Furth FortuneM9 reference

Assurance fabric / System overview

System Boundaries

Layer rules that show where code belongs

Names and dependency rules separate core mechanisms, Trident policy, applications, products, and device hosts. A lower layer cannot depend on mission-specific behavior.

Inside the system

Architecture plates

Each plate preserves the internal layout, paths, boundaries, and highlighted decisions. Use the short label first, then follow the lines through the system.

Plate 01

The grammar: five segment classes, four of them closed

the grammar · one real file, decomposed · what each segment binds

1 · THE GRAMMAR <system>_<module>[_<unit>...][_<backend>][_<role>].<ext> every tracked .c .h .cpp .m .mm under native/ · a vendored tree keeps its names 2 · ONE REAL FILE, DECOMPOSED native/thalassa/bench/thalassa_plat_alloc_wrap_real_mac_bench.c thalassasystem platmodule alloc_wrap_realunit · free text macbackend benchrole · LAST cext 4 of 5 segment classes are CLOSED only the unit tokens are free text SEGMENT 1 · SYSTEM must equal the owning directory, native/thalassa class 2 refuses a mismatch SEGMENT 2 · MODULE the manifest maps it to exactly ONE layer class 3 refuses a stray SEGMENT 4 · BACKEND the whole TU compiles only for macOS here NO gate class reads it SEGMENT 5 · ROLE the role is the LAST segment, always _bench must sit in bench/, and bench/ needs a role a test_ PREFIX is class 5; the role is a suffix 3 · THE DECLARED VOCABULARY, AND EVERY EXCEPTION TO IT CLOSED: 12 systems · 230 modules · 34 backends · 11 roles · 5 governed extensions (c h cpp m mm). FREE: the unit tokens, any count. Every exception carries a reason: 267 alias rows, 6 override rows, 3 notrole rows, 1 guardfree header, 2 vendored trees the gate skips. 4 · THE DIRECTORY OVERRIDES THE LAYER THE MODULE IMPLIES module plat = platform what segment 2 implies for a shipped source file layerdir bench = host what the DIRECTORY declares for a driver that runs on top the file occupies host 1,233 of the 1,865 files take host from a driver directory the module names the SUBJECT, never the layer it occupies 5 · THE SHORTEST LEGAL NAME, AND THE GUARD IT DERIVES merfs_runset.h system merfs · module runset MERTEK_MERFS_RUNSET_H uppercase the basename; no alias Class 7 refuses any other guard. Class 8 refuses a header with none, unless the manifest declares it guardfree.
Plate 02

Twelve systems, one directory each, and the file population

the closed system vocabulary · files and modules per system · the platform seams

THE CLOSED SEGMENT-1 VOCABULARY · 12 VALUES SYSTEM OWNING DIRECTORY FILES MODULES thalassanative/thalassa1,02356 merdbnative/merdb20332 keelnative/keel1898 fathomnative/fathom13023 tridentnative/trident10828 nautilusnative/nautilus7623 gatenative/tools4326 merfsnative/merfs3912 merbufnative/merbuf247 appnative/apps175 benthosnative/benthos76 platformnative/platform64 SEGMENT 1 EQUALS THE OWNING DIRECTORY native/tools maps to gate. native/apps maps to app. Every other system maps to its own directory name. That one rule refuses cross-system squatting mechanically: a MerBuf file cannot hide under native/merdb/, because its name reads merbuf_ and the gate sees the path. A FILE UNDER NO DECLARED ROOT IS INVISIBLE The resolver returns no system, the sweep derives nothing, and the gate reports class 2 and stops. Such a file is invisible to the standard rather than in violation of it, which reads like compliance. Give a new C file a declared root. ONE SYSTEM OWNS EXACTLY ONE DIRECTORY A second row for a system replaces the first, and every file under the old root then falls outside the standard. THE SMALL SYSTEM THIS PAGE ABSORBS · native/platform/ · 4 MODULES, EVERY ONE foundation LAYER platform_base.h the feature-test baseline _POSIX_C_SOURCE and _WIN32_WINNT platform_clock.h mtk_mono_ns, monotonic nanoseconds QueryPerformanceCounter on Windows, clock_gettime on POSIX platform_memory.h mt_process_peak_bytes, high-water mt_process_current_bytes, right now platform_thread.h MtkThread, MtkMutex, MtkCond SRW locks on Windows, pthreads on POSIX A foundation file may include only a foundation file, so nothing here can reach a subsystem. Include platform_base.h FIRST in a translation unit, before any system header.
Plate 03

The layer DAG, and the direction the gate refuses

the DAG · the one engine tier · the driver directories · what the gate scores

1 · THE LAYER DAG · AN ARROW READS "MAY INCLUDE" toolbuild-time generator or CLI · 2 modules hostowns main() or the event loop · 2 modules engine tier: core · bind · platform 128 core, 2 bind, 13 platform modules each face may include the other two mechanism · Trident seam · device seam kernelpure computation · 78 modules foundationOS and compiler seams · 5 modules THE RULE keel RESTS ON A kernel file reaches NEITHER core NOR platform. Every keel module is kernel layer, so nothing under native/keel/ may include a core file. 8 keel modules across 189 files. THE OTHER ORDERING WITH TEETH Only a host file or a tool file may include a host file. Two layer rows name host, and only the tool row names tool. THE DIRECTORY DECLARES A LAYER layerdir tests host layerdir bench host layerdir fuzz host A driver owns main(), or it drives the system under test from above. DECLARED, NOT EXEMPT A driver that reaches a tool file still fires. A production file that reaches into tests/ still fires. 1,233 of 1,865 files take host here. 2 · WHAT THE GATE DOES WITH THAT DIRECTION TODAY every quoted #include an angle include is not ours resolve to a corpus FILE relative first, then by basename read both ends' layers off segment 2, or off layerdir legal edge wrong direction · 0 unresolved · 4 LAYER_MODE = refuse · CLASS 12 COUNTS The burn-down reached zero. A wrong-direction edge is now a class-12 violation and makes gates.source-naming red. Four includes do not resolve to a corpus file; the gate reports them and scores nothing because it cannot prove which file a compiler opens. LAYER_MODE is a source constant, never an environment variable, so no run can opt out of the finished rule.
Plate 04

What the gate refuses, and what it only reports

the eleven refusal classes · the self-test · unresolved includes · the unchecked invariant

TEN NAME AND SYMBOL CLASSES COUNT TOWARD REFUSAL 01a basename with no segment 2; the grammar needs <system>_<module> 02a segment 1 that is not the owning directory, or a file outside every root 03a segment 2 that the manifest does not declare for that system 04a role suffix that disagrees with its directory, or a role directory with none 05a test_ PREFIX, because the role is a suffix, always 06a hyphen or an uppercase letter in a C-family basename 07an include guard that is not MERTEK_<UPPERCASED_BASENAME>_H 08a header with no include guard that the manifest does not declare guardfree 09a duplicate basename anywhere in the tree, compared case-insensitively 11an exported symbol outside its module's declared prefix set CLASS 11 IS THE ONLY STRUCTURAL CHECK SEGMENT 2 HAS Segment 1 is checked against the owning directory, an independent fact. A wrong-but-declared module otherwise passes forever, with nothing against it. 119 module rows declare a prefix set. 111 declare a dash and are not checked. THE LIVE VERDICT mode=refuse layer-mode=refuse corpus=1,865 files 0 files carry a violation; 0 violations, including 0 class-12 edges. A corpus under 500 files refuses as implausible; an unreadable git refuses too. CLASS 10 · THE SELF-TEST, RUN FIRST Every run plants known-bad and known-good shapes in a scratch tree, then refuses if the checker misses one. The live tally: 5 planted name classes caught 2 class-11 plants caught, 4 class-12 caught 2 unresolvable includes refused 7 conforming shapes passed CLASS 12 · REFUSES A WRONG-DIRECTION EDGE 0 wrong-direction includes in the live tree. 4 other includes resolve to no corpus file and are scored as nothing, because a name match cannot see which file a compiler opens. SECTION 6 · NO CLASS AT ALL The manifest declares 34 backend tokens. The gate parses them and never reads one against a translation unit, so backend exclusivity carries no check. Section 10 action 6 of the standard owns it. THE LEAF ADDS ONE GUARD A python traceback in the output forces a fail: a crash that printed a census first would read like a clean run.
Plate 05

Layout: where a file may sit, and the trap in the carve-outs

the subsystem tree · the two carve-outs · the trap · the gate that holds it

1 · WHERE A FILE MAY SIT native/<system>/ *.h *.c *.cppcore implementation only README.md, Makefilethe top-level docs tests/nine of the eleven roles land here bench/*_bench.c fuzz/*_fuzz.c scenes/*.tri, not boot_*.tri or sys_*.tri scripts/app, integration and deploy run-*.sh lib/ conformance/existing semantic subdirs stay shader/ app/ rel/ 1,233 of the 1,865 C-family files sit in tests/, bench/ or fuzz/. Class 4 holds the mechanical half: a role sits in its directory. 2 · THE TWO CARVE-OUTS bulk untracked assets data/ models/ assets/ at the REPO ROOT, never nested in a subsystem, so a core edge is not buried under gigabytes. The one exception to nesting. generated output renders/ at the repo root rendered frames, captures and scratch out/ products, gitignored Never a per-subsystem out/, *_out/ or proof/ beside the code. 3 · THE TRAP git add -f into renders/ a directory a gate writes into the -f sticks gitignore skips a tracked file the next profile run rewrites that file mid-run the snapshot invalidates the driver aborts, exit 76 NO VERDICT FOR ANY GATE 51 MerBuf and 947 Thalassa results lost: 71% of that run 4 · THE GATE THAT HOLDS IT · gates.renders-tracked-output 13,791 tracked native sources read for renders/ tokens 441 gate-owned dirs plus 441 named sink files 40 tracked files under renders/ today 0 offenders each proof owns its path THE WRITE-TARGET SET IS DERIVED FROM THE TREE, NEVER LISTED Every renders/<path> token in a tracked native/ .tri, .c, .h, .sh, .ps1 or .bat, taken from renders/ onward. A new sink is covered the day someone writes it. Both separators count: a Windows runner spells %REPO_ROOT%\renders\thalassa\x, so the scan folds renders\a\b onto the same renders/a/b key and strips the CRLF carriage return first. Two floors run before any verdict: 6,000 tracked native sources and 150 derived write directories, so a git that cannot enumerate refuses instead of reporting an empty scan as a clean tree.

Key parts

What the system does

These are the main boundaries, inputs, outputs, and failure rules. The examples show a specific use of each part.

Owned vocabulary

Names identify the system and role of a component. A file or service should not hide where it belongs.

Specific example

A review team can tell whether a data rule belongs to storage, mission logic, or device support from its declared place.

Layer direction

Lower layers provide general mechanisms. Higher layers apply mission meaning and policy without reaching around the boundary.

Specific example

A mission application can use a secure storage service but cannot quietly change how that service enforces durability.

Placement rules

Shared capabilities live in known platform areas, while application-specific choices stay with the application.

Specific example

A new mapping function can be reused across programs without carrying one program’s mission assumptions.

Uses

Example uses

Pilot questions

What the team must decide

Which organization owns each boundary

Where program policy must remain visible

What cross-layer access should be refused

Request a technical briefing

Connected references

Platform M9 Open reference Assurance fabric Security and Tenancy Open reference Assurance fabric Release Assurance Open reference
Return to the M9 reference library