Constitutional OS Architecture · EUDS + TrinityShell
CANONICAL ARCHIVE · v2.0Three interlocking layers govern how ETHRAEON surfaces render, respond, and reason. No layer has authority over another. All three must agree for any surface action to proceed.
Presentation-only surfaces. They never decide behavior -- they render resolved intent. Read-only reflections of backend semantic truth.
Stateless semantic container. Renders resolved meaning, not layout rules. Supports translucency, focus depth, and trust layering. No embedded logic, no branching authority.
Emits intent tokens, not actions. Button press = semantic request. Haptics and animation are expressive only, never functional.
Persistent contextual spine. Displays what is happening, never what to do. Mirrors orchestration state from Ethraeon core.
Cryptographic trust signal. Displays provenance, validation state, and compliance markers. Cannot be spoofed or overridden at UI level.
Single shell across web + mobile. Interprets intent renders via EUDS. No business logic. No orchestration authority. No semantic mutation. It is a lens, not a brain.
Same tokens. Same shell. Same behavior. Same semantic outcomes. A mobile action and a desktop action are cryptographically indistinguishable at the intent layer.
Density, gesture affordances, viewport compression. These are presentation adaptations, not semantic changes. The meaning never changes.
Attention variability (ADHD), sensory sensitivity (autism/migraine), motor variance (tremor, one-handed), predictability/anxiety safety. All addressed constitutionally.
When connectivity fails, TrinityShell shows what is known, what is pending, and what is unavailable. Never shows stale data as current. Never blocks user agency.
APIs return semantic intent, not UI decisions. No layout hints. No color instructions. No platform branching. Only: intent resolution, constraint enforcement, trust metadata, deterministic next-states.
Two jurisdictions impose contradictory requirements. TrinityShell renders both constraints visible. Intent layer escalates to human authority. Neither jurisdiction is automatically preferred. AC-1 decides.
System detects data crossing unauthorized boundary. Intent layer emits fail_closed. TrinityShell shows degraded state with explanation. No data moves until human review. Evidence chain preserved.
Geographic signals conflict (VPN vs account region). Intent layer classifies ambiguity. EUDS renders both possible interpretations. User confirms correct interpretation. Resolution logged to EDG.