Autopoiesis: Verifiable Service-Genome Fabric

Autopoiesis is a Python reference implementation for a compact, verifiable service-genome layer.

It focuses on the trust substrate needed for safe self-replication across edge and cloud environments:

• ServiceGenome models immutable service blueprints with resources, capabilities, invariants, mutation operators, and test contracts.
• GenomeSigner produces and verifies Ed25519 signatures for genome artifacts.
• PolicySandbox checks a genome against operational budgets and deterministic smoke-test contracts.
• AdmissionTokenIssuer and AdmissionGate sign and verify lightweight capability tokens for constrained edges.
• ProvenanceLedger records append-only replication events with a Merkle root and chain verification for tamper evidence.
• ReplicatorPlanner turns an approved genome into a deterministic rollout trace.
• ReplayHarness replays and verifies a rollout trace against the genome and attestation that produced it.
• ReplicaWeaveIntent provides a lightweight admission contract for solver/adapter integrations.

What is implemented

This repository ships a production-shaped core for the autonomy fabric:

• schema validation for genomes and policies
• content addressing via canonical JSON hashing
• signed artifact creation and verification
• deterministic smoke-test evaluation
• signed admission tokens for budgeted edge installs
• provenance logging with Merkle aggregation
• replayable replication traces
• a small test suite and buildable Python package

Install

python3 -m pip install -e .[dev]

Test

bash test.sh

Example

from idea187_autopoiesis_verifiable_service import (
    GenomeSigner,
    PolicySandbox,
    PolicyTemplate,
    ProvenanceLedger,
    ReplicatorPlanner,
    ResourceEnvelope,
    SafetyInvariants,
    ServiceGenome,
    TestContract,
)

genome = ServiceGenome(
    name="http-service",
    version="1.0.0",
    image_ref="ghcr.io/acme/http-service:1.0.0",
    capabilities={"network": ["https://internal.example"]},
    resource_envelope=ResourceEnvelope(cpu_millicores=250, memory_mib=256, bandwidth_mbps=20, cost_usd_per_hour=0.04, max_replicas=3),
    safety_invariants=SafetyInvariants(max_exposure=10, read_only_scopes=["/var/lib/cache"], denied_endpoints=["https://example.com"]),
    mutation_operators=[{"name": "safe-fork", "kind": "fork"}],
    test_contracts=[TestContract(name="startup", seed=7, input_fingerprint="boot", expected_output_hash="...")],
)

signer = GenomeSigner.generate()
artifact = signer.sign(genome)

policy = PolicyTemplate(name="default-edge", max_cpu_millicores=500, max_memory_mib=512, max_bandwidth_mbps=100, max_cost_usd_per_hour=1.0)
attestation = PolicySandbox().evaluate(genome, policy)

ledger = ProvenanceLedger()
entry = ledger.append(
    actor_did="did:key:z6Mkh...",
    action="replicate",
    genome_hash=artifact.genome_hash,
    attestation_hash=attestation.digest(),
    trace_hash="trace-hash",
    resource_snapshot=genome.resource_envelope.model_dump(mode="json"),
)

plan = ReplicatorPlanner().plan(genome, attestation)

Package

The package name is idea187-autopoiesis-verifiable-service and the import name is idea187_autopoiesis_verifiable_service.