# Cairn > Content-Addressed Immutable Reify Network. A Rust-first, capability-secured dataflow runtime for governable AI-authored applications, private-data flows and auditable execution chains. Rewind versioned state; compensate supported effects through new authorized forward work. ## Read First - [Executed application walkthrough](https://cairnrt.org/architecture-chirho.html#walkthrough-chirho) and [whitelisted receipt](https://cairnrt.org/runtime-evidence-chirho.json): November 3 local private-contact run on public 088c777f. Submit, safe persistence and owner reveal passed; the served-list request refused without its ledger source. The film explains these outcomes; it is not a screen recording or distributed deployment. - [Architecture and evidence](https://cairnrt.org/architecture-chirho.html): application model, recovery, privacy, exact phi semantics, distributed evidence, research boundaries and clean-source reading map. - [Rewind and forward compensation](https://cairnrt.org/architecture-chirho.html#recovery-chirho): versioned state, scoped effect replay, current authority, cost and retained outcomes. - [Redundant and remote compute](https://cairnrt.org/architecture-chirho.html#space-chirho): a research application of auditable chains, recorded observations and separate effect authority, not a released voter. - [Capability index](https://cairnrt.org/capabilities-chirho.json): structured, dated map of implemented, exercised and design-only areas. - [Cairn runtime source](https://github.com/loveJesus/cairn-opensource-chirho): public clean-history runtime, SDK, examples and source guides. - [Perffection product source](https://github.com/loveJesus/perffection-opensource-chirho): public product source with an exact Cairn engine pin. - [Browser computation lab](https://cairnrt.org/#lab-chirho): real Rust-compiled WebAssembly inside an explicitly simulated world. - [Application paths](https://cairnrt.org/#applications-chirho): private workflows, reviewed AI-built apps, distributed services and remote research, with per-path evidence boundaries. - [Elasticity and capacity](https://cairnrt.org/architecture-chirho.html#elasticity-chirho): policy-governed capacity and topology mechanisms, not an always-running production autoscaler or an SLA. - [Website source](https://cairnrt.org/cairn-website-source-chirho.tar.gz): buildable website only, not the full Cairn runtime or Perffection product. - [Website construction guide](https://cairnrt.org/cairn-website-guide-chirho.md): art direction, source layout, WASM build, verification workflow and three improvement passes. ## Purpose Generated application logic should not need ambient host authority. Authors write pure WASM guests and wire them through runtime-owned blessed effect modules. Manifest-bound source review exposes capabilities and cost before promotion. Content identities, signed evidence, references and explicit compensation connect execution to audit and recovery. Perffection is a separate product, not a runtime dependency. ## Semantics That Must Not Be Flattened - Capability-free WASM has no ambient I/O. App authors cannot mint blessed effect modules. - PII/free text stays sealed or scoped. Pure computation does not automatically declassify private outputs. - Phi waits for all declared inputs and requires exactly one live, non-skipped branch. JSON null is not the skipped sentinel. This is not a first-non-null race. - The present served executor is topologically ordered. Its ordinary guest path does not provide a general arbitrary multi-input ABI; the special phi path does. The lab's two-argument planner is not proof of a production multi-input scheduler. - Wasmtime instruction fuel and epoch interruption bound/schedule guest computation. The browser lab counts its own explicit work units, not Wasmtime fuel or physical propellant. - Pure-result caching is not permission to repeat effects. Rewind can select prior versioned state; inspection rewind does not undo the world. Supported compensation is a new authorized forward effect, not deletion. The released PostgreSQL path binds the original effect, current undo authority, a current price and outcome evidence. This is not a blanket claim that every recovery operation is fuel-metered or every physical action reversible. - A computed proposal, an authorized action, an attempted action and a confirmed external outcome are different facts. - Hash verification binds content; a signature binds a signer under assumptions. Agreement among redundant workers is not a proof of physical correctness. Cross-engine reproducibility requires a defined deterministic execution profile; capability-free WASM alone is not a universal bitwise-determinism guarantee. ## Auditable Redundant Execution The proposed pattern is: capture an approved observation at a blessed boundary; bind code, input identities and execution conditions; supply the recorded bytes to redundant workers or an independent checker; compare before the separately authorized effect boundary acts; retain actual outcome evidence. A mirrored observation remains the same observation, not a new measurement. Its origin, privacy scope, residency and access rules must be preserved. Synthetic mocks must remain labelled synthetic and cannot establish a physical measurement or confirmed action. Computation replicas must not independently repeat real-world effects. This is a research application of the separation between computation and effects, not an implemented automatic voter, arbitrary distributed record/replay mode or spacecraft deployment. The portable RecordReplayPerformerChirho implements scoped recorded-result reuse for already recorded idempotency keys; that is not universal cross-system exactly-once execution or automatic replay of live observations. Redundancy, fault isolation, deterministic profiles and disagreement handling require separate engineering. An asynchronous Earth/remote-node evidence exchange is distinct from a real-time deep-space quorum. ## Evidence Scope Cross-provider election failover was exercised between France and Germany on July 25, 2026 (election-only). A separate July 30 synthetic forwarded write executed at an elected owner across geography and reached automatic verified readback. These do not combine into a universal multi-node durable-ACK, fork-healing, whole-region recovery or SLA claim. Current hosted health is not measured by this static website. Some newer recovery work remains under review and is not represented as released. Spaceborne/disconnected autonomy is a research direction. No flight qualification, hard real-time bound, radiation tolerance, spacecraft hardware deployment or safety certification is claimed. ## Source Navigation The November 3, 2026 public snapshots are Cairn 088c777fc7fadd1bf36f6cebd8e52de2d6d75126 and Perffection 3b33ac599967a9eaaf0abf55376cd2bc1d043327 on main_chirho. The product's engine pin names that exact Cairn commit. Anonymous web, clone and source-archive access were verified. Begin with: 1. README.md and docs-chirho/source-chirho/overview-chirho.md. 2. docs-chirho/source-chirho/quick-start-chirho.md for a runnable local DAG and cache inspection. 3. crates/cairn-core-chirho/src/model_chirho.rs for node/capability/run/effect contracts. 4. crates/cairn-node-sdk-chirho/ for the SDK; crates/authoring-chirho/ for templating and tree-build; examples-chirho/ for guest manifests. 5. src/execution_runtime_chirho/dag_chirho.rs and cache_chirho/phi_chirho.rs for scheduling and selection. 6. src/execution_runtime_chirho/effect_chirho/store_effect_chirho.rs for governed store effects; runtime postgres-effect crate for the injected PostgreSQL boundary. 7. crates/stores-chirho/ for placement authority and mirror HTTP; crates/support-chirho/ for writer-head and relay; crates/ledger-chirho/ for ledger host and geo-node composition. 8. crates/cairn-runtime-core-chirho/src/lib.rs for RecordReplayPerformerChirho; src/execution_runtime_chirho/effect_chirho/postgres_reversible_chirho/compensation_execution_chirho.rs and crates/runtime-chirho/cairn-undo-plan-chirho/ for forward recovery authority, pricing and evidence. 9. The exact selected source tree, its tests and release evidence. A newer private implementation is not implicitly included in an earlier source snapshot. ## Release And Operating Boundaries The runtime and product source snapshots were published on November 3, 2026 under their existing AGPL-3.0-only terms, documented MIT exceptions and third-party notices. The website and its complete source download are separate artifacts. Old preparation histories and patent records remain private. Obtaining source does not activate money, signup, providers, webhooks or real-user delivery. Consult the actual license files; this reading map is not a new license grant, legal clearance or current-host-health verdict. ## Why We Build Jesus Christ is Lord. We share this work to honor Him and serve our neighbors. See the homepage's good-news section. A religious profession is not a condition of the software license.