Useful software.
Recoverable foundations.

Applications, not a string pipeline.

A Cairn app combines pure WebAssembly guests, a graph of runtime-owned effects, signed deployment evidence and an HTTP interface. An author or AI agent can write transformations and rendering logic without obtaining arbitrary host authority. The graph declares where the application reads, writes, invokes or uses a governed provider.

Source-candidate and review tools stage a manifest-bound proposal before promotion. They expose capabilities and registered cost without silently granting deployment authority. Runtime checks still matter after review; a pure declaration cannot make a host import safe.

Application surfaces

Routes, authentication, tenancy, private input policies, rendering, versioned state, live queries, CRM and connector flows. Perffection is a separate product built on this generic engine.

Compute surfaces

Content-identified WebAssembly, capability sandboxing, Wasmtime instruction fuel, epoch interruption, per-node pure-result reuse and provenance.

Operating surfaces

Signed control records, metering, idempotency, audit/verification, privacy controls, custody/restore evidence and distributed authority components. An evidence command is not a regulatory certification.

This is not a general guarantee that generated software is correct, safe for every use, or production-certified. The mechanisms narrow authority and make failures inspectable; application policy and operating evidence remain necessary.

The graph is a contract.

Pure code, blessed effects

Pure guests transform their inputs with no ambient storage or network access. App authors do not create their own blessed effect modules. The runtime controls that small capability-bearing surface. Versioned store reads/writes and live query projections exist; a separate PostgreSQL road uses an explicitly composed adapter, not a database password handed to a guest.

Required inputs and φ

A node must not run before its required inputs are available. Cairn’s selection primitive φ requires every declared input and exactly one live, non-skipped branch. It preserves that live value’s identity. Zero or multiple live inputs refuse. A skipped branch is an explicit sentinel, not JSON null, and φ is not a first-response race.

The present served executor is topologically ordered. Its ordinary guest path does not yet provide a general arbitrary multi-input ABI; the special multi-input φ road is implemented. The lab’s two-argument planner illustrates dependency gating in its own host, not a new production scheduler or multi-input guest feature.

Fuel and caching

Wasmtime meters actual guest instructions and limits total work; epoch interruption supplies periodic cooperative yields. Pure cache coordinates bind code, inputs and granted capabilities. A cache hit reuses a result, not authority to repeat a paid or mutating operation. Fuel bounds computation; it does not by itself bound wall-clock I/O or prove termination of an external service.

Rewind state. Recover forward.

Recovery is part of the model, not a request to forget what happened. Versioned state and references let an operator return to a prior coordinate; pure computations can reuse retained results or run again from identified inputs. A supported external effect is compensated through a new authorized action, linked to the original.

Return to a known version

Move a reference or select an earlier versioned-store view. This does not rewind another system, erase an audit event, or promise that a live read will return yesterday’s observation.

Replay evidence, not the action

The portable core’s record/replay performer can return a retained effect result for an already recorded idempotency key instead of invoking that effect again. That scoped mechanism is not a universal cross-system exactly-once guarantee, nor automatic replay of every live read.

Compensate with current authority

The released PostgreSQL compensation road checks current undo-plan authority and derives a new signed effect intent linked to the original effect key. It resolves a current price and retains compensation outcome evidence. A provider-side reversal can fail or refuse; the original action is never silently erased.

Account for the recovery work

Guest execution has its instruction-fuel budget; priced effects have their own authorization and accounting. In the PostgreSQL path, compensation is separately priced forward work. This is not a claim that every recovery operation is fuel-metered, free, automatic or physically reversible.

“Recoverable” means explicit, evidence-preserving recovery paths where supported. An email cannot be unsent, a measurement cannot be unobserved, and a physical action may have no compensation. Recovery policy must say what can be restored, by whom, at what cost, and what confirms the result.

Keep private data out of the shared trail.

PII and free text stay sealed until an authorized step needs them. Shared state can carry a private-blob reference instead of plaintext. Subject binding, viewer/owner checks and signed access evidence govern reveal; retention and key erasure have their own verification paths.

Private input does not become public merely because a pure guest processed it. Its outputs remain private or scoped unless an explicit reviewed publish/reveal policy says otherwise. Privacy is a flow constraint, not a claim that arbitrary WASM can be proven to ignore a secret.

Locally executed contact and CRM flows have exercised submit, safe listing, governed reveal, promotion and replay boundaries. Specific hosted provider and operational tests exist separately. A broad compliance or current-fleet-health claim does not follow from combining those records.

Distribution already has real-world evidence.

Cairn is not only a single-process computation experiment. Its distributed components include authenticated elections, leases, writer fencing, forwarding, placement, projections and replication/recovery work. The retained hosted results below are distinct experiments, not one universal availability proof.

Further mirror reconciliation and recovery work remains under review. It is not represented here as released or deployed. The site is a dated capability map, not a real-time fleet monitor or an SLA.

Elasticity, with a policy boundary.

Geo-distribution and high availability need governed capacity, not an unlimited “add machines” loop. Cairn’s released placement mechanisms rank candidates against hard constraints and affinities, account for reserved and observed CPU, memory and durable capacity, and refuse admissions that exceed configured headroom.

Freshness matters in both directions. The measurement posture freezes scale-out and scale-in when evidence is not usable. Topology-plan checks model node-count, provider, declared spend-rate and protected control/storage floors, with a separate worker role that may scale to zero under policy. A planner cannot simply raise its own grant.

These are building blocks for policy-governed auto-elastic operation, not proof of an always-running production autoscaler. The released placement map explicitly distinguishes its shipped CLI/mechanisms from a running geo-node integration. The pure topology checker calls no provider API and moves no money; a declared spend ceiling there is not itself metered infrastructure billing.

Read the released placement map and topology policy checks. Availability still depends on actual deployment, failure domains, custody, recovery and operated evidence. No SLA follows from the label “high availability.”

Auditable chains for redundant computation.

A useful space-compute architecture must answer more than “did two values match?” It must identify the observation, code, execution conditions, result, authority to act and evidence of the external outcome. Cairn’s separation of pure computation from governed effects is a foundation for engineering that chain across redundant onboard workers, independent checkers and ground systems.

One observation, multiple executions

A blessed input boundary could capture an observation once and supply approved recorded bytes to separate workers. A mirrored observation is a copy of that observation, not a new measurement. Replaying its response into a computation must not silently re-read a changing sensor, send another command or duplicate a database write. Its origin, acquisition context and applicable privacy, residency and access policy must travel with it.

For a test or counterfactual run, a mock can supply explicitly synthetic observations through a non-actuating boundary. That asks “what would this code do with these inputs?” It is not evidence that a sensor saw those values or that an external action occurred. Real observations and simulated inputs must remain distinguishable in the execution record.

Agreement is a check, not a proof of truth

For reproducible computation, bind the code and input identities plus a defined deterministic execution profile. Capability-free WASM alone does not guarantee bit-for-bit agreement across every engine, floating-point configuration or feature set. Redundant execution also needs engineered comparison, fault isolation and authority rules; a separately written checker can add diversity, but shared inputs, shared code and a shared physical model can still share a mistake.

Actual spacecraft use different redundancy architectures. NASA’s Orion reference describes four internally redundant flight-computer modules that cross-check operations, plus dissimilar backup computing. ESA’s onboard-systems overview describes hot-redundant units and voting in a human-spaceflight example. These are engineering context, not a claim that Cairn supplies their fault-tolerance mechanisms.

Only the authorized boundary acts

Compute replicas should produce proposals and evidence, not independently repeat the real-world side effect. A mission-specific authority boundary must decide whether to act and how to handle disagreement, stale observations and incomplete outcomes. Even an agreed result is not permission to actuate. The effect record must distinguish intent, attempt and confirmed outcome; recovery adds forward evidence where a supported compensation exists.

Earth and a remote node can share the trail

Content-identified work and retained observations could let a ground system inspect or recompute a remote result after an intermittent link returns. Commands still need freshness, replay protection, authenticated authority and local operating policy. Local safety cannot wait for a light-speed-limited round trip, and an asynchronous work-and-evidence exchange is not a low-latency quorum stretched across deep space.

The browser probe illustrates a proposer and a separately written constraint checker over synthetic observations. It does not run replicated computers, mirror real telemetry or implement a voter. The chain on the homepage is an application pattern to build and validate, not an additional released runtime feature.

Cairn’s spaceborne adaptation is design/research work. No flight qualification, hard real-time bound, zero-allocation execution, radiation tolerance, space hardware deployment or spacecraft safety certification is claimed. Those need separate engineering and evidence.

Real WASM. An explicitly simulated world.

The downloaded kernel is compiled from Rust to WebAssembly. It has zero host imports. BLAKE3 identifies the loaded module and demo computation coordinates. Arithmetic, branch selection, the bounded proposer and the separate checker execute inside that module; JavaScript orchestrates the example and renders its state.

Page counter

A simulated blessed read supplies a session-local count; one pure WASM node increments it; a simulated blessed write persists it in tab memory. It is not a global visitor counter and does not contact a server.

Remote probe

Resolve primary and backup dispositions before selecting the one live branch. Wait for the battery observation before computing. A separate constraint check must accept the proposal before the decision write and simulated telemetry step. A bad proposal or exhausted compute budget prevents those downstream effects.

History and effects

Rewind and forward inspection do not repeat writes. Compensation appends a new sandbox write; the original event remains. An unavailable link queues telemetry without claiming an ACK; restoring the simulated link appends a new delivery receipt. These are not production-signed records.

Budget and growth

The guest counts explicit demo work units, not Wasmtime instructions or physical fuel. The per-node budget is 1–256 units. Pure results use a 24-entry LRU; sessions accept at most 32 runs and retain at most 128 effect events. Reset or leaving the tab discards this sandbox.

The lab is not the Cairn Rust engine compiled to the browser. It does not prove production database isolation, distributed consensus, network delivery, full DAG execution, signature verification or a general multi-input WASM ABI. Its complete source is included in the website download.

Read the source with a map.

CAIRN means Content-Addressed Immutable Reify Network. Its name also recalls the memorial stones of Joshua 4: transient data becomes a durable mark through deliberate reification.

Cairn runtime source and Perffection product source are public. The November 3, 2026 snapshots are Cairn 088c777f and Perffection 3b33ac59; the product pins that exact engine. These navigation coordinates refer to those clean source trees, not the private operational archive. Source availability is not a production deployment or certification.

Start with the contract

docs-chirho/source-chirho/overview-chirho.md; crates/cairn-core-chirho/src/model_chirho.rs. Read node definitions, capabilities, run keys, run results, effects and references before tracing adapters.

Build an application

docs-chirho/source-chirho/quick-start-chirho.md; crates/cairn-node-sdk-chirho/; templating and tree-build under crates/authoring-chirho/; checked-in guest examples under examples-chirho/. Begin with manifests, pure guests, blessed effects and review-before-promote.

Trace execution

src/execution_runtime_chirho/dag_chirho.rs; src/execution_runtime_chirho/cache_chirho/phi_chirho.rs; src/execution_runtime_chirho/effect_chirho/store_effect_chirho.rs; runner and versioned-store crates. Check the selected release tree before relying on a path.

Trace replay and recovery

RecordReplayPerformerChirho in the portable runtime core; PostgreSQL compensation execution; crates/runtime-chirho/cairn-undo-plan-chirho/. Trace current authority, original-effect binding, price and terminal outcome separately.

Trace trust and privacy

App control-plane verification, private-input policies, private-blob subject binding, access evidence and run-result verification. Follow each caller’s actual entry point, not only a helper’s unit test.

Trace distribution

Placement authority and mirror HTTP live under crates/stores-chirho/; writer-head and write relay under crates/support-chirho/; ledger host and geo node under crates/ledger-chirho/. Treat election, admitted mutation, durable acknowledgement and verified readback as different boundaries.

Inspect this website

Use the separate complete website-source archive, not the frozen runtime snapshot. Inside it, website-chirho/src-chirho/lab-chirho/kernel-chirho.rs contains the WASM guest; wasm-chirho.ts, model-chirho.ts and controller-chirho.ts separate execution, simulation and interface.

Machine reading map · Structured capability index · Complete website source · Why we build