M01 · Core & Foundation

The heart of D-COS NEXUS: it starts the system, checks licences and protects every other module.

Benefits: One trusted centre: no module can bypass the licence, permission and supervision checks.

Example of use: At start-up the core reads the licence, enables only the licensed modules and keeps the others locked.

Key capabilities

• Licence verification and module unlocking
• Knowledge store, decisions, actions and workflows
• Signed human supervision of sensitive actions
• Protection of keys, customer identities and the internal event bus
• Encrypted storage of personal data (vault)
• MCHP: node identity, mutual authentication and anti-replay between nodes

The core of the single executable and the only Root of Trust. It holds the contract registry and the invoke() pipeline (permissions, Zero-Trust policy, schema validation, timeout, output check, operation log), the base contracts conoscenza, decisioni, azioni, workflow, supervisione and router_esecutivo, and the trust layer m01_fiducia: pinning of public trust anchors, the mediated Bus Controller, customer identities and context. The M01 Crypto Kernel is the single place that touches cryptographic primitives (SHA-256, HMAC, Ed25519, AES-256-GCM, Scrypt, HKDF). Licence verification (Ed25519), the encrypted vault (AES-256-GCM) and signed human supervision also live here. Since 2026-11-12 the licence verification also enforces the M35 hardware binding (stable V_H and TPM proof of possession) for version-2 licences. MCHP 1.0.0 (contract m01_mchp): Ed25519 node identities with pinned public keys (immutable pin, final revocation, replacement signed by the old and the new key), mutual authentication handshake, signed envelopes with SHA-256 integrity, nonce, timestamp and transaction id, persistent atomic anti-replay, Receive != Authorize (explicit per-node grants, denied by default) and execution only through invoke() with all its checks; audit in the central forensic chain (fail-secure). M01 holds no private key: the local node signs with the device identity.

Prerequisites

None: always active.

Declared limits

The sovereign Root of Trust is not implemented. MCHP messages are authenticated and integrity-protected but not encrypted, and MCHP has not been tested between separate machines. Hardware binding applies only to version-2 licences that declare it (version-1 licences already issued stay valid without binding). A check running on the customer's PC can be removed by whoever patches the executable.

Planned (roadmap)

• Sovereign Root of Trust (deferred to the executable release)
• Profile-level hardware-binding policy (option B adopted on 2026-11-12): binding mandatory for the profiles that declare it, every outcome recorded — designed, not implemented
• Active blocking on substitution of licence keys (today detected and reported)
• Migration of the P2P/mesh stack and the local TLS material to the Crypto Kernel

Interconnections

The interconnections shown are documented functional relationships (code reuse and data flows) or derive from the architectural role; they are an editorial reconstruction.