portal / + /health + /metrics.
• RBAC roles: admin / operator / submitter / reader via Authorization: Bearer role:name.
• Tamper-evident audit JSONL (BLAKE3 chain + ed25519).
• chimeractl CLI; Python (httpx) and TypeScript (fetch) SDKs.
• gRPC (tonic) deferred — document as future; REST is the supported surface.
• WIT / component-model native bindings: future path (see ADR-0012 for Nexus).

Consequences

Auth is demo-grade bearer roles (replace with OIDC/mTLS in production).

ADR-0011: Deployment artifacts

Status

Accepted

Context

Enterprises expect Docker Compose and Kubernetes starting points.

Decision

Ship Dockerfile, docker-compose.yml (3-node), and deploy/k8s/ manifests + minimal Helm chart. A Kubernetes operator is roadmap-only.

Honesty

Artifacts are syntactically authored but not executed on the Chimera Windows build host (no Docker/K8s). Validate in CI where runners allow.

ADR-0012: Universal Polyglot Function Gateway

Status

Accepted (Phase 9)

Context

Chimera needs a multi-tenant function runtime for mesh-wide deploy/invoke. Candidates include containers, language VMs, and Wasm.

Decision

• Working backend: precompiled Wasm modules via Wasmtime, with per-tenant engines, fuel, and memory caps.
• Deployment pipeline: abstract store → compile → register → invoke; Wasm is the only complete adapter today.
• Auth: Phase 7 RBAC (SubmitWorkload to deploy/invoke; ManageNodes to scale).
• Storage of blobs: in-memory CAS keyed by BLAKE3 (ChimeraFS CAS integration is the distribution path for multi-node).

Non-goals / roadmap

• Container / Dockerfile ingestion — roadmap adapter, not faked.
• Raw Python/JS via Wasm interpreters — only if a clean crate path appears; not shipped.
• gRPC / event triggers — documented roadmap; HTTP REST is the working surface.

Consequences

chimeractl deploy/invoke and /v1/functions* are production-leaning for Wasm demos. Do not claim container portability in marketing copy.

ADR-0013: Raft-replicated KV storage

Status

Accepted (Phase 9)

Context

Functions and the control plane need strongly consistent shared state. openraft was evaluated; a compact in-tree Raft core was preferred for Windows CI simplicity and zero extra native deps.

Decision

• Ship a compact Raft implementation (src/raft_kv.rs): leader election, log replication, commit/apply, single- and multi-node tests.
• KvStore wraps a shared RaftNode; single-node lab mode commits immediately; multi-node uses replicate_to.
• Expose KV via REST (/v1/kv) and optional Wasm host imports (chimera.kv_get_i32 / chimera.kv_set_i32).
• SQL / relational layer: not shipped. Prefer correct Raft KV + secondary indexes later. SQL is roadmap.

Honesty

Network transport over QUIC for Raft RPCs is pluggable/hooks-ready; unit tests use in-process replication. Production mesh wiring of Raft over QUIC remains incremental.

Consequences

Correctness tests gate merges. Do not advertise SQL until a feature-gated engine exists.

ADR-0014: Latency-aware service routing

Status

Accepted (Phase 9)

Context

Function invocations must find a healthy peer hosting the named service without central load balancers.

Decision

• Maintain a userspace service registry (src/registry.rs): tenant/function → peer instances with latency, headroom, and heartbeat TTL.
• Route by score latency_ms * (1.1 - headroom); failover via route_failover skipping failed peers.
• Heartbeats refresh entries; expired instances drop (self-healing registry).
• Integrate Phase 4 telemetry into autoscaler / traffic shedder for scale and admit decisions.

Honesty — “anycast”

This is userspace peer selection, not IP anycast or BGP. Clients (gateway) pick the best peer; there is no kernel/network anycast address.

Consequences

Docs and CLI must say “lowest-latency peer routing”, not “anycast IP”.

ADR-0015: Freight decentralized package registry

Status

Accepted (Phase 10)

Context

WorldOS needs a P2P app store without a central registry.

Decision

• Packages are Wasm modules addressed by BLAKE3, described by a signed PackageManifest (name, version, hash, ed25519 publisher key, deps).
• Publish stores the module in ChimeraFS CAS and indexes the manifest in a local Freight registry (DHT announce via CAS block providers).
• Install verifies signature + hash, then deploys into the Nexus function gateway.
• Trust model: signature-based. There is no central authority; users must trust publisher public keys. Censorship-resistance means anyone can republish signed packages — it does not mean anonymous or untraceable distribution.

Consequences

chimeractl freight publish|search|install|run and MeshShell Freight panel are the UX. Container packages remain roadmap.

ADR-0016: Compute credit economy

Status

Accepted (Phase 10)

Context

Mesh workloads need a lightweight barter unit so nodes can charge for execution without an external chain.

Decision

• Credit balances and signed double-entry transactions live in the Raft KV store (ledger:bal:*, ledger:tx:*).
• Earn: CreditLedger::earn_from_receipt credits an account after a verified Phase-4 compute receipt (fuel × rate).
• Spend: gateway invoke charges invoke_cost credits; insufficient balance → reject.
• Local meshes default to bypass (--ledger-bypass / not --enforce-credits) so demos work offline without funding accounts.

Honesty

This is an accounting layer, not a cryptocurrency or planetary settlement network. No on-chain bridges.

Consequences

Tests cover earn, spend, and broke rejection. Operators enable enforcement with --enforce-credits.

ADR-0017: Mesh bridging & retro-hardware

Status

Accepted (Phase 10)

Context

Some peers cannot speak QUIC (MCUs, serial links, legacy LANs).

Decision

• Introduce a BridgeFrame length-prefixed envelope compatible with the CNK framing story.
• Working adapter: plain TCP (TcpBridgeEndpoint) with in-process exchange tests.
• Stubs: --features bridge-serial and bridge-bluetooth expose adapters that return explicit roadmap errors (no hardware in CI).

Honesty

Bluetooth/serial are not implemented. Planet-scale bridging is not claimed. Microcontroller peers can reuse CNK no_std frames once a serial adapter is filled in.

Consequences

Document TCP as the supported legacy path; keep stubs feature-gated.

ADR-0018: TEE attestation abstraction

Status

Accepted (Phase 11)

Decision

• TeeProvider trait with TeeAttestation (measurement, nonce, quote, pubkey).
• SimulatedTee — BLAKE3 image measurement + ed25519 quote. Status: working
• Hardware stubs: Intel TDX, AMD SEV-SNP, ARM TrustZone — return explicit unimplemented errors. Status: roadmap
• Attestation can ride in AttestedHandshake alongside PQ material (Phase 6).

Honesty

No real enclave hardware is exercised in CI. Do not claim government-accredited TEE without the matching backend + certification.

ADR-0019: mTLS over QUIC

Status

Accepted (Phase 11)

Decision

• Lab LocalCa mints client+server leaves; mtls_server_endpoint requires client certs via rustls WebPkiClientVerifier.
• Default mesh transport remains skip-verify + no client auth for LAN demos (backward compatible).
• mTLS path is tested in-process: authenticated handshake succeeds; unauthenticated peer is rejected.

Status labels

ADR-0020: Retro-scaling execution policy

Status

Accepted (Phase 11)

Decision

RetroScaler::plan(profile) maps hardware profiles to ExecTier + caps:

• Constrained → Wasmi interpreter, low fuel/mem, precision degrade
• Capable → Wasmtime JIT, higher parallelism

Constrained paths degrade (downsample / fixed-point stand-in) instead of dropping tasks.

Status

ADR-0021: Continuity & hot failover

Status

Accepted (Phase 11)

Decision

• ContinuityPlane replicates Wasm frames + memory segments to N in-process peers.
• Partition tests recover latest replica after killing a majority of holders.
• Raft KV replication complements frame continuity for shared state.

Honesty — “zero packet loss”

We demonstrate zero data loss via replicated logs + deterministic replay equality checks. We do not claim lossless UDP/QUIC delivery on the wire.

ADR-0022: Omniverse modularization (28 crates)

Status

Accepted (Phase 12)

Context

Phases 1–11 delivered a working mesh in a large umbrella crate. Phase 12 splits capabilities into exactly 28 independently usable modules so consumers can depend on one surface without pulling the full node.

Layout

• Rust libraries/binaries: crates/<module>/
• Non-Rust packages: packages/<module>/
• Umbrella composer: root chimera package

Layering (acyclic)

1. Foundation: core-nano → crypto-quantum (facade) → transport-quic (wire + QUIC)
2. Storage/net: storage-cas, dht-routing, fuser-mount, network-bridge, consensus-dag
3. Execution: wasm-runtime, memory-fabric, compiler-jit, scheduler-rt
4. Autonomy: agent-swarm, telemetry-otel, inference-engine
5. Security/policy: rbac-auth, audit-ledger, compliance-tee, policy-engine
6. Edges: usb-daemon, cli-tool, SDKs, gitops, ui/dashboard/audio
7. Umbrella: chimera may depend on all layers; crates must not depend upward on chimera except usb-daemon (portable binary)

Rules

• No cycles between crates.
• Shared wire types live in transport-quic (not a 29th protocol crate).
• Prefer re-exports from the umbrella for backward-compatible chimera::* paths.

Honesty

Some umbrella modules (gateway, mgmt, fs facade, freight, …) still compose multiple crates inside chimera itself. The 28 packages are the stable boundaries; further extraction can continue without breaking those APIs.

ADR-0023: Boot-Sovereign safety model & format/bootloader tradeoffs

Status

Accepted (Phase 14)

Context

Chimera needs a Rufus-grade USB flashing / recovery engine (chimera-boot in crates/usb-flasher). Raw block writes can destroy host disks. Development runs on a real primary machine.

Decision — Safety gates (non-negotiable)

Physical writes require all of:

1. Explicit --yes-i-understand-this-destroys-data or typed disk serial confirmation
2. Removable-media check that hard-refuses fixed disks and system/boot volumes
3. --no-dry-run (dry-run is ON by default)

FileImageTarget is the only path exercised by automated tests. Enumeration (usb list) is read-only and safe.

Real-hardware flashing is UNTESTED in CI and development verification.

Decision — Formats

Decision — Bootloaders

Zero precompiled GRUB/Syslinux/EFI blobs in-tree. User supplies:

• EFI stub path → materialized as EFI/BOOT/BOOTX64.EFI in an ESP tree
• Optional 440-byte legacy MBR bootstrap (default = zeros / no-op)

Consequences

• Lab flashing uses --image file targets
• Physical path compiles on Windows/Linux but must never be used without gates
• SMART thermal is reported as unavailable rather than fabricated

ADR-0024: Global distribution & ecosystem publishing

Status

Accepted (Phase 15)

Context

Chimera ships many crates and two primary CLI binaries (chimeractl, chimera-boot). Several desirable crates.io names (chimera, wasm-runtime, network-bridge, agent-swarm, policy-engine, chimera-core) are already taken. Publishing is irreversible for claimed names.

Decision — Package naming

The library crate name for the umbrella remains chimera ([lib] name = "chimera") so dependents can use chimera::… while depending on package chimera-mesh.

Internal Cargo dependency keys keep short names via package = "chimera-…" renames to limit Rust use churn.

Decision — Publish order & index propagation

Publish leaves before dependents (see scripts/publish-crates.sh). After each real publish, poll https://crates.io/api/v1/crates/{name}/{version} until HTTP success before continuing. A fixed sleep is insufficient; a failed mid-sequence halt makes partial releases obvious.

First-release chicken-and-egg: cargo publish --dry-run rewrites path+version deps to version-only and resolves them from crates.io. Until leaf crates exist on the index, dependents cannot complete a full dry-run verify. The dry-run script therefore falls back to cargo check -p for those crates (and still fails loud on real errors). After the first leaf publish, subsequent dry-runs of dependents succeed normally.

Decision — CI features (--all-features forbidden)

--all-features enables platform-gated features (fuse, userfaultfd, bridge-serial, bridge-bluetooth, TEE backends) that cannot build on a generic runner. CI uses CI_FEATURES=cnk,mgmt,nexus.

Decision — dist vs release profiles

• release: opt-level = 3 for mesh throughput.
• dist: inherits release but opt-level = "z", strip = true, panic = "abort" for shipped CLI size. Does not affect cargo test (uses dev / test profiles).

Decision — Checksums

Release artifacts publish both SHA-256 (Homebrew / binstall ecosystem) and BLAKE3 (Chimera CAS alignment).

Consequences

• Real cargo publish / npm publish / etc. are not run in development.
• Acceptance gate: every publishable crate passes cargo publish --dry-run.
• Homebrew formula lives as a template; the tap is a separate homebrew-chimera repo.

RFC-0001: Chimera Wire Protocol

Framing

All TCP/QUIC payloads are length-prefixed little-endian u32 + postcard body.

| len:u32 LE | postcard(WireMsg) |

Message classes

Gossip handshake

1. UDP multicast GossipAnnounce { peer, known_peers } on 239.255.74.10:7410 (configurable).
2. Receivers upsert PeerTable, remember TCP/QUIC endpoints.
3. Heartbeats over QUIC/TCP refresh caps + AgentDigest.
4. Peers missing heartbeat_ms * heartbeat_misses are pruned; tasks reclaimed.

Schema source

Canonical types live in src/protocol.rs (WireMsg, TaskSlice, ComputeReceipt, …).

RFC-0002: Verifiable Compute Receipts

Default path (always on)

A receipt binds:

• task_id, executor node id
• transcript_hash (BLAKE3 of Wasm output)
• fuel_consumed
• io_merkle_root (BLAKE3 of input buffer)
• ed25519 public_key + signature over the concatenated preimage
• timestamp_ms

Verification: recompute preimage, VerifyingKey::verify.

Requesters must verify before accepting state mutations / completing jobs.

Optional ZK path

--features zk-receipts enables stub prove/verify hooks for future arkworks/bellman circuits. Default Windows builds do not pull ZK dependencies.

RFC-0003: CNK frames & PQ envelope

Mesh frame

Postcard MeshFrame { header: FrameHeader, body } with length-prefixed datagrams for smoltcp/UDP.

PQ handshake messages

1. HybridHello — KEM EK, DSA VK, nonce, puzzle challenge
2. HybridReply — KEM CT, DSA VK, nonce, puzzle response, DSA signature, transcript hash
3. Both parties derive SHA3-256(ss || transcript) as session key material

TxLog sync

Neighbor replicas exchange encoded TxEntry lists; receivers merge_replica only contiguous extensions of the local tip (no fork choice yet — scaffolding).

RFC-0004: Wire protocol versioning & rolling upgrades

Versions

• Current: major=1 minor=1 (WIRE_MAJOR / WIRE_MINOR)
• Minimum supported major: 1 (WIRE_MIN_MAJOR)

Negotiation

WireMsg::ProtocolHello { from, version } carries ProtocolVersion { major, minor, min_major }. Peers select major = min(local.major, peer.major) if each major ≥ peer.min_major; else disconnect.

Rolling-upgrade rules

1. Never remove postcard fields in a minor bump — only add optional trailing fields.
2. Major bump required for: renamed enums, changed endianness, removed message variants.
3. New nodes must keep min_major ≤ oldest fleet major until drained.
4. Management API /v1/protocol exposes local version for out-of-band checks.

Compatibility matrix (1.x)

RFC-0005: Nexus Core function & storage wire surfaces

Abstract

Phase 9 HTTP surfaces for function gateway and Raft KV (management API port, default 7600).

Deploy

POST /v1/functions

{ "tenant": "demo", "name": "add1", "wasm_hex": "...", "memory_mib": 16, "fuel": 5000000 }

Invoke

POST /v1/functions/invoke

{ "tenant": "demo", "function": "add1", "input_hex": "29", "priority": 1 }

Priority ≥ 200 is treated as real-time lane traffic (never shed under CPU saturation).

Scale / logs

• POST /v1/functions/scale { "tenant", "name", "instances" }
• GET /v1/functions/logs

KV

• POST /v1/kv { "key", "value_hex" }
• GET /v1/kv/{key}

Auth

Authorization: Bearer role:name (e.g. admin:ops) — same as Phase 7.

Roadmap (non-normative)

gRPC invoke, event triggers, container image ingest, SQL-over-KV.

RFC-0006: WorldOS MeshShell & Freight surfaces

MeshShell

Browser SPA at GET /meshshell (static HTML/JS/CSS under meshshell/web/, embedded in the node binary).

Native GUI is roadmap; desktop control remains TUI + chimeractl.

Freight

Ledger

RFC-0007: Chimera Sovereign surfaces

chimera-usb

Portable binary; config/state beside the executable. --benchmark-startup prints measured init time.

MeshShell Sovereign Dash

GET /meshshell → WebGL canvas (dashboard.js). Fed by /health.

Security

• Simulated TEE: chimera::tee
• mTLS lab: chimera::mtls
• Retro-scale: chimera::retro_scale
• Continuity: chimera::continuity