Repository boundaries

Architecture / ecosystem topology

01 / Acquire

Gather live evidence

auths-proof-apps

02 / Exchange

Carry proof bytes

auths-proof-exchange

03 / Verify

Resolve authority

auths-proof

04 / Execute

Run sealed command

auths-proof-apps

Dependency direction

auths-proof-exchange ---> auths-proof
auths-proof-apps     ---> auths-proof + auths-proof-exchange
auths-proof          -X-> auths-proof-exchange
auths-proof          -X-> auths-proof-apps

auths-proof

Owns the offline protocol kernel, canonical model and codec, pure ports and registries, deterministic evidence verification, WASM verification, pure authoring, canonical core corpus, and fuzz targets.

It reads no clock, network, filesystem, database, environment, replay state, budget state, receipt sink, application profile, or private key.

auths-proof-exchange

Owns exchange messages, exact capability negotiation, bounded framing, typed peer observations, and memory, Iroh, HTTPS, TCP, Unix-socket, and offline-file transport adapters.

Networking carries proof. It never grants authority.

auths-proof-apps

Owns application profiles, live evidence acquisition, custody integrations, runtime orchestration, replay and budget state, receipts, configuration, reference applications, Auths Lab, and independent Go/TypeScript verifiers.

Placement test

If behavior cannot be evaluated deterministically from static proof bytes and explicit immutable context, it does not belong in the kernel.