One program for building, running, governing and recording an application.

Purpose and charter. The Board, people with final authority. The Leader, a model-backed position that decides inside a grant the Board wrote. Practices, proposed and settled as Board reviews. All of it is source in dna/org.

An ask becomes a task. A sandbox makes the change. The toolchain formats, checks, verifies and tests it, composes the fleet it would deploy, diffs the program's structure and rehearses the rollback. A review settles it, inside or outside the grant, or as a pull request. Approval applies it.

Expression on your machine or across a fleet, with a plan naming each service's seed and node and hale node running one. Senses and reflexes watching it. Roles per client on every backend, secrets in a vault, deployment profiles. A crash inside the observation window rolls back on every node it reached.

Which models each position may call and a budget per day, probed by hale dna models. Spend reserved, settled and compensated under a grant's windows. Receipts filed as customer or confidential and read only as recorded rows. Schedules for recurring work.

Memory in a database the organism owns, the nerves as a stream, the vault for secrets, brought up together by hale dna dev.

refs/dna/journal, one commit per event: the ask, the sandbox, every model call with its cost and digests, each check with its receipt, the verdict with a name on it, the apply, the deploy, the outcome. hale dna history m1 is one change's whole story, from any clone.

Agents produce pull requests faster than reviewers absorb them, so review degrades to skimming and CI becomes the only real check. DNA does not make reading unnecessary. It makes each change one thing, already verified, and explains it twice: the source diff, and what changed in the program's shape. A rule that flips is one line in that view and a page of archaeology in the source. It also puts a first reader on every change whose reasoning you can audit: the Leader's verdict is a model call with its digests and its cost on the record, inside a grant only the Board can widen.

Today an agent's permissions are a toggle in a tool: edit files, run commands, auto-approve. Here the boundary is a constitution the compiler enforces. The editing position cannot reach git, the network, a deployment or the organization's memory; the Leader decides and never commits; and hale check holds that against the org chart you wrote. Hand the editor a git handle and the build fails, with the path that shows why. Widening the grant is a reviewed commit, like any other change.

A change is usually judged by tests, in a checkout, with no idea what is running where. Hale programs are modeled by their compiler, so a candidate is measured on what it does to that model and composed as the fleet it would deploy. A change to one service that breaks a claim over all of them is denied before a person sees a line. Every instance reports the model hash it expresses into the record, so hale dna fleet can say which replica runs which version.

Why a change happened is usually reconstructed from PR descriptions and transcripts. DNA's record has the ask, the sandbox, every model call with its cost and digests (never the prompt), each check with its receipt, the verdict with a name on it, the apply, the deploy and the outcome, as commits next to the code, synced like code. hale dna history m1 is one change's whole story, from any clone.

A change that breaks production is reverted by whoever notices. Here a change that crashes one instance inside the observation window is reset to the commit it started from, on every node it reached, mechanically. A change you reject after the fact goes the same way. A retried apply reads its own record and never commits twice.

In the hale binary, on your workstation, with your model key or a local model, with git as the only shared service. No control plane.

A repository and its record, with the backends attached to it: memory, nerves, secrets, senses. A clone is a replica of a record and carries no access of its own. Moving or cloning a record keeps its identity and provenance.

Two firms keep their private records and agree on a third, shared one. They publish selected facts into it, each carrying its origin, lineage and purpose. Syncing a whole record cannot export part of a private history, so a shared record never receives one.

Whoever holds a full replica can read it, and a projection that filters rows cannot hide them. Sensitive material therefore lives outside the replicated record, as protected evidence in the record's own memory, read only through a principal-checked boundary. That covers its derivatives too: summaries, embeddings, prompts, the context a worker is given.

The face, the API, the command line, a synced decision, a callback, resumed work. Each checks the actor, the record, the current membership and the policy. A git author, a --as flag or a position in a view is attribution only; proof comes from the check at the entry.

Participation: one person, a team on one record, or firms cooperating through a shared record. Deployment: your machine, hosted behind a domain, or another admitted placement. Principal source: explicit local trust, or a verified identity provider. A hosted single user with an identity provider is a normal first profile.

The compiler knows who owns a locus and what it can reach. The design adds on whose authority it runs: runs_under(locus, principal), closed the way ownership is closed. A vault policy, a database role or a broker account then becomes the rendered reach of one principal, which nobody writes by hand, and a credential is cut for one attachment, short-lived and narrowed, never for the seat.

A new responsibility is a child the organism proposes from evidence of a need and the authority admits. Standard equipment gives it competence: research and decision briefs, qualification and offers, implementation and release, onboarding and support, receipt capture and reconciliation, publication and experiments, access and documents, deployment and recovery. Installing equipment creates no department, appoints no performer and grants no authority.

The record lives in the repository, so new and init make one when there is none. Alone on one machine no remote is needed. A team, or nodes, need one.

hale dna dev brings up the organism's private services with it: Postgres for its working state, which DNA calls memory; NATS for messaging between its parts, the nerves; Prometheus for monitoring, the senses.

A key in the vault, ollama on your PATH, or a coding harness (claude, else codex) on it. The organism still runs without one; the Leader cannot decide anything, and every review waits for you.

Each waits for a verdict: the Leader's, inside a grant a person wrote, or the Board's. A restart is a restart. Live state does not carry across.

The structural view cannot see what a handler computes. A +1 becoming +100 is invisible to it, which is why the source diff is never optional, for people and for the Leader alike. The design was gated on a test of exactly that: reviewers deciding from the structural diff alone, the source alone, and both. The combined view is what shipped, and the structural view is credited with what it earned. It decides shape and rules, and it says when it cannot decide.

Designed and partly built. The table above says which pieces are in the tree; the rest is not behaviour to rely on yet.