nervur

Nervur grown on the working Quo kit. It imports @quo-systems/js and adds no protocol of its own — no wire, no envelope, no judgment, no arithmetic, ever. What Nervur is for begins where the constitution stops: the graph, the organs, the floor, and the projection from an authored contract into Quo blueprints.

The rules of this build

1. @quo-systems/js is the whole of the protocol. It is crossed by its specifier, never by a path. A gap the kit shows is reported to the quo table, never patched here.
2. nervur-dream is parked beside this, as reference. Its mechanics may be lifted — the compiler, the contract reader, the @needs directive. Its judgement may not: what a thing enforces, refuses or means is authored fresh against the constitution as it stands today, because dream was built against a protocol that no longer exists.
3. Crockford. Factory functions, closures for privacy, no this, frozen surfaces. The kit's class idiom stops at its specifier: the ground factory is the one place a Warden instance lives, closed over and never returned.
4. One played bench question at a time. Doubt is settled on the bench, not argued. Nothing lands without an assert that would fail if it broke.
5. A being never learns who is calling, but it knows who may reach it. The first half is the kit's doing: the warden places a voice at step three and hands the field its arguments and its leash, never the caller. Which being was reached already says who called. The second half is Nervur's: the warden keeps the record of which voices reach which beings, and a being is handed its own row to read and to change. No rights and no roles — those are meanings, and the record holds none.

What stands

ground() — one closure over one warden, holding beings and judging what arrives. bench/ground.test.js walks it end to end: a real sealed ask, a real answer, and silence where a standing does not reach.

The outbound relation — remember records an invitation this ground was handed and names which of its beings spends it; ask seals down that relation, posts it at the hints the invitation carried, and reads the answer back. Every one of those acts is the kit's. What is Nervur's is the ergonomics: a relation is found by whose it is, so one being cannot spend another's; the number is the ground's to pick, so no caller counts by hand; and the first ask carries the rotation an invitation's heir keys oblige, so nobody meets that trap twice. bench/estate.test.js stands two houses on two real loopback doors and crosses between them.

Silence, unreachable and a relation that is not yours are three different things and stay three: silence is null, a road that does not answer throws out of the carriage, and spending what a being does not hold throws before a byte moves.

contract(sdl) and program(contract, resolvers) — the compiler, and there is exactly one of it. A being and an organ are both a contract plus resolvers, and program cannot tell which it is holding; that is not a convenience, it is the architecture. A field is read with hasOwn and never through the prototype chain, exactly the declared arguments reach a resolver and no others, a resolver short of a required argument is not called at all, and a resolver that throws is answered as silence — nothing here promises that an ask is fulfilled, so a refusal a caller must tell apart is carried in the answer type instead. bench/program.test.js asserts every one of those, and asserts the first on a being and an organ side by side.

The contract is a GraphQL schema — schema, resolvers and a context, the shape every engineer already knows. It is authoring and nothing else: never at the wire, never an answer, never a describe. The organs a being reaches outward with are declared in the schema itself, with schema @needs(organs: [...]), and the being's own name is the root type's — schema { query: Clerk }.

project(contract) — the boundary, and there must be exactly one of it. Every implementer of Quo speaks the notation and has never heard of Nervur, so a contract becomes a Quo blueprint in the kit's own notation before anything holds it, and what a stranger verifies is that blueprint's digest. GraphQL is nullable by default and the notation is required by default, so String! becomes text and String becomes text?; the schema's other object and input types become record blocks, and their ordering is the notation's own law and therefore the kit's print to judge. Where GraphQL says something the notation has no word for — Float, ID, an enum, a union, an interface, a record field that takes arguments — the contract is refused at build rather than guessed at. One word runs the other way: the notation has a field that answers nothing and GraphQL insists every field has a type, so Nothing in answer position is that field's spelling. bench/projection.test.js holds it.

being(sdl, resolvers) — a schema and ordinary functions under it. It is compiled by program like anything else; what it adds is the wire skin the kit leaves open, and the two promises the kit leaves to Nervur: a resolver meets its arguments as named values and never bytes, and a being answers exactly the fields its contract declares. That second one is the gate the digest's meaning rests on — the law says what a blueprint does not declare does not exist, and the kit dispatches on whatever methods the held object happens to have.

Organs — the only way a being acts outward. That is not a style choice: a being has no warden and no caller, so it cannot mint standing and a field answering another being's name hands over a label rather than reach. What it can still do is pass on standing it was already given — the constitution says data can carry an invitation, and an invitation carries the heir keys — so "a being cannot hand over reach" is false as a general claim and only the minting half is true. A being names the organ aliases it needs in its own schema, the ground supplies them at hold, and the resolvers are closed over exactly those. An organ the schema never asked for is not absent from a check — it is absent from the object.

The organ that crosses — errand mints the reach a being uses to speak to another house. It is shut over which being spends the relation and which house it stands at, so a being holds one road on its own behalf and nothing it could point elsewhere; it never holds the warden and never holds the relation. Which being at the far house is still the caller's to name, because the standing decides that and the standing is judged over there. The leash is handed in rather than chosen — the resolver passes on the one the door gave it, whole and never a number read off it, because what may go onward is this door's dwell subtracted at the moment of sealing, which is later than any moment the being could have read. So the remainder reaches the far house without the being having chosen it, and a being cannot hand its organ more than it received. bench/errand.test.js serves one sealed ask at the near house by crossing to the far one and answering with what came back.

Contacts — who reaches this being, and the two acts that change it: list(), admit(keys) and remove(voicePk). Every one of them goes to the warden's own inbound record — grant, amend, standing — read live at the moment it is called and never snapshotted, so a being that admitted someone a moment ago sees them. Quo keeps that record and refuses to have an opinion about it, having no word for member, owner or guest; the opinion is Nervur's, and this is the whole of it. The inverse — voices by being, where the warden keeps beings by voice — is derived rather than indexed, because a second index is a second truth.

The scoping is structural, the same shape errand uses: the context is minted per hold with the being shut inside the closure, so there is no address it could name to reach another being's row. It reaches a resolver as the resolver factory's second argument, closed over at raise beside the organs, rather than as a third argument to every resolver. bench/contacts.test.js proves the admission and the removal at the door — a real sealed ask that gets in, and then meets silence.

Organs are declared inside the contract, with schema @needs(organs: [...]). That directive is authoring and never reaches the wire: the projection drops it, so the blueprint a stranger reads carries no trace of what a being reaches outward with, which is inside-the-ground business the wire never sees.

What is not here yet

own and the floor, memory, standings and the graph walked across them, the per-call caller, ground-as-a-folder, persistence, register-and-invoke, collections-as-beings, per-caller beings.

The bench

npm run gate-nervur