KYE Protocol™ · KYE Edge Arbiter™
✓ healthy health openapi json

Edge Arbiter™

Sealed-input deterministic arbiter for the KYE Edge Governance Rail. Evaluates a Compiled Authority Bundle™ against an Action Request and emits a signed Edge Decision Record with an integrity hash linking into the device-side Offline Evidence Log™.

edge.kyeprotocol.com · v1.0.0 · protocol kye.edge.arbiter.v1 · constitution §14 · §25

Deterministic

Same input + same Compiled Authority Bundle = bit-identical decision. Pure function modulo signed inputs.

SR 11-7 replay-safe

Sealed inputs

Each /arbitrate call carries a signed Bundle and a Context with timestamp + nonce. No wall-clock reads inside the engine.

Ed25519 over the Bundle

Offline-capable

4 deployment modes (connected, shadow, degraded, disconnected-edge). Same Worker serves all four.

Constitution §25 §6

The five-stage arbitration flow

One sealed input — Bundle + Action + Context — flows through five deterministic stages and emits one signed Edge Decision Record plus an Offline Evidence Log™ entry. No wall-clock reads, no external network calls, no retries inside the engine.

  1. 1VerifyEd25519 over BundleBundle signature + algorithm + key id check against the device-pinned trust anchor. Untrusted bundle = stop.
  2. 2MatchAction vs rule setFind every rule whose conditions match the (verified) action's fact graph. Pure function over canonical JSON.
  3. 3AuthorityAuthority chain walkWalk the principal → agent → tool delegation chain inside the Bundle. Empty or expired = stop.
  4. 4Decideallow · require_approval · denyCompose the verdict + obligations + the safety-floor override. Highest-severity rule wins.
  5. 5Emitkye.edge.decision.v1Sign the decision record. Append-only entry to the Offline Evidence Log™ for later replay-verification.

Deployment modes — pick by network reality

Same Worker code, four deployment shapes. Connected is the default; the others degrade gracefully as the network does.

ModeWhenBundle sourceEvidence
ConnectedNetwork healthy, control plane reachableFetched live from R2Streamed to the Resilience Loop™
ShadowBundle change under review (pre-prod)Side-by-side: old + candidateLogs both; enforces neither
DegradedControl plane unreachable; bundle still trustedLocally cached R2 copy (TTL'd)Queued for replay when network returns
Disconnected edgeAir-gapped device (in-vehicle, on-prem, IoT)Embedded in calling device's WASM buildLocal Offline Evidence Log™ — sync on demand

Where it goes

Vehicle & robotics

Action authorization at the edge while connectivity flaps. Disconnected-edge mode keeps the safety floor active when the cloud is unreachable.

Branch & in-store

POS, kiosk, and back-office workflows degrade to cached bundles when the WAN goes down — without dropping audit guarantees.

Sovereign & regulated zones

Data residency by design. The Bundle is signed centrally; arbitration happens inside the regulated boundary; evidence stays local until export.

Routes

POST
/arbitrate
Sealed arbitration of an Action against a Compiled Authority Bundle. Body: { bundle, action, context }. Returns kye.edge.decision.v1.
GET
/
This landing page (browser) or service descriptor JSON (API clients, content-negotiated on Accept).
GET
/health
Liveness probe — returns 200 if the arbiter is accepting traffic.
GET
/openapi
OpenAPI 3.1 contract.

Compliance

EU AI Act Art. 14 EU AI Act Art. 50 ISO 42001 A.8.2 SOC 2 CC 6.1 DORA Art. 11 SR 11-7

Try it

Quick smoke test from a terminal:

curl -s https://edge.kyeprotocol.com/health
curl -s https://edge.kyeprotocol.com/openapi
curl -s -X POST https://edge.kyeprotocol.com/arbitrate \
  -H 'content-type: application/json' \
  -d '{ "bundle": {…}, "action": {…}, "context": {…} }'