Status: pre-launch. This page describes target design; this document does not establish a deployed service.

C2 -- Adapters: Inter-Organ Wiring

Current reading — 2026-09-27

The snippets illustrate a predecessor adapter profile, not deployed adapters or authorization rails. Required stages depend on the owning consumer contract; traversal is not universally seven calls. Canonical memory, client state and polling cursors are distinct; last_poll needs defined cursor ownership before an implementation is usable. [I]

This reader boundary does not migrate interfaces, choose unresolved terms or prove deployment. See current status.

Organs do not call each other. Adapters translate between them.

The Three Adapters

Each adapter bridges two organs across the pipeline. They are the synapses of the organism -- translating one organ's output into the next organ's input.

F1 -> F2: circle_adapter.py

Circle (IS) produces observations. ReFu (COULD) consumes probability questions. The adapter translates between them.

class CircleAdapter:
    """Polls Circle API, creates ReFu market candidates."""

    def __init__(self, circle_url: str, api_key: str):
        self.client = CircleClient(circle_url, api_key)

    async def poll(self) -> list[Signal]:
        """Fetch latest verified observations from Circle."""
        raw = await self.client.get_observations(
            min_watchman_score=6.0,
            since=self.last_poll,
            limit=50
        )
        return [Signal.from_circle_observation(obs) for obs in raw]

    async def to_refu_market(self, signal: Signal) -> MarketProposal:
        """Convert a Circle observation into a ReFu market question."""
        return MarketProposal(
            question=signal.to_prediction_question(),
            category=signal.category,
            sources=signal.source_ids,
            circle_score=signal.watchman_score,
            expiry=signal.suggested_resolution_date
        )

F2 -> F3: refu_adapter.py

ReFu (COULD) produces probability prices. Agentz (SHOULD) consumes scored opportunities with edge estimates.

class ReFuAdapter:
    """Subscribes to ReFu WebSocket, injects into APU pipeline."""

    def __init__(self, refu_ws_url: str):
        self.ws = ReFuWebSocket(refu_ws_url)

    async def stream_prices(self) -> AsyncIterator[PricedSignal]:
        """Stream probability updates from active markets."""
        async for update in self.ws.subscribe("market.price.*"):
            yield PricedSignal(
                market_id=update.market_id,
                probability=update.current_price,
                edge=self.estimate_edge(update),
            )

F3 -> F4: apu_adapter.py

Agentz (SHOULD) stages unsigned proposals. The target adapter below receives a proposal and a separately authorized receipt. For a public-DAV consequence, the signer(s) required by applicable law, the entity's governing instrument, or a valid competent mandate bind the exact consequence in a complete valid bound PRISM decision receipt. PRISM records and verifies only; deterministic execution is limited to that exact consequence. This v1 adapter is public-only; a Natural Person's own typed private act and a Legal Person's lawful external authority plus required executors need later versioned adapters and receipt schemas.

class APUAdapter:
    async def dispatch(
        self,
        proposal: ProposalEnvelope,
        authority: AuthorityReceipt | None,
    ) -> ExecutionReceipt | ProposalDisposition:
        """Fail closed unless typed authority binds this exact proposal."""
        computed_proposal_hash = sha256_rfc8785_jcs(
            proposal,
            exclude_fields={"proposal_hash"},
        )
        if proposal.proposal_hash != computed_proposal_hash:
            raise InvalidProposal("proposal hash mismatch or tampering")

        if proposal.council_deliberation.chief_of_staff == "HOLD":
            return ProposalDisposition.no_action(proposal)
        if authority is None:
            raise MissingAuthority("consequential proposal has no receipt")
        if (
            authority.proposal_hash != computed_proposal_hash
            or authority.proposal_envelope_id != proposal.envelope_id
            or replay_store.contains(authority.receipt_id)
        ):
            raise InvalidAuthority("receipt/proposal mismatch or replay")
        if (
            proposal.council_deliberation.legal.vote != "proceed"
            or proposal.council_deliberation.legal.k_violations
        ):
            raise ConstitutionalVeto(
                proposal.council_deliberation.legal.k_violations
            )

        if authority.authority_mode != "public_dav_prism":
            raise UnsupportedAuthorityMode(authority.authority_mode)
        valid_signers = verify_distinct_signatures(
            authority.natural_person_councilors,
            person_type="natural_person"
        )
        if (
            authority.validation_status != "valid"
            or type(authority.required_signer_threshold) is not int
            or authority.required_signer_threshold < 1
            or len(valid_signers) != authority.required_signer_threshold
            or not authority.governing_policy_ref
            or not authority.governing_policy_sha256
            or bool(authority.ai_signatures)
        ):
            raise InvalidAuthority("exact-act authority is invalid")

        authority_receipt_hash = sha256_rfc8785_jcs(authority)
        return await self.executor.execute(
            envelope_id=proposal.envelope_id,
            action=proposal.action,
            authority_receipt=authority,
            authority_receipt_hash=authority_receipt_hash,
        )

The adapter recomputes F3 before reading its deliberation or action fields. Both the proposal's carried proposal_hash and the authority receipt's proposal_hash must equal that recomputed digest; mutating the proposal while leaving either carried hash unchanged therefore fails before execution. HOLD returns a non-F4 ProposalDisposition; it does not mint an execution or authority receipt. Any non-HOLD proposal without an authority receipt raises MissingAuthority before consequence. sha256_rfc8785_jcs(authority) is the typed adapter operation that produces the F4 authority_receipt_hash: SHA-256 over the RFC 8785/JCS encoding of the complete authority-receipt object. It is not an alias for a caller-supplied hash property. The executor receives the F3 envelope_id, the complete validated authority_receipt, and its recomputed hash; it does not accept a separately derived signer-list alias.

This v1 adapter is public-DAV-only. A future Natural Person adapter requires a separate versioned receipt schema; it cannot enter through an alias or fallback mode.

Adapter Rules

1. State has explicit ownership. Translation adapters may retain protocol state such as polling cursors; canonical memory and derived client state are separate. The example's last_poll lifecycle is incomplete and must be specified before implementation.

2. Adapters validate both sides. Input must match the source organ's schema. Output must match the target organ's schema. Malformed data dies at the synapse.

3. Adapters are replaceable. If Circle's API changes, only circle_adapter.py changes. ReFu and APU are untouched.

4. The owning profile defines required steps. The predecessor v1 consequential profile below illustrated IS → COULD → SHOULD → external authority → exact execution → receipt/review. It is not a mandatory route for every request. Adapters may stage a handoff; they do not acquire signing or authorization authority.

See Also

• C1 Pipeline -- the 13 files these adapters live within
• 35 API Contracts -- the formal organ interface specs

---

Adapter Test Matrix (F1->F2->F3->F4)

Adapters are the organism’s nerve synapses. Validate each transition with explicit tests.

Required tests per adapter

1. Schema validation — payload adheres to contract
2. Semantic validation — values mean what receiving layer expects
3. Idempotency — retries don’t duplicate side effects
4. Timeout/retry behavior — degraded networks fail safely
5. Audit trail — each handoff can be traced post-facto

Deployment gate

Do not promote adapter changes unless at least one end-to-end trace proves continuity through all downstream layers.

---

Historical predecessor wording — retained on 2026-09-27, not active rules

The displaced passages are preserved verbatim for lineage. This retention date is not their original authorship date.

Predecessor passage 1

1. Adapters are stateless. They translate, they do not remember. Memory lives in cortex_bridge.py.

Predecessor passage 2

4. No adapter skips a step. F1 cannot talk directly to F3. Consequential flow follows IS -> COULD -> SHOULD -> AUTHORIZE (v1: public-DAV exact-consequence authority receipt whose signer(s), threshold, and procedure come from applicable law, the DAV's governing instrument, or a valid competent mandate) -> EXECUTE -> RECEIPT -> REVIEW. Adapters may stage a handoff; they do not sign, execute, or witness outside the authorized membrane.