Furth FortuneM9 reference

Mission foundation / System overview

Keel

Shared math, simulation, and ML kernels

Keel supplies fast, reusable compute functions. The functions take parameters from Trident; they do not contain mission thresholds or policy.

Inside the system

Architecture plates

Each plate preserves the internal layout, paths, boundaries, and highlighted decisions. Use the short label first, then follow the lines through the system.

Plate 01

What Keel refuses to be

the boundary test · gravity as data · three membership tests

ONE QUESTION DECIDES EVERY FILE a candidate C file a solver, a query, a kernel that two engines both want generic parameterized computation? read the header, not the caller YES → native/keel/ kernel layer. Every value is a parameter. NO → a Trident .tri the value, the choice, the order, the policy THE WORKED EXAMPLE · GRAVITY IS A SCENARIO keel_physics_world.h phys_world_set_gravity(w, g[3]) the value arrives as caller DATA no keel file contains the text 9.8 same inputs, bit-identical result FAIL-CLOSED, NO DEFAULT phys_world_set_sleep refuses a negative policy; sleep stays OFF phys_world_set_ccd, same posture an undeclared case is refused THE DEFECT THIS STOPS a hardcoded algorithm constant baked into C. The repair is to PARAMETERIZE the value, never to move the compute out of C. MEMBERSHIP · EVERY TEST MUST HOLD 1 · include closure every include lands inside keel, or in an admitted seam 2 · identity generic compute over caller data. no scenario value, no policy 3 · driver coupling its runner compiles only keel C and drives no .tri program FILES THAT PASS A NAIVE PURITY GREP AND STAY OUT thalassa_diffusion_compute.h It includes shader/thalassa_glint_soft.h, so it depends on the renderer. thalassa_particle_sim.c and .h They name Trident types directly. They are not pure kernels. thalassa_anim_graph_plan.h An authoring-time graph plan, not a solver. thalassa_scene_sweep.h A scene query that COMPOSES keel kernels. It is a consumer.
Plate 02

Eight modules, and the three systems that consume them

the module census · who links each kernel · four corrected assignments

EIGHT MODULES · EVERY ONE kernel LAYER physics · 155 XPBD, FEM, MPM, rods, fluids, CCD spatial · 8 hashed Morton octree, geocell CRS audio · 8 acoustics query, HRIR, sound-graph DSP anim · 7 pose, IK, spring bone, skin cache propulsion · 3 launch and propulsion kernels navmesh · 3 bake, tiled rebuild, tile-cache carve graph · 3 generic container primitives ai · 2 packed-SoA crowd batch store WHO LINKS A KEEL KERNEL Trident · 9 files trident_rt.c includes 54 keel headers AND compiles 48 keel .c files into its own translation unit. trident_kernels.c holds the phys.* and crowd.* verb edges over them. Thalassa · 35 files thalassa_reef_cull.h, thalassa_reef_light_cull.h, the probe graph, thalassa_scene_aoi.h, thalassa_scene_sweep.h, the host supervisor. The engine composes the kernels. It does not own them. Fathom · 1 file fathom_scene_shard.h reaches the spatial index, so the server side resolves shard residency with the same primitive. ONE KERNEL, TWO ENGINES Keel exists because Trident and Thalassa need the same solver. A second copy would drift, and then neither copy is the oracle. A MODULE NAMES WHAT THE KERNEL IS, NEVER WHAT CALLS IT graph_containers vfx named its CONSUMER, the particle graph. it takes graph acoustics_query spatial named its DEPENDENCY, the index. it takes audio sg_kernels sg abbreviates sound-graph, not skin. it takes audio geocell a geospatial CRS transform. It computes no physics. it takes spatial
Plate 03

The layer rule, and the two seams that leave

the layer ladder · keel's whole outward reach · the gate that only warns

THE LADDER · INCLUDES RUN ONE WAY tool build-time generator or CLI host owns main() or the event loop core · bind · platform the engine tier: one, not three kernel native/keel/ · all 8 modules foundation OS and compiler normalization A file may include its own layer and any layer below it. Only a host or a tool file may include a host file. KEEL'S WHOLE REACH OUTSIDE ITSELF ../platform/platform_thread.h foundation. The edge runs down. keel_physics_world.c holds it. ../nautilus/nautilus_mesh.h kernel. The edge runs sideways. keel_physics_remesh.c holds it. any core file REFUSED. Zero such includes exist. This is the point of the directory. EVERYTHING ELSE intra-keel, or a C standard header: math.h, stdint.h, stdatomic.h, string.h NOTHING BELOW KEEL REACHES INTO IT 45 files outside keel include a keel header. Their declared layers: core 14 · host 29 · kernel 2 foundation 0. The ladder holds. THE tests/ CARVE-OUT A file under tests/ takes the host layer, so keel_anim_springbone_ chain_test.c may reach Thalassa. THE GATE ONLY WARNS TODAY gates.source-naming class 12 runs under LAYER_MODE = "warn", so it reports the direction, not refuses it.
Plate 04

How a kernel reaches a Trident author

the phys intercept · hit and miss · what the keel gates prove

phys.<family>.<verb>(args) · THE THREE-SEGMENT INTERCEPT a .tri scenario phys.xpbd.step(cfg, rows, dt) it declares the values the phys umbrella a PURE reserved root, so a bare phys.* is never callable PHYS_FAMILIES · 28 binary search on the family, then on its 137 verb rows HIT → the C verb edge one keel kernel call MISS → the .tri overlay the phys.<family> policy lib WHAT THE HIT COSTS trident_rt.c compiles 48 keel .c files into its OWN translation unit. No link line, no per-gate build change. WHY THE WHOLE COMPOSITE LOWERS Each verb kept in C removes one Trident-to-C crossing: the argument marshal, the namespace dispatch, the arena churn. TWO SHAPES OF THE SAME INTERCEPT phys · 28 families, 137 verb rows Membership resolves BEFORE the arguments evaluate, so a verb that is not C falls through to its .tri policy overlay and the arguments still evaluate exactly once. crowd.batch · 10 verbs, no overlay Every verb is C over keel_ai_crowd_batch.c, so an unknown verb is a hard UnknownFunction instead of a fall-through. The absent overlay is a declared decision, not an omission. WHAT THE KEEL GATES PROVE, AND WHAT THEY DO NOT 58 leaves · the numerics 41 physics lane + 14 numerics lane, plus 3 in Thalassa and Trident sections. 56 declare exerciseLayer c-kernel. NOT REACHABILITY A keel runner compiles only keel C and drives no .tri, by test 3. So no keel gate can prove a Trident path. WHERE REACHABILITY IS PROVEN 8 runners outside native/keel/tests/ compile a keel test AND drive a .tri, so each one fails test 3 itself.

Key parts

What the system does

These are the main boundaries, inputs, outputs, and failure rules. The examples show a specific use of each part.

Reusable kernels

Common calculations are implemented once and reused by applications and rendering systems. This improves consistency and performance.

Specific example

A route planner and a simulation can use the same tested distance and collision functions.

Policy stays outside

Keel performs general calculations but does not choose mission goals, thresholds, or actions. Those choices remain in Trident where they can be reviewed.

Specific example

A tracking function can score motion, while the application decides when that score should create an alert.

Common results

Shared functions reduce small differences between tools that should agree. Teams can compare outputs from the same mathematical base.

Specific example

Training, planning, and live support tools can apply the same coordinate and timing rules.

Uses

Example uses

Pilot questions

What the team must decide

Which calculations are repeated across systems

Which thresholds must remain mission-controlled

What level of repeatability the program requires

Request a technical briefing

Connected references

Mission foundation Trident Open reference Mission foundation Thalassa Open reference Assurance fabric Evidence and Verification Open reference
Return to the M9 reference library