Aelyx refuses to manufacture certainty it does not have.

A durable record of what a project is, and why.

Most tooling that reads a codebase produces a summary and then throws away the question of where the summary came from. Aelyx keeps that question. Every fact it holds is anchored to a commit, carries the class of evidence behind it, and is stored apart from facts of a different kind.

AI is a client of project truth, never the owner of it. That sentence is not a slogan here. It is why the two things below are two things.

The pressure toward a number is strong and worth naming. A store of claims invites a column that ranks them; a UI wants to sort; a context compiler wants to pick the best three. And every mechanism that could fill such a column is a mechanism that fabricates it.

There is no confidence field, no relevance score and no certainty value anywhere in the knowledge model, and a test exists to keep it that way. What replaces it is a closed set of reasons, each of which names a structural fact that can be checked: an identifier matched, a path contained another, a claim cited a blob, a caller pinned something. A candidate carries every reason that applied, and merging two candidates merges their reasons rather than choosing between them.

That is strictly more informative than a number, and unlike a number it can be explained: every component answers why by naming a record.

#[test]
fn the_public_surface_names_no_confidence_score() {
    for forbidden in ["confidence:", "pub confidence", "score:", "certainty"] {
        // ... asserted against the crate's own public surface
    }
}

Three questions that do not collapse into one.

The obvious design is a lifecycle: discovered to verified to canonical to superseded. It was drawn, and then rejected, because every arrow in it joins two answers to different questions. Verification is a question about proof. Authority is a question about endorsement. Standing is a question about time.

Canonical requires Verified     endorsement without a check is what ADR-0006 forbids
Canonical requires Active       a withdrawn or superseded claim is not project truth
Refuted excludes Canonical      the same rule, from the other side

Approval refuses an unverified claim, by construction rather than by review. And the axis that is missing is missing on purpose: absence of evidence is not recorded as falsehood, because it is not falsehood.

Architecture that fails the build when it drifts.

A layering diagram in a document is a wish. In this workspace the boundaries are tests: a domain writes down the dependencies it is permitted to have, and a test compares that constant against what the manifest actually declares. Adding a dependency is therefore a visible edit to a list, which is the point. The strictest domain is checked four ways over, because a manifest is only one of the places a coupling can arrive from.

• audit depends on no other Aelyx crate, including the shared core. Its test checks the manifest, the source, the resolved lockfile graph and what that graph is capable of.
• policy does not depend on identity. A principal arrives as an opaque reference, so an authorisation decision has no path that could ask Identity anything.
• context has no store, and therefore no way to write anything.
• architecture has no proposer. It can assess claims and it cannot author them.

/// The direct dependencies this crate is permitted to have, written down.
///
/// Adding one is a visible edit to this list, which is the point. Note what is
/// absent and what its absence buys:
///
///     aelyx-parse   Context names none: a declaration's kind, its visibility
///                   and its parser identity arrive as the text those types publish.
///     rusqlite      there is no store. That is the whole shape of the domain.
///     uuid          there is no identity to mint. A candidate's identity is structural.
const PERMITTED: &[&str] = &[
    "aelyx-architecture",
    "aelyx-core",
    "aelyx-knowledge",
    "aelyx-lang",
    "aelyx-workspace",
    "serde",
    "serde_json",
    "thiserror",
];

#[test]
fn the_dependency_list_is_exactly_the_one_written_down() {
    assert_eq!(declared_dependencies(), PERMITTED);
}

[workspace.lints.rust]
missing_docs = "warn"
unsafe_code = "forbid"
unreachable_pub = "warn"

• audit Records what happened. Depends on nothing.
• core Identifiers, timestamps, the vocabulary everything shares.
• identity Who is asking, and how that was established.
• policy Whether this principal may take this action on this resource.
• workspace Registered repositories, and the Git anchor a fact is true at.
• lang What language a file is, and whether it is worth reading.
• parse Declarations, imports and call sites. Syntax only.
• manifest Reads Cargo.toml, go.mod and package.json as data.
• knowledge Asserted claims, their evidence, and their three axes.
• architecture Intended structure, observed structure, and the gap.
• context Chooses what a task receives, and refuses when it will not fit.
• secret Brokers one approved use of one credential.
• storage The store beneath the domains that have one.
• runtime The single surface every adapter goes through.
• node-protocol Local IPC framing. A pipe, not a network.

Three binaries sit on top of these: a command line, a local node, and the MCP adapter. There is no agent domain and no replication domain. Some of the architecture documentation describes them; the implementation does not have them, and the implementation is what this page reports.

What the architecture is meant to be, and what was actually found.

These are kept as separate records, and comparing them produces something more careful than a pass or a fail. The asymmetry below is the whole of it: a prohibition and a requirement cannot be judged the same way, because one is broken by a single fact and the other is only broken by the absence of every fact that could have satisfied it.

MUST NOT DEPEND ON
    one proven dependency        -> VIOLATED, under any coverage at all
    none observed, coverage full -> SATISFIED
    none observed, coverage part -> NO VIOLATION OBSERVED   (not the same sentence)

MUST DEPEND ON
    one proven dependency        -> SATISFIED, under any coverage at all
    none observed, coverage full -> VIOLATED  (proven absent)
    none observed, coverage part -> NOT ASSESSABLE          (not a violation)

no violation observed exists so that we read what we could and found nothing does not get reported as there is nothing. A model that treated the two rows alike would report a missing dependency every time a drive was unmounted.

A parser can prove a spelling. It cannot prove a target.

Aelyx extracts call sites. It does not build a call graph, and the distinction is deliberate rather than unfinished. Two files can both call login and mean two unrelated functions. A method call resolves through a receiver's type, which needs name resolution this system does not do.

So there is no field for a resolved target. Not an empty one, not an optional one. A field to hold the answer would be filled in with a guess by the first consumer that wanted a graph, and the guess would then be indistinguishable from an observation.

//! a declaration was written here          provable from syntax        Symbol
//! this file names that module               provable from syntax        ImportObservation
//! a call to something named `login`         provable from syntax        CallSite
//! this identifier occurs here               provable from syntax        ReferenceCandidate
//!
//! this call reaches THAT implementation     NOT provable from syntax    absent
//! this import resolves to THAT file         NOT provable from syntax    absent
//! this symbol is the same one as last       NOT provable from syntax    absent
//!   month's, renamed
//!
//! Everything above the line is in this file. Nothing below it is, and no type here
//! has a field that could be mistaken for one -- there is no `target_symbol`, no
//! `resolved`, no `callee_id`.

Being in the context is not permission to obey.

A compiled context is a document assembled from sources of very different standing, and the document says so in its own structure. Every section names the zone its content came from, and the preamble that states this is a compile-time constant of the compiler: nothing a repository contains can change it, which makes it the one line whose authorship a reader can be certain of.

Seven tools, and the reason the list is not longer.

Aelyx speaks the Model Context Protocol over local standard input and output. It needs the local node running and a credential; there is no hosted endpoint and no unauthenticated mode. The catalogue is a compile-time constant, so no file in any repository can influence which operations exist.

• aelyx.status read Whether Aelyx is here, which node, and what this adapter costs.
• aelyx.repository.resolve read Which registered repository holds this path.
• aelyx.session.create session state Open a scope. Returns an opaque handle with no readable structure.
• aelyx.session.inspect session state What a session has been given and what it has left.
• aelyx.session.close session state End one.
• aelyx.context.compile read What a task should receive, fitted to a budget. The only tool that discloses project content.
• aelyx.secret.use executes Runs one use profile a local administrator wrote down. The caller chooses which profile, and nothing else.

Six of the seven read. The seventh runs a program, and it is the only one whose effect is outside Aelyx: an approved use profile, written down in advance by a local administrator, who fixes the program, the arguments, the environment and the window. The caller chooses which profile and nothing else, and the reply is a constant.

Three capabilities the runtime has and the agent surface does not

• list-workspaces Enumerating every project on a machine is metadata disclosure with no demonstrated agent need behind it.
• list-repositories The same argument. An agent arrives holding a path and resolves it.
• select-context The unbudgeted half of selection. It returns more than compiling the same request, saves no work, and answers no question compile does not.

A compiled boundary, not a promise in a privacy policy.

Local-first is worth very little as a marketing sentence and quite a lot as a dependency graph. These are the specific things the workspace does not contain.

• Git network transports are not compiled in.

  The Git library is taken with default features off and four features named. None of them enables a transport, credentials, or the filter pipeline that can spawn a process. A test asserts the resulting feature list.

• There is no model and no provider inside Aelyx.

  Aelyx computes context. Whatever reads that context is somebody else’s program, running wherever the operator runs it.

• There is no telemetry subsystem.

  Not disabled by a setting. Absent from the workspace.

• The agent interface is local inter-process communication.

  A Unix-domain socket or a Windows named pipe, behind one synchronous API. The crate that provides it contains no TCP, UDP or resolver code.

What that does not amount to is a guarantee that nothing can ever leave the machine. An operator can still run a brokered profile that talks to a network, and whatever consumes a compiled context is a separate program with its own reach. The claim is about what Aelyx itself is built to be able to do.

Decisions that overturn earlier decisions.

The interesting property of a decision record is not that it exists. It is that a later one can contradict it, in writing, with the reason attached. A working example runs through this page.

1. ADR-0005

   Knowledge requires provenance, and the minimum field set includes confidence. Recorded as provisional, with a stated condition under which it could be refined.

2. Phase 5

   Building the store surfaced the problem: every mechanism available to fill that field would have invented its value.

3. ADR-0031

   There is no confidence field and no ordinal standing in for one. The earlier minimum is met rather than weakened: confidence is represented, as six explicit things, none of which is inferred.

4. Phase 7

   The context compiler arrived as exactly the consumer ADR-0031 named in its own reversal condition. The condition was checked, and it did not fire.

Figures, with what each one does not mean.

Every quantity below is either counted against the repository or read out of the implementation. Where the obvious over-reading of a number is wrong, the over-reading is written underneath it.

What Aelyx does not do.

Stated plainly, because a system whose whole argument is about the edge of certainty should be legible at its own edge.

• Call sites are indexed. Call edges are not.

  Aelyx can tell you a call expression spells login. It cannot tell you which login runs, and it has nowhere to write the answer.

• One operator, one machine.

  There is an identity domain and a policy domain, and they are built for a local administrator. There is no team, no organisation, no invitation and no shared server.

• The evidence here is project-scale.

  Every measurement on this page was taken against one repository of roughly 420 source files on one machine. Nothing here has been validated at another order of magnitude.

• The measured repository was Rust.

  Grammars for Go, Python, TypeScript and Dart are compiled in, but the coverage figure that produced these numbers came from a repository that was entirely Rust. That makes it a weak signal about mixed-language repositories.

• One MCP host has actually been observed.

  The adapter negotiates the protocol version that host negotiates. Interoperability with any other host is untested, not claimed.

• Nothing is released.

  There is no download, no installer, no package and no public repository. This page describes a system, not a product you can obtain.

It is also not an AI product. There is no model inside it, no embedding, no semantic search and no retrieval ranking. It computes a document; something else reads it.

A documented limitation turned out to be a channel.

One part of this system had a limitation that was written down, reviewed and accepted. A later adversarial pass established that the limitation was observable from outside, which made it something an attacker could read rather than something a user had to live with.

The response was not to document it more carefully. The contract changed: the externally observable reply became constant, so the distinction that carried the information no longer exists to be measured. The decision record explaining why is in the same history as the one that accepted the limitation.

The mechanics are deliberately not described here, and will not be. What is worth publishing is the shape of the correction, which is that a security finding changed an interface rather than a paragraph.