A Constitutional Syscall Architecture for Cyber-Physical Control Systems

This paper specifies a constitutional programming architecture for cyber-physical control. An effect-pure computational core proposes world-touching operations; a boundary evaluates them against scoped authority, versioned constraints, current context, and timing obligations. Actuation, sensing, time, persistence, and communication become explicit constitutional crossings rather than ambient privileges. The central correction is that admissibility is not execution. A complete effect lifecycle distinguishes proposal, admission, dispatch, device acceptance, physical observation, and evidentiary standing. An authorization receipt proves only that a named policy state admitted a request. It does not prove that a driver accepted it, an actuator moved, the intended physical effect occurred, or the surrounding world remained safe. Cyber-physical governance therefore requires typed receipts, independent observations, bounded unknown states, non-bypassability evidence over the whole trusted computing base, and an emergency path that does not depend on the ordinary adjudicator remaining healthy. The architecture is presented as a proposal and evaluation program, not as demonstrated safety, real-time performance, replay equivalence, certification, or standards conformance.