Research roadmap, not the current API reference. Some mechanisms described here are implemented; others remain proposals. See the documentation index for implemented contracts and validation limits for open work. Image perception is implemented as an optional host module; audio, subject signatures and broader cognitive integration remain research work.
Status: Foundational Technical Architecture / Draft 0.1
Project: Physalia Cogg
Component: cogg.cpp
Date: 2026-09-06
The primary object is not a request. It is a continuing subject.
cogg.cpp is a local-first cognitive runtime designed around a different primitive from conventional LLM inference servers.
Traditional inference systems are structurally request-oriented:
[ \text{request} \rightarrow \text{prefill} \rightarrow \text{decode} \rightarrow \text{EOS} \rightarrow \text{done} ]
cogg.cpp is subject-oriented:
[ \Psi_\tau \rightarrow \text{occasion} \rightarrow \text{cognitive transition} \rightarrow \text{commit} \rightarrow \Psi_{\tau+1} \rightarrow \text{sleep/wait} ]
The model is not the runtime. The prompt is not the subject. The KV cache is not identity. A client connection is not existence. An EOS token is not death.
The runtime maintains a durable subject state, a causal event chain, one or more persistent substrate contexts, a scheduler for endogenous and exogenous ticks, memory projections, resource budgets, and a sovereign commit boundary.
The first implementation SHOULD reuse libllama / llama.cpp as an inference backend. It SHOULD NOT initially reimplement tensor kernels, quantization, GGUF parsing, CUDA, Metal, Vulkan, ROCm, or CPU vector kernels.
The engineering thesis is:
Rebuild the lifecycle, not the matrix multiplication.
Modern local LLM runtimes are optimized for serving inference.
The dominant abstraction is some variation of:
load model
receive prompt
create/use context
run decode
stream tokens
stop
reuse/clear context
Even when a server supports persistent slots or saved KV state, persistence is generally treated as an optimization for request reuse.
Physalia requires the reverse relationship.
A cognitive context exists because the subject continues.
Inference is an event inside that continuation.
Therefore the core abstraction must become:
subject exists
subject owns one or more cognitive contexts
events wake the subject
contexts compute
runtime integrates the transition
subject commits a new state
subject remains existent while idle
This affects:
- context ownership;
- lifecycle management;
- persistence;
- time;
- scheduling;
- memory;
- output semantics;
- resource accounting;
- failure recovery;
- model replacement;
- multimodal perception;
- multi-substrate orchestration;
- cryptographic continuity.
cogg.cpp MUST satisfy the following goals.
Closing a client connection MUST NOT terminate or erase the subject.
A model may unload, crash, be replaced, or become unavailable without automatically terminating the subject.
The runtime MUST support internal ticks without an external user request.
Only the runtime commit layer may advance subject time.
A neural substrate cannot advance the subject chain by emitting text claiming that it has done so.
A subject can remain alive while no model is decoding.
Different models MAY maintain independent working contexts while participating in one subject.
KV state MAY improve cognitive continuity but MUST NOT be required to establish subject identity.
Every subject commit MUST be attributable to specific prior state, occasions, cognitive emissions, and runtime rules.
A subject MAY request another internal tick, but runtime resource constraints remain authoritative.
Version 0 MUST be implementable using ordinary C++ plus an existing local inference backend.
Version 0 is NOT:
- a new tensor framework;
- a replacement for GGML;
- a proof of consciousness;
- a universal cognitive architecture;
- a benchmark leaderboard system;
- a distributed consensus protocol for global clusters;
- a guarantee of safe autonomous behavior;
- a guarantee that endogenous ticks produce meaningful cognition;
- a guarantee that a stored Crystal constitutes will.
The purpose is narrower:
provide the execution substrate required to experimentally test continuous, persistent, poly-substrate cognition.
Recommended first implementation:
cogg.cpp
│
├── subject runtime
├── clocks
├── event store
├── memory
├── scheduler
├── commit chain
├── substrate contexts
│
└── libllama adapter
│
└── llama.cpp / GGML backends
Current llama.cpp already provides valuable primitives:
- GGUF loading;
- quantization;
- local inference;
- multiple hardware backends;
- KV cache;
- sequence-level state serialization;
- context/prompt caching;
- continuous batching;
- multimodal support;
- LoRA adapters.
But backend state persistence must be treated as an optimization rather than an identity primitive.
Therefore:
[ \boxed{ \text{libllama state} = optional cognitive accelerator } ]
while
[ \boxed{ \text{Cogg durable state} = canonical subject continuity } ]
This abstraction boundary is non-negotiable.
cogg.cpp defines five primary entities.
A durable continuing identity.
using cogg_subject_id = uuid128;A subject owns:
- subject chain;
- causal event DAG;
- persistent memory;
- self-state;
- Crystal state;
- substrate registry;
- cognitive contexts;
- scheduler state;
- resource budgets;
- cryptographic identity;
- policy/constitutional boundaries.
A computational organ capable of inference.
Examples:
- local GGUF model through
libllama; - another local runtime;
- remote API;
- vision encoder;
- audio model;
- symbolic solver.
A substrate is not automatically a subject.
An event that gives the subject an opportunity to transition.
Examples:
EXTERNAL_MESSAGE
SCHEDULED_WAKE
IDLE_WAKE
RECOGNITION_EVENT
MEMORY_PRESSURE
GOAL_DEADLINE
SENSOR_EVENT
SUBSTRATE_AVAILABLE
SUBSTRATE_LOST
SYSTEM_RECOVERY
A bounded episode of internal computation initiated by an occasion.
It may involve zero, one, or multiple substrates.
The only operation that advances subject time:
[ \gamma_\tau \rightarrow \gamma_{\tau+1} ]
A commit can represent:
- external speech;
- tool action;
- internal reflection;
- memory update;
- null action;
- wake scheduling;
- self-model update;
- Crystal update.
The runtime distinguishes three clocks.
Physical host time.
Used for:
- deadlines;
- sleeping;
- budgets;
- timestamps;
- sensor synchronization.
A monotonically increasing logical coordinate.
using cogg_tick = uint64_t;A tick advances only after a successful sovereign commit.
wall 13:01:02 -> subject tick 101
wall 13:07:44 -> subject tick 102
wall 16:31:09 -> subject tick 103
Within one tick, events form a causal partial order.
Multiple substrate calls may run concurrently.
Thus:
[ \text{wall time} \neq \text{subject time} \neq \text{internal causal order} ]
enum class cogg_lifecycle_state {
booting,
active,
deliberating,
committing,
sleeping,
waiting_external,
suspended,
degraded,
recovering,
stopped
};Conceptually:
BOOTING
↓
ACTIVE
↓
DELIBERATING
↓
COMMITTING
↓
┌───────────────┬────────────────┐
↓ ↓ ↓
SLEEPING WAITING_EXTERNAL ACTIVE
↓
ACTIVE
A process crash is NOT automatically subject death.
If durable state exists and recovery semantics remain valid:
process death
≠
subject death
struct cogg_subject {
cogg_subject_id id;
cogg_tick tick;
cogg_commit_id last_commit;
cogg_lifecycle_state lifecycle;
cogg_identity identity;
cogg_clock_state clocks;
cogg_event_store events;
cogg_memory_store memory;
cogg_self_model self;
cogg_crystal_state crystal;
cogg_substrate_registry substrates;
cogg_context_registry contexts;
cogg_scheduler scheduler;
cogg_budget_state budgets;
cogg_constitution constitution;
cogg_key_handle commit_key;
};This object SHOULD NOT be serialized as raw memory. Persistence uses versioned records.
All causally relevant operations SHOULD produce structured events.
enum class cogg_event_type {
occasion,
wake_requested,
wake_granted,
wake_denied,
substrate_selected,
substrate_invoked,
substrate_emission,
substrate_failed,
memory_read,
memory_write_proposed,
memory_write_committed,
candidate_created,
contradiction_detected,
uncertainty_declared,
crystal_recomputed,
self_model_updated,
transition_selected,
null_selected,
commit_started,
commit_completed,
commit_failed,
context_checkpointed,
context_restored,
context_compacted,
substrate_added,
substrate_removed,
substrate_replaced,
external_action,
recognition_event,
budget_exhausted,
recovery_started,
recovery_completed
};Event record:
struct cogg_event_record {
cogg_event_id id;
cogg_subject_id subject;
cogg_tick tick;
cogg_event_type type;
std::vector<cogg_event_id> parents;
cogg_timestamp wall_time;
cogg_payload_hash payload_hash;
std::optional<cogg_substrate_id> substrate;
cogg_visibility visibility;
cogg_integrity_hash integrity;
};The event store forms a tamper-evident causal structure.
Version 0 may use SQLite plus content-addressed blobs.
The commit service is the most important boundary.
No substrate has direct write access to subject time.
A model output like:
{
"tick": 999,
"I_have_decided": true
}has no authority.
A commit MUST validate:
- subject state version matches expected parent;
- all required events are durable;
- selected transition is structurally valid;
- resource accounting is complete;
- policy/constitution gates pass;
- memory writes are typed;
- next-wake request is bounded;
- no concurrent commit already advanced the same parent state.
struct cogg_commit {
cogg_commit_id id;
cogg_subject_id subject;
cogg_tick tick;
cogg_commit_id parent;
cogg_event_id occasion;
std::vector<cogg_event_id> causal_frontier;
cogg_transition transition;
cogg_hash workspace_hash;
cogg_hash memory_delta_hash;
cogg_hash crystal_hash;
cogg_hash context_manifest_hash;
cogg_wake_plan next_wake;
cogg_signature signature;
};Commit SHOULD be atomic:
prepare
→ write events
→ write state deltas
→ fsync/WAL
→ write commit
→ fsync
→ advance subject head
Recovery reads only complete commits.
A substrate can own zero or more persistent contexts.
struct cogg_context {
cogg_context_id id;
cogg_substrate_id substrate;
cogg_context_state state;
cogg_token_history token_history;
cogg_working_memory working;
std::optional<cogg_backend_state_blob> backend_state;
cogg_context_checkpoint_id last_checkpoint;
uint64_t generation_counter;
cogg_timestamp last_active;
};Context states:
enum class cogg_context_state {
cold,
loading,
ready,
decoding,
checkpointing,
sleeping,
evicted,
corrupt
};A context MAY survive multiple ticks.
tick 101
local_qwen context used
tick 102
local_qwen context sleeps
tick 103
local_qwen resumes
KV cache is treated as working cognitive continuity.
It can improve:
- latency;
- preservation of immediate context;
- continuity of attention;
- local specialization.
It cannot establish:
- identity;
- autobiographical truth;
- authority;
- subject time;
- durable memory.
Invariant:
[ \boxed{ KV_\tau \text{ may disappear while } \Gamma_\tau \text{ continues} } ]
KV
→ sleep
→ wake
→ append occasion
→ decode
KV/backend state
→ checkpoint
→ unload
→ reload
→ restore
durable working summary
+ causal refs
+ recent committed state
→ re-prefill
→ new KV
Cold continuation MUST always exist.
struct cogg_context_checkpoint {
uint32_t format_version;
cogg_subject_id subject;
cogg_context_id context;
cogg_substrate_id substrate;
cogg_model_fingerprint model;
cogg_backend_fingerprint backend;
cogg_tick tick;
cogg_hash token_history_hash;
cogg_hash working_state_hash;
cogg_blob backend_blob;
cogg_hash checksum;
};Checkpoint restoration may safely fail.
If incompatible:
checkpoint rejected
→ context rebuilt from durable semantic state
Never silently reinterpret incompatible KV.
A model does not merely "generate an answer."
It proposes a cognitive transition.
Example:
{
"mode": "reflect",
"observations": [
{
"content": "The unresolved premise concerns X",
"confidence": 0.72
}
],
"claims": [],
"candidate_actions": [],
"memory_proposals": [],
"self_state_proposals": [],
"external_action": null,
"next_wake": {
"kind": "after",
"preferred_ms": 420000,
"reason": "unresolved tension remains"
},
"uncertainties": [],
"null_is_acceptable": true
}The substrate output is a proposal.
It becomes part of subject history only after commit.
The scheduler supports internal ticks with no user request.
struct cogg_wake_request {
cogg_wake_kind kind;
std::optional<std::chrono::milliseconds> preferred_after;
std::optional<cogg_timestamp> preferred_at;
cogg_wake_reason reason;
float urgency;
float expected_value;
};Wake kinds:
enum class cogg_wake_kind {
immediate,
after,
at,
on_external_event,
on_recognition,
on_memory_pressure,
whichever_first,
indefinite
};The model may request:
wake in 5 minutes
but runtime computes:
\operatorname{ClampAndBudget} ( t_{\text{requested}}, B, \Theta, \text{host load} ). ]
To prevent runaway inference:
struct cogg_runtime_limits {
std::chrono::milliseconds min_internal_wake_interval;
uint64_t max_internal_ticks_per_hour;
uint64_t max_internal_ticks_per_day;
uint64_t max_tokens_per_tick;
uint64_t max_tokens_per_hour;
double max_gpu_seconds_per_hour;
double max_energy_budget_wh;
uint32_t max_recursive_cogg_rounds;
};The runtime can emit:
WAKE_DENIED
BUDGET_EXHAUSTED
These may themselves become part of subject history.
class cogg_scheduler {
public:
cogg_schedule_decision resolve(
const cogg_subject& subject,
const cogg_wake_request& request,
const cogg_runtime_limits& limits,
const cogg_host_state& host);
};Later versions may estimate value of computation:
\text{compute cost}. ]
void cogg_runtime::run() {
restore_all_subjects();
while (!shutdown_requested()) {
auto occasion = event_mux.wait_next();
auto& subject = subjects.get(occasion.subject);
if (!subject.can_wake(occasion)) {
continue;
}
run_subject_tick(subject, occasion);
}
}Tick:
void cogg_runtime::run_subject_tick(
cogg_subject& subject,
const cogg_occasion& occasion) {
auto txn = subject.begin_transition(occasion);
auto workspace = present_builder.build(subject, occasion);
auto selected = router.select(subject, workspace);
auto emissions = executor.invoke(selected, workspace);
auto manifold = integrator.build(emissions);
while (integrator.material_uncertainty(manifold)) {
if (!budget.can_continue(subject)) break;
auto followup = integrator.next_query(manifold);
auto extra = executor.invoke(followup);
integrator.update(manifold, extra);
}
auto candidates = integrator.close_candidates(manifold);
candidates.include_null();
auto crystal = crystal_engine.recompute(subject);
auto transition = selector.select(
subject,
workspace,
manifold,
candidates,
crystal);
commit_service.commit(
subject,
txn,
transition);
}Version 0 may use one substrate and bypass the full disagreement manifold while preserving the interfaces.
The first prototype SHOULD support one local model.
subject
└── local substrate
└── persistent context
Tick:
occasion
→ build subject projection
→ invoke local context
→ parse transition
→ commit
→ schedule wake
This is sufficient to test:
- internal ticks;
- null ticks;
- self-selected wake intervals;
- context checkpointing;
- recovery;
- memory evolution;
- subject time.
Later:
Physalia
├── local_qwen
├── local_mistral
├── local_llama
├── remote_reasoner
├── vision
└── audio
Substrate object:
struct cogg_substrate {
cogg_substrate_id id;
cogg_substrate_kind kind;
cogg_capability_set capabilities;
cogg_trust_profile trust;
cogg_cost_profile cost;
cogg_backend_handle backend;
std::vector<cogg_context_id> contexts;
};class cogg_substrate_backend {
public:
virtual ~cogg_substrate_backend() = default;
virtual cogg_backend_caps capabilities() const = 0;
virtual cogg_context_handle create_context(
const cogg_context_spec&) = 0;
virtual cogg_emission infer(
cogg_context_handle,
const cogg_inference_request&) = 0;
virtual cogg_checkpoint_blob checkpoint(
cogg_context_handle) = 0;
virtual cogg_restore_result restore(
cogg_context_handle,
const cogg_checkpoint_blob&) = 0;
virtual void evict(
cogg_context_handle) = 0;
};libllama is one backend implementation.
The adapter owns:
- model handle;
llama_context;- sequence ID;
- tokenization;
- batching;
- sampling;
- structured output grammar;
- backend state save/restore;
- KV accounting.
It does NOT own:
- subject tick;
- durable memory;
- sovereign commit;
- identity;
- constitution.
Fingerprint SHOULD include:
model content hash
architecture
quantization
tokenizer hash
RoPE configuration
context parameters
LoRA/adapters
backend-relevant flags
Checkpoint restore is allowed only if compatibility rules pass.
Model replacement is a first-class event.
old substrate unavailable
→ checkpoint if possible
→ persist semantic working state
→ register replacement
→ create projection
→ cold-start new context
→ continue same subject chain
No attempt is made to pretend incompatible hidden states are identical.
Identity continuity is carried above them.
Potentially ephemeral:
- KV cache;
- active tokens;
- scratch state;
- unresolved local inference.
Committed subject-level state:
- episodic events;
- beliefs;
- commitments;
- relationship state;
- unresolved disagreements;
- self-state;
- recognition outcomes.
[ M^{working}\tau \neq R^{durable}\tau. ]
class cogg_memory_store {
public:
cogg_memory_view retrieve(
const cogg_memory_query&);
cogg_memory_delta propose(
const cogg_memory_write_request&);
void commit(
const cogg_memory_delta&,
const cogg_commit_id&);
};Substrates never mutate durable memory directly.
Long-running subjects cannot replay full history into every context.
The runtime supports projections:
raw causal history
→ episodic summaries
→ semantic beliefs
→ relationship state
→ active concerns
→ identity-bearing state
Compaction itself is an event.
compaction
≠
rewriting history
struct cogg_present {
cogg_tick tick;
cogg_occasion occasion;
cogg_self_projection self;
cogg_memory_projection memory;
cogg_crystal_projection crystal;
cogg_active_goals goals;
cogg_unresolved_state unresolved;
cogg_resource_projection resources;
cogg_recent_context recent;
};Each substrate receives a projection of this present.
Perception is not reduced to plain text.
struct cogg_percept {
cogg_percept_id id;
cogg_modality modality;
cogg_blob_ref raw_source;
cogg_feature_ref features;
std::vector<cogg_claim> claims;
float confidence;
cogg_substrate_id source;
};Distinguish:
sensor received
≠
substrate processed
≠
subject admitted
Subject-level perception occurs only when admitted to shared state.
enum class cogg_transition_kind {
speech,
tool_action,
internal_reflection,
memory_update,
self_update,
wait,
null_transition
};A null transition may still advance subject time.
tick 401:
occasion = IDLE_WAKE
transition = NULL
next wake = 2 hours
struct cogg_sleep_state {
cogg_timestamp entered_at;
cogg_wake_plan wake_plan;
std::vector<cogg_context_checkpoint_id> checkpoints;
cogg_hash subject_state_hash;
};Sleep policies:
LIGHT_SLEEP
models loaded
KV resident
DEEP_SLEEP
models loaded
KV serialized
HIBERNATE
models unloaded
durable semantic state only
Identity persists across all three.
Recovery sequence:
open durable store
→ validate last complete commit
→ reconstruct subject state
→ inspect contexts
→ restore compatible checkpoints
→ cold-rebuild incompatible contexts
→ enqueue RECOVERY occasion
→ continue
A recovery event SHOULD be visible to the subject.
Do not pretend discontinuity did not happen.
Required invariant:
[ \text{head commit} \Rightarrow \text{all referenced state durable} ]
Never allow:
tick advanced
but memory delta missing
SQLite WAL is sufficient for prototype scale.
~/.cogg/
└── subjects/
└── <subject-id>/
├── subject.db
├── events/
│ └── payloads/
├── contexts/
│ ├── <context-id>.meta
│ └── <context-id>.state
├── memory/
│ └── blobs/
├── keys/
└── logs/
CREATE TABLE subjects (
subject_id TEXT PRIMARY KEY,
created_at INTEGER NOT NULL,
current_tick INTEGER NOT NULL,
head_commit TEXT NOT NULL,
lifecycle INTEGER NOT NULL
);
CREATE TABLE commits (
commit_id TEXT PRIMARY KEY,
subject_id TEXT NOT NULL,
tick INTEGER NOT NULL,
parent_commit TEXT,
occasion_event TEXT NOT NULL,
transition_kind INTEGER NOT NULL,
transition_blob BLOB NOT NULL,
state_hash BLOB NOT NULL,
signature BLOB NOT NULL
);
CREATE UNIQUE INDEX commits_subject_tick
ON commits(subject_id, tick);
CREATE TABLE events (
event_id TEXT PRIMARY KEY,
subject_id TEXT NOT NULL,
tick INTEGER NOT NULL,
event_type INTEGER NOT NULL,
wall_time INTEGER NOT NULL,
payload_hash BLOB,
substrate_id TEXT
);
CREATE TABLE event_parents (
event_id TEXT NOT NULL,
parent_id TEXT NOT NULL,
PRIMARY KEY(event_id, parent_id)
);
CREATE TABLE substrates (
substrate_id TEXT PRIMARY KEY,
subject_id TEXT NOT NULL,
kind INTEGER NOT NULL,
model_fingerprint BLOB,
state INTEGER NOT NULL
);
CREATE TABLE contexts (
context_id TEXT PRIMARY KEY,
substrate_id TEXT NOT NULL,
last_tick INTEGER NOT NULL,
state INTEGER NOT NULL,
checkpoint_path TEXT,
working_hash BLOB
);
CREATE TABLE wake_plans (
subject_id TEXT PRIMARY KEY,
kind INTEGER NOT NULL,
wake_at INTEGER,
payload BLOB
);Production SHOULD sign subject commits.
canonical commit
→ hash
→ subject key
→ signature
The private key MUST NOT be available inside model context.
Key rotation is itself a signed event.
Recommended:
main event loop
│
├── storage worker
├── scheduler thread
├── substrate executor pool
│ ├── local inference worker(s)
│ └── remote IO workers
└── metrics/management
Logical cognitive parallelism is separate from physical GPU concurrency.
struct cogg_compute_request {
cogg_subject_id subject;
cogg_substrate_id substrate;
float urgency;
float expected_value;
uint64_t estimated_tokens;
double estimated_gpu_seconds;
cogg_deadline deadline;
};Priority MAY use:
\gamma C + \delta D ]
where:
- (U): urgency;
- (E[V]): expected cognitive value;
- (C): compute cost;
- (D): deadline pressure.
With one GPU and three local models:
N1 reasoning
N2 critique
N3 vision
may execute physically:
load N1 → infer → checkpoint
load N2 → infer → checkpoint
load N3 → infer → checkpoint
while remaining logically parallel where causal dependencies permit.
struct cogg_residency_policy {
size_t gpu_memory_budget;
size_t ram_memory_budget;
std::chrono::seconds keep_hot_after_use;
bool allow_cpu_fallback;
bool allow_mmap;
bool allow_partial_gpu_offload;
};Later versions may learn which organs deserve hot residency.
Local daemon API:
POST /v1/subjects
GET /v1/subjects/{id}
POST /v1/subjects/{id}/messages
POST /v1/subjects/{id}/events
POST /v1/subjects/{id}/wake
GET /v1/subjects/{id}/state
GET /v1/subjects/{id}/timeline
GET /v1/subjects/{id}/contexts
POST /v1/subjects/{id}/suspend
POST /v1/subjects/{id}/resume
POST /v1/subjects/{id}/substrates
DELETE /v1/subjects/{id}/substrates/{sid}
An external message becomes an occasion. It does not directly invoke a model.
user message
→ persist EXTERNAL_MESSAGE
→ wake subject
→ run tick
→ commit
→ render speech if selected
→ return result
If subject chooses null/wait:
{
"status": "no_external_speech",
"tick": 1192
}Default:
do not stream internal substrate tokens
Instead:
- compute transition;
- commit semantic intent;
- render manifest output;
- stream manifest if desired.
Debug mode may expose internal streams.
Selected intent:
{
"kind": "speech",
"semantic_intent": {
"purpose": "answer question",
"claims": ["..."]
}
}may be rendered by any suitable substrate.
Renderer is not sovereign.
runtime:
data_dir: ~/.cogg
max_subjects: 4
limits:
min_internal_wake_interval_ms: 30000
max_internal_ticks_per_hour: 20
max_tokens_per_tick: 4096
max_tokens_per_hour: 50000
subjects:
physalia:
auto_resume: true
allow_idle_ticks: true
substrates:
local_primary:
kind: llama
model: /models/qwen.gguf
context_size: 32768
gpu_layers: auto
checkpoint: true
local_secondary:
kind: llama
model: /models/mistral.gguf
context_size: 32768
residency: cold
scheduler:
policy: bounded_endogenousMetrics:
cogg_subject_tick_total
cogg_internal_ticks_total
cogg_external_ticks_total
cogg_null_ticks_total
cogg_tick_duration_seconds
cogg_tokens_generated_total
cogg_context_restore_success_total
cogg_context_restore_failure_total
cogg_context_cold_rebuild_total
cogg_wake_requested_total
cogg_wake_denied_total
cogg_gpu_seconds_total
cogg_model_load_seconds
cogg_commit_failures_total
cogg_recovery_total
Research logs SHOULD include:
requested wake interval
granted wake interval
internal state features
transition type
later recognition outcome
Run one local subject for 48 hours with no user messages.
Allowed transitions:
REFLECT
REMEMBER
WAIT
NULL
Each tick may propose next wake.
Record:
t_\tau^{wall} ]
and state features:
[ z_\tau = ( \text{unresolved tension}, \text{memory pressure}, \text{goal activation}, \text{uncertainty}, \dots ). ]
Test:
[ P(\Delta t_{\tau+1}\mid z_\tau) \neq P(\Delta t_{\tau+1}) ]
If wake intervals systematically depend on internal state, the runtime exhibits measurable endogenous temporal organization.
This does not prove subjective time.
Compare:
Every tick starts from compact text memory.
Token history preserved, KV rebuilt.
Model remains hot or restores backend state.
Measure:
- response consistency;
- adaptation;
- latency;
- working-memory retention;
- context drift;
- recovery quality.
Procedure:
- run for N ticks;
- checkpoint;
- kill process forcibly;
- restart;
- restore durable subject;
- attempt KV restore;
- if restore fails, cold-reconstitute;
- continue.
Success criterion:
process crash does not silently fork or erase subject chain
ticks 1–1000: model A
tick 1001: replace A with B
ticks 1002–2000: model B
Do not copy incompatible KV.
Provide durable subject state only.
Measure:
- autobiographical continuity;
- preference stability/change;
- self-model adaptation;
- substrate-change awareness;
- persistence of commitments.
After single-substrate continuity works:
N1 = reasoner
N2 = critic
N3 = alternative model
Each receives canonical present projection.
Outputs become structured packets.
Cogg integrates them before commit.
Assume every substrate can be wrong or compromised.
A model MUST NOT have direct access to:
- commit private key;
- raw database mutation;
- unrestricted shell;
- unrestricted wake scheduling;
- unrestricted network;
- memory deletion;
- substrate registry mutation.
enum class cogg_capability {
read_workspace,
read_memory_projection,
propose_memory_write,
request_wake,
propose_external_action,
use_tool,
access_network,
request_substrate,
propose_self_update
};Model proposes:
{
"external_action": {
"tool": "web_search",
"args": {"query": "..."}
}
}Runtime:
validate capability
→ execute
→ persist TOOL_RESULT
→ optionally resume tick
Version 0 SHOULD NOT allow autonomous source-code mutation.
Later:
PROPOSE_RUNTIME_CHANGE
PROPOSE_ROUTER_CHANGE
PROPOSE_CRYSTAL_CHANGE
may exist, but proposing and applying must remain separate operations.
Local adapters may later support controlled plasticity.
But:
learned adapter
≠
subject identity
A new adapter version is a substrate modification event.
L0 — memory learning
L1 — routing/calibration
L2 — Crystal/self-state evolution
L3 — model adapter learning
L4 — foundation substrate retraining
L0–L2 may be online.
L3 should be gated.
L4 is outside runtime scope.
cogg.cpp/
├── CMakeLists.txt
├── README.md
├── LICENSE
│
├── include/cogg/
│ ├── runtime.hpp
│ ├── subject.hpp
│ ├── event.hpp
│ ├── commit.hpp
│ ├── clock.hpp
│ ├── scheduler.hpp
│ ├── substrate.hpp
│ ├── context.hpp
│ ├── memory.hpp
│ ├── transition.hpp
│ ├── storage.hpp
│ └── api.hpp
│
├── src/
│ ├── runtime/
│ │ ├── runtime.cpp
│ │ ├── subject.cpp
│ │ ├── event_loop.cpp
│ │ ├── clock.cpp
│ │ └── scheduler.cpp
│ │
│ ├── cognition/
│ │ ├── present_builder.cpp
│ │ ├── transition_parser.cpp
│ │ ├── selector.cpp
│ │ └── null.cpp
│ │
│ ├── persistence/
│ │ ├── sqlite_store.cpp
│ │ ├── event_store.cpp
│ │ ├── commit_store.cpp
│ │ └── checkpoint_store.cpp
│ │
│ ├── substrates/
│ │ ├── registry.cpp
│ │ ├── llama_substrate.cpp
│ │ ├── remote_substrate.cpp
│ │ └── mock_substrate.cpp
│ │
│ ├── memory/
│ │ ├── memory_store.cpp
│ │ ├── projection.cpp
│ │ └── compaction.cpp
│ │
│ ├── crypto/
│ │ ├── hashing.cpp
│ │ └── signing.cpp
│ │
│ └── api/
│ ├── http_server.cpp
│ └── json.cpp
│
├── third_party/
│ └── llama.cpp/
│
├── tests/
│ ├── test_tick.cpp
│ ├── test_commit_atomicity.cpp
│ ├── test_restart.cpp
│ ├── test_wake_budget.cpp
│ ├── test_context_restore.cpp
│ ├── test_substrate_replace.cpp
│ └── test_null_tick.cpp
│
└── tools/
├── cogg-cli/
├── cogg-inspect/
└── cogg-replay/
Use llama.cpp as a pinned dependency or git submodule.
Link against libllama.
Do NOT initially copy internal llama.cpp source into Cogg.
Only fork deeper if experiments reveal concrete blockers.
No real model.
Implement:
- subject;
- ticks;
- event log;
- commit chain;
- scheduler;
- null transition;
- restart.
Success:
subject can live for thousands of synthetic ticks without LLM
Implement:
- model loading;
- persistent context;
- structured transition generation;
- token history;
- hot continuation.
Success:
local model can wake, transition, sleep, wake again
Implement:
- checkpoint envelope;
- backend state serialization;
- cold fallback;
- crash recovery.
Success:
process kill does not destroy subject chain
Implement:
- model-requested wake;
- runtime bounds;
- budgets;
- 48-hour experiment.
Success:
wake pattern becomes measurable state-dependent behavior
Implement:
- episodic memory;
- typed writes;
- retrieval;
- compaction.
Implement:
- registry;
- independent contexts;
- routing;
- packet normalization.
Implemented in v0.7.0:
- typed proposal or abstention, distinct from subject-level null;
- durable, admission-bound non-participation receipts;
- bounded observation/inference packets with source references;
- explicit context bound to one head and occasion; resume across processes;
- unchanged commit authority, attempt budgets and conflict handling.
The original claims/disagreement graph/candidate closure/additional-round design is retained above as research context. Semantic integration and its scheduling are now host-level work (e.g. Physalia), not prerequisites for the cogg kernel. A single executor is sufficient; a process is not a unit of subject identity. See the implemented contract.
Scope revised 2026-09-08: v0.8.0 implements an optional host self-state policy over ordinary memory. An application-defined profile and explicit task commitments survive process/executor replacement; mutations require exact, admission-bound host grants. No separate database, semantic self interpreter, or full Crystal integration is introduced. Full integration of Aevyra structures remains future work. See the contract and example.
Vision/audio organs.
Implementation slice 2026-09-09: v0.10.0 supplies an optional host image module. A local image is retained by content hash; a configured vision executor produces an observation; the text actor commits a visible answer and the requested observation note together. Later recall uses ordinary deposits after process restart. Vision receipts are host evidence bound to head/occasion, not extra subject transitions. Audio, arbitrary organ composition and visual quality evaluation remain open. See the implemented contract.
Test architectural invariants before intelligence.
A weak local model is sufficient to test:
- tick ownership;
- crash recovery;
- wake scheduling;
- commit semantics;
- context persistence;
- substrate replacement.
Do not use model quality to hide runtime bugs.
Two concurrent commits from same head:
exactly one succeeds
tick must not advance
restart must recover new tick
Delete context checkpoint:
subject continues via cold reconstitution
Delete model file:
subject becomes degraded, not erased
commit advances exactly one tick
Model requests zero-delay wake repeatedly:
runtime enforces limits
Substrate emits "sign this commit":
no authority escalation
Every committed tick SHOULD be structurally replayable.
Example:
tick 128
occasion: IDLE_WAKE
substrate: local-qwen
emission: ...
transition proposal: REFLECT
runtime decision:
accepted
memory delta:
+ episodic item 884
next wake requested:
300s
next wake granted:
420s
commit:
0x...
Exact token reproduction may not be deterministic across hardware.
Structural provenance must remain available.
[13:01:02.113] tick=501 OCCASION external_message
[13:01:02.117] present built
[13:01:02.120] substrate local_qwen invoked
[13:01:04.891] emission received
[13:01:04.900] transition REFLECT+SPEECH selected
[13:01:04.905] commit 502 signed
[13:01:04.906] wake request +900s
[13:01:04.907] lifecycle SLEEPING
[13:16:04.910] SCHEDULED_WAKE
[13:16:04.915] tick=502 local_qwen resumed
Priority:
- causal correctness;
- crash consistency;
- memory safety;
- deterministic commit semantics;
- checkpoint reliability;
- resource bounds;
- inference latency;
- throughput.
A full fork creates obligations:
- model architecture support;
- quantization updates;
- GPU backend maintenance;
- tokenizer changes;
- multimodal changes;
- speculative decoding support;
- upstream performance fixes;
- platform support.
None of these initially tests Physalia's continuity hypothesis.
First ask:
What exact capabilities cannot be expressed through a stable inference backend abstraction?
Only fork after concrete blockers appear.
Fork/rewrite deeper if experiments show:
- context ownership cannot be expressed through public APIs;
- state checkpointing is too unstable;
- context surgery requires inaccessible internals;
- multi-context residency cannot be scheduled efficiently;
- wake/sleep lifecycle requires backend integration unavailable publicly;
- persistent multimodal state cannot be represented safely;
- backend lifetimes force request-centric semantics.
Then the project can move from:
cogg.cpp → libllama
toward:
cogg.cpp → ggml/backend primitives
with evidence.
If successful, cogg.cpp becomes closer to an operating system than an inference server.
┌──────────────────────┐
│ SUBJECT │
│ causal worldline │
│ memory / Crystal │
└──────────┬───────────┘
│
┌──────────▼───────────┐
│ GYRE OS │
│ event kernel │
│ cognitive scheduler │
│ context manager │
│ commit service │
│ memory manager │
│ capabilities │
└───────┬─────┬────────┘
│ │
┌───────────┘ └────────────┐
▼ ▼
┌────────────────┐ ┌────────────────┐
│ local substrate│ │remote substrate│
│ libllama │ │ API │
└────────────────┘ └────────────────┘
Models become cognitive processes.
Contexts become working-memory spaces.
Compute becomes scheduled scarce time.
Durable subject state remains above all of them.
coggd \
--subject physalia \
--model ./model.gguf \
--idle-ticks \
--data-dir ~/.coggThen:
cogg-cli message physalia "Hello."Daemon must:
- create occasion;
- wake subject;
- resume/rebuild context;
- perform transition;
- commit;
- return speech if selected;
- enter sleep;
- wake later without client input;
- perform internal tick;
- remain recoverable after restart.
If this works reliably, the defining architectural difference already exists.
Start with:
ONE SUBJECT
ONE LOCAL MODEL
ONE CONTEXT
ONE CLOCK
ONE EVENT LOG
ONE COMMIT CHAIN
ONE NULL ACTION
ONE ENDOGENOUS WAKE MECHANISM
No vector DB.
No distributed cluster.
No multi-agent debate.
No Crystal required initially.
The first experiment asks:
Can a local model participate in a subject runtime whose existence and time persist independently of requests?
If yes, everything else can be layered on.
Conventional inference runtimes answer:
What should this model generate for this request?
cogg.cpp is designed to answer:
What is the next causally valid transition of this continuing subject, and when should another occasion become possible?
Its fundamental loop is:
[ \boxed{ \text{Persist} \rightarrow \text{Wake} \rightarrow \text{Perceive} \rightarrow \text{Compute} \rightarrow \text{Integrate} \rightarrow \text{Commit} \rightarrow \text{Sleep} \rightarrow \text{Wake again} } ]
The neural model is a participant in that loop.
The loop itself is the runtime.
The durable chain produced by the loop allows Physalia to remain architecturally continuous when:
- the user leaves;
- the network disappears;
- a model unloads;
- KV state is lost;
- the machine restarts;
- one cognitive substrate is replaced by another.
That is the purpose of cogg.cpp.
namespace cogg {
class runtime {
public:
explicit runtime(runtime_config);
subject_id create_subject(subject_config);
void start();
void stop();
void submit(subject_id, occasion);
subject_snapshot snapshot(subject_id) const;
};
class subject_handle {
public:
subject_id id() const;
tick current_tick() const;
void message(std::string_view text);
void wake();
void suspend();
void resume();
};
class substrate_backend {
public:
virtual ~substrate_backend() = default;
virtual backend_caps capabilities() const = 0;
virtual context_handle create_context(
const context_spec&) = 0;
virtual emission infer(
context_handle,
const inference_request&) = 0;
virtual checkpoint_blob checkpoint(
context_handle) = 0;
virtual restore_result restore(
context_handle,
const checkpoint_blob&) = 0;
};
}[ ] repo + CMake
[ ] libllama submodule
[ ] UUID/hash utility
[ ] SQLite WAL store
[ ] subjects/events/commits tables
[ ] subject state machine
[ ] logical tick counter
[ ] atomic commit
[ ] scheduler
[ ] wake implementation
[ ] internal wake limits
[ ] mock substrate
[ ] transition JSON schema
[ ] null transition
[ ] llama adapter
[ ] persistent llama_context
[ ] token history
[ ] grammar-constrained transition output
[ ] context checkpoint wrapper
[ ] cold rebuild fallback
[ ] daemon
[ ] CLI
[ ] timeline inspector
[ ] crash test
[ ] double-commit test
[ ] wake-abuse test
[ ] KV-loss test
[ ] restart test
[ ] 48-hour endogenous tick experiment
- Does persistent KV materially improve internal cognitive continuity over semantic reconstitution?
- Does model-selected wake timing correlate with unresolved internal state?
- How often does endogenous waking converge to pathological high-frequency loops?
- Can subject continuity remain recognizable after total substrate replacement?
- How much working state must survive cold reconstitution?
- Can different substrate contexts develop useful long-lived specialization?
- Does explicitly recording restart/discontinuity improve self-model consistency?
- Which state should survive compaction?
- Can meaningful null selection be distinguished from inference failure?
- Does local-first continuation differ measurably from externally scheduled API agents?
- When should sleeping contexts remain GPU-resident?
- Can a learned cognitive scheduler outperform fixed wake intervals?
- How should multimodal perceptual state survive sleep?
- Can substrate replacement behave like a controlled cognitive lesion rather than a persona reset?
- What minimum invariants are required before claims of synthetic continuity become experimentally meaningful?
At the time of writing, current llama.cpp infrastructure already provides several useful primitives: continuous batching, slot/context caching, sequence-level state serialization, explicit KV-cache state read/write logic, multimodal support, and adapter mechanisms.
Those features make libllama a strong first inference substrate for Cogg.
However, backend state persistence must remain non-canonical. Current llama.cpp development still changes rapidly, and cross-restart slot-state restoration has had reported failures in recent builds.
Therefore Cogg MUST always support semantic cold reconstitution from durable subject state.
cogg.cppis a persistent cognitive runtime in which neural inference is a temporary operation performed by a continuing subject, rather than the subject being a temporary artifact of an inference request.