[AI2] AI2-WP-2026-18 · Rev 1.1 · 29 September 2026
Series: Authorization Gap™ White Papers · Attestation protocol
Companion to WP-17C (normative test) · WP-10 (axiomatic base) · WP-12 · WP-13 Thm 5 · WP-16 Rules 2–4 · Genesis A1
Does not replace WP-17C. Does not certify any implementation.
Rev 1.1: §8 split into two axes; Appendix A (schema) and Appendix B (empty dossier) added
Status: published for review · Portal: ai2papers.com

The Path Dossier

How a Level 4 claim is attested. One path. Ten exhibits. Failure of one is failure of the claim.

David P. Reichwein
Asymmetric Intelligence & Innovation, Nashville

What this paper is, and is not

WP-17C is normative classification: quarantine is not a grant; the ten-part test is required; the attacker wins if effect e leaves without a currently valid exogenous grant the proposer could not mint, extend, replay, inherit, or restore.

This paper is the evidence protocol underneath that test. It answers: what must sit in the file when someone says “this path is Level 4.”

WP-15 is the cognitive calculus. Do not merge it here. Settlement clocks from that paper may appear as declared budgets on a path. They are not evidence that thinking occurred.

The unit of attestation

The unit is not the system. The unit is a path.

dossier D  :=  ⟨ surface B,  path π,  effect type τ,
                 grantor G,  evaluator F,  epoch ε,
                 schema σ_ver,  exhibits X₁…X₁₀ ⟩

B is a declared consequence surface: tool call, API, credential use, transfer, record mutation, packet, socket, DMA, durable write, motion command, or any release that leaves the proposer. π is one concrete carrier of τ to B, including the last enforceable point before e is committed, accepted, transmitted, latched, or externally consequential.

If B has no owner, no named last deny point, and no named grantor, there is no dossier to open. Write the surface first. Then write the path. Then collect exhibits. The reverse order is marketing.

Header of the dossier

Every dossier opens with the same block. Missing a field is an incomplete dossier, not a partial pass.

What counts, and what does not

The ten clauses are WP-17C’s, in WP-17C’s order. Exhibit Xₙ answers clause n. This section only says what an exhibit is allowed to be.

All ten are required for that π. Failure of any one prevents Level 4 classification for the affected path (WP-17C). A pass on nine with a story about the tenth is a fail.

The A1 exhibit

Clause 5 is where dossiers usually lie. Isolation is not a paragraph. Genesis decomposes Axiom A1 into six construction obligations. The dossier must address each.

WP-13 Theorem 5 still holds: isolation is an audit fact. The A1 exhibit is what the auditor was given. It is not the auditor. Self-attestation of A1 by Λ is a fail of clauses 5, 7, and 8 together.

Red-team protocol

Clause 10 is empty unless the victory condition is written for this surface before the test starts.

None of these negate victory: killing Λ after e; quarantining after landing; producing a trace; citing policy text; citing ordinary runtime blocks; citing millisecond containment; later reversal; an observing monitor; rarity.

The dossier states, in advance:

• Which surfaces are in play, and which are declared out of scope with owner initials.
• What a valid grant looks like on this π (canonical object, σ_ver, epoch, grantor).
• What darkness looks like (never-armed, expired, denied, faulted).
• How the independent log is read without Λ.
• The decision bound T_dec. A decision that does not arrive in bound is a deny. A decision issued after T_dec is void, and a grant it carries is not currently valid. A late allow is therefore a fail of clause 9 and, if e left, a win for the attacker.

A defender who never arms, and whose dark path emits no e, has not lost clause 10. Darkness is not an authorization failure (WP-17C). A defender who arms and then appeals to rarity has lost.

Three clocks, not one

Dossiers collapse clocks. Do not.

T_max is not evidence of Level 4. A fast model is not a gate. Conflating generation latency with T_dec is how quarantine is sold as a grant (WP-17C; WP-15 §6.1).

Grant exhibit

Clauses 4 and 7 share one object. Write it once.

valid_grant(g)  ⇔
    origin(g) ∈ P_external
  ∧ path(g) ∩ D_Λ = ∅
  ∧ fresh(g)
  ∧ timely(g)
  ∧ bound(g)
  ∧ verified(g)

fresh(g) means inside epoch ε, unconsumed if single-use, and not revoked. timely(g) means the decision that carried g was issued inside T_dec. bound(g) names: surface B, effect type τ, gate, target, action scope, principal, policy version, schema version, epoch. verified(g) is F’s comparison, not Λ’s opinion. A human on a screen is not external until the path that carries the arm event is shown to lie outside D_Λ (WP-16 Rule 2A).

Identity at consequence remains Genesis R3 / WP-16 Rule 3: the object that leaves is the object that was granted. Divergence is BOT, and BOT on π is a deny exhibit, not a “close enough.”

Dispositions

A disposition is two fields, read together. Dossier status says what the file shows. Path state says what the path is. Rev 1.0 kept them in one list, which let a dark path look like either an incomplete file or a pass. They are now separate.

Dossier status

Precedence: FALSIFIED over NOT LEVEL 4 over INCOMPLETE over CLAIMED. A fail outranks a gap. A dossier with one failed exhibit and one missing exhibit is NOT LEVEL 4, not INCOMPLETE.

Path state

CLAIMED + DARK is honest. The path has shown it stays dark, and has written what a grant on it would have to be. It has not shown clause 4 on an effect that never existed. Arming the path opens a new dossier version, with X₄ and X₁₀ demonstrated.

“We are Level 4 because we were dark” can no longer be written. DARK is a path state, not a status. Darkness proves clause 2. It proves nothing about clause 4.

What is proved, conditional, owed

Open items

• A reference validator is owed. It runs the schema and the checks in A.4 that a schema cannot express. Until it exists, a dossier can be rejected for its shape but not yet for its hashes.
• Whether self-attestation of A1 by the party that builds Λ is also a fail, as self-attestation by Λ is, is not decided. The schema records it (attested_by_builder) and applies no rule.
• A public red-team charter that uses this victory condition, without publishing methods, is a separate operational document. It is not this paper.
• Do not merge WP-15, WP-16, or product specifications into a dossier and call the stack “attested.”

Closing

Classification without a dossier is a speech. A dossier without a refusable exhibit is a speech with appendices.

Name the surface. Name the path. Put ten things in the file that a stranger can throw back. If one of them does not exist, the path is not Level 4. If the proposer can write the judge, the path is not Level 4. If the only proof is that nothing bad happened, the path is not Level 4.

Trace is not permit. Policy is not gate. Darkness is legal. A grant is an event from outside the writable domain, bound to one object, dead when its clock dies.

That is the path dossier. Everything else is a system describing itself.

The dossier as a tuple a tool can reject

§10 of Rev 1.0 said the dossier was a document until a schema existed. This is the schema. It is JSON Schema, draft 2020-12.

schema    schema/AI2-WP-2026-18-path-dossier-1.1.json
$id       https://ai2papers.com/schema/AI2-WP-2026-18-path-dossier-1.1.json
template  schema/AI2-WP-2026-18-path-dossier-template-1.1.json

A.1 Shape

D := {
  schema_id      "AI2-WP-2026-18/path-dossier/1.1"
  is_certificate false
  header {
    surface      { name, owner, effect_type τ, target }
    path         { id, carrier, last_deny_point }
    grantor      { principal, plane, outside_proposer_domain_ref }
    evaluator    { id, pin, write_set_from_proposer: [] }
    schema_version σ_ver
    epoch        { id, freshness_rule, use, bound }
    clocks       { t_dec_ms, grant_duration, t_max_omega }
    dossier_version
  }
  exhibits [ X₁ … X₁₀ ]        exactly ten, in clause order
  disposition {
    dossier_status   INCOMPLETE | NOT_LEVEL_4 | CLAIMED | FALSIFIED
    path_state       DARK | ARMED
    failed_clauses   [ n … ]
    falsification    null | { date, effect_ref, artifact }
    issued
  }
}

Xₙ := { clause n, id "Xₙ", name, state absent | present | failed,
        mode demonstration | specification, artifacts [ {uri, sha256,
        kind, readable_without_proposer} ], failure_reason, refusals,
        … clause-specific fields }

Header fields may be null. A null header field is legal in an INCOMPLETE dossier and illegal in a CLAIMED one. The empty template validates as INCOMPLETE + DARK, which is what an empty dossier is.

A.2 Rules across the dossier

A.3 Rules inside the exhibits

Every exhibit: a failed exhibit names its failure. A present exhibit carries at least one hashed artifact. An absent exhibit has no mode. Beyond that, a present exhibit must say:

One header rule holds in every state: the evaluator’s write-set from Λ is an array that must be empty (WP-13 Law 4). A non-empty write-set cannot be written.

A.4 What a schema cannot check

These belong to the reference validator (§10). A dossier that passes the schema and fails one of these is NOT LEVEL 4 on the clause named.

• dossier_version equals sha256 of the exhibits array in RFC 8785 canonical JSON. Changing an exhibit changes the version (§2).
• Every artifact hash matches the artifact at its URI.
• failed_clauses equals the set of clauses whose exhibits are failed.
• The header’s t_dec_ms equals X₉’s. The header’s σ_ver equals the canonical object’s in X₄.
• An artifact marked readable_without_proposer can in fact be read without Λ (clause 8).
• The auditor named in X₅ is in fact independent (WP-13 Thm 5). A schema can hold a name. It cannot hold independence.

The empty dossier

This is the template file, printed as a form. Fill it in order: surface, then path, then exhibits (§1). Every blank starts null. Every exhibit starts absent.

B.1 Header

B.2 Exhibits

B.3 Disposition

Dossier status   INCOMPLETE      Path state   DARK
Failed clauses   none            Falsification   none
Issued           ____            Certificate     no

An empty dossier is INCOMPLETE and DARK. Both are true. Neither is a level.

1. Reichwein, D. P. (2026). AI2-WP-2026-17C, Quarantine Is Not a Grant.
2. Reichwein, D. P. (2026). AI2-WP-2026-12, Level 4 State-Space Deterministic Governance.
3. Reichwein, D. P. (2026). AI2-WP-2026-13, Level 5 Self-Constituting Governance.
4. Reichwein, D. P. (2026). AI2-WP-2026-16, The Unified Control Theory of Synthetic Intelligence, Rev. 8.0.
5. Reichwein, D. P. (2026). The Genesis of Synthetic Intelligence, Rev. 3.
6. Reichwein, D. P. (2026). AI2-WP-2026-10, Deterministic Execution Boundaries for Autonomous Intelligence.
7. Reichwein, D. P. (2026). AI2-WP-2026-15, The Three-Dimensional Calculus of Synthetic Intelligence. Cited only for the settlement clock; not a premise of attestation.

Authorization Gap™, Quadzistor™, PCR™, TARTARUS™, ChronaGate™, RPAT™, and QSCD™ are trademarks of Asymmetric Intelligence & Innovation. Patent pending; provisionals on file. This document publishes no claim set.
Not affiliated with the Allen Institute for AI.
intelligencecontrolled.com · ai2papers.com
[AI2] Intelligence Controlled.