The typed transaction API is the OS API

Context

If the model were the only way to change the machine, the machine would be as reliable as the model. The review asked for this sentence to be written down: the typed transaction API is the operating-system API, and the CLI, scripts, other agents and the model are all its clients.

The three plans

• Grok: tacid rebuild applies a declared tree; deterministic : verbs never touch the model.
• Fable: plan → propose diff → approval → apply → verify → record; every action is a diff.
• Codex: the transaction model (intent → typed change → policy → Nix diff → validate → build → preview → activate → journal) with an ephemeral/persistent split.

Decision

One envelope, two kinds. action transactions are ephemeral (tests, serial monitors, flashing, Wi-Fi, screenshots) and never render Nix; change transactions are persistent and follow the full lifecycle: classify → verdict → render → stage → eval → build → preview → approval → activate by class → health gate → rollback on failure → journal → agent-signed commit. Every transaction has an activation class (switch, session-restart, boot): changing the kernel, a driver, the compositor or tacidd under a live session is not reversible in effect and is boot-class. Rollback claims are three-way (system, data snapshot, external). tacid undo is a generation switch and a genome revert in one operation. Deterministic : verbs and tacid do use the API without a model.

Consequences

• The machine is deterministic first and intelligent second; the model proposes, the API acts.
• “Connect to Wi-Fi” does not rebuild the system (review objection).
• Scripts and other agents get exactly the owner’s power and no more.

Alternatives rejected

• Everything through Nix: turns ephemeral work into rebuilds.
• The model calls shell: the thing this project exists to replace.