Periodic tick
Collects CPU, RAM, disk, GPU, heartbeat SLO and running-session count, along with a tamper-evident receipt chain.
yana-rt os supervisor tick
→ health receipt
→ tamper-evident chainGOVERNANCE · LIVE
Power doesn't live in a prompt.
A model can propose an action. The authority chain, capability scope and a human decide how far that action actually goes.
Model requestfile.write
Policy preflightworkspace only
Human approvalrequired
Execution receiptrecorded
GIÁM THỊ
A supervisor that runs outside the AI session,
not a hook that ends with it.
Claude/Codex/Cursor hooks only enforce a shared safety state — they hold no HALT authority of their own. That authority belongs only to the Giám Thị native supervisor, running independently at the OS level, outside any AI session.
HALT via a shared lock file
An anomaly is detected → a shared lock file is created → every Claude/Codex/Cursor hook respects it immediately.
.claude/state/
GIAMTHI_HALT.lockUnlocking needs a human ceremony
Clearing a HALT requires the actor and reason to be recorded before the lock is removed — no agent can unlock itself.
unlock requires
actor + reason
recorded firstAUTHORITY CHAIN
Allow, ask, or deny.
No grey zone.
YanaAuthorityChain runs a deterministic preflight before any real action; Giám Thị holds the highest HALT authority.
Capability manifest
Every action has a formal name, a risk tier and its own approval requirement.
capability file.write
risk mutating
approval requiredScoped leases
Permission is bounded by subject, scope and time — and revocable.
subject current session
scope /workspace
ttl 27 min
revoke availableFail loudly
Missing governance has to surface — never silently skip a permission check.
guard missing → stop
denied → visible
HALT → highestAUDIT
A trail you can verify.
The audit log uses a hash chain to detect tampering. Yana names it accurately: tamper-detectable, not oversold as tamper-proof.
Proposal#a81f
Decision#bd40
Execution#c298
Receipt#ef31