SELAH

SELAH is an agent-native integration system and protocol for portable identity, environment awareness, capability boundaries, and deterministic, receipt-backed communication.

It gives an agent a small, stable vocabulary for answering four practical questions:

1. Who is this agent?
2. What runtime, provider, account, environment, and project context is actually observed?
3. Which capabilities are merely available, and which have been explicitly granted?
4. What decision was made, and what evidence can another process verify?

SELAH is model-, provider-, account-, and environment-neutral. Its core does not call a model, choose a provider, read credentials, or infer authority from model text. Adapters supply authenticated evidence and provider-specific behavior at the boundary.

SELAH is installed to give an agent a portable, structured identity and an observed environment/capability/receipt layer. Departments govern documents and prompts through packaged language profiles, and Spanish is the explicit cross-department communication profile. Start with selah --help, then use the documented setup and orientation flow below.

Install

python -m pip install selah==0.1.0rc1

The base distribution has one runtime dependency, rfc8785==0.1.4. Optional adapter extras are available for mcp, server, google, noldorian, animation, and all. The core import does not load optional SDKs.

First run

The setup command asks for one human choice: name a new agent or select an existing opaque agent ID. It then reports local observations. If the adapter cannot know a context field, SELAH asks for a conditional confirmation instead of silently treating the field as known.

For a new identity, the conditional confirmation is bound to the pending transition saved in the configured state database. Re-running the same product-facing command with --confirm consumes that transition and reuses its candidate identity; a mismatched, expired, malformed, or already-consumed transition fails closed.

STATE=.selah/selah.sqlite3

# First call: inspect the conditional context prompt.
selah --json --state "$STATE" setup --name Ada

# Second call: confirm that saving the still-unknown observations is acceptable.
selah --json --state "$STATE" setup --name Ada --confirm

The setup response includes an identity, an observed context projection, and an onboarding receipt. The receipt is evidence of the transition; it is not a grant.

Inspect the saved orientation with the agent_id returned by setup:

selah --json --state "$STATE" orient --agent-id agent:REPLACE_ME --profile latina

Orientation is read-only. It distinguishes known values from unknown values, observed capabilities from authorized capabilities, and current authority from missing or stale authority.

Deny before allow

An observed capability is not permission. A grant must be issued by an authenticated authority adapter and must match the agent, scope, authority generation, and time window. The runnable quickstart at examples/selah/quickstart.py shows both paths:

python examples/selah/quickstart.py

The example reports:

• MISSING_GRANT when a capability is observed but no grant exists;
• ALLOW after an explicit, scoped grant is issued by the fixture verifier;
• the onboarding receipt ID and digest for later inspection.

The fixture uses an internal verifier seam only to keep the example offline and deterministic. A deployed adapter must obtain its issuer and principal from its authenticated transport or authority system; a caller cannot create them by supplying a label, boolean, or digest.

Runtime lifecycle mutations

The optional runtime lifecycle adapter keeps status read-only. start and stop require the typed identity, session, runtime lifecycle grant, ALLOW authority decision, an ExecutableDispatch, and its StateRepository. The dispatch nonce is claimed before the provider is loaded or called, so a dispatch can execute at most once. Bind the operation into the authority request with RuntimeAdapter.operation_intent_hash("start") or RuntimeAdapter.operation_intent_hash("stop"); callers using the mutation API without typed dispatch/state receive a stable denial.

What SELAH does not claim

SELAH does not promise universal protection from manipulation, prompt injection, or semantic drift. It makes a narrower, measured and testable claim: when an integration uses the typed language, authenticated context, explicit grants, fail-closed decisions, and receipts, the evaluation suite can measure whether particular drift and instruction-hacking cases were reduced. Results are reported by model, language profile, corpus, and release threshold rather than converted into a general guarantee.

Related documents

• docs/selah/SECURITY.md — identity, context, observations, grants, decisions, receipts, and the trust boundary.
• docs/selah/LANGUAGE.md — deterministic lexical and grammatical protocol behavior.
• docs/selah/MIGRATION.md — explicit one-way migration from legacy ACETATE records.
• examples/selah/quickstart.py — an offline installed-package walkthrough.

SELAH is not Dreamjournal. Dreamjournal is a separate product. SELAH is not a Dreamjournal dependency, and Dreamjournal is not a SELAH dependency. Neither package imports, bundles, or release-gates the other, and Dreamjournal does not provide SELAH identity or authority.