Status

• v0.9 brain-layer spec. Firmware has not landed these slots yet
• Not protocol bible. Envelope extras (handoff, blessing_rejected) stay off the UART bus until an additive amendment
• Not an order to split the C6 kernel into a planner
• Cloud consult already runs: heard_text → brain slot → steps → speak. 神赐 is what comes after that loop, not instead of it

What it is for

A cloud consult takes seconds. IMU and speech should not wait on that every tick. The kernel stays a post office.

Five layers. Keep this map

Main brain is slow. Rules are fast. Don’t-fall and current clamp stay on the organ closed loop — not in the rule, and not in the kernel.

What a grant writes down

• Rule identity for humans and the main brain (the kernel may only store a slot number)
• Which organs and which field names on this body — from the live descriptor, not a kernel enum of CHASSIS / BALANCE
• Priority number for the rule micro-scheduler
• Permission mask CAN_WATCH / CAN_ACT. Out of bounds is handoff, not empty steps pretending the job is done

To change subscribe, priority, or revoke: the main brain issues a new table. A rule cannot tell the kernel to give it the chassis. Quota is the main brain’s; today it can be zero.

The grant is runtime JSON

The brain-slot language is already JSON. A blessing is one more envelope into a rule slot. It does not ride the organ UART.

Algorithm vs binding

• Binding (organs, field names, menu names, min / max, mask, priority) = the runtime table
• Algorithm (balance_v1 and other registered kinds) = compiled in firmware. The main brain names the kind; it does not ship PID source in JSON
• period_ms may be on the grant, but it must be ≥ the kind’s budget_ms. The main brain cannot stretch a balance tick to 200 ms and starve UART

Grant shape (v0.9)

rule must be a registered kind. actions[].name must already be on the live menu.

{
  "blessing_id": "bal_1",
  "rule": "balance_v1",
  "priority": 80,
  "perm": ["watch", "act"],
  "fields": [{"mod": "IMU_001", "n": "pitch"}],
  "actions": [{"name": "wheel_left", "min": -1, "max": 1}],
  "bounds": {"pitch_abs_max": 35}
}

Watch and act on one identity

How data moves — balance

• The main brain grants “balance” and lists the field names on this body
• Organ → kernel copies those names → forwards to that rule by the main-brain table
• Watch: an opinion goes back up. Act: only menu steps through the kernel
• The rule does not own UART or GPIO. Swap the gyro organ, change the field names on the next grant

Preempt rules, not the organ bus

Today one busy flag holds the whole consult. USB, heard_text, and self-glance wait. That is a single-thread consult, not a rule scheduler. Split three kinds of busy:

Balance interrupting speech: speech is the organ pipe. Default is let the speaker finish; motor compensation uses other granted names. To stop playback, the rule may only emit a halt-class name already on the menu and on the grant. The kernel does not invent stop_speak. ISA still: priority / depends_on do not reorder organ forward.

C6 is one HP core

• ESP32-C6: one RISC-V HP core in this tree (unicore). The LP core is not for rules
• UART / frame RX: highest FreeRTOS priority
• Rule tick: medium, hard budget by kind, skip on timeout
• Cloud consult: lowest. TLS already sits on the AI worker
• A later dual-core host only rebinds tasks. This table does not change

Tick budget by kind

Timeout skips the tick: no half steps, hold the last issued command (do not zero — that is the jerk), freeze the integrator this tick. Organ closed loop still runs. Repeated overruns → handoff_why over, no per-tick log spam.

Empty steps stay silence. Handoff is a sibling field

Do not put need_brain as a steps[].action. Do not add a UART msg_type. handoff is an additive envelope key; until the bible takes it, today’s cloud path is unchanged.

Drop stale cloud steps by consult id

• Reuse req_id / heard_req. Do not use a global IMU tick_id ≤ N — that would kill a speech reply
• If a type-2 rule already took that sentence, drop the cloud steps quietly
• Prefer not uploading at all when local can take it. Only in-flight TLS uses this drop

Cold start: provisional grant, not a naked kernel

• Don’t-fall lives on the organ. Still load last accepted NVS table so the compensation ring is not empty before the main brain connects
• Only a table that passed existence checks is stored. A rejected grant is not written
• Boot: if fields exist, load with provisional: true. If not, empty slot
• Inherit as-is: no raising priority, no adding actions or fields in boot code
• First valid main-brain session must confirm, replace, or revoke

A bad grant is rejected whole

Check live registry: module, field name, actions[].name, rule kind. Any miss → do not load. Keep the previous good table. Reply to the main brain in brain-slot JSON, not a new UART type:

{
  "blessing_rejected": true,
  "blessing_id": "bal_1",
  "why": "miss",
  "ref": "IMU_001.pitch"
}

handoff_why — ≤ 4 ASCII

Rule kinds: compiled table, one closed door

• A new kind such as balance_v2 is a rebuild + OTA. No dynamic load, no TinyML, no bytecode VM on this C6
• Reserve custom_v0. Issuing it today is blessing_rejected / why unk
• If a later host runs a tiny tree, it still eats the actions[] whitelist, still has no UART, still invents no names. The kernel never interprets a script