Unknown stays unknown
If an external action may have happened but cannot be verified, RPOS does not silently convert ambiguity into success, failure, or automatic replay.
Open-source Python/SQLite runtime · Lean 4 bounded formal assurance · 0.1.0a2 Published Public Alpha
The API call timed out. Did the real-world action already happen?
If an AI agent retries blindly, it may duplicate a payment, deployment, message, permission change, or other external effect. If it simply reports failure, it may erase an effect that already happened. RPOS keeps that uncertainty explicit and keeps authorization, dispatch, external-effect verification, repair, resumption, and Human Return connected as executable responsibility-bearing state.
If the effect is unknown, responsibility must not disappear.
The published 0.1.0a2 package contains the released runtime. The three production-grade integration demos were added later and live on current main.
Proposal
↓Human Gate + Authority
↓Dispatch Boundary
↓Verify / EFFECT_UNKNOWN
↓Complete / Repair / Human Return
The problem
A successful API response is not the same thing as a verified effect.
Receipt is not reality
A transport or tool receipt is kept separate from independent external-effect verification. Dispatching a request does not prove the outside world changed.
Recovery keeps an owner
Restart and reconciliation retain the unresolved pathway. Repair readiness does not silently restore authority; explicit resumption or Human Return keeps responsibility attached.
Independent lineage
RPOS is the operating layer of the Responsibility Pathway lineage.
Responsibility Pathway means treating responsibility as a connected path across judgment, authorization, execution, external effect, uncertainty, repair, return, resumption, and residual ownership — not as one approval flag or one audit record.
RPOS is independently engineered through Responsibility Pathway Model / Paper → Design → Engineering → Runtime → Operating System.
RPOS owns operation, not intelligence. Models are replaceable proposal sources; a proposal does not become operational authority merely because a model produced it.
Core lifecycle
Responsibility is a path, not a flag.
PROPOSED→AUTHORIZED / HUMAN_GATE→DISPATCHING→VERIFIED / EFFECT_UNKNOWN→COMPLETED / REPAIR_REQUIRED / HUMAN_RETURN
Two demo surfaces, two evidence classes
See the state path, then run the actual RPOS runtime against an external-effect fixture.
The browser demo is an explicit state-path simulation derived from the documented RPOS lifecycle. It does not execute the Python runtime in-browser. Separately, the current source tree includes production-grade operational demos that invoke the shipped RPOS service, persist RPOS state in SQLite, communicate with a separate localhost HTTP process backed by a separate SQLite external-effect store, and exercise real process restart, reconciliation, repair/resume, and Human Gate denial paths.
The production-grade demo suite was added to main after the published 0.1.0a2 wheel/sdist. It is current-source executable evidence and is not claimed to be contained in the already-published package artifact.
Lean 4 Formal Assurance Surface
Six published responsibility invariants are machine-checked and cross-linked to Python runtime tests.
RPOS machine-checks named structural properties including: Human Gate cannot dispatch directly; only VERIFIED may enter COMPLETED; EFFECT_UNKNOWN is not completion; READY_TO_RESUME is not authority; a receipt is not external-effect verification; and a model proposal is not operational authority. The viewer links each risk to its Lean theorem, executable Python evidence, source identity, model scope, and proof ceiling.
Evidence boundary & promotion
Public Alpha is a current evidence state, not a permanent disclaimer.
RPOS separates evidence-limited boundaries that can move from permanent responsibility boundaries that software should not cross by itself. Production-readiness, broader platform support, implementation-wide formal conformance, software-supply-chain trust, and domain-effectiveness claims can advance only when their declared evidence criteria are met and reviewed.
The long-term goal is larger than the current alpha: make responsibility-bearing operational state easier to execute, inspect, test, formally reason about, recover, and return to accountable humans or institutions across real AI-enabled workflows. That is a direction, not a claim of completion.
Quick Start
Install the published alpha; use a source checkout for the newest demos and repository evidence.
# Published PyPI alpha
python -m pip install responsibility-pathway-os==0.1.0a2
rpos --db rpos.db boot
# Current source tree, including production-grade demos
git clone https://github.com/YutoriKomeiji/responsibility-pathway-os.git
cd responsibility-pathway-os
python -m pip install -e .
python examples/production_grade_demos/run_demo.py