The problem as I see it
Today’s software is largely a collection of walls. Each application or library lives in its own silo, with hard-coded APIs and implicit assumptions about the environment. Recombining pieces or letting end users safely modify them requires a miracle of coordination or an explosion of glue code. The Malleable Systems Manifesto talks about tools that are easy to change as they are to use, and about the need for fearless extensibility. But that requires a foundation that doesn’t exist yet: one where every component declares what it needs and offers, where composition is a negotiation rather than a wiring job, and where extension cannot corrupt the whole.
What is OPHANIM / NegI?
OPHANIM (Ontological Polymorphic Host for Authority and Negotiation Interface Management) is a runtime environment, and NegI (Negotiation Interface) is its front‑end language and protocol layer. Together they form a capability‑secure composition substrate built on top of Lua.
Everything in the system is a Manifest - a value coupled with a Protocol. The protocol describes what the manifest can do (named capabilities), what its default action is (call), how to passively evaluate it (get), how to handle unknown labels (ask), and how to wrap other manifests (pass). When you place two manifests next to each other, negotiation takes over: the left manifest inspects the right one and decides how to combine, falling back through a series of clauses (can, ask, call, pass, get). There is no global function table, no fixed syntax for operations - only manifests negotiating with each other.
Why this matters for malleable software
Fearless extensibility via Membranes
The environment is layered, not flat. Three primitive membranes give users complete control over scoping and effects:
-
Contain
()- an isolated block. Changes made inside affect nothing outside (internal bindings are invisible to outer binding). This is a sandbox - any extension can run here without fear of corrupting the host. -
Quote
{}- a dynamic block that captures a reference to the environment at call time, not at creation time. This lets behaviour adapt to context, while still being safe because the creator of the quote defines what permission it carries. -
Make
[]- a grounded block that remembers the current environment and will ignore all outer changes that happens outside of context it relies on.
These membranes are the answer to the community’s Fearless Extensibility challenge: they let anyone modify behaviour in use, with guarantees that no silent side‑effects leak.
Errors are values, not exceptions
Failed negotiations or internal faults produce Error manifests that are just ordinary values in the system. A computation never crashes - it returns an error that can be handled, composed, or displayed. This is crucial for a malleable system where users are experimenting freely: failures become part of the exploration, not a terminal stop.
Early returns and loops via pass
The language provides a single way to do non‑local control flow: the pass manifest. It captures a delimited continuation (the current membrane) and later transfers a value back to it, discarding all intermediate layers. This is a safe, garbage‑collected replacement for exceptions, tail calls, and loop breaks, all without breaking the composability model.
Parallel by construction
Because Frame construction never mutates context layer until a commit, all independent elements in a Frame (or a Sequence) can be evaluated in parallel. A GPU‑style “construct Frame” manifest could one day execute thousands of computations simultaneously, with results merged atomically. The substrate already supports this; only the scheduler is missing.
Frame is a representation of a context layer within manifest system. Frames can be saved, dumped from environment, shared, loaded into other sequences and current context, and used as data packs, enabling effortless recombination.
Current state
It’s a pre‑alpha prototype written in Lua (there are plans, so the users can provide their ow host abstraction layers full of non Lua authority) The core dispatch loop, environment management (KES), parser, and a REPL are all working and pass a battery of tests that demonstrate quoting, containment, grounding, early returns, and error‑as‑value. Currently looping mechanism pass isn’t finished. Same goes for host specific manifests. Performance is not yet a focus - the goal is to prove that the composable‑by‑negotiation idea works at all.
You can find the source (and a small test suite) here: GitHub - MegadronA03/NegI: Semantic substrate for programming languages · GitHub
A personal note
I discovered the Malleable Systems Collective only after building much of this. When I read the manifesto, I noticed this is the place where I can get actually useful feedback for what I have been making for 3.5 years (3 years of design and goal scoping, 6 months on current implementation). My design didn’t come from academic theory; it came from asking “what would make the system whole?” and letting simple, orthogonal rules create complex, emergent behaviour. Now I see that those rules (manifests, protocols, membranes, negotiation) are directly addressing the very bottlenecks the malleable systems community has identified.
I’d love to hear your thoughts, criticisms, and wild ideas. Does this substrate make you want to build something? Does it open up any new avenues for fearless extensibility? I’m here for the conversation.