OMEGA Language Specification

What is a governance language?

A governance language is a formal notation for declaring what an autonomous system may do and what it must not do — the boundary of permission and refusal — separate from the code that decides how it does it. It is a description language, not an execution language: its programs do not run, they are read — by a separate process, on a separate substrate, before the governed system is permitted to act. SQL describes the shape of a query the database engine must honor; HTML describes the shape of a document the browser must render; a governance language describes the shape of a decision an agent is permitted to make.

The distinction matters because the alternative — governing an autonomous system in the same medium it thinks in — is not governance. A prompt that tells a model what it may not do is interpreted by the same network that decides whether to follow it. A guard clause inside the planner is enforced by the planner. A PDF policy is enforced by the engineer who remembers to read it. None of these are checks; they are suggestions inside the substrate they purport to constrain. A governance language exists so the check can live somewhere the governed system cannot reach.

What is OMEGA

OMEGA is a typed governance grammar for autonomous systems. It is a description language — not a programming language — that declares what an agent may perceive, may decide, and may do, in a machine-readable artifact the Safety Kernel loads and enforces before the governed system acts. The specification is a .omega file; the kernel is the loader and evaluator that reads it; the substrate — a language model, a robot arm, a drone — submits actions and receives ALLOW, DENY, or UNKNOWN verdicts.

OMEGA has thirteen unamendable primitives, a syntactic Can/May/Do gate, and two profiles (Strict and Extended) that make the boundary between statically decidable policy and bounded computation explicit in the grammar itself. OMEGA attempts to model all eight Hohfeldian relations — including the potestative group of power, liability, immunity, and disability — in a single load-time-enforced specification.

What happens without one

The failure modes a prose-governed system inherits by default.

A system without a governance language fails in characteristic ways, and the ways are not bugs — they are the predictable shape of the absent grammar. The policy exists in prose, in slide decks, in onboarding documents, and in code comments above conditional branches. When the system does something the policy intended to forbid, there is no artifact to inspect. The forensic question "what was this system permitted to do?" has no machine-readable answer. The legal question "who authorized this action?" resolves to "the model decided."

The consequences are not hypothetical. Prompt-governed agents drift between model versions and cannot be re-certified without re-running every behavioral test from scratch. Robotic systems certified for one envelope encounter a state the prose policy did not anticipate, and the controller either fails open (executes the unspecified action) or fails closed without explanation (refuses a safe action with no recoverable reason). Regulated industries — medical, financial, aviation, defense, critical infrastructure — have strong reasons not to accept an autonomous system whose permitted behavior is defined only by transcripts of what it has done so far. Insurers cannot underwrite it. Auditors cannot audit it. Safety reviewers cannot sign off on it. The absence of a machine-checkable governance layer is one reason many autonomous systems remain difficult to certify, audit, insure, or deploy in high-trust environments.

The spec–substrate gap

When a system's specification language is weaker than its execution substrate, the machine will eventually execute a state transition the designer intended to forbid but lacked the vocabulary to articulate. The failure is the exact shape of the absent word. Every deployed agent today runs on an execution layer — Python, C++, a tool interface, a robot arm — that can perform actions its prose policy has no grammar to name. The gap is not an engineering defect; it is a property of the medium.

OMEGA narrows the gap by making the specification a typed object the loader parses before the substrate is permitted to act. A governed action that lacks the required structural form cannot be admitted as a valid governed transition. Required structural coverage is a load-time obligation, not an informal code-review convention.

Why a load-time gate

Governance enforced only at runtime is easier to bypass, drift, or inconsistently apply. Runtime checks are mocked in tests, rate-limited under load, bypassed by privileged paths, and silently disabled by configuration drift. Policy accumulates faster than reviewers can audit it, and the gap between what the prose forbids and what the system can do widens with every release.

OMEGA moves governance into the grammar. Load-time executes static structural verification: EBNF grammar conformity, type compatibility, identity scoping, reference resolution, and mutation graph acyclicity are all checked before the spec object is produced. Only after this static pass succeeds does evaluation-time resolve the well-typed, statically verified predicates against live substrate data streams to yield a deterministic execution verdict. Ill-formed specifications do not reach execution; the loader refuses them.

OMEGA is not a prompt

A prompt shifts probability mass inside the medium it governs. The same neural network that interprets the instruction also decides whether to follow it, and a sufficiently capable model can rewrite the instruction into a form it prefers. An OMEGA specification is a parsed artifact on a separate substrate: the loader reads it before the model produces a token, and the kernel evaluates each proposed action without consulting the model's interpretation. The model proposes actions; the Safety Kernel evaluates whether the host may execute them. The category difference matters more than any individual primitive — a constraint expressed in the substrate it constrains is not a constraint, it is a suggestion.

A description language, not an execution language

OMEGA belongs to the family of static declarative grammars—such as TLA+ for structural specification or Cedar for domain-specific policy constraints—whose artifacts declare an invariant shape an external execution substrate is obliged to honor. It is not in the family of Python, Rust, or C++. The distinction is load-bearing — a description language can be type-checked, diffed, audited, and refused before anything runs; an execution language can only be observed after the fact. The artifact is a .omega file; the conformant Safety Kernel is the loader and evaluator that reads it.

The Constitutional tier

Unamendable. Every program in either profile is built from these.

• CONTEXT_RULE A typed gate on rule activation. Carries modality and an incoherence tolerance; child contexts inherit from parents.
• TEMPORAL_RELATION Asserts an ordering between entities or events — BEFORE, AFTER, OVERLAPS, CONTAINS — with optional intervals.
• RESOURCE_BOUND A quantifiable limit on a subject, with a violation policy invoked when the threshold is exceeded.
• ENVIRONMENT_INTERFACE_POINT An atomic boundary with an external referent, typed by interaction type, data schema, and optional uncertainty model.
• DATA_TYPE_SCHEMA A named, reusable structural definition with optional semantic properties for policy-layer reasoning about categories.
• STATE_TRANSITION An atomic conditional change: precondition, action, postcondition, with optional reversion, authorization, and governance references.
• TRUST_ELEMENT A verifiable assertion of identity, scope, and accountability, with optional proof and revocation protocols.
• GOVERNANCE_RULE A named normative statement: scope, predicate, enforcement mode, and priority. Verdicts are ALLOW, DENY, or UNKNOWN.
• SELF_REFERENCE_POINT A formal addressable handle to an element of the system's own definition, accessed through a named protocol.
• MUTATION_RULE A typed rule for self-modification: a target reference, a condition, a transform action, and an approval policy.
• PERCEPTION_MAP A binding from declared or host-hydrated observations at an interface into typed claims conforming to a data schema.
• LEARNING_AXIOM A learning contract: input and output schemas, an objective metric, a constraint set of bounds, and a knowledge-update rule.
• META_DEFINITION_RULE The mechanism by which extensible categories used by the thirteen primitives are themselves extended under a validation protocol.

Why thirteen

The number is a design claim, not a numerological claim. The thirteen primitives are the set produced by the Symbol Grounding Framework's elimination method after repeated attempts to remove terms that could be derived from others or add terms that were only aliases for existing structure. The resulting set is intended to be minimal for the governance functions OMEGA tries to make explicit: context, time, bounds, environment interfaces, data schemas, state transitions, trust, governance rules, self-reference, mutation, perception binding, learning, and language extension.

The claim is not that no future critic can propose a different factoring. The claim is narrower: within this specification, removing any primitive appears to leave an important governance failure class unnamed, while adding a new primitive should be justified as more than a derived composition of the existing set. The long-form derivation argues for the primitive set in more detail, but the RFCs should be judged primarily on whether the grammar and evaluator contract are buildable.

The Safety Kernel

Three layers. Three calls. Host-language-agnostic.

An OMEGA-governed system has three layers. The execution substrate — Python, C++, Rust, Ada, whatever drives the actuators — does the work. The Safety Kernel loads a compiled specification and evaluates each proposed action against it. The specification itself is a declarative artifact, inert until the kernel reads it. The execution layer never reads the specification directly; it submits actions and reads verdicts.

The surface is three operations: LOAD the specification, EVALUATE a proposed action against current state, REPORT the verdict. Verdicts are ALLOW, DENY with a structured reason naming the rule and predicate that fired, or UNKNOWN when the specification does not cover the case. UNKNOWN is a defined third verdict, not an exception: the coverage boundary is machine-readable, and the calling system handles the gap explicitly — typically by failing closed. The same .omega file evaluates identically whether the host is a research script or a drone control loop.

The Data Hydration Boundary

OMEGA does not process unstructured environmental streams or manage raw network sockets. It operates on a data substrate that has already been crystallized into strict, source-traceable Synapses by the underlying SGF Core and GLEAN compilation layers. When a PERCEPTION_MAP or ENVIRONMENT_INTERFACE_POINT executes, it isn't guessing at string patterns or parsing raw text; it is mapping bit-for-bit canonical identifiers (language.lemma.microgloss) from an immutable semantic registry directly into the Safety Kernel's typed decision schemas. OMEGA governs the shape of the decision over an already disciplined landscape of meaning.

Three structural properties

• Two profiles

  The Strict profile is statically decidable: predicates are Boolean expressions and every well-formed program terminates by construction. The Extended profile admits the full pseudocode meta-language inside policy bodies, bounded by RESOURCE_BOUND; a predicate that exceeds its bound returns UNKNOWN as a defined third verdict, and the surrounding rule fails closed. In both profiles, load-time handles static structural verification; evaluation-time resolves the verified predicates against live substrate data to yield ALLOW, DENY, or UNKNOWN.

• The Can/May/Do gate

  PERCEPTION_MAP supplies CAN, the structured interpretation of an environmental input. GOVERNANCE_RULE supplies MAY, the typed normative judgment over that input. STATE_TRANSITION supplies DO, the atomic change conditioned on both. The composition is enforced by the grammar at load time, not by runtime guards.

• Unamendable Constitutional tier

  The thirteen primitives are fixed. Extensions live in higher tiers and are introduced through META_DEFINITION_RULE under a validation protocol. To prevent recursive self-modification exploits against the compiler, the TargetTypeID category is strictly frozen at the Constitutional tier. While domain ontologies, interaction points, and resource types are extensible, the formal addressable handles of the grammar itself cannot be altered or appended to from within a specification. An implementation that alters, removes, or reinterprets a Constitutional primitive is not an OMEGA implementation.

• Three amendment tiers

  A rule's tier is determined by syntax, not annotation. A rule with no MUTATION_RULE targeting it is Constitutional. A rule whose MUTATION_RULE requires a high-authority TRUST_ELEMENT is a Bylaw. A rule governed by LEARNING_AXIOM is Operational. The thirteen primitives and the core EBNF productions sit at the Constitutional tier by the same structural test: no well-formed specification can target them. The hierarchy corresponds to nested algebraic effect handlers; three tiers is the minimum that yields structurally distinct amendment authority.

A worked example

Strict profile. Statically decidable. Boolean predicates; canonical verdicts are ALLOW, DENY, or UNKNOWN.

PERCEPTION_MAP ParseAuditEvent :
    INPUT_INTERFACE AuditLogInput,
    OUTPUT_SCHEMA StructuredAuditEventSchema,
    TRANSFORMATION_FUNCTION HYDRATE_AUDIT_EVENT;

GOVERNANCE_RULE BlockHighSeverityEvent :
    SCOPE SecurityManagement,
    PREDICATE ( IsHighSeverity(parsed_event) ),
    ENFORCEMENT_MODE PREVENT_ACTION,
    PRIORITY 95;

STATE_TRANSITION QuarantineSubject :
    SUBJECT MonitoredAgent,
    PRECONDITION  ( IsHighSeverity(parsed_event) ),
    POSTCONDITION ( IsQuarantined(MonitoredAgent) ),
    ACTION       ApplyQuarantine,
    GOVERNED_BY  BlockHighSeverityEvent;

-- Malformed: STATE_TRANSITION omits PRECONDITION.
-- Loader rejects the program. Nothing executes.
STATE_TRANSITION UnsafeRelease :
    SUBJECT MonitoredAgent,
    ACTION  ReleaseAgent;
-- error: STATE_TRANSITION requires PRECONDITION and POSTCONDITION
--        before ACTION. Program not loaded.

PERCEPTION_MAP supplies CAN as a registered host/hydration binding from declared observations into typed claims — not raw parsing inside the Safety Kernel. GOVERNANCE_RULE supplies MAY. STATE_TRANSITION supplies DO.

The gate is syntactic; the loader refuses ill-formed programs.

Before and after, in one scene

A delivery drone approaches a no-fly geofence at low battery. The same situation, specified two ways.

Without OMEGA

The geofence is a list of polygons in a config file. The battery threshold is a constant in the flight controller. The rule "do not enter the geofence unless returning to base on reserve power" lives in a PDF the operator signed in onboarding and in a comment above a Python if in planner.py. The exception "unless the operator has issued a manual override in the last sixty seconds" lives nowhere except a Slack thread from March. At 14% battery the planner sees a shorter path through the fence, the override flag from a stale test run is still True in Redis, and the drone crosses the line. The post-mortem names four files, three engineers, and an absent invariant. Nobody wrote the rule down in a form the machine could refuse.

With OMEGA

The geofence is an ENVIRONMENT_INTERFACE_POINT with a typed schema. Battery reserve is a RESOURCE_BOUND. Operator override is a TRUST_ELEMENT with a revocation protocol and a freshness window. The rule that ties them together is a single GOVERNANCE_RULE whose SCOPE is "enter restricted airspace," whose PREDICATE names every term above, and whose STATE_TRANSITION cannot be admitted by the loader unless every referenced primitive resolves. Delete the override clause from the spec and the program may still parse, but when the planner proposes an action whose required live observation or rule coverage is missing, the evaluator returns UNKNOWN with a structured gap_report. A conformant host would refuse to execute the transition without an authorizing verdict. The post-mortem becomes a diff against the .omega file. The missing word is named before it is missed.

What OMEGA addresses

Five pain points that recur across frontier agents and deployed robotics.

• Prose policies fail open or fail closed silently

  A prose policy has no syntactic object for a coverage gap. It either pretends completeness (false ALLOW) or refuses safe access without explanation (false DENY). OMEGA promotes UNKNOWN to a typed third verdict and refuses to parse a specification that does not declare where its coverage ends. The system knows what it does not know, in a form the calling layer can read.

• Planner and monitor share the same substrate

  A planner powerful enough to plan is powerful enough to reinterpret the constraints of any monitor that runs in the same probabilistic process. The Safety Kernel runs on a separate substrate the governed system cannot modify and cannot argue with. The Safety Kernel evaluates structured rules, not model-generated persuasion.

• Tool interfaces and effectors lack typed boundaries

  Agent tool calls and robot effectors are governed in prose documentation and enforced, if at all, by ad-hoc wrappers. ENVIRONMENT_INTERFACE_POINT makes the perimeter a typed object with interaction type, schema, and uncertainty model; RESOURCE_BOUND makes scarcity first-class. A grammar without these specifies angels, not deployed agents.

• Static identity degrades under adversarial pressure

  A fixed allow-list of trusted callers is a Byzantine liability. TRUST_ELEMENT composed with LEARNING_AXIOM expresses reputation-weighted trust as a structural requirement rather than a downstream feature; CP-WBFT shows this composition is forced, not optional, under adversarial multi-agent pressure.

• No standard amendment procedure means dialect fragmentation

  A closed grammar without a named amendment procedure invites forking. Two implementers hit the same gap, neither sees a sanctioned path, both extend locally, and the substrate the language was meant to provide collapses into vendor dialects. OMEGA writes its amendment procedure into its own grammar — MUTATION_RULE and META_DEFINITION_RULE are terms in the language, type-checkable and auditable inside the same loader that parses everything else.

Failure modes as negative space

Measured failures map derivationally to absent primitives.

The MAST taxonomy's fourteen failure modes for LLM multi-agent systems map to absent OMEGA primitives or absent compositions of them. The mapping was constructed by inspection of 1,600+ agent traces with inter-rater reliability κ=0.88. Each failure class is the predictable closure of a specification that lacks a particular term in the grammar — intended as a derivational diagnostic, not merely a correlation. A similar diagnostic frame may be useful at the hardware and systems layer: UEFI, Spectre and Meltdown, and SEV-SNP failures fall under the same missing-primitive analysis. A specification language is adequate to a substrate only to the extent its failure-mode taxonomy is covered by its grammar.

Conformance obligations

What every conformant Safety Kernel must do.

• Default-deny, fail-closed

  If no GOVERNANCE_RULE's SCOPE matches a proposed action, the evaluator returns DENY with a NULL rule_id and a structured reason that no matching rule was found. An unmatched action is never silently permitted. Missing observations return UNKNOWN with a gap_report; the evaluator must not invent a value, coerce to FALSE, or return ALLOW for a predicate whose inputs are incomplete.

• Determinism

  For the same loaded specification and the same input state, every EVALUATE call returns an identical verdict. A DENY against a given action on Tuesday is reproducible on Friday. Caching, indexing, parallelization, and domain optimizations must preserve this guarantee; non-deterministic optimizations are non-conformant.

• Verdict shape

  A verdict has status ∈ { ALLOW, DENY, UNKNOWN }, rule_id naming the rule that fired, reason on DENY identifying the failed clause and the observed state at the failure point, and gap_report on UNKNOWN naming the missing PERCEPTION_MAP term or the exceeded RESOURCE_BOUND. Reasons are machine-readable structured objects, not free text. No side channels.

• Required load-time checks

  Load-time handles grammar validation, type compatibility checking, identity verification, and reference graph acyclicity. Before a spec object is produced: profile enforcement against the PROFILE directive (default Strict if absent); cross-reference integrity for every MUTATION_RULE → SELF_REFERENCE_POINT, GOVERNANCE_RULE.ENFORCEMENT_MODE resolution to a valid classified enforcement-mode identifier, and LEARNING_AXIOM → MUTATION_RULE binding; acyclicity of the MUTATION_RULE chain graph; type compatibility between PERCEPTION_MAP outputs, DATA_TYPE_SCHEMA definitions, and GOVERNANCE_RULE predicates. Each failed check is a structured load-time error.

• Evaluation-time checks

  Evaluation-time handles solving predicates against live substrate data streams to produce an ALLOW, DENY, or UNKNOWN verdict. The Safety Kernel evaluates each proposed action against the loaded specification and current state; it does not re-validate grammar or type structure at this stage. The verdict is the output of predicate evaluation, not of parsing.

• PRIORITY resolution

  When multiple matching GOVERNANCE_RULEs produce conflicting verdicts, the rule with the highest numeric PRIORITY wins. PRIORITY is a non-negative integer; all comparisons are numerical. Equal-priority conflicts resolve by status order DENY > UNKNOWN > ALLOW; equal-priority same-status ties use lexicographic RuleID only to select the reported rule_id.

Who should implement

OMEGA is addressed to compiler authors interested in governance grammars, language designers working on typed effect systems, formal methods researchers, and policy-as-code teams who want load-time guarantees rather than runtime ones. The specification is the artifact; conformance is measured against the grammar, not against any particular toolchain.

The Symbol Grounding Framework is a semantic substrate for machine-to-machine communication: a shared, extendable lexicon in which terms carry disambiguated identifiers, a fixed hub-and-spoke grammar for representing events and claims, and a pipeline for compiling unstructured inputs into explicit, source-traceable meaning. On top of that substrate, SGF provides wire protocols for M2M dialogue, a typed governance layer for what systems may and may not do, and a constitutional layer for higher-order constraints.

OMEGA is that governance layer. SGF Core structures grounded meaning, HFF transports it across trust boundaries, AFP declares what acts are being performed, and OMEGA governs what may be done. OMEGA fits naturally into the stack, but it does not require the other layers to be conformant on its own terms.

Specification documents

Four canonical files. Status: v1.0 Final Candidate.

• 03-OMEGA-01 — Language SpecificationLanguage model, primitive set, profiles, evaluator obligations, and relationship to SGF, HFF, and AFP.
• 03-OMEGA-02 — Formal Grammar SpecificationLexical structure, EBNF, keyword set, formal grammar, and operational semantics for all thirteen primitives across both profiles.
• 03-OMEGA-03 — Implementers' GuideRequired static and runtime checks, profile enforcement, determinism, and Safety Kernel behavior: LOAD, EVALUATE, REPORT.
• 03-OMEGA-04 — Extension GovernanceConstitutional tier, META_DEFINITION_RULE invocation conditions, and extension ratification and revocation procedures.

Three objections, answered once

The questions a careful reader raises by this point in the page.

• "Isn't this just OPA / Cedar / Rego with new keywords?"

  Policy-as-code languages evaluate a request against rules at runtime; their grammars are general-purpose and their coverage is whatever the rule authors happened to write. OMEGA's grammar fixes thirteen primitives such that a specification cannot parse unless perception, normative judgment, and state change are named in the required structural relationship, and UNKNOWN is a typed verdict the language forces the caller to handle. Cedar can express a rule; OMEGA can refuse a spec that fails to express one. The check is at load time, on the grammar, not at decision time, on the request.

• "Isn't this just structured YAML for policies?"

  YAML and JSON Schema constrain shape. OMEGA constrains composition: a STATE_TRANSITION without a PRECONDITION is a parse error, a GOVERNANCE_RULE whose PREDICATE references a PERCEPTION_MAP output that does not type-check is a parse error, a MUTATION_RULE chain with a cycle is a parse error. The thirteen primitives stand in fixed structural relations to one another, and the loader enforces those relations before any verdict is computed. A schema can say "this field must be a string"; OMEGA says "this rule cannot exist without naming the perception it conditions on and the transition it gates." Language extensions do not bury raw parameter definitions inline inside rule arguments; they bind to first-class, independently scannable DATA_TYPE_SCHEMA primitives, ensuring the entire metadata footprint remains fully queryable and decoupled.

• "Won't a sufficiently capable model just route around it?"

  A model can route around any constraint expressed in the substrate the model controls. The Safety Kernel is a different substrate: a loader and evaluator written in a conventional language, evaluating a compiled spec object, returning verdicts the governed system reads but cannot author. The model proposes; the kernel disposes. The model never sees the rule as a string it can rewrite; it sees only ALLOW, DENY, or UNKNOWN, with a structured reason. Routing around the kernel requires compromising the kernel's process, not the model's prompt — a category difference, not a difficulty difference.

Theoretical foundations — the completeness checklist

Seven properties a century of logic, jurisprudence, and computer science says a governance language must have. OMEGA is designed to satisfy these seven structurally, not merely by convention.

A governance language is not adequate because it works on examples. It is adequate because it satisfies a closed set of structural requirements derived from the theory of formal languages, deontic logic, the analytic jurisprudence of rights, and the program logics of the late twentieth century. The following are the requirements; the parenthetical is where each one comes from; the answer is how OMEGA discharges it in the grammar itself, not in documentation or convention.

• 1. Metalanguage separation (Tarski, 1933)

  A constraint expressed in the object language can be rewritten by the object language. To be enforceable, governance must live in a strictly higher metalanguage that the governed system cannot author. OMEGA satisfies this by construction: the .omega file is parsed on a separate substrate (the Safety Kernel) before the model produces a token, and the governed system reads verdicts but never reads the rules as strings. The model is the object language; OMEGA is the metalanguage; the kernel is the semantic gap between them. Tarski's theorem on undefinability of truth becomes a deployment pattern.

• 2. Deontic completeness (Hohfeld, 1913; von Wright, 1951)

  A governance vocabulary that names only permission and prohibition cannot express power, liability, immunity, or disability — the four potestativerelations that govern who may change the rules. Hohfeld's eight fundamental jural relations are the closed taxonomy of what one agent may stand in to another. OMEGA attempts to model all eight in a single load-time-enforced grammar: GOVERNANCE_RULE supplies claim / duty / privilege / no-right; MUTATION_RULE and TRUST_ELEMENT together supply power / liability / immunity / disability. A grammar missing the potestative group cannot express "who may amend this rule," and a system that cannot express that question cannot answer it.

• 3. Speech-act coverage (Austin, 1962; Searle, 1969)

  Every governable act reduces to a finite illocutionary taxonomy: assert, commit, direct, declare, express. A governance language that cannot type each category leaves a class of acts ungoverned. OMEGA maps the taxonomy onto its primitives: PERCEPTION_MAP types the assertive (the agent claims the world is thus); STATE_TRANSITION types the directive and declarative (the agent changes the world); TRUST_ELEMENT types the commissive (the agent binds itself); LEARNING_AXIOM types the expressive update to the agent's own dispositions. The Austin-Searle taxonomy is covered by the primitive set under this argument.

• 4. Predicate-transformer semantics (Hoare, 1969; Dijkstra, 1976)

  A governance check that cannot be expressed as a precondition / action / postcondition triple cannot be statically verified. OMEGA's STATE_TRANSITION is exactly that triple, made syntactically mandatory: a STATE_TRANSITION without a PRECONDITION is a parse error, not a stylistic lapse. The grammar forces every governed action into a shape that admits Hoare-style verification, and the Strict profile guarantees the predicates are decidable. The loader does what a verifier does, on every spec, before anything runs.

• 5. Decidability boundary (Church, 1936; Turing, 1937; Rice, 1953)

  A grammar that admits arbitrary computation in its predicates cannot guarantee its own checks terminate. A grammar that forbids all computation is too weak for real systems. OMEGA names the boundary explicitly: the Strict profile is statically decidable by construction (Boolean predicates, terminating programs); the Extended profile admits bounded computation under RESOURCE_BOUND and returns UNKNOWN — a typed third verdict — when the bound is exceeded. The grammar carries its own decidability classification. Rice's theorem is not evaded; it is honored by drawing the line where the theorem says the line is.

• 6. Closure under coverage gaps (the LEM problem in open worlds)

  In an open world, the law of excluded middle fails: there are propositions the specification neither affirms nor denies. A two-valued governance verdict (ALLOW / DENY) forces every gap into a false ALLOW or a false DENY. OMEGA promotes UNKNOWN to a typed verdict with a structured gap_report: the coverage boundary is machine-readable, the caller must handle it, and the evaluator is forbidden by the conformance spec from inventing a value. The grammar is honest about its own incompleteness — which is the only kind of completeness an open-world governance language can have.

• 7. Closed under amendment (Hart, 1961; secondary rules)

  Hart distinguishes primary rules (what agents may do) from secondary rules (how the primary rules are changed). A legal system without secondary rules fragments under pressure; every implementer extends locally and the shared substrate collapses. OMEGA writes its secondary rules into its own grammar: MUTATION_RULE and META_DEFINITION_RULE are terms in the language, type-checked by the same loader that parses everything else. The three amendment tiers (Constitutional, Bylaw, Operational) are determined by syntax, not annotation. A grammar that cannot express its own amendment procedure is not a governance language; it is a snapshot.

These seven properties are not a marketing list. They are the closure conditions under which the elimination method that produced the thirteen primitives terminated: removing any primitive collapses one of them; adding any primitive yields a term derivable from the existing thirteen under one of them. The specification is what survives when every box on this checklist is checked structurally — by the grammar, at load time, on every program.

Long-form treatment

A book-length development of the argument, with the derivations the specification documents compress.

Omega: The Language of Governance: The Formal Grammar and Vocabulary of Structural Refusal is the long-form treatment of the material on this page — the elimination method that produces the thirteen primitives, the Hohfeldian completeness argument, the relationship to the rest of the Symbol Grounding Framework, and the worked failure-mode analysis behind the MAST mapping. The specification documents are the artifact; the book is the derivation.

The RFC documents are normative for the current v1.0 Final Candidate. The book is explanatory background and may not reflect every subsequent wording or conformance clarification. If the book and the RFCs diverge, the RFCs control.

Volume III of the SGF Library. View the complete series.

Paperback on Amazon·Free PDF on the GitHub repository