Boot Sequence

If the OSTK_AGENTFILE environment variable is set, boot reads and parses the Agentfile at that path. Resolves:

• FROM <model> — which LLM the agent targets
• TOOL <name> — tool declarations (counted, not loaded)
• LIMIT, ISOLATION — resource and sandbox constraints

Missing Agentfile is non-fatal — boot continues with defaults. Present-but-unreadable is an error.

Hierarchical resolution loads operator identity and preferences. Resolution order:

1. ~/.HUMANFILE — global identity (MODEL, SIGN, TRUST directives are immutable from this layer)
2. .ostk/HUMANFILE — project-level config (may EXTENDS global)
3. Merge if both exist — project overlays global, but identity fields stay pinned to the global source

Directives resolved at this stage: MODEL, SIGN, PREPROCESS, TRUST, SECRET, EMBED, DRIVER, VERB, BOOT.

After loading, boot auto-populates the AVAILABLE model list by scanning for known API keys (ANTHROPIC_API_KEY, GEMINI_API_KEY, etc.) and initializes secret masking for any SECRET directives.

The identity and capability layer. Boot determines who you are and what you can do:

• Trust tier — HUMANFILE and verified primefile evidence resolve first; the local GPG keyring is the fallback path for T0 through T3.
• ENTITYFILE — governance evidence is loaded through the supported verifier. Current Ed25519/DSSE paths are primary; detached GPG and Sigstore-era artifacts remain compatibility routes.
• Pin caps — when OSTK_PIN=<name> is active, capabilities load from .ostk/pins/<name>/pin.caps and compose with tier defaults.
• Drivers — declared drivers probed via Unix sockets. Boot never spawns drivers — it only checks what is already running. Inactive drivers are registered for demand-spawn on first use.
• .language — the verb registry is populated. Kernel services, MCP primitives, introspection tools, and HUMANFILE VERB directives are all registered into the .language file.

Before any of this, boot reaps dead agents from the process table and cleans up orphaned heartbeat files — housekeeping from the previous session.

Builds the context injection that every agent instance receives at session start. The preload is assembled from:

• Project structure scan (what files exist, language breakdown)
• .language register contents (all verbs, devices, services with their resolutions)
• boot.md swap — the compiled operator section replaces the template boot.md
• Identity blocks from HUMANFILE (communication style, scheduling preferences, corrections log)

The stable portion can be rendered once and reused locally. Compatible Anthropic routes may optionally upload a file-backed copy for context efficiency, but upload is not required and other routes can keep the same artifact local.

Resolves the tack grammar and validates the dispatch loop:

• Tack grammar — HUMANFILE VERB definitions are validated against .language. Unresolvable verbs reduce boot confidence.
• INIT validation — the post-language INIT verb sequence is checked. Missing verbs in the INIT chain are flagged and penalize the boot confidence score.
• Verb momentum — recent tack resolution history from the audit log is loaded to seed the confidence gradient.

After this stage, the compressed register dump is printed — a one-line summary of .language state (verb count, fleet size, open needles).

The agent loop begins. Boot transitions from observation to action:

• Harness detection — environment is probed to determine tool routing (Claude Code, ostk-serve, CI, terminal). This controls whether the agent uses native tools or MCP primitives.
• Checkpoint verification — the most recent checkpoint is checked through its configured verifier. Current attestation and legacy detached-signature paths have separate compatibility rules.
• Version pin — if .ostk/version exists, the running binary version is checked against the pin.
• Continuation prompt — if enabled, a dynamic prompt is generated from current workspace state and written to .ostk/prompts/continuation.md.

The embedded CPU agent loop uses the 7-step approval chain. Other System ABI verbs use their own documented policy and audit paths.