The Athanor Code Flow Map

This document maps the current first-party code by ownership, call boundary, and runtime order. It is a source map, not a target-architecture proposal. Each large path is split into a small diagram so that a reader can follow one event without crossing the whole repository at once.

Snapshot: current working tree on 2026-08-17.

Scope: production Rust, the OMP adapter, parked Godot code, and operational build/install scripts. Tests are proof satellites rather than runtime nodes. gui/addons/juicee/ is a third-party plugin boundary for the parked client. gui-prototype/ is the read-only web operator surface. It has one runtime read edge: nine POST-only /live/* routes through serve.ts to the Host. Run bun gui-prototype/serve.ts to serve the surface and its loopback proxy.

Reading the map

1. Whole runtime

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart LR
    Operator["Operator"] --> App["athanor.exe"]
    Operator --> Manager["athanor-manage<br/>service::dispatch"]
    Manager --> Plan["runtime_plan"]
    Plan --> Supervisor["Supervisor::run"]

    subgraph Children["Managed service children"]
        PG[("PostgreSQL<br/>AKASHA authority")]
        NATS["NATS JetStream<br/>transport, not authority"]
        Delivery["athanor-delivery<br/>PostgreSQL ↔ NATS bridge"]
    end

    Supervisor --> PG
    Supervisor --> NATS
    Supervisor --> Delivery
    App --> Host["one in-process<br/>multi-room Host"]

    OMP["OMP adapter"] <-->|"authenticated Host WebSocket"| Host
    OMP <-->|"long-lived JSONL child stdio"| Substrate["athanor-substrate"]

    Substrate <-->|"durable organ reads and writes"| PG
    Substrate <-->|"Vault profile only"| Vault[("room-attributed files")]
    Substrate -.->|"query embeddings"| Ollama["Ollama<br/>inference only"]
    Substrate --> GigaWorker["GIGA worker task<br/>inside substrate process"]
    GigaWorker <-->|"claim events / store candidates"| PG
    GigaWorker -.->|"bounded classifier / extraction"| Ollama

    PG -->|"claim crane_outbox rows"| Delivery
    Delivery -->|"mark published / record receipts"| PG
    Delivery -->|"publish and consume Crane subjects"| NATS
    NATS -->|"JetStream acknowledgements"| Delivery
    NATS -->|"sanitized receipt stream"| Host
    Host --> HostState[("room-scoped Host projection state")]

The Windows service starts PostgreSQL when managed, then NATS and delivery. athanor.exe independently owns the one multi-room Host and may start or stop without owning OMP sessions. OMP can use both boundaries: Host commands for interactive room state and substrate JSONL for durable organs. The dormant Godot prototype is parked and is not launched by this runtime path.

NATS never opens a PostgreSQL connection. athanor-delivery is the transactional-outbox bridge: it claims durable rows from PostgreSQL, publishes them to JetStream, consumes delivered events, and records authoritative receipts back in PostgreSQL.

GIGA's queue events, candidates, review transitions, and promotions are durable PostgreSQL state. The worker runs inside the substrate process and calls Ollama only for bounded classification or extraction. Ollama holds neither the GIGA queue nor candidate authority.

Sources: crates/athanor-install/src/service.rs, crates/athanor-install/src/native_runtime.rs, crates/athanor-install/src/supervisor.rs, crates/host/src/house.rs, adapters/omp/rust-transport.ts, gui/src/host_session.rs.

2. Rust workspace dependency DAG

Arrows point from a crate to its internal workspace dependency.

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart BT
    Hearth["hearth"]
    Origami["origami"]
    Summoning["summoning"]
    Protocol["protocol"]
    Vault["vault"]
    Akasha["akasha"]
    Host["host"]
    Keeper["omp-keeper"]
    Interactive["interactive-process"]
    Install["athanor-install"]
    Godot["parked athanor-godot<br/>gui/src"]

    Origami --> Hearth
    Summoning --> Hearth
    Summoning --> Origami
    Protocol --> Hearth
    Protocol --> Origami
    Protocol --> Summoning
    Akasha --> Hearth
    Akasha --> Protocol
    Akasha --> Vault
    Akasha --> Origami
    Akasha --> Summoning
    Host --> Akasha
    Host --> Hearth
    Host --> Origami
    Host --> Protocol
    Host --> Summoning
    Keeper --> Protocol
    Keeper --> Interactive
    Install --> Host
    Install --> Hearth
    Install --> Protocol
    Install --> Interactive
    Install --> Keeper
    Godot -->|parked client dependency| Protocol

hearth, vault, and interactive-process have no internal workspace crate dependency. Repository proximity does not erase authority boundaries: Vault stays database-free, hearth reads no file, socket, database, or clock, and the core does not import an adapter.

Source: workspace manifests resolved from Cargo.toml and each crate manifest.

3. Service boot and shutdown

Architecture flow from The Athanor Code Flow Map
Read the diagram source
sequenceDiagram
    participant SCM as Operator / Windows SCM
    participant Manage as athanor-manage service::dispatch
    participant Layout as current.json + config + secrets
    participant Plan as runtime_plan
    participant Sup as Supervisor::run
    participant PG as managed PostgreSQL
    participant NATS as NATS
    participant Delivery as delivery

    SCM->>Manage: start
    Manage->>Layout: resolve the active version and service topology
    Manage->>Plan: build the ordered ProcessSpec list
    Plan-->>Sup: PostgreSQL? -> NATS -> delivery
    opt managed database mode
        Sup->>PG: spawn and await readiness
    end
    Sup->>NATS: spawn and await readiness
    Sup->>Delivery: spawn and await readiness
    Sup-->>SCM: report RUNNING

    SCM->>Manage: stop
    Manage->>Sup: stop the process plan
    Sup->>Delivery: stop
    Sup->>NATS: stop
    opt managed database mode
        Sup->>PG: stop
    end

A child spawn is not readiness. Failure before the full plan becomes ready is a service-start failure, not a partial success.

Sources: crates/athanor-install/src/service.rs, crates/athanor-install/src/native_runtime.rs, crates/athanor-install/src/supervisor.rs.

4. One OMP context turn

The ordering below is the pi.on("context") path. Conversation capture occurs before memo replay so detached GIGA ingestion is not skipped by a cache hit.

Architecture flow from The Athanor Code Flow Map
Read the diagram source
sequenceDiagram
    participant Pi as OMP context hook
    participant Adapter as adapters/omp/index.ts
    participant Host as Athanor Host
    participant Rust as RustJsonlTransport
    participant Data as substrate or Vault

    Pi->>Adapter: context event
    Adapter->>Adapter: load room directives, room state, active-spirit snapshot
    opt enabled room model default
        Adapter->>Adapter: resolve and apply model selector
    end
    Adapter->>Host: write conversation log
    Adapter-->>Rust: detached GIGA conversation ingest
    Adapter->>Adapter: inspect turn-addition memo/cache

    alt byte-stable memo hit
        Adapter->>Adapter: replay memoized additions
    else cache miss
        Adapter->>Host: analyze_context
        Host-->>Adapter: query classification and lane hints
        Adapter->>Adapter: add room and routing reminders
        opt fresh session
            Adapter->>Rust: paper_boat_wake
            Rust->>Data: load latest Boat and later unboated memories
            Adapter->>Rust: anamnesis read
        end
        Adapter->>Adapter: keyword directive
        Adapter->>Adapter: deterministic process-lesson plan
        Adapter->>Adapter: prose lesson-trigger matches
        Adapter->>Adapter: inspect Recall Policy
        opt unresolved entity affects classification
            Adapter->>Rust: entity_resolve
            Rust-->>Adapter: canonical entity evidence
            Adapter->>Host: analyze_context again
        end
        Adapter->>Host: evaluate Recall Policy
        alt Vault profile
            Adapter->>Rust: vault_recall
            Rust->>Data: file-authoritative bounded retrieval
        else AKASHA profile
            Adapter->>Rust: recall
            Rust->>Data: PostgreSQL-authoritative retrieval
        end
        Adapter->>Host: apply_viewport
        alt refresh succeeds
            Adapter->>Host: complete_refresh
        else refresh fails
            Adapter->>Host: fail_refresh
        end
        Adapter->>Adapter: record recall telemetry
        Adapter->>Adapter: memoize byte-stable additions
    end
    Adapter-->>Pi: anchor additions after the current user turn

Related lifecycle hooks:

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart LR
    Compact["session_compact"] --> Strip["remove recall working set"]
    Strip --> Invalidate["Host invalidateAfterCompaction"]

    Task["task tool_call / progress / lifecycle / result"] --> Normalize["Host lineage normalize / settle"]
    Normalize --> Lineage["write lineage memories"]

    End["agent_end"] --> Capture["capture final conversation"]
    Capture --> Giga["detached GIGA ingest"]

    Shutdown["shutdown"] --> Close["close Host and Rust transports"]

Sources: adapters/omp/index.ts, adapters/omp/giga.ts, adapters/omp/kitten-lineage.ts, and adapters/omp/house-proof/.

5. OMP tool ownership and transport

The current adapter registers 35 tools. A tool name is not an authority claim; the owner column names the boundary that actually performs or persists the operation.

Tool Runtime owner / boundary
recall Rust JSONL -> substrate recall or vault_recall routing
canon_read Rust JSONL -> PostgreSQL canon store
canon_write Rust JSONL -> guarded PostgreSQL canon write
remember Rust JSONL -> typed lesson transaction or memory transaction
delete_lesson Rust JSONL -> lesson store mutation
update_lesson Rust JSONL -> lesson store mutation
wake Rust JSONL -> paper_boat_wake
room_state Adapter -> room-state file
set_room_state Adapter -> room-state file plus active_spirit.md snapshot
lessons Rust JSONL -> typed lesson query
design_doc Rust JSONL -> design-document query
design_doc_write Rust JSONL -> guarded design-document write
sleep Adapter flushes GIGA buffer, then Rust JSONL -> paper_boat_sleep
house_lane_status Host lane status plus substrate health probe
familiar_status Host routing boundary plus room spellbook file
familiar_dispatch Host routing boundary plus room spellbook; returns a packet only
house_dispatch Host routing boundary; returns a packet only
house_routing_mode Adapter -> room-state file
kitten_lineage_status Adapter-local lifecycle diagnostics
recall_policy authenticated Host Recall Policy command
house_model_default Adapter -> room-state file and current OMP model resolver
anamnesis Rust JSONL -> PostgreSQL Anamnesis read
anamnesis_write Rust JSONL -> guarded PostgreSQL Anamnesis write
giga_candidate_list Rust JSONL -> GIGA candidate store
giga_health Rust JSONL -> GIGA queue/store health
giga_queue_maintenance Rust JSONL -> bounded GIGA queue maintenance
giga_review Rust JSONL -> trusted GIGA review transition
giga_promote_memory Rust JSONL -> transactional memory promotion
giga_promote_coding_lesson Rust JSONL -> transactional coding-lesson promotion
giga_promote_project_lesson Rust JSONL -> consent-gated project-lesson promotion
hallway_create Rust JSONL -> Hallway store
hallway_join Rust JSONL -> Hallway store
hallway_post Rust JSONL -> Hallway store
hallway_read Rust JSONL -> Hallway store
hallway_inbox Rust JSONL manual read; Host-owned automatic projection
hallway_knock_policy Rust JSONL -> append-only room-owned Hallway wake policy
hallway_knock Rust JSONL -> bounded Hallway Knock lifecycle
Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart LR
    Tools["tools.ts registrations"] --> Local["adapter-local handlers"]
    Tools --> HostClient["Host command clients"]
    Tools --> RT["RustJsonlTransport.request"]

    Local --> Files[("room files / OMP session state")]
    HostClient <-->|"authenticated WebSocket"| Host["multi-room Host router"]

    RT --> Ensure["ensureStarted"]
    Ensure --> Queue["queue and flush stdin line"]
    Queue --> Main["athanor-substrate main"]
    Main --> Decode["decode response stdout line"]
    Decode --> Handle["handleLine"]
    Handle --> RT

    Timeout["timeout after definitive dispatch"] --> Unknown["outcome unknown<br/>do not retry as if unsent"]
    RT -.-> Timeout

RustJsonlTransport keeps one child process alive and correlates JSONL request IDs. A timeout after dispatch is explicitly outcome-unknown because replaying a write could duplicate an operation whose response was merely lost.

Hallway Knock actuation follows a separate local path. The recipient Host claims one PostgreSQL pointer under a short session lease; the OMP doorman includes only trusted routing IDs in its custom wake message and invokes pi.sendMessage for one turn. Injection settles the authoritative parent as started before the model can answer. If the recipient is already generating, the adapter then aborts that active turn so the bounded Knock can run next; the interrupted turn cannot be mistaken for the Knock's completion because completion still waits for the custom Knock message's own lifecycle. The spirit reads the exact Hallway message through the ordinary untrusted social path. Started/completed/failed settlement returns through Host; claiming never advances a Hallway read cursor or clears a Bell row.

Sources: adapters/omp/house-proof/tools.ts, adapters/omp/rust-transport.ts, adapters/omp/house-proof/host.ts, adapters/omp/house-proof/knock.ts.

6. Substrate request router

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    Stdin["stdin JSONL"] --> Main["main.rs line loop"]
    Main --> Req{"ProtocolRequest"}

    Req --> Vault["vault_recall"]
    Vault --> VaultCrate["vault<br/>no database initialization"]

    Req --> Pre["health / migrations<br/>pre-init paths"]

    Req --> NeedDB["database-backed request"]
    NeedDB --> Lazy["lazy Config::from_env + pool"]
    Lazy --> Worker["spawn_giga_worker when enabled"]
    Lazy --> Router{"request family"}

    Router --> Continuity["canon, remember, paper boat,<br/>recall, entity, anamnesis"]
    Router --> Knowledge["lesson, lesson context/triggers,<br/>design documents, cluster"]
    Router --> Social["Hallway create/join/post/read/inbox<br/>Knock policy/create"]
    Router --> Giga["GIGA ingest, queue, worker,<br/>review, promotion, health"]
    Router --> Ops["substrate health and maintenance"]

    Continuity --> PG[("PostgreSQL")]
    Knowledge --> PG
    Social --> PG
    Giga --> PG
    Ops --> PG
    Worker -.-> Giga

    PG --> Resp["ProtocolResponse"]
    VaultCrate --> Resp
    Pre --> Resp
    Resp --> Stdout["stdout JSONL"]

The main binary owns protocol dispatch and lazy shared state. Domain modules own the transactions; main.rs does not become a second implementation of their rules.

Sources: crates/akasha/src/main.rs, lib.rs, config.rs, health.rs, and the domain modules listed in the module index.

7. Recall paths

AKASHA profile

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    Q["recall request"] --> Validate["validate and normalize"]
    Validate --> Parse["extract dates and terms<br/>rooms = room + house"]
    Parse --> Embed["optional Ollama query embedding"]

    Parse --> BM["BM25F candidates"]
    Parse --> Vocab["nearest semantic vocabulary"]
    Vocab --> Bridge["BM25F concept bridge"]
    Embed --> Vector["pgvector semantic chunks"]
    Parse --> Trgm["pg_trgm word-similarity chunks"]
    Parse --> Dates["date matches"]
    Parse --> Threads["lexical thread rows"]

    BM --> Fuse["weighted rank fusion"]
    Bridge --> Fuse
    Vector --> Fuse
    Trgm --> Fuse
    Dates --> Fuse
    Threads --> Fuse

    Fuse --> Bound["dedupe and truncate"]
    Bound --> Neighbors["hydrate thread-neighbor graph"]
    Neighbors --> Canon["attach active canon matches"]
    Canon --> Cluster["attach cluster resonance"]
    Cluster --> Result["evidence + taxonomy + warnings"]

Vault profile

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    Q["vault_recall request"] --> Marker["load .athanor-room.json"]
    Marker --> Collect["collect eligible attributed files<br/>respect ignores and limits"]
    Collect --> Parse["parse Markdown / JSON / JSONL / text"]
    Parse --> Docs["in-memory documents"]
    Docs --> Rank["BM25F rank"]
    Rank --> Bound["bounded attributed candidates"]

    NoDB["No PostgreSQL<br/>No writes"] -.-> Q

Sources: crates/akasha/src/recall/, crates/akasha/src/bm25f.rs, crates/vault/src/recall.rs.

8. Host command cycle

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    App["athanor.exe"] --> Start["host::start"]
    Start --> House["open_house"]
    House --> Pool["one shared PostgreSQL pool"]
    House --> Listener["one loopback listener"]
    House --> Rooms["nest /room/&lt;key&gt;"]
    Rooms --> New["Host::new for each room"]
    New --> Load["load room state, cursor,<br/>sessions, receipts, ReceiptTracker"]
    Load --> Axum["Axum room routes"]
    New -.-> Bridge["run_receipt_bridge<br/>when NATS configured"]
    Axum --> Socket["handle_socket"]
    Socket --> Text["process_text"]
    Text --> JSON["parse JSON"]
    JSON --> Hash["semantic hash"]
    Hash --> Parse["parse_client_command"]
    Parse --> Validate["validate room/spirit/session binding,<br/>expiry and hop bounds"]
    Validate --> Route{"command router"}

    Route --> Receipt["receipt / recall subscribe,<br/>resync, ack"]
    Route --> Policy["Recall Policy set/evaluate/<br/>complete/fail/invalidate"]
    Route --> Context["analyze_context / apply_viewport"]
    Route --> Routing["lane status / dispatch / familiar status"]
    Route --> Lineage["lineage normalize / settle"]
    Route --> Shell["conversation log / lesson plan / braid"]

    Policy --> Mutate["commit_change"]
    Receipt --> Mutate
    Context --> Reply["typed direct event"]
    Routing --> Reply
    Lineage --> Reply
    Shell --> Reply

    Mutate --> Version["compute mutations, version, state hash"]
    Version --> Store["persist policy, sessions, cursor,<br/>idempotency receipt"]
    Store --> Reply
    Store --> Delta["broadcast ordered delta"]
    Reply --> Socket
    Delta --> Socket

    Validate -->|"invalid"| Reject["typed rejection; no mutation"]
    Bridge --> Tracker["filter accepted / duplicate / stale /<br/>foreign / malformed receipts"]
    Tracker --> Delta

Sources: crates/athanor-install/src/app.rs, crates/host/src/house.rs, config.rs, server.rs, policy.rs, store.rs, receipt.rs, and viewport.rs.

9. Paper Boat, Crane delivery, and receipt projection

Architecture flow from The Athanor Code Flow Map
Read the diagram source
sequenceDiagram
    participant Tool as OMP sleep tool
    participant Sub as paper_boat_sleep
    participant PG as PostgreSQL
    participant Delivery as DeliveryService
    participant NATS as JetStream
    participant Host as Host receipt bridge
    participant Godot as Parked Godot client

    Tool->>Sub: room + standalone Boat body
    Sub->>Sub: hash db-only source path and prepare memory
    Sub->>PG: BEGIN
    Sub->>PG: write_memory_tx + continuation graph
    PG->>PG: trigger inserts crane_outbox boat.ready
    Sub->>PG: select outbox event id
    Sub->>PG: COMMIT
    opt configured filesystem backup
        Sub->>Sub: post-write backup
    end
    Sub-->>Tool: durable receipt

    Delivery->>PG: Store::claim_next
    PG-->>Delivery: pending Crane outbox row
    Delivery->>Delivery: parse and validate CraneEvent
    Delivery->>NATS: Broker::publish lane subject
    NATS-->>Delivery: publish acknowledgement
    Delivery->>PG: Store::mark_published

    NATS-->>Delivery: consume boat.ready before addressed Crane
    Delivery->>Delivery: enforce subject, lane, recipient, expiry
    Delivery->>PG: Store::record_receipt authoritative transaction
    Delivery->>NATS: sanitized BoatReceiptProjection
    Delivery->>NATS: acknowledge consumed event
    NATS-->>Host: receipt stream
    Host->>Host: ReceiptTracker classification
    Host-->>Godot: historical client receipt snapshot / delta

paper_boat_wake does not trust a NATS payload as continuity. It reloads the latest complete Boat from PostgreSQL and adds a bounded set of later unboated memories. Duplicate delivery replays safely; poison events dead-letter and transient failures nack within bounded retry policy.

Sources: crates/akasha/src/paper_boat.rs, migrations 0016 and 0017 in crates/akasha/src/migrations.rs, crates/origami/src/cranes/, crates/host/src/receipt.rs.

10. GIGA candidate lifecycle

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    Conversation["OMP conversation"] --> Capture["capture transcript + private source ledger"]
    Capture --> Ingest["GIGA conversation ingest<br/>bounded turn windows"]
    Ingest --> Events[("PostgreSQL<br/>giga_events: pending")]

    Events --> Claim["worker claim"]
    Claim --> Validate["validate claim and event bounds"]
    Validate --> Sources["resolve exact private-ledger sources"]
    Sources --> Ollama["Ollama inference<br/>gate + extraction only"]
    Ollama --> Decision{"worthy candidate?"}
    Decision -->|"no"| Finish["finish event without candidate"]
    Decision -->|"yes"| Store["atomically store one GigaCandidate<br/>in PostgreSQL and finish event"]
    Validate -->|"retryable failure"| Retry["bounded retry then failed"]

    Store --> Proposal["candidate proposal<br/>not authority"]
    Proposal --> Review["giga_review"]
    Review --> ReviewChecks["trusted room + reviewer identity +<br/>current state + exact source resonance"]
    ReviewChecks --> InReview["durable PostgreSQL<br/>in_review transition"]

    InReview --> Promote{"promotion tool"}
    Promote --> Authority["re-check authority, state, and sources"]
    Authority --> Memory["transactional memory write"]
    Authority --> Coding["transactional coding lesson write"]
    Authority --> Consent["explicit project publication consent"]
    Consent --> Project["transactional project lesson write"]
    Memory --> Record["record promotion"]
    Coding --> Record
    Project --> Record

A candidate never becomes evidence merely because the worker extracted it. Review and promotion are separate durable transitions. Project lessons add an operator publication-consent gate.

Sources: adapters/omp/giga.ts, crates/akasha/src/giga/, crates/akasha/src/giga_worker/, crates/hearth/src/conversation.rs.

11. Native release, install, rollback, and removal

Release assembly

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart LR
    Pins["installer/dependencies.json"] --> Fetch["fetch pinned PostgreSQL,<br/>pgvector, NATS, parked Godot"]
    Fetch --> Verify["hash verification + cache"]
    Verify --> Cargo["cargo release-build<br/>five binaries + parked Godot cdylib"]
    Cargo --> Stage["stage runtime, adapter, parked Godot, manager"]
    Stage --> Import["parked Godot headless import"]
    Import --> Manifest["hash payload and emit release manifest"]

package.json is the native product version authority. The OMP adapter has an independent content-derived release identity. A native release includes a compatible fallback component bundle, but does not include the adapter in its native version identity.

The native builder and the shared component builder reject a missing or mismatched toolchain before they create a work directory. Each release stage appends one JSONL timing record. The workflow adds Inno packaging and retains the complete report.

Native and component ownership

Surface Owner Required behavior
Native product version, native current.json, service, and product rollback Rust installer Validates and atomically activates native releases
Adapter source bundle and component-manifest.json Shared PowerShell component builder Builds source artifacts only; does not write Program Files
Installed adapter versions and components/omp-adapter/current.json Rust installer Stages, validates, atomically activates, rolls back, and diagnoses components
Stable bin/athanor-omp-loader.ts Product payload Reads native environment and component pointer; refuses invalid or incompatible imports; starts the scoped Host when health fails and keeps it alive for the whole session
Adapter-only deployment Native manager Installs a built component with install-omp-adapter --source <component-root> without rebuilding or mutating a native release

The component pointer is components/omp-adapter/current.json. It contains format, releaseId, and previousReleaseId. The selected component directory is components/omp-adapter/versions/<releaseId>.

Before activation, the installer validates the component manifest identity, each declared SHA-256 and size, and all four compatibility fields against the active or requested native manifest. The loader repeats the same refusal gate before it imports adapter code. An explicit adapter rollback refuses an incompatible target. A failed activation restores the prior component and native state.

Install or update

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    Start["ReleaseManifest validate"] --> Config["load House config"]
    Config --> Preflight["platform + payload hash preflight"]
    Preflight --> Mutable["create and ACL-restrict mutable dirs<br/>and room state"]
    Mutable --> Legacy["one-time legacy import"]
    Legacy --> Backup["pre-upgrade database backup"]
    Backup --> Stop["stop service"]
    Stop --> Stage["stage, copy, write manifest,<br/>atomic version rename"]
    Stage --> Stable["update stable manager, runtime config,<br/>secrets, OMP client projection"]
    Stable --> Pointer["atomically update current.json"]
    Pointer --> Migrate["run production migration registry"]
    Migrate --> Service["install or update Windows service"]
    Service --> Run["start service and await health"]
    Run -->|"ready"| Loader["register stable OMP loader"]

    Stage -->|"failure"| Restore["restore pointer and database;<br/>remove failed first install"]
    Stable -->|"failure"| Restore
    Pointer -->|"failure"| Restore
    Migrate -->|"failure"| Restore
    Run -->|"failure"| Rollback["rollback to prior release"]

Sources: package.json, rust-toolchain.toml, installer/native-release-contract.ps1, installer/build-native-release.ps1, installer/omp-adapter-component.ps1, installer/native-build-cache.ps1, adapters/omp/deploy-local.ps1, .github/workflows/release.yml, crates/athanor-install/src/installer.rs, manifest.rs, layout.rs, boundaries.rs, omp.rs, service.rs, and supervisor.rs.

Explicit rollback and removal

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    Rollback["rollback command"] --> Undo["take undo backup"]
    Undo --> Stop["stop service"]
    Stop --> Pointer["flip current pointer to prior version"]
    Pointer --> DB["restore prior database backup"]
    DB --> Start["start and await readiness"]
    Start -->|"failure"| Newer["restore newer release"]

    Uninstall["uninstall"] --> Remove["remove service, operator integration,<br/>and program files"]
    Remove --> Preserve["preserve operator data"]
    Purge["purge + explicit confirmation"] --> Destroy["remove operator data"]

Sources: package.json, rust-toolchain.toml, installer/native-release-contract.ps1, installer/build-native-release.ps1, installer/native-build-cache.ps1, .github/workflows/release.yml, crates/athanor-install/src/installer.rs, manifest.rs, layout.rs, boundaries.rs, omp.rs, service.rs, and supervisor.rs.

12. Web operator surface and parked Godot specification

Architecture flow from The Athanor Code Flow Map
Read the diagram source
flowchart TD
    Host["Athanor Host"] <-->|WebSocket: parked client| Session["AthanorHostSession"]
    Session -->|"owns credentials and transport"| Link["HostLink"]
    Session --> Protocol["protocol.rs<br/>wire vocabulary, parsers, delta application"]
    Protocol --> Shell["shell.rs router"]

    Shell --> Resume["Resume"]
    Shell --> Policy["RecallPolicy"]
    Shell --> Routing["Routing"]
    Shell --> Familiar["Familiars"]
    Shell --> Dispatch["Dispatch"]
    Shell --> Health["Health"]

    Policy -->|"only authored mutation"| Requested["requested Recall mode"]
    Routing --> ReadOnly["read-only projections"]
    Familiar --> ReadOnly
    Health --> ReadOnly
    Dispatch --> Packet["validated OMP spawn packet<br/>never executes it"]

    Session --> Boat["PaperBoatReceipt state"]
    Boat --> Chat["S01ChatCenter"]
    Chat --> Composer["Composer<br/>visibly disabled: no conversation command"]
    Chat --> Message["MessageCard"]
    Chat --> Receipt["ReceiptCard"]
    Chat --> Disclosure["DisclosureBanner"]
    Shell --> Nav["ReliquaryNavigator"]

    Effects["Effects Lab"] -.-> Juicee["third-party Juicee plugin"]
    Prototype["gui-prototype/<br/>read-only operator surface"] --> Proxy["serve.ts: loopback proxy"]
    Proxy -->|nine POST-only /live/* read routes| Host

The Rust extension owns Host protocol state. GDScript composes the visible instrument. Generic design-system components present state but do not gain persistence or transport authority. The composer remains disabled because the Host protocol does not implement a conversation-send command.

Sources: gui/src/, gui/screens/s01_chat_center.gd, gui/design-system/components/, gui/navigation/reliquary_navigator.gd, gui/effects_lab/effects_lab.gd, gui/main.tscn.

13. Module ownership index

Rust production modules

Crate Modules Boundary
hearth (23) lib, authority, canon, cluster, context, conversation, error, giga/*, hallway, lesson_triggers, lineage, recall, remember, room, triggers Vocabulary and pure rules only: typed requests and receipts, context classification, transcript/source identity, Hallway validation, trigger vocabulary, quest normalization. No file, socket, database, or clock
origami (22) lib, sea, boats/*, cranes/*, hallways/* The communication layer: paper boat records, sleep and wake; Crane envelopes, PostgreSQL outbox and receipts, JetStream broker and the delivery loop; Hallway channels, messages, Bells and Knocks over PostgreSQL
summoning (7) lib, anamnesis, presence/* The waking cycle's typed requests: Anamnesis read and write shapes, Presence frames, turns and settlement rules
protocol (5) lib, contract, harness, host, restart/* Substrate JSONL DTOs/results/errors, Host command/event envelopes, harness and restart wire shapes
vault (12) lib, config, documents, error, ignore, index, model, rank, recall, text, walk Strict file-authoritative, database-free Vault retrieval
akasha (114) lib, main, config, state, settings, migrations, backup, health, remember/*, recall/*, bm25f, canon, entity, anamnesis, lesson/*, cluster, paper_boat, presence, hallway, timeline, docket/*, giga/*, giga_worker/*, insula/*, insula_writer, restart/* JSONL dispatch, PostgreSQL configuration and migrations, durable organs, retrieval, lesson registry and trigger engine, Presence session rows, Docket, GIGA, Insula telemetry, restart intents, backup, and health
host (15) lib, house, config, chat, insula, panel, policy, presence, receipt, routing/*, server, store, viewport One in-process multi-room listener, authenticated client boundary, room projection state, Recall Policy, receipts, panels, viewport shaping, worker lanes, spellbook dispatch, and the delivery task it spawns. Presence frames and ledgers are cached here; presence_sessions in PostgreSQL is their authority
omp-keeper (10) lib, main, clock, config, control, decide, keeper, protocol, resolve, session Supervises one OMP session per room: restart intents, relaunch decisions, and the substrate executable it resolves
interactive-process (1) lib Child process with a PTY-shaped stdin/stdout contract for the keeper and installer
athanor-install (20) lib, main, app, bin/athanor, bin/athanor-chat, boundaries, component, endpoints, harness/*, installer, layout, manifest, native_runtime, omp, service, supervisor athanor.exe: installed layout, release validation, transactional update/rollback, runtime planning, Windows service supervising PostgreSQL and NATS, OMP integration, and the in-process Host
athanor-godot (14) lib, host_link, host_session, protocol, shell, tokens, disclosure, recall_policy, routing, familiar_status, dispatch, health, harness_control/*, paper_boat_receipt Thin native client transport, exact Host wire contract, projections, shell routes, and Paper Boat receipt state (parked; the web gui-prototype/ is the operator surface)

OMP adapter modules: 26

Area Modules Boundary
Adapter entry and loading index.ts, athanor-root.ts, installed-loader.ts, discovery.ts OMP registration, installed-source resolution, room discovery, lifecycle hooks
Transport and capture rust-transport.ts, giga.ts, kitten-lineage.ts Long-lived substrate child, transcript/source-ledger ingestion, task lifecycle bridge
Standalone guard hygiene.ts Repository/packaging hygiene check; not a session runtime import
House proof runtime tools.ts, host.ts, context.ts, recall-policy.ts, recall.ts, substrate.ts, room.ts, conversation-log.ts, lesson-context.ts, lesson-ttsr.ts, routing.ts, lineage.ts, entity-resolution.ts, anamnesis.ts, recall-telemetry.ts, feedback.ts, text.ts, constants.ts Tool registration, Host clients, context assembly, retrieval routing, room files, native lesson guards, lineage, entity handling, telemetry, and shared text/constants

Parked Godot GDScript

Area Modules Boundary
Product screen screens/s01_chat_center.gd S01 composition and visible session/receipt state
Navigation navigation/reliquary_navigator.gd Shell navigation projection
Design components receipt_card, consequence_button, composer, message_card, evidence_card, status_channel, text_action, disclosure_banner, field_row, reliquary_panel, page_header, ritual_surface Presentation components; no persistence or transport authority
Effects lab effects_lab/effects_lab.gd Separate visual experiment using the external Juicee plugin
External plugin addons/juicee/ Third-party effect implementation treated as one dependency node
Proof satellites navigation/tests/, screens/tests/, effects_lab/tests/ Parked Godot smoke and contract checks; not runtime ownership

Operational surfaces

Path Responsibility
package.json Native product version authority and local command entry points
adapters/omp/package.json Adapter component version authority
rust-toolchain.toml Pinned Rust toolchain authority
installer/native-release-contract.ps1 Version resolution, toolchain identity, early refusal, and stage timing
installer/native-release-contract.test.ps1 Isolated proof for the native release contract
installer/omp-adapter-component.ps1 Shared source-only component builder and component identity authority
installer/omp-adapter-component.test.ps1 Isolated proof for component manifest, artifact, and identity contracts
adapters/omp/deploy-local.ps1 Adapter-only test, build, and manager deployment; never writes Program Files directly
installer/build-native-release.ps1 Fetch, verify, compile, stage, import, hash, and assemble a native payload with its fallback component
installer/native-build-cache.ps1 Deterministic dependency cache used by release assembly
installer/athanor.iss Windows installer packaging
.github/workflows/release.yml Product and component build proof, Inno packaging, and retained release proof
substrate/deploy-local.ps1 Local substrate deployment helper
substrate/state_paths.sh Shared local state-path resolution for substrate operations
.github/workflows/ci.yml CI proof; not runtime
tests/, crate tests, substrate/tests/ Cross-boundary proof satellites
gui-prototype/ Read-only web operator surface; nine POST-only /live/* routes through serve.ts to the Host

14. Fast traversal paths