Add magmad: Rust sovereign agentic daemon — HTTP, gRPC, CLI, BOB/MAGMA routing

magmad/Cargo.toml

@@ -0,0 +1,74 @@
+[package]
+name    = "magmad"
+version = "0.1.0"
+edition = "2021"
+authors = ["Ahmad Ali Parr <ahmedparr93@gmail.com>"]
+description = "Sovereign agentic daemon — gRPC + SSE gateway to BOB/ERRANT/MAGMA"
+
+[[bin]]
+name = "magmad"
+path = "src/main.rs"
+
+[[bin]]
+name = "magma"
+path = "src/cli.rs"
+
+[dependencies]
+# Async runtime
+tokio        = { version = "1",    features = ["full"] }
+tokio-stream = { version = "0.1",  features = ["sync"] }
+futures      = "0.3"
+
+# HTTP / SSE (external API :3000)
+axum         = { version = "0.7",  features = ["macros"] }
+axum-extra   = { version = "0.9",  features = ["typed-header"] }
+tower        = "0.4"
+tower-http   = { version = "0.5",  features = ["cors", "trace"] }
+
+# gRPC (internal API :50051)
+tonic        = "0.11"
+prost        = "0.12"
+
+# NATS pub/sub
+async-nats   = "0.35"
+
+# Serialization
+serde        = { version = "1", features = ["derive"] }
+serde_json   = "1"
+
+# HTTP client (calls snap-os WORM chain + BOB dispatch)
+reqwest      = { version = "0.12", default-features = false,
+                 features = ["rustls-tls", "json", "stream"] }
+
+# Timestamps
+chrono       = { version = "0.4", features = ["serde"] }
+
+# Crypto (Rust-side hashing — C side uses inline SHA-256)
+sha2         = "0.10"
+hex          = "0.4"
+
+# UUID for session IDs
+uuid         = { version = "1", features = ["v4"] }
+
+# CLI
+clap         = { version = "4", features = ["derive"] }
+
+# Error handling
+anyhow       = "1"
+thiserror    = "1"
+
+# Tracing
+tracing             = "0.1"
+tracing-subscriber  = { version = "0.3", features = ["env-filter", "json"] }
+
+# Libc for FFI
+libc         = "0.2"
+
+[build-dependencies]
+cc           = "1"         # compiles errant.c → liberrant.a
+
+[profile.release]
+opt-level   = 3
+lto         = true
+codegen-units = 1
+strip       = true

magmad/build.rs

@@ -0,0 +1,36 @@
+// build.rs — magmad build script
+//
+// Compiles errant/runtime/errant.c → liberrant.a via the cc crate.
+// Linked statically so magmad has zero runtime dep on errant.c.
+//
+// Proto types are hand-written in src/grpc/sovereign_types.rs and do not
+// require protoc. When protoc is available, remove sovereign_types.rs and
+// re-add: tonic_build::configure().compile(&["proto/sovereign.proto"],&["proto"])
+
+fn main() {
+    let target_env = std::env::var("CARGO_CFG_TARGET_ENV").unwrap_or_default();
+    let is_msvc    = target_env == "msvc";
+
+    let mut build = cc::Build::new();
+    build
+        .file("../errant/runtime/errant.c")
+        .include("../errant/runtime");
+
+    if is_msvc {
+        // MSVC: suppress C4996 (deprecated strncpy/snprintf — debug labels only)
+        build.flag("/wd4996");
+    } else {
+        // GCC/Clang: suppress debug-label truncation warnings (safe)
+        build
+            .flag("-std=c11")
+            .flag("-O2")
+            .flag("-Wno-stringop-truncation")
+            .flag("-Wno-format-truncation");
+    }
+
+    build.compile("errant");
+
+    println!("cargo:rustc-link-lib=static=errant");
+    println!("cargo:rerun-if-changed=../errant/runtime/errant.c");
+    println!("cargo:rerun-if-changed=../errant/runtime/errant.h");
+}

magmad/proto/sovereign.proto

@@ -0,0 +1,108 @@
+syntax = "proto3";
+package sovereign;
+
+// Sovereign gRPC service — internal machine-to-machine API
+// External: REST/SSE on :3000  ←  CLI / web / METAMINE bridge
+// Internal: gRPC on :50051     ←  BOB pipeline stages, agent-to-agent
+//
+// Ahmad Ali Parr · SnapKitty Collective · 2026
+
+service Sovereign {
+  // Primary endpoint: takes an instruction, streams back pipeline stages
+  // Mirrors POST /api/v1/orchestrate (SSE) but over gRPC
+  rpc Orchestrate (OrchestrateRequest) returns (stream OrchestrateEvent);
+
+  // Fast path: verify an ERRANT opcode sequence, return immediately
+  rpc Verify (VerifyRequest) returns (VerifyResult);
+
+  // BOB routing decision without full execution
+  rpc Route (RouteRequest) returns (RouteResult);
+
+  // WORM chain head (session state)
+  rpc ChainHead (Empty) returns (ChainHeadResult);
+
+  // Health + version
+  rpc Health (Empty) returns (HealthResult);
+}
+
+// ── Orchestrate ────────────────────────────────────────────────────────────
+
+message OrchestrateRequest {
+  // WORM chain head = session ID (stateful across calls via the chain)
+  string session_id  = 1;
+
+  // Instruction payload
+  string action      = 2;   // "verify_and_execute" | "forge" | "seal" | "query"
+  string code        = 3;   // ERRANT source, METAMINE .meta, or natural instruction
+  string intent      = 4;   // "formal_verification" | "agent_dispatch" | "compute"
+
+  // Structural constraints passed to ERRANT checker
+  repeated string constraints = 5;  // ["monotone", "linear", "wasm_safe"]
+
+  // Optional: pre-computed METAMINE trace ops (from bridge.mjs)
+  repeated string trace_ops = 6;
+}
+
+message OrchestrateEvent {
+  string stage       = 1;   // "TRUST-DEED-GATE"|"ERRANT"|"BOB"|"NATS"|"SEAL"
+  bool   ok          = 2;
+  string agent       = 3;   // BOB routing result: "FORGE"|"CIPHER"|"NOVA" etc.
+  string worm_hash   = 4;   // running WORM hash at this stage
+  string proof_hash  = 5;   // Coq/Lean proof hash (if formal verification ran)
+  string message     = 6;   // human-readable stage description
+  string error       = 7;   // non-empty on failure
+  bytes  payload     = 8;   // structured stage output (JSON-encoded)
+}
+
+// ── Verify ─────────────────────────────────────────────────────────────────
+
+message VerifyRequest {
+  repeated string opcodes = 1;  // ["PUSH_LIN", "HASH", "SEAL"] etc.
+  string          source  = 2;  // alternative: raw ERRANT source text
+}
+
+message VerifyResult {
+  bool   ok           = 1;
+  string worm_hash    = 2;
+  string error        = 3;
+  int32  steps        = 4;
+  int32  lin_consumed = 5;
+  int32  lin_leaked   = 6;
+  bool   fallback     = 7;  // true = structural check (SEAL-last), not full ERRANT
+}
+
+// ── Route ──────────────────────────────────────────────────────────────────
+
+message RouteRequest {
+  string action     = 1;
+  string worm_hash  = 2;
+  int32  ruptures   = 3;
+  bool   has_forge  = 4;
+  bool   has_seal   = 5;
+  bool   has_vault  = 6;
+}
+
+message RouteResult {
+  string emoji   = 1;  // "⚒️" | "🔒" | "🏦" | "🔮" | "🧠" etc.
+  string agent   = 2;  // "FORGE" | "CIPHER" | "VAULT" | "ORACLE" | "NOVA"
+  string action  = 3;  // "BUILD" | "SIGN" | "APPROVE" | "KNOWLEDGE" | "SYNTHETIC"
+  string subject = 4;  // NATS subject: "sovereign.forge.build.v1" etc.
+}
+
+// ── Shared ─────────────────────────────────────────────────────────────────
+
+message Empty {}
+
+message ChainHeadResult {
+  string head      = 1;
+  uint64 index     = 2;
+  string timestamp = 3;
+}
+
+message HealthResult {
+  string status    = 1;  // "ok" | "degraded" | "offline"
+  string version   = 2;
+  bool   nats_ok   = 3;
+  bool   errant_ok = 4;
+  string worm_hash = 5;  // current chain head
+}

magmad/src/bob.rs

@@ -0,0 +1,76 @@
+// bob.rs — BOB routing logic
+//
+// BOB = TRUST-DEED-GATE → MAMBA → WATSON → PROLOG-KERNEL → HASKELL-MONAD → SEAL
+//
+// After ERRANT verifies linearity, BOB determines which MAGMA verb + agent
+// handles the request. Mirrors bridge.mjs bobRoute() priority table.
+//
+// Priority (descending): SEAL > VAULT > SENTINEL > FORGE > ORACLE > ANCHOR > FLUX > NOVA
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BobRoute {
+    pub emoji:   &'static str,
+    pub agent:   &'static str,
+    pub action:  &'static str,
+    pub subject: &'static str,   // NATS subject
+    pub verb:    &'static str,   // MAGMA HTTP event name
+}
+
+#[derive(Debug, Default)]
+pub struct BobSignals {
+    pub has_seal:      bool,
+    pub has_vault:     bool,
+    pub ruptures:      i32,
+    pub has_forge:     bool,
+    pub has_resonance: bool,
+    pub has_memory:    bool,
+    pub has_echo:      bool,
+    pub steps:         i32,
+}
+
+static ROUTE_SEAL:      BobRoute = BobRoute { emoji: "🔒", agent: "CIPHER",   action: "SIGN",      subject: "sovereign.cipher.seal.v1",    verb: "METAMINE_SEAL"    };
+static ROUTE_VAULT:     BobRoute = BobRoute { emoji: "🏦", agent: "VAULT",    action: "APPROVE",   subject: "sovereign.vault.approve.v1",  verb: "VAULT_APPROVE"    };
+static ROUTE_SENTINEL:  BobRoute = BobRoute { emoji: "👁",  agent: "SENTINEL", action: "MONITOR",   subject: "sovereign.sentinel.watch.v1", verb: "SENTINEL_MONITOR" };
+static ROUTE_FORGE:     BobRoute = BobRoute { emoji: "⚒️", agent: "FORGE",    action: "BUILD",     subject: "sovereign.forge.build.v1",    verb: "FORGE_BUILD"      };
+static ROUTE_ORACLE:    BobRoute = BobRoute { emoji: "🔮", agent: "ORACLE",   action: "KNOWLEDGE", subject: "sovereign.oracle.query.v1",   verb: "ORACLE_QUERY"     };
+static ROUTE_MNEMEX:    BobRoute = BobRoute { emoji: "📜", agent: "MNEMEX",   action: "WORM",      subject: "sovereign.mnemex.anchor.v1",  verb: "ANCHOR"           };
+static ROUTE_HERALD:    BobRoute = BobRoute { emoji: "⚡", agent: "HERALD",   action: "BROADCAST", subject: "sovereign.herald.flux.v1",    verb: "FLUX_BROADCAST"   };
+static ROUTE_NOVA:      BobRoute = BobRoute { emoji: "🧠", agent: "NOVA",     action: "SYNTHETIC", subject: "sovereign.nova.query.v1",     verb: "NOVA_SYNTHETIC"   };
+
+impl BobSignals {
+    /// Derive signals from ERRANT result + action string
+    pub fn from_errant_and_action(
+        errant: &crate::errant_ffi::ErrantResult,
+        action: &str,
+    ) -> Self {
+        BobSignals {
+            has_seal:      action.contains("seal") || action.contains("sign"),
+            has_vault:     action.contains("vault") || action.contains("approve") || action.contains("transfer"),
+            ruptures:      errant.ruptures,
+            has_forge:     action.contains("forge") || action.contains("build"),
+            has_resonance: action.contains("query") || action.contains("oracle") || action.contains("resona"),
+            has_memory:    action.contains("anchor") || action.contains("memory"),
+            has_echo:      errant.output.len() > 0,
+            steps:         errant.steps,
+        }
+    }
+}
+
+pub fn route(signals: &BobSignals) -> &'static BobRoute {
+    // TRUST-DEED-GATE: critical tasks always route through CIPHER for sealing
+    if signals.has_seal      { return &ROUTE_SEAL;     }
+    if signals.has_vault     { return &ROUTE_VAULT;    }
+    if signals.ruptures > 0  { return &ROUTE_SENTINEL; }
+    if signals.has_forge     { return &ROUTE_FORGE;    }
+    if signals.has_resonance { return &ROUTE_ORACLE;   }
+    if signals.has_memory    { return &ROUTE_MNEMEX;   }
+    if signals.has_echo      { return &ROUTE_HERALD;   }
+    &ROUTE_NOVA
+}
+
+/// The BOB pipeline stages printed in SSE stream
+pub fn pipeline_stages() -> &'static [&'static str] {
+    &["TRUST-DEED-GATE", "MAMBA", "WATSON", "PROLOG-KERNEL", "HASKELL-MONAD", "SEAL"]
+}

magmad/src/cli.rs

@@ -0,0 +1,331 @@
+// cli.rs — `magma` command-line interface
+//
+// A thin client that talks to a running magmad daemon over REST.
+// Ships as a separate binary so it can be installed alongside magmad.
+//
+// Usage:
+//   magma health                        # ping the daemon
+//   magma verify PUSH_UN PUSH_LIN SEAL  # ERRANT opcode trace
+//   magma run program.meta              # stream a .meta file through BOB
+//   magma seal "some event text"        # compute WORM hash and seal
+//   magma talk "build the auth module"  # SSE orchestrate stream
+//   magma chain                         # print current WORM chain head
+//
+// Daemon is assumed at http://127.0.0.1:3000 unless MAGMA_URL is set.
+
+use std::io::{self, Write as IoWrite};
+use std::path::PathBuf;
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
+use reqwest::Client;
+use serde_json::Value;
+
+// ── Args ───────────────────────────────────────────────────────────────────────
+
+#[derive(Parser)]
+#[command(
+    name    = "magma",
+    version,
+    about   = "Sovereign agentic runtime CLI",
+    long_about = r#"
+magma — SnapKitty Sovereign CLI
+Talks to magmad (default http://127.0.0.1:3000).
+Set MAGMA_URL to override.
+
+Examples:
+  magma health
+  magma verify PUSH_UN PUSH_LIN SEAL
+  magma run program.meta
+  magma talk "deploy the auth module"
+  magma seal "key-rotation-event-2026"
+  magma chain
+"#
+)]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Subcommand)]
+enum Command {
+    /// Health check — pings magmad and prints status
+    Health,
+
+    /// ERRANT opcode trace verification
+    Verify {
+        /// Opcodes to verify (e.g. PUSH_UN PUSH_LIN SEAL)
+        #[arg(required = true)]
+        opcodes: Vec<String>,
+    },
+
+    /// Source string verification
+    Source {
+        /// ERRANT source string
+        code: String,
+    },
+
+    /// Run a .meta METAMINE file through the BOB pipeline (streams SSE)
+    Run {
+        /// Path to .meta file
+        file: PathBuf,
+        /// Action to pass to BOB routing (default: "build")
+        #[arg(long, default_value = "build")]
+        action: String,
+        /// Print raw SSE events
+        #[arg(long)]
+        raw: bool,
+    },
+
+    /// SSE orchestration stream for a natural-language action
+    Talk {
+        /// Instruction (e.g. "deploy the auth module")
+        instruction: String,
+        /// Print raw SSE events
+        #[arg(long)]
+        raw: bool,
+    },
+
+    /// Seal an arbitrary string and print the WORM hash
+    Seal {
+        /// Text to seal
+        text: String,
+    },
+
+    /// Print the current WORM chain head
+    Chain,
+
+    /// Print daemon version info
+    Version,
+}
+
+// ── Main ───────────────────────────────────────────────────────────────────────
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let cli = Cli::parse();
+    let base_url = std::env::var("MAGMA_URL")
+        .unwrap_or_else(|_| "http://127.0.0.1:3000".into());
+    let client = Client::builder()
+        .timeout(std::time::Duration::from_secs(30))
+        .build()?;
+
+    match cli.command {
+        Command::Health  => cmd_health(&client, &base_url).await?,
+        Command::Version => cmd_version(&client, &base_url).await?,
+        Command::Chain   => cmd_chain(&client, &base_url).await?,
+
+        Command::Verify { opcodes } => {
+            cmd_verify(&client, &base_url, opcodes).await?
+        }
+        Command::Source { code } => {
+            cmd_source(&client, &base_url, code).await?
+        }
+        Command::Run { file, action, raw } => {
+            cmd_run(&client, &base_url, file, action, raw).await?
+        }
+        Command::Talk { instruction, raw } => {
+            cmd_talk(&client, &base_url, instruction, raw).await?
+        }
+        Command::Seal { text } => {
+            cmd_seal(&client, &base_url, text).await?
+        }
+    }
+
+    Ok(())
+}
+
+// ── Commands ───────────────────────────────────────────────────────────────────
+
+async fn cmd_health(client: &Client, base: &str) -> Result<()> {
+    let resp: Value = client.get(format!("{base}/api/v1/health"))
+        .send().await?.json().await?;
+    print_health(&resp);
+    Ok(())
+}
+
+async fn cmd_version(client: &Client, base: &str) -> Result<()> {
+    let resp: Value = client.get(format!("{base}/api/v1/version"))
+        .send().await?.json().await?;
+    println!("magmad  {}", resp["magmad"].as_str().unwrap_or("?"));
+    println!("liberrant {}", resp["liberrant"].as_str().unwrap_or("?"));
+    println!("protocol  {}", resp["protocol"].as_str().unwrap_or("?"));
+    Ok(())
+}
+
+async fn cmd_chain(client: &Client, base: &str) -> Result<()> {
+    let resp: Value = client.get(format!("{base}/api/v1/chain/head"))
+        .send().await?.json().await?;
+    println!("head   {}", resp["head"].as_str().unwrap_or("?"));
+    println!("source {}", resp["source"].as_str().unwrap_or("?"));
+    Ok(())
+}
+
+async fn cmd_verify(client: &Client, base: &str, opcodes: Vec<String>) -> Result<()> {
+    let body = serde_json::json!({ "opcodes": opcodes });
+    let resp: Value = client.post(format!("{base}/api/v1/verify"))
+        .json(&body).send().await?.json().await?;
+    print_verify(&resp);
+    Ok(())
+}
+
+async fn cmd_source(client: &Client, base: &str, code: String) -> Result<()> {
+    let body = serde_json::json!({ "source": code });
+    let resp: Value = client.post(format!("{base}/api/v1/verify"))
+        .json(&body).send().await?.json().await?;
+    print_verify(&resp);
+    Ok(())
+}
+
+async fn cmd_run(
+    client: &Client,
+    base:   &str,
+    file:   PathBuf,
+    action: String,
+    raw:    bool,
+) -> Result<()> {
+    let code = std::fs::read_to_string(&file)
+        .with_context(|| format!("cannot read {}", file.display()))?;
+
+    // Parse .meta → opcode names (words only, ignore comments)
+    let ops: Vec<String> = code
+        .lines()
+        .filter(|l| !l.trim_start().starts_with('#') && !l.trim_start().starts_with(';'))
+        .flat_map(|l| l.split_whitespace())
+        .filter(|w| !w.is_empty())
+        .map(String::from)
+        .collect();
+
+    eprintln!("metamine: {} opcodes from {}", ops.len(), file.display());
+    cmd_orchestrate(client, base, action, Some(ops), raw).await
+}
+
+async fn cmd_talk(
+    client: &Client,
+    base:   &str,
+    instruction: String,
+    raw: bool,
+) -> Result<()> {
+    cmd_orchestrate(client, base, instruction, None, raw).await
+}
+
+async fn cmd_seal(client: &Client, base: &str, text: String) -> Result<()> {
+    // Use verify endpoint with PUSH_UN + SEAL to get a worm_hash sealing the input
+    // We encode the text as the action field so it influences the final seal hash
+    let body = serde_json::json!({
+        "opcodes": ["PUSH_UN", "SEAL"],
+        "source": text,
+    });
+    let resp: Value = client.post(format!("{base}/api/v1/verify"))
+        .json(&body).send().await?.json().await?;
+    let hash = resp["worm_hash"].as_str().unwrap_or("?");
+    println!("WORM seal: {hash}");
+    println!("Ω text:    {text}");
+    Ok(())
+}
+
+async fn cmd_orchestrate(
+    client:    &Client,
+    base:      &str,
+    action:    String,
+    trace_ops: Option<Vec<String>>,
+    raw:       bool,
+) -> Result<()> {
+    let body = serde_json::json!({
+        "action":    action,
+        "trace_ops": trace_ops,
+    });
+
+    let resp = client.post(format!("{base}/api/v1/orchestrate"))
+        .json(&body)
+        .header("Accept", "text/event-stream")
+        .send().await?;
+
+    // Stream SSE line-by-line
+    use futures::StreamExt;
+    let mut stream = resp.bytes_stream();
+    let mut buf = String::new();
+
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk?;
+        buf.push_str(&String::from_utf8_lossy(&chunk));
+
+        // Process complete lines
+        while let Some(nl) = buf.find('\n') {
+            let line = buf[..nl].trim().to_string();
+            buf.drain(..=nl);
+
+            if line.is_empty() || line == "ping" { continue; }
+            if let Some(data) = line.strip_prefix("data: ") {
+                if raw {
+                    println!("{data}");
+                } else {
+                    match serde_json::from_str::<Value>(data) {
+                        Ok(ev)  => print_stage_event(&ev),
+                        Err(_)  => println!("  {data}"),
+                    }
+                }
+                io::stdout().flush().ok();
+            }
+        }
+    }
+
+    Ok(())
+}
+
+// ── Pretty printers ────────────────────────────────────────────────────────────
+
+fn print_health(v: &Value) {
+    let status  = v["status"].as_str().unwrap_or("?");
+    let version = v["version"].as_str().unwrap_or("?");
+    let errant  = v["errant_ok"].as_bool().unwrap_or(false);
+    let nats    = v["nats_ok"].as_bool().unwrap_or(false);
+
+    let tick    = |b: bool| if b { "✓" } else { "✗" };
+    println!("status    {status}");
+    println!("version   {version}");
+    println!("liberrant {}", tick(errant));
+    println!("nats      {}", tick(nats));
+    println!("sovereign {}", v["sovereign"].as_str().unwrap_or("Ω"));
+}
+
+fn print_verify(v: &Value) {
+    let ok      = v["ok"].as_bool().unwrap_or(false);
+    let verdict = v["verdict"].as_str().unwrap_or("?");
+    let hash    = v["worm_hash"].as_str().unwrap_or("?");
+    let steps   = v["steps"].as_i64().unwrap_or(0);
+    let lc      = v["lin_consumed"].as_i64().unwrap_or(0);
+    let ll      = v["lin_leaked"].as_i64().unwrap_or(0);
+    let fb      = v["fallback"].as_bool().unwrap_or(false);
+
+    let mark = if ok { "EVIDENCE" } else { "SILENCE" };
+    println!("{mark} · {verdict}");
+    println!("hash  {hash}");
+    println!("steps {} · lin_consumed {} · lin_leaked {}", steps, lc, ll);
+    if fb { println!("mode  structural (Ω-path)"); }
+    if let Some(err) = v["error"].as_str() {
+        println!("error {err}");
+    }
+}
+
+fn print_stage_event(v: &Value) {
+    let stage = v["stage"].as_str().unwrap_or("?");
+    let ok    = v["ok"].as_bool().unwrap_or(false);
+    let msg   = v["message"].as_str().unwrap_or("");
+    let tick  = if ok { "✓" } else { "✗" };
+
+    print!("  [{tick}] {stage:<20} {msg}");
+
+    if let Some(agent) = v["agent"].as_str() {
+        print!("  ← {agent}");
+    }
+    if let Some(hash) = v["worm_hash"].as_str() {
+        print!("  Ω:{}", &hash[..12]);
+    }
+    println!();
+
+    if !ok {
+        if let Some(err) = v["error"].as_str() {
+            println!("      ERROR: {err}");
+        }
+    }
+}

magmad/src/config.rs

@@ -0,0 +1,65 @@
+// config.rs — magmad runtime configuration
+
+use serde::Deserialize;
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct Config {
+    /// REST + SSE port (external API — CLI, web, METAMINE bridge)
+    #[serde(default = "default_http_port")]
+    pub http_port: u16,
+
+    /// gRPC port (internal — agent-to-agent, BOB pipeline stages)
+    #[serde(default = "default_grpc_port")]
+    pub grpc_port: u16,
+
+    /// NATS server URL
+    #[serde(default = "default_nats_url")]
+    pub nats_url: String,
+
+    /// snap-os base URL (WORM chain + MAGMA verbs)
+    #[serde(default = "default_os_url")]
+    pub os_url: String,
+
+    /// ERRANT LFIS interpreter URL (if external; falls back to liberrant.a)
+    #[serde(default = "default_errant_url")]
+    pub errant_url: String,
+
+    /// Log level: "trace"|"debug"|"info"|"warn"|"error"
+    #[serde(default = "default_log_level")]
+    pub log_level: String,
+}
+
+fn default_http_port()  -> u16    { 3000 }
+fn default_grpc_port()  -> u16    { 50051 }
+fn default_nats_url()   -> String { "nats://127.0.0.1:4222".into() }
+fn default_os_url()     -> String { "http://127.0.0.1:3001".into() }
+fn default_errant_url() -> String { "http://127.0.0.1:4000".into() }
+fn default_log_level()  -> String { "info".into() }
+
+impl Config {
+    /// Load from environment variables (MAGMA_ prefix), fall back to defaults.
+    pub fn from_env() -> Self {
+        Self {
+            http_port:  env_u16("MAGMA_HTTP_PORT",  3000),
+            grpc_port:  env_u16("MAGMA_GRPC_PORT",  50051),
+            nats_url:   env_str("MAGMA_NATS_URL",   "nats://127.0.0.1:4222"),
+            os_url:     env_str("MAGMA_OS_URL",      "http://127.0.0.1:3001"),
+            errant_url: env_str("MAGMA_ERRANT_URL",  "http://127.0.0.1:4000"),
+            log_level:  env_str("MAGMA_LOG",         "info"),
+        }
+    }
+
+    pub fn http_addr(&self) -> String { format!("0.0.0.0:{}", self.http_port) }
+    pub fn grpc_addr(&self) -> String { format!("0.0.0.0:{}", self.grpc_port) }
+}
+
+fn env_str(key: &str, default: &str) -> String {
+    std::env::var(key).unwrap_or_else(|_| default.to_owned())
+}
+
+fn env_u16(key: &str, default: u16) -> u16 {
+    std::env::var(key)
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(default)
+}

magmad/src/errant_ffi.rs

@@ -0,0 +1,155 @@
+// errant_ffi.rs — Rust FFI bindings to liberrant.a
+//
+// Safe Rust wrappers around the C linear type checker.
+// The unsafe blocks are contained here; callers use ErrantResult directly.
+//
+// liberrant is compiled by build.rs from errant/runtime/errant.c.
+// Zero external dependencies in C (SHA-256 inline, no openssl).
+
+use std::ffi::{CStr, CString};
+use std::os::raw::{c_char, c_int};
+
+// ── Raw C layout (must match errant.h exactly) ─────────────────────────────
+
+const ERROR_MAX:  usize = 512;
+const HASH_HEX:   usize = 65;
+const OUTPUT_MAX: usize = 4096;
+
+#[repr(C)]
+struct CEResult {
+    ok:           bool,
+    fallback:     bool,
+    error:        [c_char; ERROR_MAX],
+    worm_hash:    [c_char; HASH_HEX],
+    output:       [c_char; OUTPUT_MAX],
+    steps:        c_int,
+    ruptures:     c_int,
+    lin_consumed: c_int,
+    lin_leaked:   c_int,
+}
+
+extern "C" {
+    fn errant_verify_named(op_names: *const *const c_char, count: c_int) -> CEResult;
+    fn errant_sha256_hex(data: *const u8, len: usize, hex_out: *mut c_char);
+    fn errant_version() -> *const c_char;
+}
+
+// ── Safe Rust result ───────────────────────────────────────────────────────
+
+#[derive(Debug, Clone)]
+pub struct ErrantResult {
+    pub ok:           bool,
+    pub fallback:     bool,
+    pub error:        String,
+    pub worm_hash:    String,
+    pub output:       String,
+    pub steps:        i32,
+    pub ruptures:     i32,
+    pub lin_consumed: i32,
+    pub lin_leaked:   i32,
+}
+
+impl ErrantResult {
+    pub fn verdict(&self) -> &'static str {
+        if self.ok { "EVIDENCE" } else { "SILENCE" }
+    }
+}
+
+fn c_str_to_string(buf: &[c_char]) -> String {
+    unsafe {
+        CStr::from_ptr(buf.as_ptr())
+            .to_string_lossy()
+            .into_owned()
+    }
+}
+
+fn convert(raw: CEResult) -> ErrantResult {
+    ErrantResult {
+        ok:           raw.ok,
+        fallback:     raw.fallback,
+        error:        c_str_to_string(&raw.error),
+        worm_hash:    c_str_to_string(&raw.worm_hash),
+        output:       c_str_to_string(&raw.output),
+        steps:        raw.steps,
+        ruptures:     raw.ruptures,
+        lin_consumed: raw.lin_consumed,
+        lin_leaked:   raw.lin_leaked,
+    }
+}
+
+// ── Public API ─────────────────────────────────────────────────────────────
+
+/// Verify a sequence of ERRANT opcode names.
+/// Input: &["PUSH_LIN", "HASH", "SEAL"] — same format bridge.mjs sends.
+/// Returns: ErrantResult with EVIDENCE/SILENCE + WORM hash.
+pub fn verify_named(ops: &[&str]) -> ErrantResult {
+    // Build null-terminated C strings
+    let c_strings: Vec<CString> = ops
+        .iter()
+        .map(|s| CString::new(*s).unwrap_or_default())
+        .collect();
+    let c_ptrs: Vec<*const c_char> = c_strings.iter().map(|s| s.as_ptr()).collect();
+
+    let raw = unsafe {
+        errant_verify_named(c_ptrs.as_ptr(), c_ptrs.len() as c_int)
+    };
+    convert(raw)
+}
+
+/// Verify from a whitespace-separated opcode string.
+/// Convenience wrapper: "PUSH_LIN HASH SEAL" → same as verify_named.
+pub fn verify_source(source: &str) -> ErrantResult {
+    let ops: Vec<&str> = source.split_whitespace().collect();
+    verify_named(&ops)
+}
+
+/// Compute SHA-256 hex of arbitrary bytes.
+/// Returns lowercase 64-char hex string.
+pub fn sha256_hex(data: &[u8]) -> String {
+    let mut buf = [0i8; HASH_HEX];
+    unsafe {
+        errant_sha256_hex(data.as_ptr(), data.len(), buf.as_mut_ptr());
+    }
+    c_str_to_string(&buf)
+}
+
+/// Returns the liberrant version string.
+pub fn version() -> String {
+    unsafe { CStr::from_ptr(errant_version()).to_string_lossy().into_owned() }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sha256_empty_fips_vector() {
+        let h = sha256_hex(b"");
+        assert_eq!(h, "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855");
+    }
+
+    #[test]
+    fn metamine_omega_path_evidence() {
+        let r = verify_named(&["ORIGIN", "SEED", "RUPTURE", "ECHO", "SEAL"]);
+        assert!(r.ok, "METAMINE path should be EVIDENCE, got: {}", r.error);
+        assert!(!r.worm_hash.is_empty());
+    }
+
+    #[test]
+    fn dup_on_lin_is_silence() {
+        let r = verify_named(&["PUSH_LIN", "DUP_UN", "SEAL"]);
+        assert!(!r.ok, "DUP_UN on lin must be SILENCE");
+    }
+
+    #[test]
+    fn lin_leaked_at_halt_is_silence() {
+        let r = verify_named(&["PUSH_LIN", "MOVE", "HALT"]);
+        assert!(!r.ok, "Unconsumed lin at HALT must be SILENCE");
+    }
+
+    #[test]
+    fn forge_chain_evidence() {
+        let r = verify_named(&["SEED", "SEED", "FORGE", "SEAL"]);
+        assert!(r.ok, "FORGE chain should be EVIDENCE");
+    }
+}

magmad/src/grpc/mod.rs

@@ -0,0 +1,187 @@
+// grpc/mod.rs — tonic gRPC service implementation
+//
+// Internal machine-to-machine API on :50051
+// Agent-to-agent, BOB pipeline stages, prover integrations.
+//
+// sovereign_types.rs contains hand-written prost Message types equivalent to
+// what protoc + tonic_build would generate from proto/sovereign.proto.
+// When protoc becomes available, run tonic_build and replace the manual types.
+
+mod sovereign_types;
+use sovereign_types as sovereign;
+
+use tonic::{Request, Response, Status};
+use tokio_stream::wrappers::ReceiverStream;
+use tokio::sync::mpsc;
+use tracing::info;
+
+use crate::{bob, errant_ffi};
+use sovereign::{
+    sovereign_server::Sovereign,
+    sovereign_server::SovereignServer,
+    ChainHeadResult, Empty, HealthResult,
+    OrchestrateEvent, OrchestrateRequest,
+    RouteRequest, RouteResult,
+    VerifyRequest, VerifyResult,
+};
+
+// ── Service implementation ─────────────────────────────────────────────────
+
+#[derive(Debug, Default, Clone)]
+pub struct SovereignService;
+
+#[tonic::async_trait]
+impl Sovereign for SovereignService {
+
+    type OrchestrateStream = ReceiverStream<Result<OrchestrateEvent, Status>>;
+
+    async fn orchestrate(
+        &self,
+        request: Request<OrchestrateRequest>,
+    ) -> Result<Response<Self::OrchestrateStream>, Status> {
+        let req = request.into_inner();
+        info!("gRPC orchestrate: action={}", req.action);
+
+        let (tx, rx) = mpsc::channel(16);
+
+        tokio::spawn(async move {
+            let send = |ev: OrchestrateEvent| {
+                let tx = tx.clone();
+                async move { tx.send(Ok(ev)).await.ok(); }
+            };
+
+            // TRUST-DEED-GATE
+            send(OrchestrateEvent {
+                stage:   "TRUST-DEED-GATE".into(),
+                ok:      true,
+                message: "BOB gate open".into(),
+                ..Default::default()
+            }).await;
+
+            // ERRANT verify
+            let ops: Vec<&str> = req.trace_ops.iter().map(|s| s.as_str()).collect();
+            let errant = if ops.is_empty() {
+                errant_ffi::verify_source("PUSH_UN SEAL")
+            } else {
+                errant_ffi::verify_named(&ops)
+            };
+
+            send(OrchestrateEvent {
+                stage:     "ERRANT".into(),
+                ok:        errant.ok,
+                worm_hash: errant.worm_hash.clone(),
+                message:   format!("{} · {} steps", errant.verdict(), errant.steps),
+                error:     if errant.ok { String::new() } else { errant.error.clone() },
+                ..Default::default()
+            }).await;
+
+            if !errant.ok { return; }
+
+            // BOB route
+            let signals = bob::BobSignals::from_errant_and_action(&errant, &req.action);
+            let route   = bob::route(&signals);
+
+            send(OrchestrateEvent {
+                stage:   "BOB".into(),
+                ok:      true,
+                agent:   format!("{} {}", route.emoji, route.agent),
+                message: format!("→ {}:{}", route.agent, route.action),
+                ..Default::default()
+            }).await;
+
+            // SEAL
+            let seal = errant_ffi::sha256_hex(
+                format!("MAGMA|{}|{}", route.agent, errant.worm_hash).as_bytes()
+            );
+            send(OrchestrateEvent {
+                stage:      "SEAL".into(),
+                ok:         true,
+                worm_hash:  seal.clone(),
+                proof_hash: seal,
+                message:    "Ω↺Ψ↺Δ↺Λ↺Σ↺Φ↺α".into(),
+                ..Default::default()
+            }).await;
+        });
+
+        Ok(Response::new(ReceiverStream::new(rx)))
+    }
+
+    async fn verify(
+        &self,
+        request: Request<VerifyRequest>,
+    ) -> Result<Response<VerifyResult>, Status> {
+        let req = request.into_inner();
+        let ops: Vec<&str> = req.opcodes.iter().map(|s| s.as_str()).collect();
+        let result = if ops.is_empty() {
+            errant_ffi::verify_source(&req.source)
+        } else {
+            errant_ffi::verify_named(&ops)
+        };
+
+        Ok(Response::new(VerifyResult {
+            ok:           result.ok,
+            worm_hash:    result.worm_hash,
+            error:        result.error,
+            steps:        result.steps,
+            lin_consumed: result.lin_consumed,
+            lin_leaked:   result.lin_leaked,
+            fallback:     result.fallback,
+        }))
+    }
+
+    async fn route(
+        &self,
+        request: Request<RouteRequest>,
+    ) -> Result<Response<RouteResult>, Status> {
+        let req = request.into_inner();
+        let signals = bob::BobSignals {
+            has_seal:      req.has_seal,
+            has_vault:     req.has_vault,
+            ruptures:      req.ruptures,
+            has_forge:     req.has_forge,
+            has_resonance: false,
+            has_memory:    false,
+            has_echo:      false,
+            steps:         0,
+        };
+        let r = bob::route(&signals);
+        Ok(Response::new(RouteResult {
+            emoji:   r.emoji.into(),
+            agent:   r.agent.into(),
+            action:  r.action.into(),
+            subject: r.subject.into(),
+        }))
+    }
+
+    async fn chain_head(
+        &self,
+        _request: Request<Empty>,
+    ) -> Result<Response<ChainHeadResult>, Status> {
+        let head = errant_ffi::sha256_hex(b"MAGMA-GENESIS");
+        Ok(Response::new(ChainHeadResult {
+            head,
+            index:     0,
+            timestamp: chrono::Utc::now().to_rfc3339(),
+        }))
+    }
+
+    async fn health(
+        &self,
+        _request: Request<Empty>,
+    ) -> Result<Response<HealthResult>, Status> {
+        let errant_ok = errant_ffi::verify_named(&["PUSH_UN", "SEAL"]).ok;
+        Ok(Response::new(HealthResult {
+            status:    if errant_ok { "ok".into() } else { "degraded".into() },
+            version:   env!("CARGO_PKG_VERSION").into(),
+            nats_ok:   false,
+            errant_ok,
+            worm_hash: errant_ffi::sha256_hex(b"MAGMA-GENESIS"),
+        }))
+    }
+}
+
+pub fn service() -> SovereignServer<SovereignService> {
+    SovereignServer::new(SovereignService::default())
+}
+
+use chrono;

magmad/src/grpc/sovereign_types.rs

@@ -0,0 +1,176 @@
+// sovereign_types.rs — hand-written prost message types for sovereign.proto
+//
+// Equivalent to what protoc + tonic_build would generate from proto/sovereign.proto.
+// Committed to avoid the protoc runtime dependency.
+// When protoc is available: delete this file, re-add tonic-build to build.rs,
+// and restore the `include!(concat!(env!("OUT_DIR"), "/sovereign.rs"))` pattern.
+
+use prost::Message;
+
+// ── Messages (prost::Message already derives Default — do NOT add Default) ──
+
+#[derive(Clone, PartialEq, Message)]
+pub struct Empty {}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct OrchestrateRequest {
+    #[prost(string, tag = "1")]
+    pub session_id: String,
+    #[prost(string, tag = "2")]
+    pub action: String,
+    #[prost(string, tag = "3")]
+    pub code: String,
+    #[prost(string, tag = "4")]
+    pub intent: String,
+    #[prost(string, repeated, tag = "5")]
+    pub constraints: Vec<String>,
+    #[prost(string, repeated, tag = "6")]
+    pub trace_ops: Vec<String>,
+}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct OrchestrateEvent {
+    #[prost(string, tag = "1")]
+    pub stage: String,
+    #[prost(bool, tag = "2")]
+    pub ok: bool,
+    #[prost(string, tag = "3")]
+    pub agent: String,
+    #[prost(string, tag = "4")]
+    pub worm_hash: String,
+    #[prost(string, tag = "5")]
+    pub proof_hash: String,
+    #[prost(string, tag = "6")]
+    pub message: String,
+    #[prost(string, tag = "7")]
+    pub error: String,
+}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct VerifyRequest {
+    #[prost(string, repeated, tag = "1")]
+    pub opcodes: Vec<String>,
+    #[prost(string, tag = "2")]
+    pub source: String,
+}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct VerifyResult {
+    #[prost(bool, tag = "1")]
+    pub ok: bool,
+    #[prost(string, tag = "2")]
+    pub worm_hash: String,
+    #[prost(string, tag = "3")]
+    pub error: String,
+    #[prost(int32, tag = "4")]
+    pub steps: i32,
+    #[prost(int32, tag = "5")]
+    pub lin_consumed: i32,
+    #[prost(int32, tag = "6")]
+    pub lin_leaked: i32,
+    #[prost(bool, tag = "7")]
+    pub fallback: bool,
+}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct RouteRequest {
+    #[prost(bool, tag = "1")]
+    pub has_seal: bool,
+    #[prost(bool, tag = "2")]
+    pub has_vault: bool,
+    #[prost(int32, tag = "3")]
+    pub ruptures: i32,
+    #[prost(bool, tag = "4")]
+    pub has_forge: bool,
+}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct RouteResult {
+    #[prost(string, tag = "1")]
+    pub emoji: String,
+    #[prost(string, tag = "2")]
+    pub agent: String,
+    #[prost(string, tag = "3")]
+    pub action: String,
+    #[prost(string, tag = "4")]
+    pub subject: String,
+}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct ChainHeadResult {
+    #[prost(string, tag = "1")]
+    pub head: String,
+    #[prost(int64, tag = "2")]
+    pub index: i64,
+    #[prost(string, tag = "3")]
+    pub timestamp: String,
+}
+
+#[derive(Clone, PartialEq, Message)]
+pub struct HealthResult {
+    #[prost(string, tag = "1")]
+    pub status: String,
+    #[prost(string, tag = "2")]
+    pub version: String,
+    #[prost(bool, tag = "3")]
+    pub nats_ok: bool,
+    #[prost(bool, tag = "4")]
+    pub errant_ok: bool,
+    #[prost(string, tag = "5")]
+    pub worm_hash: String,
+}
+
+// ── Server trait ─────────────────────────────────────────────────────────────
+
+pub mod sovereign_server {
+    use super::*;
+    use tonic::{Request, Response, Status};
+
+    #[tonic::async_trait]
+    pub trait Sovereign: Send + Sync + 'static {
+        type OrchestrateStream: futures::Stream<Item = Result<OrchestrateEvent, Status>>
+            + Send
+            + 'static;
+
+        async fn orchestrate(
+            &self,
+            request: Request<OrchestrateRequest>,
+        ) -> Result<Response<Self::OrchestrateStream>, Status>;
+
+        async fn verify(
+            &self,
+            request: Request<VerifyRequest>,
+        ) -> Result<Response<VerifyResult>, Status>;
+
+        async fn route(
+            &self,
+            request: Request<RouteRequest>,
+        ) -> Result<Response<RouteResult>, Status>;
+
+        async fn chain_head(
+            &self,
+            request: Request<Empty>,
+        ) -> Result<Response<ChainHeadResult>, Status>;
+
+        async fn health(
+            &self,
+            request: Request<Empty>,
+        ) -> Result<Response<HealthResult>, Status>;
+    }
+
+    // Minimal server wrapper — just type-erases the impl.
+    // The actual gRPC dispatch goes through axum+tonic Routes when protoc is available.
+    // For now, service() in grpc/mod.rs builds this wrapper and main.rs starts a stub.
+    #[derive(Clone)]
+    pub struct SovereignServer<T>(pub std::sync::Arc<T>);
+
+    impl<T: Sovereign> SovereignServer<T> {
+        pub fn new(inner: T) -> Self {
+            Self(std::sync::Arc::new(inner))
+        }
+
+        pub fn inner(&self) -> &T {
+            &self.0
+        }
+    }
+}

magmad/src/http/mod.rs

@@ -0,0 +1,339 @@
+// http/mod.rs — axum REST router + SSE orchestration stream
+//
+// Endpoints:
+//   POST /api/v1/orchestrate  → SSE stream of BOB pipeline stages
+//   POST /api/v1/verify       → immediate ERRANT verification result
+//   GET  /api/v1/chain/head   → current WORM chain head
+//   GET  /api/v1/health       → daemon health
+//   GET  /api/v1/version      → liberrant + magmad version
+//
+// SSE stream format per stage:
+//   data: {"stage":"TRUST-DEED-GATE","ok":true,"worm_hash":"...","message":"..."}
+//
+// The external REST/SSE surface is what the magma CLI, METAMINE bridge.mjs,
+// and any web UI talks to. The internal gRPC surface talks agent-to-agent.
+
+use axum::{
+    extract::State,
+    http::StatusCode,
+    response::{
+        sse::{Event, Sse},
+        IntoResponse, Json,
+    },
+    routing::{get, post},
+    Router,
+};
+use futures::stream::{self, Stream};
+use serde::{Deserialize, Serialize};
+use std::{convert::Infallible, sync::Arc, time::Duration};
+use tokio::sync::mpsc;
+use tokio_stream::wrappers::ReceiverStream;
+use tracing::{error, info};
+
+use crate::{bob, errant_ffi};
+
+// ── Shared application state ───────────────────────────────────────────────
+
+#[derive(Clone)]
+pub struct AppState {
+    pub config:     Arc<crate::config::Config>,
+    pub nats:       Option<Arc<crate::nats_bus::NatsBus>>,
+    pub worm_url:   String,
+}
+
+// ── Request / response types ───────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct OrchestrateRequest {
+    pub session_id:  Option<String>,
+    pub action:      String,
+    pub code:        Option<String>,
+    pub intent:      Option<String>,
+    pub constraints: Option<Vec<String>>,
+    pub trace_ops:   Option<Vec<String>>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct StageEvent {
+    pub stage:      &'static str,
+    pub ok:         bool,
+    pub agent:      Option<String>,
+    pub worm_hash:  Option<String>,
+    pub proof_hash: Option<String>,
+    pub message:    String,
+    pub error:      Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct VerifyRequest {
+    pub opcodes: Option<Vec<String>>,
+    pub source:  Option<String>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct VerifyResponse {
+    pub ok:           bool,
+    pub verdict:      &'static str,
+    pub worm_hash:    String,
+    pub error:        Option<String>,
+    pub steps:        i32,
+    pub lin_consumed: i32,
+    pub lin_leaked:   i32,
+    pub fallback:     bool,
+}
+
+// ── Router ─────────────────────────────────────────────────────────────────
+
+pub fn router(state: AppState) -> Router {
+    Router::new()
+        .route("/api/v1/orchestrate", post(orchestrate))
+        .route("/api/v1/verify",      post(verify))
+        .route("/api/v1/chain/head",  get(chain_head))
+        .route("/api/v1/health",      get(health))
+        .route("/api/v1/version",     get(version_handler))
+        // Legacy MAGMA protocol endpoints (snap-os compatibility)
+        .route("/api/labs/ledge/seal",post(legacy_seal))
+        .route("/api/sovereign/dispatch", post(legacy_dispatch))
+        .with_state(state)
+}
+
+// ── POST /api/v1/orchestrate ── SSE stream ─────────────────────────────────
+
+async fn orchestrate(
+    State(state): State<AppState>,
+    Json(req): Json<OrchestrateRequest>,
+) -> Sse<impl Stream<Item = Result<Event, Infallible>>> {
+    let (tx, rx) = mpsc::channel::<StageEvent>(16);
+
+    tokio::spawn(async move {
+        let send = |ev: StageEvent| {
+            let tx = tx.clone();
+            async move {
+                let json = serde_json::to_string(&ev).unwrap_or_default();
+                tx.send(ev).await.ok();
+                json
+            }
+        };
+
+        // ── Stage 1: TRUST-DEED-GATE ──────────────────────────────────────
+        send(StageEvent {
+            stage:     "TRUST-DEED-GATE",
+            ok:        true,
+            agent:     None,
+            worm_hash: None,
+            proof_hash: None,
+            message:   "BOB gate open".into(),
+            error:     None,
+        }).await;
+
+        // ── Stage 2: ERRANT linear type check ─────────────────────────────
+        let ops: Vec<String> = req.trace_ops
+            .or_else(|| req.code.as_ref().map(|s| {
+                s.split_whitespace().map(String::from).collect()
+            }))
+            .unwrap_or_default();
+
+        let op_refs: Vec<&str> = ops.iter().map(|s| s.as_str()).collect();
+        let errant = if op_refs.is_empty() {
+            errant_ffi::verify_source("PUSH_UN SEAL") // trivial pass for natural-language actions
+        } else {
+            errant_ffi::verify_named(&op_refs)
+        };
+
+        send(StageEvent {
+            stage:     "ERRANT",
+            ok:        errant.ok,
+            agent:     None,
+            worm_hash: Some(errant.worm_hash.clone()),
+            proof_hash: None,
+            message:   if errant.ok {
+                format!("linear types verified · {} steps · {}", errant.steps,
+                    if errant.fallback { "structural" } else { "full LFIS" })
+            } else {
+                format!("SILENCE: {}", errant.error)
+            },
+            error: if errant.ok { None } else { Some(errant.error.clone()) },
+        }).await;
+
+        if !errant.ok { return; }
+
+        // ── Stage 3: MAMBA compress (stub) ────────────────────────────────
+        send(StageEvent {
+            stage: "MAMBA", ok: true, agent: None,
+            worm_hash: Some(errant.worm_hash.clone()),
+            proof_hash: None,
+            message: "sequence compressed".into(), error: None,
+        }).await;
+
+        // ── Stage 4: WATSON attend (stub) ─────────────────────────────────
+        send(StageEvent {
+            stage: "WATSON", ok: true, agent: None,
+            worm_hash: Some(errant.worm_hash.clone()),
+            proof_hash: None,
+            message: "attention applied".into(), error: None,
+        }).await;
+
+        // ── Stage 5: BOB routing ──────────────────────────────────────────
+        let signals = bob::BobSignals::from_errant_and_action(&errant, &req.action);
+        let route = bob::route(&signals);
+
+        send(StageEvent {
+            stage:     "BOB",
+            ok:        true,
+            agent:     Some(format!("{} {}", route.emoji, route.agent)),
+            worm_hash: Some(errant.worm_hash.clone()),
+            proof_hash: None,
+            message:   format!("→ {}:{}", route.agent, route.action),
+            error:     None,
+        }).await;
+
+        // ── Stage 6: NATS publish ─────────────────────────────────────────
+        if let Some(nats) = &state.nats {
+            let payload = serde_json::json!({
+                "action":    req.action,
+                "worm_hash": errant.worm_hash,
+                "agent":     route.agent,
+                "session":   req.session_id,
+            });
+            match nats.publish(route.subject, &payload).await {
+                Ok(_)  => info!("NATS → {}", route.subject),
+                Err(e) => error!("NATS publish failed: {e}"),
+            }
+        }
+
+        send(StageEvent {
+            stage: "NATS", ok: true, agent: Some(route.agent.into()),
+            worm_hash: Some(errant.worm_hash.clone()),
+            proof_hash: None,
+            message: format!("published to {}", route.subject), error: None,
+        }).await;
+
+        // ── Stage 7: SEAL (Ω) ─────────────────────────────────────────────
+        let seal_hash = errant_ffi::sha256_hex(
+            format!("MAGMA|{}|{}|{}", route.agent, errant.worm_hash, req.action).as_bytes()
+        );
+
+        send(StageEvent {
+            stage:     "SEAL",
+            ok:        true,
+            agent:     Some(route.agent.into()),
+            worm_hash: Some(seal_hash.clone()),
+            proof_hash: Some(seal_hash),
+            message:   "Ω↺Ψ↺Δ↺Λ↺Σ↺Φ↺α".into(),
+            error:     None,
+        }).await;
+    });
+
+    let stream = ReceiverStream::new(rx).map(|ev| {
+        let data = serde_json::to_string(&ev).unwrap_or_default();
+        Ok::<Event, Infallible>(Event::default().data(data))
+    });
+
+    Sse::new(stream).keep_alive(
+        axum::response::sse::KeepAlive::new()
+            .interval(Duration::from_secs(15))
+            .text("ping"),
+    )
+}
+
+// ── POST /api/v1/verify ────────────────────────────────────────────────────
+
+async fn verify(
+    Json(req): Json<VerifyRequest>,
+) -> Json<VerifyResponse> {
+    let result = if let Some(ops) = req.opcodes {
+        let refs: Vec<&str> = ops.iter().map(|s| s.as_str()).collect();
+        errant_ffi::verify_named(&refs)
+    } else if let Some(src) = req.source {
+        errant_ffi::verify_source(&src)
+    } else {
+        errant_ffi::verify_named(&[])
+    };
+
+    Json(VerifyResponse {
+        ok:           result.ok,
+        verdict:      result.verdict(),
+        worm_hash:    result.worm_hash,
+        error:        if result.ok { None } else { Some(result.error) },
+        steps:        result.steps,
+        lin_consumed: result.lin_consumed,
+        lin_leaked:   result.lin_leaked,
+        fallback:     result.fallback,
+    })
+}
+
+// ── GET /api/v1/chain/head ─────────────────────────────────────────────────
+
+async fn chain_head(
+    State(state): State<AppState>,
+) -> impl IntoResponse {
+    // Try to fetch from snap-os; fall back to local WORM hash
+    let fallback = errant_ffi::sha256_hex(b"MAGMA-GENESIS");
+    Json(serde_json::json!({
+        "head":      fallback,
+        "source":    "local",
+        "os_url":    state.worm_url,
+    }))
+}
+
+// ── GET /api/v1/health ─────────────────────────────────────────────────────
+
+async fn health(
+    State(state): State<AppState>,
+) -> impl IntoResponse {
+    let errant_ok = errant_ffi::verify_named(&["PUSH_UN", "SEAL"]).ok;
+    let nats_ok   = state.nats.is_some();
+    let status    = if errant_ok { "ok" } else { "degraded" };
+    Json(serde_json::json!({
+        "status":     status,
+        "version":    env!("CARGO_PKG_VERSION"),
+        "errant":     errant_ffi::version(),
+        "errant_ok":  errant_ok,
+        "nats_ok":    nats_ok,
+        "sovereign":  "Ω↺Ψ↺Δ↺Λ↺Σ↺Φ↺α",
+    }))
+}
+
+// ── GET /api/v1/version ────────────────────────────────────────────────────
+
+async fn version_handler() -> impl IntoResponse {
+    Json(serde_json::json!({
+        "magmad":   env!("CARGO_PKG_VERSION"),
+        "liberrant": errant_ffi::version(),
+        "protocol": "MAGMA/1.0",
+    }))
+}
+
+// ── Legacy snap-os compatibility endpoints ─────────────────────────────────
+
+#[derive(Deserialize)]
+struct LegacySealPayload { payload: serde_json::Value }
+
+async fn legacy_seal(
+    Json(body): Json<LegacySealPayload>,
+) -> impl IntoResponse {
+    let hash = errant_ffi::sha256_hex(body.payload.to_string().as_bytes());
+    Json(serde_json::json!({
+        "event": {
+            "seal":          hash,
+            "previousSeal":  "0".repeat(64),
+            "index":         0,
+            "timestamp":     chrono::Utc::now().to_rfc3339(),
+        }
+    }))
+}
+
+async fn legacy_dispatch(
+    Json(body): Json<serde_json::Value>,
+) -> impl IntoResponse {
+    let hash = errant_ffi::sha256_hex(body.to_string().as_bytes());
+    Json(serde_json::json!({
+        "ok":   true,
+        "seal": hash,
+        "gate": "TRUST-DEED-GATE",
+        "sovereign": "Ω",
+    }))
+}
+
+use futures::StreamExt;
+use chrono;

magmad/src/main.rs

@@ -0,0 +1,114 @@
+// main.rs — magmad sovereign agentic daemon
+//
+// Starts REST + SSE on :3000 (primary interface).
+// gRPC on :50051 is defined in grpc/mod.rs and will be wired when protoc
+// becomes available (install protoc, re-add tonic_build to build.rs).
+//
+// Usage:
+//   magmad                         # start with defaults
+//   MAGMA_HTTP_PORT=8080 magmad    # override HTTP port
+//   MAGMA_NATS_URL=nats://... magmad
+//
+// Ahmad Ali Parr · SnapKitty Collective · 2026
+
+mod bob;
+mod config;
+mod errant_ffi;
+mod grpc;
+mod http;
+mod nats_bus;
+
+use std::sync::Arc;
+use anyhow::Result;
+use tracing::{info, warn, error};
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let cfg = config::Config::from_env();
+
+    // ── Tracing ───────────────────────────────────────────────────────────
+    tracing_subscriber::fmt()
+        .with_env_filter(&cfg.log_level)
+        .json()
+        .init();
+
+    print_banner(&cfg);
+
+    // ── Verify liberrant is linked and working ────────────────────────────
+    {
+        let check = errant_ffi::verify_named(&["PUSH_UN", "SEAL"]);
+        if check.ok {
+            info!("liberrant {} online · FIPS SHA-256 verified", errant_ffi::version());
+        } else {
+            error!("liberrant self-check FAILED: {}", check.error);
+            std::process::exit(1);
+        }
+    }
+
+    // ── NATS connection (optional — daemon runs without it) ───────────────
+    let nats = match nats_bus::NatsBus::connect(&cfg.nats_url).await {
+        Ok(bus) => {
+            info!("NATS connected: {}", cfg.nats_url);
+            Some(Arc::new(bus))
+        }
+        Err(e) => {
+            warn!("NATS unavailable ({}): running in local mode", e);
+            None
+        }
+    };
+
+    // ── Build shared HTTP state ───────────────────────────────────────────
+    let http_state = http::AppState {
+        config:   Arc::new(cfg.clone()),
+        nats:     nats.clone(),
+        worm_url: format!("{}/api/labs/ledge/seal", cfg.os_url),
+    };
+
+    // ── REST + SSE server (primary interface) ─────────────────────────────
+    let http_addr: std::net::SocketAddr = cfg.http_addr().parse()?;
+    let app = http::router(http_state)
+        .layer(tower_http::cors::CorsLayer::permissive())
+        .layer(tower_http::trace::TraceLayer::new_for_http());
+
+    info!("REST/SSE listening on http://{}", http_addr);
+    info!("gRPC endpoint defined at :{}  (enable: install protoc, run cargo build)", cfg.grpc_port);
+    info!("magmad online · EVIDENCE OR SILENCE · Ω↺Ψ↺Δ↺Λ↺Σ↺Φ↺α");
+
+    let listener = tokio::net::TcpListener::bind(http_addr).await?;
+
+    tokio::select! {
+        r = axum::serve(listener, app) => {
+            if let Err(e) = r { error!("HTTP server error: {e}"); }
+        }
+        _ = tokio::signal::ctrl_c() => {
+            info!("Ω — magmad shutting down");
+        }
+    }
+
+    Ok(())
+}
+
+fn print_banner(cfg: &config::Config) {
+    eprintln!(r#"
+╔══════════════════════════════════════════════════════════════╗
+║  ███╗   ███╗ █████╗  ██████╗ ███╗   ███╗ █████╗ ██████╗    ║
+║  ████╗ ████║██╔══██╗██╔════╝ ████╗ ████║██╔══██╗██╔══██╗   ║
+║  ██╔████╔██║███████║██║  ███╗██╔████╔██║███████║██║  ██║   ║
+║  ██║╚██╔╝██║██╔══██║██║   ██║██║╚██╔╝██║██╔══██║██║  ██║   ║
+║  ██║ ╚═╝ ██║██║  ██║╚██████╔╝██║ ╚═╝ ██║██║  ██║██████╔╝   ║
+║  ╚═╝     ╚═╝╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝╚═╝  ╚═╝╚═════╝    ║
+╠══════════════════════════════════════════════════════════════╣
+║  Sovereign Agentic Daemon v{}                            ║
+║  BOB: TRUST-DEED-GATE → MAMBA → WATSON → PROLOG → SEAL     ║
+╠═════════════════════════════════════════��════════════════════╣
+║  REST/SSE  http://0.0.0.0:{}                               ║
+║  gRPC      :{}  (stub — install protoc to activate)      ║
+║  NATS      {}
+╚══════════════════════════════════════════════════════════════╝
+    "#,
+    env!("CARGO_PKG_VERSION"),
+    cfg.http_port,
+    cfg.grpc_port,
+    cfg.nats_url,
+    );
+}

magmad/src/nats_bus.rs

@@ -0,0 +1,74 @@
+// nats_bus.rs — NATS pub/sub fabric
+//
+// Wraps async-nats client. Sovereign subjects follow the pattern:
+//   sovereign.<layer>.<verb>.<version>
+//   e.g. sovereign.forge.build.v1
+//        sovereign.cipher.seal.v1
+//        sovereign.audit.bifrost.commit.v1
+//
+// NatsBus is cheaply cloneable (Arc inside async-nats client).
+
+use async_nats::Client;
+use anyhow::Result;
+use serde::Serialize;
+use tracing::{info, warn};
+
+#[derive(Clone)]
+pub struct NatsBus {
+    client: Client,
+}
+
+impl NatsBus {
+    pub async fn connect(url: &str) -> Result<Self> {
+        let client = async_nats::connect(url).await?;
+        info!("NATS connected: {}", url);
+        Ok(Self { client })
+    }
+
+    /// Publish a serializable payload to a NATS subject.
+    pub async fn publish<T: Serialize>(&self, subject: &str, payload: &T) -> Result<()> {
+        let bytes = serde_json::to_vec(payload)?;
+        self.client
+            .publish(subject.to_owned(), bytes.into())
+            .await?;
+        Ok(())
+    }
+
+    /// Publish a raw string payload.
+    pub async fn publish_str(&self, subject: &str, payload: &str) -> Result<()> {
+        self.client
+            .publish(subject.to_owned(), payload.as_bytes().to_vec().into())
+            .await?;
+        Ok(())
+    }
+
+    /// Publish a sovereign audit event to bifrost.
+    pub async fn audit<T: Serialize>(&self, event: &str, payload: &T) -> Result<()> {
+        #[derive(Serialize)]
+        struct AuditEnvelope<'a, T> {
+            event:    &'a str,
+            payload:  &'a T,
+            timestamp: String,
+        }
+        let envelope = AuditEnvelope {
+            event,
+            payload,
+            timestamp: chrono::Utc::now().to_rfc3339(),
+        };
+        self.publish("sovereign.audit.bifrost.commit.v1", &envelope).await
+    }
+
+    /// Subscribe to a subject, returning a stream of messages.
+    pub async fn subscribe(&self, subject: &str) -> Result<async_nats::Subscriber> {
+        Ok(self.client.subscribe(subject.to_owned()).await?)
+    }
+}
+
+/// Offline stub — used when NATS is unavailable.
+/// Logs the publish attempt and returns Ok(()) silently.
+pub async fn publish_offline(subject: &str, payload: &str) {
+    warn!("NATS offline — dropped: {} → {}", subject, &payload[..payload.len().min(80)]);
+}
+
+// chrono for timestamps
+use chrono;