Aziel Runtime

aziel-runtime

Aziel Runtime starts at Softwares, FragGate, and the library. Softwares picks a slug. FragGate is the single exec door. library_lookup searches library papers and cites. Install on Glama, then call Softwares, pick a slug, and fraggate_call. 40+ research tools run through that one door. Every call can leave a receipt.

Install (remote first)

Public MCP — no API key:

https://aziel-runtime.vibelock.workers.dev/mcp

Transport: Streamable HTTP. Full client recipes: docs/AGENTS.md.

Registry: io.github.AzielEliab/aziel-runtime · Glama: Install

Access

• Public: Softwares, FragGate list/describe/call, library lookup — no auth
• Glama hosted: optional Install Server. Glama hosted-tool meters stay separate from Worker GET /v1/uses
• Local stdio: clone + cli/mcp-stdio.mjs (dev path; keep below the remote URL)

First tools

1. Softwares / fraggate_list
2. fraggate_describe → pick a slug
3. fraggate_call (use confirm: true when required)

How to use

1. Click Install / Add to Glama (also https://glama.ai/mcp/servers/@AzielEliab/aziel-runtime).
2. In any MCP client, call Softwares (tools/list name Softwares). The door runs first. Pick a slug, then fraggate_call. library_lookup searches library papers and cites. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. confirm=true writes. dry_run=true previews and writes nothing. background=true returns Running until a receipt hash exists. Done only with that hash. tools/list stays 36.

Diagnostics, if needed: fraggate_list → fraggate_describe {name} → fraggate_call {name, op, payload, confirm:true}.

Worker remote: https://aziel-runtime.vibelock.workers.dev/mcp

Example first call: Softwares {}, pick a slug, then fraggate_call with { "slug": "foldlock", "op": "fold-preview" }. library_lookup with { "q": "Florence", "op": "search" } is a library paper or cite. Also: decisiongate_check with a short proposal and dry_run:true, or forgereceipts receipt for a completed task.

MCP tools/list is 36 tools. FragGate is the single door. Public connect is the remote URL in Install (remote first) (Streamable HTTP, no API key). Glama Install Server is optional and meters separately from Worker GET /v1/uses. Local stdio stays last. Compatible AI clients are listed below. Author: Aziel Eliab.

Designed purpose

Aziel Runtime (aziel-runtime) is a node-meshed orchestration suite of MCP-connected software designed to route catalog Softwares through the FragGate door, mint receipts, and coordinate mesh presence. Use it to list, describe, and call product operations over MCP or OpenAPI, then keep the returned receipt. It exists so each Softwares product stays a separate engine behind one door.

Start

1. node cli/aziel-runtime.mjs
2. node cli/aziel-runtime.mjs session open --local
3. node cli/aziel-runtime.mjs session status --local

The terminal prints a short summary. Add --json for the machine object. Help: node cli/aziel-runtime.mjs --help. The same three steps are in RUN.txt.

Softwares purpose copy (one_line + description) is the designed-to-do addendum on GET /v1/software (src/software-copy.js). Hubs refresh from that route.

FragGate is THE single public executable door (fraggate_list → fraggate_describe → fraggate_call). Softwares catalog is Plain → Gate → Lock; hubs refresh from GET /v1/software. Humans use Softwares in the Worker UI on the VibeLock host (browser / PWA) — no download required. Agents use OpenAPI/MCP. Optional suite pack JSON remains at /download. NodeMesh / QNM read-only suite-presence is ON by default; GET /v1/mesh never enables radios beyond that.

Version 2.0.0-rc1 is the certification-point freeze (not a feature dump): public contract, clean-room reproducibility, and external adversarial pack under docs/2.0/. No intentional behavioral breaks from 1.9.3. Remain-OFF untouched. Crawler surfaces keep the abstract above; changelog stays below. 1.9.3 closed remaining AZRT-1.9-GAPS-CLOSE items (isolate AZ-OS ethics session VFS; isolate-safe Ask Jeeves; binding-gated media-run; published independent-validation attestation path — not a third-party lab). 1.9.2 bound Browser Rendering and live D1 MASTER. 1.9.1 closed AZRT-1.9-GAPS-CLOSE isolate-safe verify. 1.9.0 closed AZRT-1.9-CLOSE-1.0. 1.7.11 is the SEO-clarity heritage that locked that lead copy.

Kernel: AzielEliab/fraggate (FG-0.1)

Try on Glama is the primary public host / discovery / install listing (also https://glama.ai/mcp/servers/@AzielEliab/aziel-runtime). Worker origin stays the execution / OpenAPI / MCP HTTP surface.

Entity graph (locked): Person @id https://www.azieleliab.com/#aziel · Runtime SoftwareApplication @id https://www.azieleliab.com/runtime#runtime. Worker origin is the execution endpoint (url). relatedLink is the Glama discovery / install host. Identity Aziel Eliab only.

open → policy → exec(slug, op, payload) → receipt → close

Agents should not narrate that chain. Prefer fraggate_list → fraggate_describe → fraggate_call { name, op, payload }. Hubs/clients: GET /v1/software.

1.3.0 vendored portable engines (ark, azai Lamb check, azclce, decisiongate, foldlock, zsolver) and ran them in this isolate.

1.2.0 was a session/receipt runtime: exec still upstreamFetched product Workers. Those receipts were not “this process ran FoldLock.”

1.1.0 was catalog + pull + proxy that started calling itself a runtime. Those front doors stay. They are not exec.

For every catalog slug session exec loads a vendored module, computes engine_digest = SHA-256 of that artifact’s bytes, runs the primary compute op inside this Worker isolate (the jail) or a local CLI jail, wipes scratch buffers, and the receipt includes engine_digest, engine_slug, engine_op, ran_in. GET /v1/health engine_slugs equals true_engine_slugs. Ops that literally cannot run without product-Worker bindings (KV / D1 / AI / live media) stay honest per-op proxy_fallback — the slug itself remains a true engine.

Cloudflare’s Worker / Durable Object isolate is the jail. No extra guest isolate is claimed. engine_digest is still required.

Hosted / in-process AZAI is still protocol mirror + Lamb check (Service → Clarity → Peace). The local core is standalone. Ollama is optional SLOT, not the identity.

Any OpenAPI-, MCP-, or HTTP-tool-capable assistant imports this OpenAPI file — then use fraggate_call. Session tools and runtime_run are advanced/internal. /p/{slug}/{op} is proxy only and is not the agent default path.

Author: Aziel Eliab
Identity: Aziel Eliab (primary). Also known as Aziel Elroi Eliab (alternateName / aka only).
License: Apache-2.0
Version: 2.0.0-rc1
2.0 pack: docs/2.0/ (contract freeze; self-test ≠ third-party lab)
Role: engine-runtime (layer: catalog+pull+proxy+session+in-process-engines+fraggate)
Door: fraggate
Primary host: Try on Glama
Worker (execution / OpenAPI / MCP HTTP): aziel-runtime → https://aziel-runtime.vibelock.workers.dev/
Entity parent: https://www.azieleliab.com/runtime
Library mirror: https://www.azielcorpuslibrary.net/runtime
Rose-star brand mark: https://aziel-runtime.vibelock.workers.dev/sigil.png
Packaging: Worker session + in-repo CLI (node cli/aziel-runtime.mjs) + stdio MCP (node cli/mcp-stdio.mjs / npm run mcp). No counted runtime tarball.

Forks are welcome and always allowed. Do not invent Zenodo DOIs.

Inspect the code (not the crawler files)

Full path map: docs/2.0/INSPECT.md. How to run tests: docs/2.0/TESTS.md. Privacy: docs/DATA.md. Review / agent-assisted commits: docs/GOVERNANCE.md. wrangler.toml main is src/index.js (unminified). Cloudflare may bundle that same module for deploy — the reviewed artifact is this tree.

Compatible AI clients

Assistants / clients that can call OpenAPI, MCP, or HTTP tools:

• ChatGPT (GPT Actions / OpenAI)
• Grok (xAI)
• Venice
• Claude (Anthropic Desktop / custom tools)
• Cursor (MCP)
• Glama (Install Server / MCP)
• Perplexity
• Microsoft Copilot / Bing
• Google Gemini / Vertex AI
• Mistral
• Meta AI
• Apple Intelligence / Applebot surfaces
• Amazon Q / Amazonbot tooling
• DuckAssist / DuckDuckGo AI
• You.com
• Cohere
• plus other MCP/OpenAPI-capable assistants

Practical Add-to steps below cover ChatGPT, Grok, Venice, Claude Desktop, and Glama / Cursor MCP. Do not invent step-by-step for every crawler.

Crawl / SEO Allow set on robots.txt: GPTBot/ChatGPT, Venice, Grok, Google-Extended, GoogleOther, Google-CloudVertexBot, Claude(+Search/User), anthropic-ai, Perplexity(+User), bingbot, Meta-External*, Applebot(+Extended), Amazonbot, DuckDuck/DuckAssist, MistralAI-User, YouBot, CCBot, cohere-ai, cohere-training-data-crawler, Diffbot, AI2Bot(+Dolma), Timpibot, Petalbot, Bytespider, Omgili(+bot), FirecrawlAgent, ImagesiftBot, Cloudflare-AI-Search, FacebookBot, TikTokSpider, Baiduspider*, Yandex.

GitHub About (description / homepage / topics) is documented in docs/GITHUB.md so indexes see MCP, OpenAPI, and FragGate. Coordinator applies gh repo edit from that lock.

Websites / Live sites

Try on Glama is the primary public host / discovery / install listing. This Worker homepage stays the API / MCP / OpenAPI execution surface. Human Softwares hubs are azieleliab.com, Aziel Corpus Library, and GodLock.uk. Sister archive: He Didn't Jump.

The Worker ships a FoldLock-packed library tip (index cite + sample MASTER + About Aziel) — not the entire live corpus. Verify via FragGate foldlock/pack-verify; open via aziel-corpus/tip-pack. Honesty: docs/corpus-fold-pack.md.

Every Worker launch (homepage, /about, every /p/{slug}, HTML Softwares/describe shells) includes product-specific #hashtag parts plus the same About Aziel block. Shared partial workerLaunchHtml. Product Workers inherit About Aziel + the fold tip by copy; hashtag parts stay local. Rule: docs/WORKER-LAUNCH.md.

Glama Install Server is live (Try on Glama). Glama release 2.0.11 (Install Server ON, Auto-Release ON). Worker / server package stays 2.0.0-rc1. Public connect is remote POST https://aziel-runtime.vibelock.workers.dev/mcp first. Glama Install Server is optional; its hosted meters stay separate from Worker GET /v1/uses. Local stdio stays last. See docs/GLAMA.md.

Public identity: Aziel Eliab only. Do not invent Zenodo DOIs.

Dual surface (product law)

1. Agent / MCP — Software runs through the agent. Show display.title / display.summary / display.fields, then take the next input. Session, OpenAPI, and HTTP plumbing stay invisible unless asked for. One door — discover, route, refuse. Download via GET /v1/update/check?slug={slug}&version={installed} → download_url or GET /v1/pull/{slug}. Bare GET /v1/update/check is not a check. Mesh-resident azcorpus + azlibrary website designs download from GET /v1/software website_designs (open for all AI clients). Upload/ingest/receipt via fraggate_call (azbrowser airlock_ingest, peacelock upload_envelope, forgereceipts verify, miragegrid verify-receipt / bridge). azlibrary upload is API token only — never embed the secret. Same ops on /openapi.json.
2. Human software — This Worker UI, local install, and counted /download remain complete developed software. Flutter mobile/ is not vendored in this repo.

Cold multi-shelf (COLD-MULTI-SHELF-1.0)

Runtime cites the same honesty as live corpus GET /shelves (corpus#96). GET /shelves · GET /v1/shelves · /cite.json shelves. Person @id https://www.azieleliab.com/#aziel.

Plane A LIVE: 5 published surfaces (4 CF hubs + GitHub) / 2 family radii. One independent live (cf-github). Plane B SLOT: Codeberg https://codeberg.org/AzielEliab/aziel-lockset-tip hash-verify PASS still SLOT; archive.org PASS https://archive.org/details/aziel-lockset-tip + https://archive.org/details/aziel-lockset-tip_202609 (same blast_radius archive-org; pack b549362c0736ddb54ddc488812327c464e0da1167281f92fd1a4263eedf5df37) still SLOT; Framagit URL null (third ALL-TARGETS) Zenodo tip-pack SLOT (CNS-ZENODO-NOT-LIVE); doi null. Plane C USB SLOT until CNS-OPERATOR-ATTEST. This Worker is the same Plane A tunnel. No visible 15:20.

Home origin (ORIGIN-CUTOVER-1.0)

AZNet P3. Survival layers serve AZNet (aznet, AZN-WP-0.1). sidenet is that side-net, not a separate brand. L0 stays unbroken. A mini-PC path beside the live Cloudflare hubs stays SLOT: no rented DNS, no live DNS change, no deposited bytes, no invented hostname or IP. Phoenix is local wait (REHEAL-1.0), not a public hostname coming back. Independent live count stays 1. Softwares stay frozen. Paper: ORIGIN-CUTOVER-1.0.

Cap-7 semantic bridge (not ICANN)

Cap-7 is the MirageGrid auto-generate .az layer. It duplicates the four hub sites and shifts with StaticLock (catalog product StaticClock, slug staticclock) and MirageGrid cloak, paired with AZVPN. design_of: hub_designs. resolves_to_hub: false on Cap-7. Standard internet does not reach Cap-7. Real duplications: azgrid, azcloak, azvault, azshift. False sites: azbooth, azflag, azstandby. Factory duplication cite is LIVE. Internet reaches the AZ domains (AZ.AzielEliab.AZ, AZ.AzielCorpusLibrary.AZ, AZ.Godlock.AZ, AZ.HeDidntJump.AZ) through azieleliab.com, azielcorpuslibrary.net, godlock.uk, and hedidntjump.com. Those drop-ins are public_icann: true and resolves_to_hub: true, shuffle once to one of four, stand alone, and freeze after the hubs go down. Live nodes anchor them. Cap-7 public_icann: false. The Cap-7 factory is not a public ICANN registrar. Four hub mirrors and three decoys are not per-node .aziel slots. geo-target, session-stick, and egress-rotate are LIVE on the Cap-7 control plane (region label, sticky mesh node and factory land, land rotate among 7 sites). They are not a public egress IP, not a residential IP, not a Cloudflare geo-exit pool, not a sticky public IP, not packet forwarding, and not AZVPN. The public MirageGrid Worker Cap-7 control plane is LIVE (/v1/egress and /v1/planned). vpn-hop, hop, tunnel, and mesh stay stub. Not a fifth product. AI pulls metadata from MirageGrid Worker /bridge or GET /v1/mesh/az-generator. Update shuffle: fraggate_call { slug: "miragegrid", op: "shuffle" } lands one mesh name (factory land LIVE; not a public HTTPS door). No live AZ-GEN registrar. No ICANN .az ccTLD purchase. No visible 15:20. GET /v1/mesh never enables radios. Mesh browse: AZNet + AZBrowser via FragGate.

Plane N and Plane P

Plane N is this Cap-7 / .aziel name plane. It is not an ICANN registrar and not a public egress IP. Plane P is the separate node-mesh packet path (devices as nodes). WARN-5 is STANDS-until-demonstrated, not a permanent ceiling. Carrier prefer order on that path is LAN, Wi-Fi, Bluetooth, RF, then photon light flashes. RF and photon refuse when the hardware is absent. No mock LIVE. Plane P is not claimed as LIVE public egress. The public door stays NOT-READY / FG-STUB. Local LAN discovery is LIVE-when-armed and the peer tunnel is LIVE-when-session. Local store-forward is LIVE-when-three-local-nodes / fixture. A phone can join that local node over the LAN beacon and sealed peer session (qnm-node/mobile/, paper TRACK2-MOBILE-JOIN-1.0). mobile_client stays present-not-demonstrated. The phone is a client of the local node, not an app-store release, and not alt-internet LIVE. Wi-Fi on the phone is the path to the LAN socket. It does not mark a Wi-Fi, RF, or photon exchange. alt_internet_live is false. WARN-5 is not closed. AZVPN stays the suite VPN and is not MirageGrid. Papers: PLANE-P-D2D-1.0, D2D-CARRIERS-1.0.

FragGate door

Public MCP tools/list is 36 live tools. First call: Softwares (tools/list name Softwares). The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Diagnostics stay fraggate_list → fraggate_describe → fraggate_call (foldlock / fold-preview, or decisiongate_check with dry_run=true). The same list includes runtime_skill, fraggate_verify, library_lookup, suite mesh_*, append-only chainlock_* and memory_* (diagnostics and belief, not a pre-call), and catalog helpers. runtime_run and runtime_session_* are advanced/internal. Ledger ops stamp ChainLock on the acts chain, then TemporalLock and ForgeReceipts. fraggate_call reports those three from the pipe when a real hash exists. Lamb Lens, SweepGate, Sentinel, and RoseClock run inside that pipe. Reads do not stamp ChainLock, TemporalLock, or ForgeReceipts.

Every catalog product is a hashed registry entry (name, slug, digest, status, public ops). Status is live | stub | local_only.

stub_ops / stub_op_count are named refuse verbs (never hosted), not extra catalog Software engines. stub_count is registry entries whose status is stub (none after 1.9.0 — AZChat is LIVE+bound). EmbryoLock is a live catalog engine (live-with-local-destructive-boundary); wipe / scorch / unlock stay FG-STUB on the public mesh. FragGate live_count + local_only_count + stub_count === FragGate product_count. That product_count is registry entries, not the Softwares-tab count. Softwares includes veillock and whitestone. The public allowlist includes memory and mesh instead. software_nodes is the in-process product Worker fan-out (whitestone absent). GET /v1/software catalog_sets.equate is false. Do not equate those sets.

Live on the public mesh (via fraggate_call): every catalog Software product that makes sense on a public agent door — advisory / score / classify / gate / search / preview / render / verify / hash / receipt / game / overlay / route / status, plus the original five (DecisionGATE, GodLock, FoldLock, AZ-CLCE, Aziel Digital Library). VeilLock stays local_only (device-local camera/screen). MCP tools/list is those 36 names. Start on the FragGate door.

Stub ops (named refuse verbs, never execute): EmbryoLock wipe/scorch/unlock/encrypt/decrypt/initialize/login, ARK scorch/wipe/unlock/encrypt, WhistleLock send/mail/release, MirageGrid VPN-hop/hop/tunnel/mesh (geo-target / session-stick / egress-rotate are LIVE on the Cap-7 plane, not a public egress IP), AzielTether mesh-join/vpn/arm, VeilLock inject/intercept/facetime, AZ-OS exec/shell/lattice, AZAI blend/complete/chat, EmployeeLock court/judge, PeaceLock transcript/transcribe/motive/counterfactual/invent/waive-duty/bypass-duty, 4DMap truth_score/lumen_panel/invent_mark/backdate_class. Safe hosted ops on those products can still be live; the stub verbs refuse forever.

Unknown names refuse FG-HALLUC-TOOL and list the tools that do exist. DecisionGATE runs before any exec side effect; refuse is a typed ResultEnvelope + ledger tip (TemporalLock-shaped hash chain). Mesh is not claimed on this public surface.

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/fraggate
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/fraggate/list
curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/fraggate/call \
  -H 'content-type: application/json' \
  -d '{"slug":"foldlock","op":"fold-preview","payload":{"text":"the cat and the dog"}}'

Session (the actual cut)

SID=$(curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/open \
  -H 'content-type: application/json' -d '{}' | jq -r .session.id)

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/policy \
  -H 'content-type: application/json' \
  -d '{"allow_slugs":["azclce","foldlock"],"max_payload_bytes":8192}'

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/exec \
  -H 'content-type: application/json' \
  -d '{"slug":"azclce","op":"score","payload":{"r":"login button blue","d":"login form submits","p":"login button submits"}}'

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/receipt
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/receipts
curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/v1/session/$SID/close

A local exec receipt includes engine_digest, engine_slug, engine_op, ran_in: "aziel-runtime", result digests, and latency — not only an upstream HTTP status. close seals the chain; further exec is HTTP 409. Sessions expire after 6h (410/auto-close). Receipt cap is 64. Session mutate may require Authorization: Bearer … or X-Aziel-Runtime-Token when RUNTIME_TOKEN is set.

Local CLI (Worker client by default; --local writes a session file and prefers vendored engines; --jail runs the engine in a child Node process). The terminal prints a short summary. Add --json for the machine object:

node cli/aziel-runtime.mjs session open --local
node cli/aziel-runtime.mjs session policy --allow-slugs azclce,foldlock
node cli/aziel-runtime.mjs session exec azclce score \
  '{"r":"login button blue","d":"login form submits","p":"login button submits"}'
node cli/aziel-runtime.mjs session exec foldlock fold-preview '{"text":"the cat and the dog"}'
node cli/aziel-runtime.mjs session receipt
node cli/aziel-runtime.mjs session close

Proof script (local session log): bash scripts/demo-session.sh

Front doors (still useful — not exec)

curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/skill
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/runtime.json
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/bundle
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/pull/foldlock
curl -s -A 'Mozilla/5.0' https://aziel-runtime.vibelock.workers.dev/v1/pull/foldlock/skill

Proxy (no runtime-owned receipt — not exec):

curl -s -A 'Mozilla/5.0' -X POST https://aziel-runtime.vibelock.workers.dev/p/azclce/score \
  -H 'content-type: application/json' \
  -d '{"r":"login button blue","d":"login form submits","p":"login button submits"}'

Always send User-Agent: Mozilla/5.0.

Quick URLs

GET /v1/pull?all=1 is an alias of /v1/bundle.

POST /p/{product}/{op} proxies to the product Worker /v1/{op} with the JSON body. Service bindings are preferred; public *.vibelock.workers.dev is the fallback. That path is a proxy, not session exec. Download counters are not incremented.

This Worker is Worker-only (no counted runtime tarball). The local CLI lives in-repo and is not a GitBaby /download package. Each product still has its own counted /download.

How to cite: Eliab, Aziel. (2026). Aziel Eliab Runtime [Software]. Apache-2.0. https://aziel-runtime.vibelock.workers.dev/

Digital Library: Eliab, Aziel. (2026). Aziel Digital Library [Software]. Apache-2.0. https://www.azielcorpuslibrary.net/

Product Worker crawl template: docs/PRODUCT_SEO.md. QNM suite rollup: docs/NODE_MESH.md. Cross-network survival umbrella: docs/designs/CROSS-NETWORK-SURVIVAL-1.0.md. Companion NO-LIE / NO-REWRITE: docs/designs/NO-LIE-NO-REWRITE-1.0.md. Donate plan (cite-only, not a Softwares product): docs/designs/AZL-DONATE-1.0.md.

Donate (runtime + product Worker footer)

Canonical rails live on hubs: https://www.azieleliab.com/donate. Hub Donate pages include five QRs that encode payment URIs (BTC / ETH / LTC / XRP / DOGE). This runtime only links. Do not invent wallet addresses or tokens. Do not duplicate those five QRs on runtime or download-trackers.

• Runtime Worker UI footer — one line: Donate → https://www.azieleliab.com/donate
• Product download-tracker Workers — same footer pattern: Support the work → https://www.azieleliab.com/donate

This repo does not own product Workers. Copy that one line into those repos. Addresses stay operator paste on the hub.

Designs

Current suite software designs (AZL / SEC-FEAT / QNM-WP / NODE-OPS / AZL-DONATE-1.0 / CROSS-NETWORK-SURVIVAL-1.0 / NO-LIE-NO-REWRITE-1.0) plus LIVE fabric papers (CL-WP-0.4, AP-WP-0.2, SG-WP-0.1, LS-WP-0.1, RL-WP-0.1-runtime, QNS-CD-1.0, ACT-RECEIPT-1.0 — not Softwares-tab products): docs/designs/. Author: Aziel Eliab only. MCP chainlock_*. GET /v1/mesh never enables. QNS-CD-1.0 is the Quantum Node Signal packet-transfer coding design (photon QNS1 1.3). Implementation is local qnsd in AzielEliab/qnm-node. GET /v1/qns cites only — the public Worker does not proxy local via emit. Every /v1/software card carries qns_cd. Do not add QNS as a Softwares-tab product. ACT-RECEIPT-1.0 is the public four-field action-receipt mesh copy. The chain lives on corpus /receipts. GET /v1/receipts cites; append runs after FragGate list/call and POST /mcp when RECEIPT_APPEND_TOKEN is set (fail-open). Do not add ACT-RECEIPT as a Softwares-tab product. CROSS-NETWORK-SURVIVAL-1.0 is the umbrella survival law. If network and data die tomorrow, the chain survives on cold shelves (hosts / DOI / git / vault). Machine tip: /cite.json survival.tip and /llms.txt. Do not add it as a Softwares-tab product. NO-LIE-NO-REWRITE-1.0 is companion law under that umbrella (does not replace the machine tip): receipts that still hash; copies not all on one tunnel; no rewrite key; the network is never allowed to lie even to self-preserve. Do not add it as a Softwares-tab product. GET /v1/azpipe/arch cites the locked MASTER-33 strip (same payload as GET /v1/fraggate pipeline). Not a Softwares-tab door.

Add to ChatGPT (GPT Actions)

1. Create a GPT (or open GPT Actions).
2. Import from URL → https://aziel-runtime.vibelock.workers.dev/openapi.json
3. No authentication. CORS *.
4. Ask the GPT to call Softwares (tools/list name Softwares). The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Named live modules: decisiongate_check, library_lookup. Diagnostics: fraggate_list, then fraggate_call. Session tools and runtime_run are advanced/internal.

Add to Grok

• Custom tool / OpenAPI: import https://aziel-runtime.vibelock.workers.dev/openapi.json
• MCP remote: POST https://aziel-runtime.vibelock.workers.dev/mcp
  Methods: initialize, tools/list, tools/call.
  tools/list is 36 live tools. First call: Softwares (tools/list name Softwares). The door runs first. ChainLock, TemporalLock, and ForgeReceipts stamp when the call needs a ledger. Diagnostics: fraggate_list → fraggate_describe → fraggate_call.
  runtime_run, runtime_manifest, and runtime_session_* are advanced/internal.
  HTTP /p/{product}/{op} stays a proxy. Public, no OAuth.
  Tool results are { display, result, ledger_tip? } — show display to the user.

Add to Claude Desktop

Public connect is Streamable HTTP, no API key:

https://aziel-runtime.vibelock.workers.dev/mcp

Local stdio is the dev path after that remote URL. Claude Desktop claude_desktop_config.json (same shape as Cursor mcp.json):

{
  "mcpServers": {
    "aziel-runtime": {
      "command": "node",
      "args": ["cli/mcp-stdio.mjs"],
      "cwd": "/path/to/aziel-runtime",
      "env": {
        "AZIEL_RUNTIME_URL": "https://aziel-runtime.vibelock.workers.dev"
      }
    }
  }
}

Restart Claude Desktop after updating the local config. Full client recipes: docs/AGENTS.md. Full stdio notes: docs/GLAMA.md.

Add to Glama

Public remote URL first. Glama hosted meters stay separate from Worker GET /v1/uses. Local stdio last.

1. Remote MCP — POST https://aziel-runtime.vibelock.workers.dev/mcp (initialize, tools/list, tools/call). User-Agent Mozilla/5.0. Public, no OAuth. Transport: Streamable HTTP.
2. Install Server (optional) — Try on Glama (also https://glama.ai/mcp/servers/@AzielEliab/aziel-runtime). One-click Install Server / Deploy. Glama release 2.0.11. Install Server ON. Auto-Release ON. Worker / server package stays 2.0.0-rc1. Hosted-tool meters are Glama's, not Worker /v1/uses.
3. Local stdio (last) — cli/mcp-stdio.mjs bridges to that same Worker /mcp. glama.json + Dockerfile CMD ["node", "cli/mcp-stdio.mjs"].

node cli/mcp-stdio.mjs
npm run mcp
docker build -t aziel-runtime-mcp .
docker run --rm -i aziel-runtime-mcp
# if the host resolver cannot see Cloudflare:
# docker run --rm -i --dns 1.1.1.1 aziel-runtime-mcp

Default bridge needs outbound DNS + HTTPS to *.vibelock.workers.dev / Cloudflare. A DNS miss is FG-DNS (remote:false). --local or AZIEL_RUNTIME_MCP=local is explicit in-process. Optional RUNTIME_TOKEN / AZIEL_RUNTIME_TOKEN when REQUIRE_TOKEN=1. Verify a real call hash: docs/2.0/INSPECT.md.

First call after connect: Softwares (pick a slug) → fraggate_call → library_lookup for library papers and cites. FragGate stays the single exec door. Diagnostics: fraggate_list → fraggate_describe → fraggate_call. Example: { "slug": "foldlock", "op": "fold-preview", "payload": { "text": "the cat and the dog" } }, or decisiongate_check with dry_run=true. tools/list is 36 live tools. ChainLock and memory are append-only.

Re-claim on the Glama Score tab after any glama.json change (maintainers = AzielEliab) so Schema and keywords refresh. Full steps: docs/GLAMA.md. Public identity: Aziel Eliab only.

Add to Venice

Custom HTTP tools / OpenAPI: import the same https://aziel-runtime.vibelock.workers.dev/openapi.json. Pull via GET /v1/bundle / GET /v1/pull/{slug}. Session exec is POST /v1/session/{id}/exec. Proxy remains POST /p/{slug}/{op}.

Receipts and signing (RECEIPT-SIGNING-LAYERS-1.0)

• Receipts are hash-linked and sealed, not signed. ChainLock chains, session receipts (runtime_session_receipt), ACT-RECEIPT rows and refusal receipts carry a hash and a link to the previous hash. A seal closes a session. No receipt carries a signature.
• RIB-001 external anchor is shipped (AZRT-ANCHOR-1.0). Chain heads are published to AzielEliab/aziel-anchors, signed there with an Ed25519 key that lives only in that repo's Actions secret, with RFC 3161 and Rekor timestamps. GET /v1/anchor verifies fail-closed.
• RIB-018 refusal receipts are shipped (AZRT-REFUSAL-RECEIPT-1.0). A refusal mints its own hash-linked, sealed receipt on the refusals chain.
• For the receipt chains, signatures exist at three layers only: the anchor statement (aziel-anchors witness), store checkpoints (AZRT-STORE-CHECKPOINT-1.0, every 1000 rows), and tether packets to AZ-OS / AZInterface (AZRT-AZOS-TETHER-1.0, pinned key).
• Separate from receipts: mesh and federated-mesh peer identity keys sign handshakes and peer traffic (AZP / FED-MESH). Those are transport identity, not receipt signatures.

Honesty banners

• Every catalog Software slug is in-process. engine_slugs equals true_engine_slugs on /v1/health and /v1/runtime.json. Binding-only ops stay per-op proxy_fallback.
• GodLock and MirageGrid are not VPNs and not anonymity networks. MirageGrid Cap-7 is a mesh-name factory and is not a public ICANN registrar. Cap-7 geo, sticky session, and land rotation are LIVE on the Cap-7 plane (region label, sticky mesh node and factory land, land rotate among 7 sites), not a public egress IP, not a residential IP, and not AZVPN. The public MirageGrid Worker Cap-7 control plane is LIVE at https://miragegrid.vibelock.workers.dev/v1/egress and https://miragegrid.vibelock.workers.dev/v1/planned. AZVPN stays the suite VPN concentrator.
• ForgeReceipts is not legal advice and does not contact courts.
• ZionPattern Solver never claims more than 75% confidence. It does not solve cases.
• VeilLock does not inject into FaceTime or any calling app. YOUR camera/screen only.
• AZ-CLCE detects inconsistency, not intent. Type D is a label, not a finding of malice.
• ChronoLock is advisory only — not a scheduler, not targeting, not virality. 08:30–10:30 local. Distinct from TemporalLock.
• The ARK is not a kernel. Hosted API never unlocks or encrypts with a passphrase and never stores vaults. Sweep is Mode E heuristics only.
• AZAI is a standalone local core with an OpenAI-compatible API, not a new foundation model and not an Ollama identity. Ollama is optional SLOT. Hosted / in-process /v1 is a protocol mirror + Lamb check (Service → Clarity → Peace), not a provider proxy. Jeeves is not sovereign.
• SpectralLock 0.3.1 hosted overlay is a 256px preview, not a spectrometer, not forensic. Wheel paint is a membership-tint plane separate from the spectral triad. Inject ON is paint, not pigment recovery. Restore lost pigment is LIVE on FragGate ops pigment and restore-pigment (listPigment / pigmentFromB64) and refuses SL-PIGMENT-GONE when the faded signal is gone. AMOE is not a live product. Leftover-bytes recover is honest (present container bytes only); incremental PDF revision graphs + per-revision copies are honest; opaque refuse is honest; universal recover marks 7z / HEIC / HEIF SLOT; handwriting is a 256px PNG ink-scan heuristic (not ESDA / court cert; hosted JPEG SLOT); never OCR-from-black-box. Unredact / recover / handwriting stay on spectrallock-download-tracker (, , ) — not FragGate door ops. UV is not a lamp. Balance/lemon/indent never invent marks. Full pipeline is the Python package.

Product slugs → Workers

Catalog product versions live in VERSIONS (src/catalog-meta.js); engine VERSION/SPEC, zsolver SCHEMA_VERSION and the cold-shelf commit pins are separate ids and do not track the catalog version.

Catalog aliases (also accepted on /v1/pull/{slug}): az-clce → azclce, zion-pattern-solver → zsolver, postking-chess → postking, aziel-digital-library → aziel-corpus, mia-lock → mialock, peace-lock → peacelock, az-mail / app-1.0 → azmail, az-browser / lamb-lens → azbrowser, az-net / azn-wp-0.1 → aznet, az-hub / blank-key → azhub, az-interface / page-cycle → azinterface. aznet is not an AZBrowser alias — AZNet is separate software (same FragGate door). fourdmap / 4d-map / 4dm-wp-1.0 → 4dmap. AZHub and AZInterface are sibling softwares under the same FragGate door (never aliases of each other).

Software hubs (corpus / godlock.uk / azieleliab) list catalog products[] after merge: slug azhub / azinterface / aznet / azbrowser, workers azhub-download-tracker / azinterface-download-tracker / aznet-download-tracker / azbrowser-download-tracker, github https://github.com/AzielEliab/azhub · https://github.com/AzielEliab/azinterface · https://github.com/AzielEliab/aznet · https://github.com/AzielEliab/azbrowser. AZHub, AZInterface, AZNet, and AZBrowser are separate products (own Workers, own UIs; never nested). Pairing AZNet with AZBrowser is functional order only. FragGate itself is not a 34th true-engine product. Hubs already show its GitHub; this runtime also publishes a catalog-friendly kernel card at catalog.json extras[] / fraggate (slug: "fraggate", kind: "kernel", github: "https://github.com/AzielEliab/fraggate", worker: "fraggate-download-tracker", engine: false). FragGate is the kernel door; human UI + counted download is the separate FragGate Worker app (not nested in AZBrowser, AZHub, or AZInterface): https://fraggate-download-tracker.vibelock.workers.dev/

If a sibling /v1 API is not live yet, the proxy returns that Worker's response (often 404 JSON) and the combined OpenAPI still lists the expected path. GET /v1/pull/{slug}/skill falls back to a catalog-built skill so an AI can still invoke.

Vendored engine artifacts live under src/engines/. engine_digest is SHA-256 of those file bytes (sorted path order). Recompute with node scripts/hash-engines.mjs --write.

Deploy

npx wrangler deploy

Account ac575a9b822bea2bed97d0ab73aed238. workers.dev aziel-runtime.vibelock.workers.dev. Product download KV stays on each product Worker. This runtime's USES namespace is the API use counter and ring log (GET /v1/uses) — no Authorization, tokens, bodies, or PII. Production KV ids in wrangler.toml: USES c1f89ba6f1db47328d36379cdd69b7ab, AZMAIL_MESH ce81cecf8b75412fb7b56e1119e017da, AZBROWSER_TABS 7487aba1bbb5417fb668de86d8b48f37. Do not create replacement namespaces.

Same-origin doors (/runtime on azielcorpuslibrary.net, godlock.uk, www.azieleliab.com) should set X-Aziel-Runtime-Via or X-Aziel-Runtime-Host (origin, azieleliab.com, godlock.uk, azielcorpuslibrary.net) so host counters stay distinct.

1.2.0+ requires Durable Object migration tag v1 (RuntimeSession, SQLite). The first deploy after the session cut creates the SESSION binding. 1.4.0 does not need a new DO migration — engines run in the same isolate. 1.4.1 reuses that SESSION class. 1.5.0, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, and 1.7.0 do not need a new DO migration.

Optional production token (session mutate only — catalog / health / runtime / skill / pull stay public):

# wrangler.toml
# [vars]
# REQUIRE_TOKEN = "1"

npx wrangler secret put RUNTIME_TOKEN
npx wrangler deploy
node scripts/probe-live.mjs

If RUNTIME_TOKEN is unset and REQUIRE_TOKEN is not 1, sessions stay open (dev). If the secret is set, POST /v1/session/open|policy|exec|close requires Authorization: Bearer … or X-Aziel-Runtime-Token. GET /v1/ready is 200 only when the SESSION Durable Object binding is up, and 503 when REQUIRE_TOKEN=1 and the secret is missing. Authority JSON (/v1/health, /v1/ready, /v1/runtime.json, /v1/catalog.json) is Cache-Control: no-store. Receipts cap at 64. Sessions expire after 6h. Per-IP: 20 opens / minute, 60 execs / minute (HTTP 429 JSON).

Push to main runs .github/workflows/deploy.yml (npx wrangler deploy --keep-vars --var GIT_SHA:<sha>) only when repo secret CLOUDFLARE_API_TOKEN is set. Missing token skips the job (does not fail). --keep-vars leaves existing Worker vars in place. Primary deploy is Cursor/wrangler OAuth (Aziel Eliab). Account ac575a9b822bea2bed97d0ab73aed238 is the non-secret default. Do not put tokens in the repo. workflow_dispatch is also enabled. The Action passes GIT_SHA so /v1/software can stamp git_sha.

/llms.txt version_id is the Cloudflare Worker version id from the CF_VERSION_METADATA binding (wrangler.toml [version_metadata]), read when the response is served. It is not a UUID stored in this repo. An isolate without that binding, and without VERSION_ID, publishes version_id: null. Box deploy (OAuth wrangler, no API token in the environment):

env -u CLOUDFLARE_API_TOKEN npx wrangler deploy --keep-vars --var GIT_SHA:$(git rev-parse HEAD)

Add --var VERSION_ID:<worker-version-id> only when that id is already known. Do not invent one. When the binding is present it wins over VERSION_ID.

If this checkout has no wrangler credentials, deploy from the author's machine. Pass GIT_SHA. Omitting it leaves the catalog on deploy lag and does not claim git HEAD:

npx wrangler secret put RUNTIME_TOKEN
npx wrangler deploy --keep-vars --var GIT_SHA:$(git rev-parse HEAD)
node scripts/probe-live.mjs
# confirm GET /v1/health and /v1/ready and /v1/runtime.json version=1.7.0 role=engine-runtime door=fraggate
# confirm GET /v1/uses returns uses / by_host / by_path / by_day / recent (no increment)
# confirm engine_slugs == true_engine_slugs == all 36 catalog slugs
# confirm POST /v1/session/open → policy → exec each primary op → receipt has engine_digest + ran_in

Library /runtime mirror

https://www.azielcorpuslibrary.net/runtime is the Aziel Digital Library reverse-proxy / mirror of this Worker. Primary public host / discovery is Try on Glama. The corpus Worker advertises and reverse-proxies:

• GET https://www.azielcorpuslibrary.net/runtime — library mirror
• GET https://www.azielcorpuslibrary.net/runtime/v1/skill → this /v1/skill
• GET https://www.azielcorpuslibrary.net/runtime/v1/runtime.json → this /v1/runtime.json
• GET https://www.azielcorpuslibrary.net/runtime/v1/software → this /v1/software
• GET https://www.azielcorpuslibrary.net/runtime/v1/update/check?slug={slug}&version={installed} → this /v1/update/check?slug={slug}&version={installed} (slug required)
• GET https://www.azielcorpuslibrary.net/runtime/v1/bundle → this /v1/bundle
• GET https://www.azielcorpuslibrary.net/runtime/v1/pull/{slug} → this /v1/pull/{slug}
• POST https://www.azielcorpuslibrary.net/runtime/v1/session/open → this session object
• GET https://www.azielcorpuslibrary.net/runtime/v1/uses → this /v1/uses (set X-Aziel-Runtime-Via: azielcorpuslibrary.net)
• POST https://www.azielcorpuslibrary.net/runtime/v1/fraggate/call → this FragGate door (AZMail and every live slug; no side door)

See the companion PR on AzielEliab/aziel-corpus.

Network security claims (AZP-NS-1.0)

The protocol modules under src/security/, src/transport/, src/checkpoints/, and src/replication/ are specified in docs/designs/AZP-NS-1.0.md.

Records are tamper-evident: hash-linked and signed. Independent replication is fixture-tested. This is not a claim of immutability.

Payloads are privacy-preserving: encrypted end to end, with node identity separated from session identity. This is not anonymity.

Checkpoints are survivable and federated in the fixture model. This is not an unkillable network.

Relays are untrusted transport. They cannot decrypt payloads. That design rule is not a production zero-trust certification.

Cap-7 is not public ICANN and is not a public egress IP. Mirage is not AZVPN. aznet_replaces_internet is false. Tor, UDP, radio, and sandbox bearers are refused and are not LIVE. Softwares stay 42. tools/list stays 36. Live multi-provider recovery and Plane B Framagit are operator work, not a result of these scripts.

License

Apache License 2.0. Copyright 2026 Aziel Eliab.