Build a real program, block by block

Header, modules, and bindings

Every program declares its apiVersion and pulls in signed, content-addressed modules.

apiVersion "kwam.dev/v0.2"

import "std/faultdomains" as fd digest "sha256:1c0ffee…"   # pinned, signed
use fd.h100

let fanout = 8x
let ca     = secret://vault/kwam/mtls-ca

The digest pins the module to a specific signed content hash: a swapped module that quietly alters your fault-domain sets cannot pass. let binds reusable values you'll interpolate with ${…}.

Declare the trust policy

Who may do what — and the floor nobody may drop below.

policy trust_root {
  ca            ${ca}
  sandbox_floor gvisor                    # client.sandbox may not request weaker
  grants {
    "spiffe://kwam/acme/cl-7/*/*/*/seed" {
      caps           [discover, replicate, deploy, quarantine]
      signed_by      "acme-prod"          # required signer of consent tokens
      discover_scope [10.40.0.0/16]      # discover is non-default + scoped
      dual_control   true                 # destructive caps need two people
    }
  }
}

Define the client and the replication

A content-addressed image, a sandbox at or above the floor, and fault-domain spread.

client kwam_node {
  image    "sha256:9f3a7c…d21"          # cid; cosign-verified; no mutable tags
  sandbox  gvisor                          # >= policy.sandbox_floor; 'none' illegal
  health   [dcgm.gpu_health, nvml.xid_errors, nccl.comm_status]
  safepoint cooperative                    # reexec available for security-critical swaps
}

replicate code_and_data {
  factor        3
  anti_affinity [rack, pdu, spine, az]     # no two replicas share a listed domain
  # … chunker + repair tunables omitted …
}

The placer guarantees no two replicas share a listed fault domain until domains are exhausted. Content is split into variable-size chunks tuned to keep the dedup index small; the exact chunker and repair tunables are provided to licensees.

Watch it, then roll it out — with consent

Metrics feed the error budget; the deploy is gated on a signed token the server can't forge.

metric integrity_slo { observe silent_corruption_count target 0 window 30d }

deploy rollout_h100 {
  server   seed
  client   kwam_node
  to       h100_pool
  strategy canary
  waves    [1percent, 5percent, 25percent, 50percent, 100percent]
  bake     10m
  consent {
    grant_ref <signed-consent-token>       # externally-minted, signed, single-use
    scope     fleet.h100_pool              # MUST be a subset of the token's resource glob
  }
}