CRI-CORE
CRI-CORE is the deterministic admissibility kernel. It receives a canonical proposal and a compiled authority contract, evaluates the fixed stage pipeline, and returns an execution decision before any action is allowed to run.
Kernel Contract
Input
- Canonical proposal
- Compiled authority contract
- Exact contract identity: id, version, hash
- Actor, mutation, artifacts, and context supplied by upstream layers
Output
{
"commit_allowed": false,
"reason": "required approval missing",
"contract_hash": "sha256:...",
"stage": "approval_requirements"
}Deterministic Stage Pipeline
Reject proposals that do not match the canonical boundary structure.
Verify the proposal references the exact contract used for evaluation.
Validate required evidence and immutable references supplied by upstream systems.
Evaluate roles, approvals, separation requirements, and contract constraints.
Return the deterministic admissibility result: allowed or blocked.
Guarantees
Deterministic outputs
Identical proposal and contract inputs produce the same admissibility result.
No hidden logic
The kernel evaluates explicit contract and proposal data. It does not infer policy meaning.
Contract identity enforcement
Contract hash mismatch blocks execution instead of silently accepting drift.
Boundary-safe decisioning
The result is suitable for Waveframe Guard to enforce before production execution.
Install
pip install cricore
PyPI: cricore
GitHub: Waveframe-Labs/CRI-CORE
Boundary Responsibility
CRI-CORE decides admissibility. It does not execute actions.
- Does not author governance policy.
- Does not compile contracts.
- Does not normalize proposals.
- Does not orchestrate workflows.
- Does not distribute authority or store audit receipts.
Where It Fits
Governance-Ledger and the Contract Compiler define authority upstream. Proposal Normalizer supplies the canonical input shape. CRI-CORE evaluates. Waveframe Guard enforces the result.