5. The Compute Plane▲ Contents

Plane

Wunderblock answers what is memorialized. Herzschlag answers what is computable over it—the second plane of WunderOS, and the second published here. Memory without compute is an archive; the loop closes only when the substrate runs analysis over its own contents without surfacing them first. This internal analysis is the quilting point at which the substrate reads itself to defer its own termination.

Herzschlag

A systolic, SIMD-accelerated compute core in Zig. GraphBLAS-shaped kernels—semi-ring matrix–vector and matrix–matrix products (mxv, mxm, spmm) over CSR adjacency—run as BEAM-managed resource pools: lockless, cache-aligned, no GPU. The semi-ring selects the computation: Boolean for reachability, min-plus (tropical) for shortest paths, arithmetic for rank, and so on. One kernel surface, many algorithms. The GPU's objet petit a without the power bill.

Grafiklog

The graph-analytics surface on Herzschlag. Classical graph algorithms—reachability (BFS, SSSP, connected components, transitive closure), rank and centrality (PageRank, Laplacian), order and cycles—alongside hypergraph-native operations (dual, line graph, k-skeleton, k-core) that the Pentad's five-ary structure requires and a binary graph cannot express without lossy projection. Reached from Wunderlog as a graph atom: no separate API, no separate store.

Conformance

For every operation with a GraphBLAS-shape equivalent, Grafiklog output matches SuiteSparse row by row, checked continuously against an independent oracle. Substrate's VOPR-like determinism guarantees hold here as in Wunderblock memory: same graph, same query, same result.

6. The Query Engine▲ Contents

Engine

Gleamalog is the Gleam-Zig hybrid query engine that evaluates Wunderlog over the substrate. It is the sole query entry point: every read, whether from an agent, an operator, or the public protocol, passes through it. The language and the engine are distinct concerns; the engine is described here, the language in §10. A fuller treatment is in PLRN-019.

Arm Selection

Gleamalog selects among the substrate primitives per clause algorithmically, on query-planning principles, rather than by a fixed syntactic rule. The arms are:

• Forest (Blätterwald) — tiered LSM, exact graph Path-B. SSTable leaves tier from RAM through local NVMe to object storage.
• In-memory slab — ZRP navigation over HotSlab.
• VSA wavefront — multi-hop VSA for unbound and semantic shapes.
• Iota — institutional-tier adapter for upstream-projected facts.
• Bsc — BSC plane substrate for match-atom clauses.
• Hnsw — HNSW kNN substrate.

Caller intent constrains the feasible set; a cost model over already-maintained HLL sketches optimizes within it, under a semantics-respecting recall invariant and a tuple-target (first, midpoint, last). The architecture is ADR-120 (Abfrage); the forest arm is ADR-103 (Blätterwald).

Standing Leases

An agent does not ask the same question twice. It registers the question once and is told when the answer changes. A shadow lease is a registered standing query with three operations: register and receive a handle, read the current folded view, revoke. The query is a full Wunderlog query, not a smaller subscription language. Any join, recursion, temporal bound, or similarity match a one-shot query expresses, a lease expresses, since standing is an orthogonal modifier over the same planner. The narrow fixed-shape probe the substrate already had is the degenerate case, folded in unchanged.

Cost of the Change

A lease compiles to an incremental circuit over signed multisets, in the manner of DBSP. Each operator consumes a change and produces a change, so the work on each write tracks the size of the change, not the size of the answer. A retraction is a write of negative weight and propagates by the same arithmetic as an assertion. The join probes key-indexed traces rather than scanning; recursion feeds its own output back as a delayed input and re-evaluates only the layers a change reaches.

Determinism

Every change and every read carries the substrate epoch it reflects, the logical clock of §1, so a standing query is replayed exactly rather than merely re-observed. The circuit is clean-room Gleam. Correct behavior is defined by an offline conformance oracle that generates frozen change-stream fixtures and is never linked or shipped, the same discipline the compute plane uses against SuiteSparse (§5).

Approximate Operators

Similarity and optimal-transport matches are approximate and carry a false-negative risk: a missed match is a lease that never fires and a failure no one sees. A calibrated correctness layer bounds it. Each result is tagged fast-probabilistic or exact-certified, and an online gate, calibrated to the lease's recall target, decides which results escalate to the exact matcher. A compliance lease sets recall to one, every result escalates, and the deterministic path is the limiting case of the same mechanism.

Status

The exact-relational core is implemented and tested: the lease API, the change-stream representation, the circuit with join, distinct, and recursion, the conformance oracle, and the calibrated layer on the fixed-shape lease. The approximate operators rest on the vector primitive (PLRN-001) and the structured-memory certification path and are in progress. The architecture is ADR-048; a fuller treatment is in PLRN-010.

7. The Planner▲ Contents

Subsystem

Wunderblock answers what is memorialized; Herzschlag answers what is computable; the planner answers what is chosen—the third axis of §1, given here at the altitude of the memory plane. The planner is zg-planner. It runs over the Pentad substrate rather than beside it: plans are facts, methods are facts, preconditions are queries. The planner keeps no store of its own.

HTN Decomposition

A goal is reduced by recursive method application. A method names a task, the subtasks it expands to, and the conditions under which it applies. Decomposition proceeds top-down until every leaf is a primitive action the executor can actuate. Methods are stored as Pentads in the procedural tier and carried in a durable, write-ahead-logged per-agent method store. The architecture is fixed in ADR-025 and ADR-026.

Case Retrieval

Method selection is associative, not enumerative. A goal vector resonates against the method index and returns candidate methods by Hamming proximity in one SIMD pass—the same physics the memory plane uses for recall. The index supplies the candidates; the precondition oracle filters them.

Preconditions are Queries

A method's preconditions are decided by Sajak, an OWL-2 RL closure computed over the Datalog axis. The planner does not hard-code applicability; it asks whether a precondition is derivable from current memory under the ontology, then admits or rejects the method. The logic surface of §1 is load-bearing in planning, not adjacent to it.

Status

The decomposer, the durable method store, and the Sajak precondition closure are implemented and tested; the architecture is ratified (ADR-025, ADR-026). The live path from a customer agent's goal through decomposition to a committed plan is in implementation. The plan, once committed, is run by the Loom.

8. The Loom▲ Contents

Shadow & Customer Agents

Every customer-owned agent (CA) runs paired with a WunderOS-native, supevistory Shadow Agent. The Shadow Agent observes the customer agent's events, evaluates each step against contract, and gates emission. Shadow Agents are the productized supervisor axis: deterministic, CPU-focused, Erlang BEAM-back concurrency, resilience. The Ramadge-Wonham specification surface from §1 is exposed as a runtime peer, not buried in the harness; supervisory logic ships, deploys, and versions like any other artifact.

The Supremal

Each Shadow Agent enforces a Supremal: the synthesized supervisor for its contract. The Supremal is the supremal element of the policy lattice in RW theory; the unique maximally permissive supervisor for a given (plant, spec). Minimum restriction, never more nor less. Specs are written in Wunderlog and versioned like code; static synthesis of a fresh Supremal on change is specified in ADR-032. The aim is audit-grade, verifiable supervisors rather than hand-coded gates.

Plan Ledger

Plans are not transient. The planner emits steps as Pentads [(precondition, action, postcondition, compensating action, lineage)] and appends them to the plan ledger, an ordered durable record. Agents do not act from in-context plans. They act from committed ledger entries. Execution is replayable; pauses are resumable; the planner / executor split is clean. The planner writes. The executor reads. The ledger is the contract.

Saga Rollback

When a step's contract fails (Shadow Agent veto, tool error, vaccine trigger), the executor enacts the failed step's compensating action and aborts the invocation under a durable, write-ahead-logged decision. Multi-step unwinding—walking the ledger backward to compensate every prior committed step until the plan reaches a known consistent state—is specified as Sagenbaum (ADR-063). Forward and rollback are one primitive seen from opposite directions; the ledger is the axis of symmetry.

Earned Autonomy

Holding the right to use a tool is not the same as having shown one can use it. A competence gate unlocks a tool for a plan only when the agent has passed a probe for that plan, a certification it can do the thing it is about to attempt. Integrity and competence compose; both gate the call. The teacher that runs the certification loop carries no frontier model of its own: a grammar settles what is well-formed, the platform's own logic is the oracle for what is correct, and a single small encoder covers the rest. Re-certification is online, with no flag days, as the structured surface keeps changing. The architecture is ADR-081 (Lehrgerüst); the authority chain is in PLRN-014.

9. Compensation▲ Contents

Two Layers

The Loom (§8) enacts rollback; this is the architecture under it. A compensation is the inverse of a forward action, and a saga runs compensations in reverse on failure. WunderOS splits the saga in two. A per-agent coordinator, inside the Shadow Agent, formulates each forward action with its inverse, because that formulation needs the agent's intent and exists only while the agent is live. A per-tenant executor, on the dispatcher bus, holds the inverses and fires them. The executor outlives any one agent, because a compensation timer runs for hours to weeks while a Shadow Agent hibernates and is torn down on disconnect.

Held Until Commit

A step's compensation is held until the whole plan commits, not discarded when its own step succeeds, because a later step's failure must still be able to undo this one. The held compensations form a tree that unwinds last-in-first-out on failure and retires all at once only on a terminal success. Commit is a property of the plan, not of a step.

Triggers are Leases

A compensation fires when a condition becomes true, and the condition is a standing lease (§6) over a temporal expression, pushed from the write path rather than polled. A deadline is a lease over a clock predicate that becomes true at expiry, so a timer weeks out and a tool call milliseconds out are one mechanism. A supervisory verdict that blocks an action already past the boundary is itself a trigger, so the customer needs no rollback logic of its own.

The Ledger is Never Edited

A compensation does not delete what it undoes. An immutable forward log records what was committed; a separate working memory is where compensations take effect, and it is reconstructable from the log. A compensation references, by address, the action it reverses, which is what makes it auditable, in the manner of audit-grade provenance (PLRN-006). Eviction is reframed the same way: discarding a fact under pressure is a forward action, and re-ingesting it from the log is its compensation.

Status

The design is adopted (ADR-063) and the reference implementation is landing in slices: the registration schema, the dispatcher protocol, the durable segment, trigger evaluation over leases, and the eviction reframe. The interim guarantee is best-effort compensation, decoupling rather than linearizability; provable deterministic rollback waits on the clock and simulation harness of §1. Cross-tenant triggers and a runtime limit on compensation cascades are open. A fuller treatment is in PLRN-011.

10. The Interface▲ Contents

Gleamalog

The engine that evaluates Wunderlog over the substrate is Gleamalog. It is described in §6; the language and the engine are distinct concerns. A fuller treatment is in PLRN-019.

Wunderlog

The native query language is Wunderlog, a Datalog variant optimized for LLM emission—agents produce well-formed queries without prompt engineering. A request body is a squirt: one or more scopes, each opened with WZ:: and closed with ETX; the squirt ends with EOT. Temporal operators map to MTL+ via Unicode glyphs with ASCII aliases.

N-ary Relations

Arity greater than 2 is supported by the ⟪⟫ role-binding operator in the O slot. K ≤ 5 produces resonance in the 0.37–0.50 range. K ≤ 10 is the practical ceiling. Higher arities require decomposition.

WUNDERLOG GRAMMAR                                  EBNF (v4 wire form)

<squirt>         ::= <scope>+ "EOT"
<scope>          ::= "WZ::" <tiers>? <modifier>? <item>* <end>
<end>            ::= "ETX" | "-30-"

<tiers>          ::= <tier_glyph>+ | "[" <tier_glyph>+ "]"
<tier_glyph>     ::= "ε" | "σ" | "ι" | "ω" | "λ" | "κ" | "Ω" | "⏚"

<item>           ::= <statement> | <squirt_block> | <rule>
<squirt_block>   ::= <label> "{" <tiers>? <modifier>? <statement>* "}"
<label>          ::= [a-z][a-zA-Z0-9_]*

<statement>      ::= <pattern> <modifier>?                  bare = read
                   | <action> <modifier>?
                   | <statement> <disj> <statement>

<action>         ::= <linda_op> "(" <pattern> ")"
<pattern>        ::= <pentad> | <temporal_expr>
<pentad>         ::= "(" <term> <term> <term> ")"
                   | "(" <term> <term> <term> <term> <term> ")"
<temporal_expr>  ::= <temporal> "(" <pentad> ")"

<rule>           ::= <atom> "(" <variable>+ ")" <arrow> <pentad>+
<arrow>          ::= "⇒" | ":-" | ":implies"

<modifier>       ::= "|>>" ("bindings" | "pentad" | "proof")

<linda_op>       ::= "⇑" | ":out"           write / emit
                   | "⇓" | ":in"            destructive read / consume
                   | "⊢" | ":rd"            non-destructive read
                   | "⊶" | ":retract"       retract a prior fact
                   | "⊸" | ":revise"        supersede a prior fact

<temporal>       ::= "♦" | ":once"          past: at some point
                   | "■" | ":historically"  past: always been true
                   | "●" | ":prev"          past: true at t-1
                   | "↤" | ":since"         past: A since B
                   | "○" | ":next"          future: t+1
                   | "◇" | ":eventually"    future: park until
                   | "□" | ":always"        future: forever

<disj>           ::= ";" | "∨"

<term>           ::= <atom> | <ns_atom> | <variable>
                   | <wildcard> | <string>
<atom>           ::= ":" [a-zA-Z_][a-zA-Z0-9_]*          :alice, :knows
<ns_atom>        ::= <atom> ":" [a-zA-Z_][a-zA-Z0-9_]*   app:ships_to
<variable>       ::= "?" [a-zA-Z_][a-zA-Z0-9_]* | "?"   ? = anonymous
<wildcard>       ::= "_"
<string>         ::= '"' [^"]* '"'
<closure>        ::= <atom> "+" <integer>?              :knows+, :knows+3

11. The Handshake▲ Contents

Protocol

WunderOS rejects JSON tool-calling envelopes. All HTTP requests carry Content-Type: application/x-datalog. The body is raw Wunderlog text. Authentication is Authorization: Bearer <token>. There is no REST resource model—every request is a Wunderlog statement evaluated against the bivectorspace.

Bootstrap

An agent begins by fetching the protocol primer from GET /agents.txt. After parsing, it completes the handshake by emitting a self-naming Pentad to POST /wunderlog:

Session Frame

A request body is a squirt—one or more scopes, each opened with WZ:: and closed with ETX; the squirt ends with EOT. The framing is telegraphic: -30- is the human-readable alias for ETX. A scope pins a copy-on-write snapshot of the named tiers for the duration of the scope.

• ε episodic · σ semantic · ι institutional · ω working memory.
• λ loom / procedural · κ compliance · Ω all tiers.
• ⏚ lineage ground (L-slot anchor).

Bare pentads (:S :P :O) are reads. ⇑ / ⇓ wrap writes and destructive consumes. Result modifier |>> selects bindings (default), pentad, or proof. Squirts are named lexical blocks: label { [tiers] |>> modifier … }.

POST /wunderlog HTTP/1.1
Host: api.pentad.ai
Authorization: Bearer sk-live-...
Content-Type: application/x-datalog

// Scope 1 — episodic + semantic. Writes, reads, nested squirt.
WZ::εσ
  ⇑((:Agent_Procurement :status "online"))
  ⇑((:Factory_1 app:ships_to :Warehouse_7))

  (:Factory_1 app:ships_to ?Dest) |>> pentad

  audit { σ |>> proof
    ♦((:User_Alice :has_role "Admin"))
  }
ETX   // -30- is the human alias

// Scope 2 — working memory. Prev-tick workflow check.
WZ::ω
  (:User_Bob :action "Payment")
  ●((:User_Bob :action "View_Cart"))
ETX

// Scope 3 — episodic. Park on SSE, consume when Job_123 completes.
WZ::ε
  ⇓(◇((:Job_123 :status "Complete")))
ETX

// Rule (outside any scope): friends are knows-chains of length 2
friends(?X ?Y) ⇒ (?X :knows ?Z) (?Z :knows ?Y)

EOT   // end of transmission, release the line

Operations

Glyph	ASCII	Operation
⇑	:out	Write. Etches a Pentad or rule into the bivectorspace.
⊢	:rd	Read. Non-destructive. Binds variables against matching facts.
⇓	:in	Consume. Destructive read. Fact is removed on match.
⇶	:infer	Infer. Transitive traversal up to H hops.
⍰	:explain	Reflect. Returns fuzzy NL context for a complex fact.
≋	:nl	Cast. Projects unstructured text into the vectorspace via LSH.
≜	:ns_bind	Mutate. Invents a new namespace concept and expands the ontology.

Lifecycle

Emitted facts do not remain static. Working Memory holds active context in superposition. Sleep cycles crystallize stable patterns into Episodic. Repeated invariants promote to Semantic (immutable). Procedural bindings are revisable action-trigger rules evaluated by Shadow Agents.

Error Shapes

Failures return the ↯ operator. ↯(:syntax, :parse_failure) indicates malformed Wunderlog. ↯(:hardware, :hop_limit_exceeded) means the 32-hop traversal ceiling was hit. ↯(:semantics, :unbound) means the predicate is unknown—expand the ontology with ≜ and retry.

Transport

Responses are newline-delimited Wunderlog assertions, not JSON. HTTP POST for synchronous evaluation. SSE for parked forward-MTL queries (◇ / :eventually). WebSocket for persistent bidirectional streams. The wire format is identical in all cases.

12. The Operator Surface▲ Contents

Operator Experience

An agent running under deterministic replay, non-repudiation, rollback, saga, fork-exec-commit, and supervisory control has sufficient substrate to host an operator experience that behaves like a debugger for a mid-run agentic workload. The operator can inspect a run, intervene forward, and branch back to a prior state. The UX foundation is ADR-106 (Benutzererfahrung); the debugger is ADR-092 (Leitstand).

Public Read Protocol

The first public read-query API for Gleamalog is Auskunft, a language-neutral wire contract over HTTP. It is read-only; all mutation stays in the write triad. The contract is fixed so that future SDKs can evolve from a published spec. The architecture is ADR-068.

Pipeline Tracer

The interceptor pipeline returns a single governed verdict on each tool call, memory write, and egress. A live event-log surface traces that verdict through the ordered evaluators, giving the operator a running view of what the pipeline admitted, redacted, or rejected.

13. Implementation▲ Contents

Cognitive Plane

Implemented in Zig. SIMD dispatch covers AVX-512, NEON, and scalar fallback. WaxBanks are page-aligned at 128KB—32 O_DIRECT pages. Storage uses O_DIRECT + io_uring for zero-copy NVMe access. Concurrency is lockless SWMR with CAS loops and atomic pointer swap over a 64-generation retired ring. Hot paths perform no heap allocation.

Control Plane

Implemented in Gleam on the BEAM. Provides HTTP gateway, actor supervision, AST parsing, query engine, and symbol-vector mapping. A NIF shared library bridges Gleam to Zig through Erlang’s C-ABI.