ADR-0034: Domain operations are reality-declared Acts, not kernel syscalls

Status

Accepted. Refines the implementation of, and does not disturb the decisions in, ADR-0025, ADR-0026, and ADR-0027. Grounds the domain-neutral Assert-name rule in ADR-0033.

Date

2026-07-04

Context

The ticketing/RCA thin-slice promoted domain operations into the kernel as first-class syscalls: raise_alarm_syscall / clear_alarm_syscall (fault.rs, VinxiVerb::Assert, span syscall.assert.raise_alarm) and open_ticket_syscall / transition_ticket_syscall / confirm_root_cause_syscall (ticket.rs, Acts). These are VinxiKernel methods — the kernel now knows what an “alarm” and a “ticket” are.

That contradicts the kernel’s founding law: it is meta-semantic — “it never learns the point is a manhole” (the-seam §II). And it surfaced as a wire-naming question (ADR-0030): /sys/assert/raise-alarm felt wrong because Act and Assert are asymmetric about names. An Action is a declared, kernel-visible, SDK-projected operation-type (the-seam §VIII) — so Act legitimately carries domain vocabulary. There is no equivalent “assertion type”: Assert declares facts (series, links, entity state). “Raise an alarm” is neither a kernel primitive nor a fact — it is a domain operation (and in fact a composite: create the alarm entity + assert a raised_on link).

Decision

Domain-specific operations are reality-declared Actions that live in userland and are dispatched through the generic Act verb. The kernel’s syscall surface is the six generic verbs plus their meta-semantic base operations only. The line is specificity: create-entity is generic (any kind); raise-alarm knows “alarm” → domain → userland.

The kernel keeps one generic Act dispatch path (validate against the declared action-type → apply policy → append the decision Event). That is the syscall. Domain actions (raise-alarm, open-ticket, transition-ticket, confirm-root-cause) ride it as /sys/act/<name> with their logic in the reality/package, not in kernel-core.
Which write verb an operation’s effect uses stays provenance-driven, per the seam and ADR-0026: an owned decision writes through Act (a decision Event); a mirrored, high-volume declaration — an NMS alarm — is an Assert of the alarm entity’s facts (ADR-0026: “alarms … are Asserts, not Acts”). Either way it is the generic verb, never a bespoke raise_alarm method.
raise_alarm / open_ticket / transition_ticket / confirm_root_cause as hardcoded kernel methods are a thin-slice layering leak to be lifted into userland-declared Actions behind a generic Act dispatcher — the “registry of action kinds rather than one hardcoded syscall” ADR-0026 already scoped as the next kernel growth.

This reinforces ADR-0026 (transitions are Acts → therefore generic-Act dispatch, not per-transition syscalls) and leaves ADR-0025 (faults are graph citizens) and ADR-0027 (correlation is recompute) intact — it corrects an implementation choice, not a decision.

Alternatives Considered

Bless domain syscalls in the kernel (keep raise_alarm etc. as VinxiKernel methods): rejected — least churn now, but the kernel accretes domain semantics, and every new domain operation becomes kernel growth; the meta-semantic law is the whole reason the kernel is expected to outlast the domains on it.
Model raise-alarm as a bespoke Assert type (/sys/assert/raise-alarm): rejected — Assert has no operation-types to name, and raising an alarm is a composite over generic facts, not a single declaration.

Consequences

The next kernel growth is a generic Act dispatcher + reality-declared action registry, not more syscalls; the base SDK stays “the six verbs + base ops,” and reality SDKs project their own actions on top (the-seam §VIII).
The wire Assert namespace stays domain-neutral — series, link, and (reserved) state (ADR-0030). series/link exist as syscalls; state has no dedicated Assert yet — entity state is written via the Act create-entity path today. There is no domain assertion-type to name.
Lifting fault.rs / ticket.rs domain logic into userland Actions is a real refactor. It is recorded here and deferred (repo TODO.md); it is deliberately kept out of the Query vertical slice, which only needs the ADR-0030 route rename.
Agents and userland author domain Actions without touching the kernel — the “author-blind, no privileged admin channel” property (the-seam §IV) becomes literal: defining domain behavior is governed userland effect, not kernel code.