An immutable, content-addressed object model + a deterministic, effect-typed evaluator + cryptographic provenance + federated trust — the OS layer over a shipping CIRIS substrate. Signed attestations are the only state; agents are optional participants the fabric can reject. AGPL-3.0.

∅ NULLIUS — a verified object-capability substrate. A window is a capability; a light client cannot be fooled. Take nobody's word for it. $NULL

Declare and prove a package's seam claim — allowed imports + zero ambient authority — with a coverage meta-check. The extractability harness, productized.