Trust
is proven.

The standalone path comprises seven modules: Perceptual (input and linguistic representations), Epistemic (facts and relationships), Theory of Mind (intentions and perspectives), Ethical (Normative Package), LMH (generation), Router (activation and routing), and Metacognitive (supervision). The Adapter is the eighth component when supervising an external LLM (Documents 02 and 05). The Gateway is an enforcement point, not a ninth module. The register counts three qualified and five declared modules; the standalone diagram shows seven and describes the Adapter separately. The bus publishes representations between containers without control commands. Co-located pairs use direct projections. On the separate privileged channel, all modules publish states or events; the Router may write but cannot read. Metacognitive receives input before routing and issues orders to Router and Gateway; it does not publish to the operational bus. The Ethical→LMH correction path is separate from the bus. The Gateway blocks or authorises external release.

P0 properties are tested in-process within a single Python process. The threat model covers design errors, accidental coupling, configuration drift and silent failures. It excludes privileged insiders, compromised runtimes or build chains, modules incentivised to evade the supervisor, and inputs inducing misleading internal states. This is engineering hygiene tested within scope, not security against those adversaries (register §6).