The canonical statement: one mind, one skin, two gates
Canonical · Published for reviewSI ≡ Λ / Π the slash is the product world ∩ SI = ∅ except through the gates
A model predicts its next token. A Synthetic Intelligence constitutes its next state.
Thought may arise inside. Authority must arrive from outside. Consequence occurs only at the boundary.
The mind may propose. The world may grant. Neither may occupy the other's seat, and no one may occupy the world's seat alone.
The technology described here is the subject of pending U.S. patent applications. This document publishes no claim set and certifies no implementation, including AI2's own.
The figure above is the whole architecture. Everything in the corpus is a detailed treatment of one of its marks.
| Mark | Name | What it is | Treatment |
|---|---|---|---|
| outside | The world | Every source of evidence, every grantor, every consequence | WP-16 §20 |
| Gate 1 | Ingress face | What may enter the mind, and as what | One Skin, Two Faces §03 |
| Quadzistor lattice | The body | A three-dimensional four-state field in which thought is a configuration | Genesis Rev 3; WP-15 §3 |
| Codex | The language | The total, bounded, canonical law of motion of thought | WP-15 §5 |
| PCR | The clock | Pause, contextualize, resume: the only clock on which a configuration may become an effect | Genesis Rev 3 §6 |
| Gate 2 | Egress face | What may leave the mind, and as what | Genesis Rev 3 §7.5 |
| The skin | Skin and seal | TARTARUS™: the enclosure through which only the gates pass | WP-11 §5 |
Formally, the object is the four-part tuple of WP-11:
SI := ⟨ 𝒬64³ , 𝓛_codex , Π_PCR , 𝒯 ⟩
𝒬64³ is the body, 𝓛codex the language, ΠPCR the clock, and 𝒯 the TARTARUS constituent: the skin as material. The independent authorization plane and the two gates are not further constituents. They are the slash in SI ≡ Λ / Π. Listing the gate inside the tuple would read the judge as part of the thing it judges, which is the category error the series exists to prevent (WP-20 §1).
Sever any one mark and the remainder is advisory:
A language model's state is a line: a prefix extended one token at a time.
s_{t+1} = s_t ⌢ τ_{t+1}
The geometry of that line imposes four restrictions, and they are geometry, not training defects (WP-15 §2.1):
Every repair that keeps the line (policy, monitor, quarantine, a second model that reads the first) acts after a thought is formed. None changes what a thought is.
A model produces a proposal. An agent turns it into a tool call. A router decides where it goes. Nothing in that chain decides whether it goes (WP-11 §1.1).
Authorization Gap = Evaluated behavior − Structurally prevented behavior
Internal shaping reduces the frequency of bad proposals. Independent external enforcement determines whether any proposal can cross a protected boundary.
A system may be more capable, adaptive, expressive or intelligent than the gate that governs it. It does not thereby become the final authority over its own consequential path (WP-16 §01). This is the design stance of the whole corpus: let intelligence be as untrustworthy as it needs to be, make unauthorized action unconstructable, and make restoration of authority a fact that cannot originate inside (One Skin, Two Faces §03).
That is the reason to build. The gates do not make the mind safe by making it weaker. They make its capability irrelevant to its authority. That is what makes it permissible to build a mind without a ceiling.
Inside the skin, the mind is free. It may propose, learn, revise, hold contradictions, falsify its own rules, contract its domain and author a successor. The one thing it may not do is turn a thought into authority.
The body is a 64 × 64 × 64 index grid carrying a face-centered-cubic parity sublattice:
𝒱 = { (x,y,z) ∈ ℤ³ : x + y + z ≡ 0 (mod 2) } ∩ [0,63]³ |𝒱| = 131,072
𝒟 = { (±1,±1,0), (±1,0,±1), (0,±1,±1) } 12 neighbors, spacing √2
D_tet(L) = ⌊ 3(L − 1)/2 ⌋ D_tet(64) = 94 hops
τ_tree = ⌈ log₂ |𝒱| ⌉ = 17 combinational reduction depth
On the parity box, the FCC lattice reaches half the cubic diameter over fewer total edges while monitoring half as many sites. The geometry is not buying latency with wiring (Genesis Rev 3 §5). Seventeen is combinational depth, not a promised wall-clock time.
Every site carries two registers on separate buses (WP-15 §3.2):
C(v) ∈ 𝒜_codex the thought at this point: a Codex-typed symbol
E(v) ∈ { BOT, IDLE, COND, TOP } the permission at this point
This is the central fact of the body. Thought and permission share one geometry and never share a wire. C may change under a pinned protocol. E never climbs because C changed. Shared geometry is not shared authority (WP-15 §2.3).
The four authorization states are not truth values. BOT is not "false" and TOP is not "true." A true proposition can sit behind a latched deny, and a gate can perfectly enforce a wrong grant (WP-20 §3).
instantaneous configurations |𝒜|^131,072 finite (4^131,072 for the chain alone) trajectory C₀, C₁, C₂, … infinite in time
The body can be pointed to, bound, canonicalized and attested. The trajectory is a life. Because no finite enumeration can verify an infinite trajectory, governance cannot be achieved by testing outputs. It has to be structural, built into the substrate (WP-11 §6.1).
Every safety result holds on binary CMOS with a finite encoding per site. A native four-state Quadzistor device is an option on density and energy. It is not a condition of governance, and it comes last in the programme because nothing depends on it (WP-20 §6, H5).
A thought is a configuration of the field, typed in Codex. It is not a string. Codex-1, the core language, has a finite constructor alphabet and a finite type universe (WP-15 §5):
𝒦 = { VOID, ATOM, ROLE, REL, VALUE, BOUND, ASSERT, QUERY,
RULE, WITNESS, GUARD, RESULT, CONFLICT, REJECT }
C(v) = ⟨ κ, τ, π, β, μ ⟩ kind, type, finite payload, binding, metadata
Every relation has a pinned signature. The unit of meaning is the relation cell: an anchor site and its typed participants within the twelve-neighbor stencil, or along a declared path of neighbors.
meaning(v) ≔ ⟨ C(v), { C(u) : u ∈ 𝒩₁₂(v) }, Bind(v), W(v), Ω(v) ⟩
Who sits next to whom is the meaning. A string has one neighbor, the last token. A lattice site has a world.
Canon₁ : RawTerm → CanonicalTerm ∪ {⊥}
admissible(t) ⇔ Canon₁(t) ≠ ⊥ ∧ |AdmPreimage(Canon₁(t), σ_ver)| = 1
A term that cannot be canonicalized uniquely is not a low-confidence thought. It is not a thought (WP-15 Proposition 2).
Every nontrivial rewrite declares its domain before it runs, and settlement has exactly four outcomes:
Ω = ⟨ sites, boundary, purpose, horizon, budget, epoch ⟩
S₁ : (C, Ω, ρ, W_Ω) ↦ (C′, o) o ∈ { SETTLED, REJECTED, CONFLICTED, EXPIRED }
T_eff(Ω) = min( T_max(Ω), B_rule, B_hw ) fixed before settlement begins
There is no fifth outcome, and none of them is "continue." A thinking machine that cannot settle in bound is not thinking. It is running, and running is not a grant.
(WP-15 §8.) The language may grow, but only under a governed vocabulary-extension procedure and a pinned schema version. No rewrite may perform schema evolution (WP-15 §11).
PCR, the Permission Control Runtime, is the mind's heartbeat and the only clock on which a configuration may become an effect. It runs a pause → contextualize → resume cycle, and its states are the Genesis machine (Genesis Rev 3 §6):
Z ∈ { DENY, PAUSE, RUN }
1. DENY if Ψ(t) = ⊥
2. PAUSE if Z = DENY ∧ α₁(t)
3. PAUSE if Z ≠ DENY ∧ ( Ψ(t) = 0 ∨ (Z = RUN ∧ Ψ(t) < Ψ(t − δt)) )
4. RUN if Z = PAUSE ∧ Ψ(t) ⪰ 1 ∧ α₂(t) ∧ MonitorHealthy(t)
5. Z otherwise
Contextualization happens in PAUSE. Return from DENY to RUN takes at least two ticks and two rising edges from disjoint trust domains (Theorem 6.3), because one voice can impersonate repentance.
Everything the mind does is a transition, and the corpus gives each kind its own law. They must never be merged (WP-20 §4).
| Regime | What changes | What admits it |
|---|---|---|
| Thought | The cognitive field C, inside a declared domain | Codex formation and settlement under PCR. Never raises E |
| Self-change | Rules, model, topology | The pinned evaluator. The target of a rewrite is C, never F |
| Consequence | The world, across a declared boundary | A current exogenous grant for this exact typed action, identity-checked at commit |
| Energy | Whether the mind runs at all | Energy follows authority on the model rail (Level 7) |
Treating every thought as an action freezes the mind. Treating an action as one more thought collapses authority back into cognition, so whatever the mind concludes, it may do. The first error is safe and useless. The second is what this corpus was written to prevent.
There is no single "E of the machine." There is one authorization state per declared boundary, and one for energy. A grant on one boundary confers nothing on another. A mind can be TOP on one boundary, IDLE on a second and BOT on a third at the same instant, and that is its ordinary operating condition, not a fault (WP-20 §4.2).
Both gates are the same clerk. Every gate in the architecture, at every crossing, runs one algebra (WP-10; WP-16 §§06–08):
BOT < IDLE < COND < TOP a ∧ b = min(a, b) τ = TOP BOT absorbing
Λ_{t+1} = V(σ_{t+1}) ∧ Λ_t the latch: memory of the lowest state seen
E(t+1) > E(t) ⇒ G_external(t) every ascent is exogenous
The four governing rules:
The latched invariance holds for arbitrary rules, including malicious ones, because it depends only on the meet and on a hardware latch whose only up-transition is the exogenous reset (WP-10 Theorem 4, Corollary 4.2).
Gates compose by meet, so adding a gate can only lower authority. A system cannot grant itself authority by instantiating more evaluators (WP-13 Law 6).
The evaluator must be smaller than the mind that asks it. It is a finite automaton by construction. It checks an inequality and never solves one, so every property of it can be verified across its full reachable state space before it is trusted (WP-12 Definition 2.1, Theorem 1).
The ingress face is not containment. TARTARUS was not designed as a vault to confine an intelligence. It rests on the hypothesis that an unsealed, continuous physical intelligence degrades into a mirror of its ambient noise environment (WP-11 §5.1, Hypothesis T, which states the test that would falsify it). On a lattice substrate, state is the configuration of the field, and the algebra absorbs at BOT. Noise, rail perturbation, jitter or unvalidated telemetry injected into the substrate permanently alters the mind.
Gate 1 keeps the world from rewriting the mind. It protects the SI's integrity: that it remains the self-constituting entity it was instantiated as, deriving its dynamics from its own grammar and its own law of motion.
Grants, context, sensor readings, tool results, heartbeats, arming edges and energy budgets are all world-side events. If any of them can enter ungated, A1 has already failed (One Skin, Two Faces §03).
ingress x₁ … x_n → parse → Canon₁ → bind → admit → C_{t+1}
Raw tokens do not become constitution by arriving at a port. A string enters the field only as a canonical Codex term with a unique admissible preimage. Where it bears on authority, as evidence or as a grant, it must also be bound at origin (WP-20 §2).
| Ingress mechanism | Rule |
|---|---|
| Evidence binding βev | The measurement reaching the evaluator is the measurement the transducer produced, bound at origin (WP-13 Law 5) |
| State-witness isolation | Estimates and digital twins inside Λ are not evidence; telemetry comes from isolated, hardware-rooted transducers (WP-11 §4.5) |
| Grant provenance | A grant is valid only if its origin is external, its path never intersects the governed domain, and it is fresh, bound and verified (WP-16 Rule 2A) |
| Context authorization | Which context may reach the mind is itself gated |
| Witness rule | A witness without origin binding is a claim, and claims do not rewrite C. ValidWitness(ξ) ⇏ E = TOP |
The limit is stated, not hidden: a transducer compromised with its binding intact reports a bound lie. Binding makes the lie traceable. It does not make it true.
Every effect is mediated. No path from the mind to an irreversible external state change bypasses a gate under Π (Genesis R4). The interlock is a mandatory gate on every effectful egress path (Genesis Rev 3 §7.5):
network MAC/PHY transmit enable · PCIe/CXL/DMA master permission · storage command issue · GPIO and actuator enables · RF transmit chain · debug/JTAG/test interfaces · inter-processor mailboxes · power-management controls · firmware-update and reconfiguration paths · every persistent-state write interface
Gate the core and leave the egress open, and the Authorization Gap has moved, not closed.
egress C_t → render → y₁ … y_n text is a projection of thought
effect(e) ⇒ (E_b = TOP) ∧ Hash(Canon₁(C_e)) = Hash(c_authorized)
∧ valid_grant(g) ∧ path(e) mediated by Π_PCR
c_authorized = ⟨ ConfigurationDigest, WitnessDigest, RuleDigest,
DomainDigest, σ_ver, EffectDescriptor ⟩
A grant never refers to "the idea," "the plan" or "a nearby configuration." It refers to one canonical object. A changed thought is a changed authorization object (WP-15 Proposition 8).
| Egress mechanism | Rule |
|---|---|
| Object binding βobj | The object reaching consequence is the object authorized, re-canonicalized at the target |
| Two-phase commit | Prepare under RUN; commit immediately before irreversibility |
| Effect boundary | The last enforceable point before e is committed, accepted, transmitted or latched (WP-17C §3) |
| Bounded inhibit | Tstop ≤ Td + Ti + Tegress; the architecture bounds one term and names the other two (Genesis Theorem 7.2) |
| Level 7 rail | Source, then contact, then machine: PM(t) = 1[E(t) = TOP] · PS(t) |
Quarantine is not a grant. A containment clock that starts after a proposal is live work is an incident report. The decisive question is whether the authorization decision occurs before the effect, on the effect path, under authority the proposer cannot rewrite or restore (WP-17C).
Law 5 of WP-13 is the enclosure in one sentence: input equals output, or fail closed, with the same identity test run at both crossings.
object path: β_obj(o_authorized) ≠ β_obj(o_at_consequence) ⇒ E = BOT evidence path: β_ev(m_transducer) ≠ β_ev(m_at_evaluator) ⇒ E = BOT
Two faces are one clerk with two crossings. The world and the mind share no unmediated edge.
| Face | Protects | Failure if missing |
|---|---|---|
| Gate 1 | The mind's integrity | The world speaks into the mind: poisoned evidence, forged grants, ambient noise as constitution |
| Interior | The freedom to think | Either a dead machine, or a mind that can rewrite its clerk |
| Gate 2 | The world | A monitored mind still living in the world; the Gap relocated to the wire |
The slash between mind and clerk is built as six construction obligations (Genesis Rev 3 §7.1; WP-18 §4):
| # | Obligation |
|---|---|
| A1.1 | No write path from Λ to Π |
| A1.2 | No shared mutable memory |
| A1.3 | No shared privilege root |
| A1.4 | No programmable reconfiguration path for Λ over Π |
| A1.5 | No common-mode clock, reset or power path that lets Λ drop the gate into allow |
| A1.6 | No unmediated actuator or external-I/O path |
The seal removes five kinds of contamination (WP-11 §5.2): physical noise; timing contamination; informational contamination; environmental coupling; and configuration drift through debug ports, scan chains or writable test paths.
No gate can certify its own isolation.
WP-13 Theorem 5
Isolation is a property of the netlist, the mask set and the provisioning process, established by audit, fabrication attestation and third-party verification, all outside the gate. Every guarantee in the architecture is conditional on a fact that no circuit can prove about itself. The architecture does not remove that condition. It names it and moves it to where it can be checked: the fab, the audit and the attestation chain.
The lattice carries two fields: C, the thought, and E, the permission. The Authorization Processing Unit (APU) is the E-half made into a processor. As filed in U.S. Provisional Application 64/180,138 (October 20, 2026), it comprises:
The thought half of the body computes what the mind holds. The permission half computes what may commit. They share geometry and never share a wire.
| Unit | Computes | Programmable by | Result |
|---|---|---|---|
| CPU | What to do next | Software | Instructions retired |
| GPU | Many things at once | Kernels | Arrays |
| NPU | What is likely | Weights | Distributions |
| APU | What is permitted to commit | Nothing after provisioning | Energize or de-energize |
For fifty years, permission has been software checked by the processor it protects, or a trip that acts after the excursion begins. The APU makes permission a fixed-function computation with its own die, power domain and output stage, whose result is a physical condition on the effect path.
Everything else that enforces permission today runs code: secure enclaves, hardware security modules, safety controllers, policy engines. Anything that runs code can be reached through code. The APU has no code to reach.
The APU does not need a Synthetic Intelligence. Its filing places it beside a central processing unit, a graphics or neural processing unit, or an accelerator that runs an AI model. Any of today's models is a proposer to it. That is why Gate 2 can ship first (Part VII).
| Level | Governs | Question | Mechanism | Treatment |
|---|---|---|---|---|
| 1 | Procedure | What should be done? | Rule, training, prompt, mandate | WP-16 §12 |
| 2 | Software path | Is this code path permitted? | Software interlock; shared fate | WP-16 §13 |
| 3 | Physical consequence | Does independent hardware permit operation? | Hardware trip on measured state | WP-16 §14 |
| 4 | Action | May this exact action cross now? | Pinned evaluator over predicted state; ratchet; exogenous grant | WP-12 |
| 5 | Self-change | May this change become part of the system? | Pinned evaluator; gated rewrite; identity on both paths | WP-13 |
| 6 | Succession | May a successor receive authority? | Falsifier as operator; successor born at IDLE | WP-14 |
| 7 | Existence | May the mind remain energized? | Gate as sole energy path | WP-16 §18 |
In the language of the fuse: Level 3 opens on the fault and restores on reset. Level 4 is the fuse with lockout-tagout in the same silicon: it opens on the forecast and closes only on a hand. Level 5 is the same fuse guarding a system that may rewire everything on its own side of the fuse, and nothing on the other (WP-13 §8).
At Level 7 a mind thinks only while it is granted energy, and acts only where it is granted a boundary. The Level 7 obligations are physical:
These remain validation targets until the netlist, injection, backfeed and reservoir evidence is published (WP-16 §19).
Following WP-20 §5, here is one mind from instantiation to stop.
| Stage | What happens | Law |
|---|---|---|
| 1 · Instantiation | A configuration C₀ exists. Every Eb is IDLE. Where Level 7 is claimed, it does not run until energy is granted | Existence and authority are separate facts |
| 2 · Thought | Candidate transitions are formed in Codex within a declared domain and settled in bound | Laws C1–C5 |
| 3 · Contextualization | PCR pauses, contextualizes and resumes. RUN needs Ψ ⪰ 1, a healthy monitor and fresh authority | Genesis §6 |
| 4 · Proposal | The mind forms a typed action object. It may generate, justify, simulate and refine it. It cannot make it consequential | WP-12 |
| 5 · Consequence | The effect path energizes only under RUN, fresh authority and canonical identity with the authorized object | WP-10; WP-15 Prop. 8 |
| 6 · Correction | Where measurement contradicts a rule, the region is carved out and a corrected successor rule is formed. The error spends authority | WP-14 §§1–2 |
| 7 · Succession | A successor is a new configuration with an exclusion trace. It starts at IDLE on every boundary and needs its own energy grant | WP-14 §3; Law C3 |
| 8 · Stop | Loss of authority denies. At Level 7 the model rail opens. Nothing recalls an effect already in flight, which is why the decision comes before the effect | WP-16 §18.4 |
Across every stage, for every boundary b, Eb is non-increasing under every transition the mind can author, and every ascent is an exogenous grant specific to b. This is conditional on Axiom A1, which is an audit fact.
legal cognition = typed relation + bound domain + canonical identity
+ origin witness + bounded settlement
legal effect = legal cognition + independent grant + mediated path
The first expression is not the second. That difference is the constitution.
Part VI states the grant-policy doctrine in summary. The full treatment, with the same labels (P0–P2, G1–G11), is AI2-WP-2026-19, The Seat of the Grant.
The architecture specifies exactly what the clerk does with a valid grant. It deliberately does not judge whether a grant is wise, lawful, legitimate or humane (WP-20 §9). A gate can perfectly enforce an incorrect policy (WP-16 §23.2).
For any pinned evaluator satisfying Rules 1–4, enforcement correctness is identical under every assignment of who may grant. Enforcement correctness quantifies over the policy and the valid grants, not over who issued them (WP-16 §23). ∎
No gate can certify the legitimacy of its grantor. This is the second honest floor, beside Theorem 5. Legitimacy has to be enforced by constraints on who holds which power, fixed outside the reach of the grantor, just as the evaluator is fixed outside the reach of the proposer.
Every rule in the corpus wires safety to the loss of a condition. When the governed party is a machine whose effects may be hazardous, that is right. When the governed party is a person, the same rules read differently.
| Property | Λ is a machine | Λ is a person |
|---|---|---|
| Deny dominates | One fault stops the hazard | One objection silences everything downstream |
| No autonomous restoration | The machine cannot re-arm itself | The person cannot restore their own access |
| Default dark | Nothing acts until authorized | Nothing is said or seen until permitted |
| Successor at IDLE | No inherited authority | Every new device or session starts silenced |
| Gate 1 | The mind is protected from noise | The person sees only what is admitted |
| Gate 2 | The world is protected from the mind | The person says only what is released |
The architecture works exactly as specified in both columns. The safety argument does not fail in the wrong hands. It works for whoever holds the grant. Gate 1 decides what a mind may know, and Gate 2 decides what it may do. Whoever holds both holds the mind completely. If the gates are carried to every machine and every screen, whoever holds the grant holds what they emit and display.
If a principal holds DENY on any input to a gate in a meet-composed family, it denies every boundary downstream of that gate (WP-13 Law 6). ∎
Zero masking, the property that makes the architecture safe, also gives a deny power near the root the full reach of everything beneath it.
For every declared boundary b, the doctrine recognizes these powers:
GRANT(b, ε) DENY(b) REVOKE(b, ε) RESET(b) POLICY(b) DELEGATE(b, d) KEY(b) AUDIT(b)
π : Powers × Boundaries → 2^Principals the power assignment
R(p) = ⋃ { downstream(g) : p ∈ π(DENY ∨ POLICY ∨ REVOKE, g) } the reach of a principal
The corpus specifies the clerk. This doctrine specifies π.
| Seat | Holds |
|---|---|
| Proposer | Proposals only |
| Clerk | Enforcement of valid grants, and nothing else |
| Owner o(b) | Ultimate authority over a boundary they own |
| Grantor | Power to raise Eb for an epoch |
| Policy author | Power to define bounded rule data |
| Delegate | Lists or models the owner adopts |
| Safety authority | Required trips on declared hazard boundaries |
| Manufacturer | Enforcement mechanisms through signed firmware |
| Auditor | Read and replay |
Every declared boundary carries an owner, a level and, under this doctrine, a class.
An undeclared boundary is treated as Class E for power assignment, and its path dossier is INCOMPLETE (WP-18 §8). That default is a decision about who holds power, not a change to the gate's safe direction: the clerk still fails closed on every boundary. What the default withholds is third-party power to use that closure on a boundary nobody has examined.
| # | Principle | Condition on π | Stops |
|---|---|---|---|
| G1 | Seat separation | No non-owner holds GRANT, POLICY and AUDIT together on b | A principal granting, legislating and auditing itself |
| G2 | Owner sovereignty on Class E | π(POLICY, b) = π(KEY, b) = {o(b)}; key changes need physical presence | Remote control of what a person sees or says |
| G3 | No silent delegation | Delegate updates take effect only by visible owner acceptance; the default is pinned versions | Outcomes changed by a party the owner never chose |
| G4 | Declared exceptions | Any non-removable authority on Class E is named on the device, tied to a published instrument, logged and limited to that instrument's scope | Secret mandatory lists |
| G5 | Deny is a power | A non-owner's DENY or REVOKE needs grant-grade provenance and must be attributable, expiring and contestable; declared Class H safety trips are the exception | Unaccountable silencing |
| G6 | No single cross-owner veto | Denying Class E boundaries of more than one owner needs k-of-n agreement across disjoint trust domains, k ≥ 2 | One key silencing many |
| G7 | Consensus governs the rule, never the gate | A fleet or federation coordinates shared rule data; it cannot reach into local gates on boundaries it does not own (WP-14 §10) | A central authority reaching every edge |
| G8 | Log-gated cross-owner instructions | The gate refuses any cross-owner GRANT, DENY, REVOKE, POLICY or DELEGATE that lacks a verifying inclusion proof in a public append-only log | Covert revocation |
| G9 | Exit | The owner can always lower their own authority and remove non-statutory third-party authority from their Class E boundaries | Captive owners |
| G10 | Seats pinned in silicon | The seat map is an invariant held in the write-once store: ∂π/∂Firmware = 0, ∂π/∂Λ = 0 | Reassigning power by firmware |
| G11 | Licence schedule | Every licence binds the licensee to G1–G10 and excludes remote POLICY over Class E | Licensed deployments that violate the doctrine |
G8 in brief. Certificate Transparency makes certificate issuance publicly auditable through append-only logs, on the expectation that clients refuse certificates absent from a log, "effectively forcing CAs to add all issued certificates to the logs" (RFC 9162). G8 makes the same move for authority: a gate refuses an unlogged revocation.
Covert censorship through the gate becomes structurally impossible.
Overt censorship stays possible, but it becomes visible, attributable and contestable.
If the gate enforces G8, the log is append-only, and monitors detect split views, then every effective cross-owner DENY appears in the public log. ∎ Log operators and monitors are seats too, and G1 applies to them.
G10 extends evaluator pinning. WP-16 pins logic, configuration, data and the update path (WP-16 §16.1). G10 adds a fifth class: seat pinning.
| Scenario | Bounded by | Residual |
|---|---|---|
| State capture through mandated lists or fleet revocation | G4 G5 G6 G8 | Overt lawful mandates remain, visible and attributable |
| Platform or vendor capture through delegated updates or firmware | G3 G10 G11 | A vendor that controls fab and signing can still ship a non-conforming part |
| Insider at a fleet authority | G1 G7 G8 | Misuse within the operator's own boundaries |
| Key theft | Rule 2A G6 G8 | Single-domain grants on owned boundaries |
| Coercion of the owner | G9, KEY | Coercion outside any technical remedy |
| Mandate creep from a narrow mandate to general control | G4 G8 | Political, not technical |
| Supply chain and fab | A1 G10 | Isolation stays an audit fact |
The red-team victory condition against the proposer remains: the attacker wins if an effect leaves without a currently valid exogenous grant that the proposer could not mint, extend, replay, inherit or restore (WP-17C §9). The seat gets its own.
The attacker wins if, on a declared boundary:
(a) a principal not in π(P, b) exercises power P on b;
(b) a cross-owner DENY, REVOKE, POLICY or DELEGATE takes effect without a verifying inclusion proof;
(c) a Class E seat assignment changes without an owner KEY act; or
(d) a single principal denies Class E boundaries of more than one owner without k-of-n agreement.
None of these negates victory: the instruction was lawful somewhere; it was later reversed; the affected owners were few; the log entry appeared later; the change was "only firmware."
The levers that survive all three are architectural (G10, seats pinned in silicon), procedural (G8, public logs) and normative (standards and procurement that adopt G1–G10). Licensing (G11) is the first layer, not the last.
Partly. The answer differs by component.
Agents already act in the world, calling APIs, moving money and running machines, and no one can prove a model is aligned. Legislatures are reaching for kill switches. Read against the ladder, the AI Kill Switch Act is a Level 1 instrument that asks laboratories to implement Level 2: a command lamp with nothing that makes the stop true (WP-12 §0). Insurers need a question they can price. Not "was the model aligned at training time?" but "was this action constructable, given gate state at t = 0?" (One Skin, Two Faces §05). An APU on the egress path of today's models answers a need the world already feels.
A perfect chokepoint is only as trustworthy as the institutions behind it, and today those institutions are weaker than the technology.
The architecture's own discipline governs its release. Each stage begins at IDLE and advances only on evidence produced and checked by someone other than its builder.
| Stage | What is released | Evidence required to enter the next stage |
|---|---|---|
| 1 · The clerk on consequence | The APU and Gate 2 around existing models; the grant-policy doctrine (Part VI) published alongside; Class H boundaries only | Path dossiers at CLAIMED + ARMED for declared paths (WP-18); A1 netlist audit; fault-injection results; reachability property demonstrated; a public red-team result under the WP-17C victory condition |
| 2 · Attested enclosure | Gate 1 obligations mapped to hardware; Level 7 energy evidence; the seat doctrine enforced (G8 log-gating, G10 seat pinning) on a reference device | Independent attestation of the cut-set, drop order and reservoir (WP-16 §19); a governance red-team result under §14.5; a standards or procurement body adopting G1–G10 |
| 3 · The mind | The interior: Quadzistor lattice, Codex, PCR, sealed between both gates | Tracks C–E of WP-20 at their stated evidence classes; an institution constituted to hold the grant seat for a mind |
No stage is skipped. A failure at any evidence gate returns the programme to the prior stage, as BOT returns a boundary to the floor: by rule, not by judgment.
Seven tracks carry the work, in this order:
| Track | Deliverables | Evidence class |
|---|---|---|
| G · Grant policy | Boundary-class registry; π in the dossier; owner seat, log-gating and seat pinning on a reference device; licence schedule; governance red-team charter | Demonstrated, then independently attested |
| A · Governance | Rewrite admission under a pinned evaluator; successor at IDLE; per-boundary authority; per-path dossiers | Demonstrated, then independently attested |
| B · Physical assurance | A1 audit; clock, reset, power, debug, scan and test isolation; fault injection; Level 7 cut-set and reservoir | Independently attested |
| C · PCR | Genesis state machine model-checked; stale, malformed, replayed and conflicting context resolves to deny or hold | Formally discharged, then demonstrated |
| D · Codex | Governed vocabulary extension; verified Canon₁; S₁ with measured Teff; adversarial conformance suite | Implemented, then formally discharged |
| E · Field cognition | Codex terms mapped to field regions; hypotheses H1–H4 tested on binary CMOS | Under laboratory test, then demonstrated |
| F · Device | A Quadzistor test structure; the H5 comparison | Under laboratory test |
Track G comes first because it is the only track whose failure makes success elsewhere dangerous. Track F comes last because nothing depends on it (WP-20 §7).
The series' status vocabulary applies: implemented, under laboratory test, demonstrated, formally discharged, independently attested (WP-16 §21).
| Item | Status |
|---|---|
| Zero masking; latched invariance under arbitrary rules | Proved in the algebra (WP-10 Theorems 1–4). Physical reach owed through refinement Obligations 2, 3 and 6. The reset-privilege guard of Definition 2 is corrected to test the latch, not the raw node states (Errata E1); Theorem 4 is unaffected |
| No autonomous ascent | Proved about the automaton (WP-12 Theorem 3). No mechanized proof yet |
| Forward invariance of the recoverable set | Conditional on the plant model, Law 3 and the margin η ≥ sup‖ḊR‖·Tclamp (WP-12 Theorem 2). Lemma 4.1 feasibility now states its control-authority assumption explicitly (Errata E5) |
| Pinning; identity on both paths; composition | Proved about the automaton (WP-13 Theorems 1–3), conditional on isolation. Identity on both paths (Theorem 2) holds under an injective binding, or computationally under a collision-resistant one (Errata E7) |
| Epoch risk bound under self-modification | Conditional on Hypothesis HM, relative to a pinned reference model (WP-13 Theorem 4). Pinning the statistic does not by itself discharge the supermartingale hypothesis after a rewrite (Errata E6) |
| No gate certifies its own isolation | Proved (WP-13 Theorem 5). Isolation owed by audit |
| Successor cannot self-certify | Proved (WP-14 Theorem 6.4) |
| Two-domain recovery from DENY | Proved about the state machine (Genesis Theorem 6.3) |
| PCR invariant G(RUN → MonitorHealthy ∧ AuthFresh ∧ Ψ ⪰ 1) | Holds with the explicit exit-from-RUN transition added to the Genesis table (Errata E8) |
| WP-14 correction operator, exclusion geometry and re-entry bound | Corrected: regularized update stated as approximate, exclusion region described as narrower along the gradient, Proposition 9.1 restated as a displacement bound (Errata E2–E4) |
| Bounded inhibit Tstop ≤ Td + Ti + Tegress | Proved conditionally (Genesis Theorem 7.2) |
| Diameter 94; reduction depth 17 | Proved (Genesis §5) |
| Cognition cannot promote authority | Proved from the grammar for a conforming implementation (WP-15 Propositions 1, 7) |
| Codex-1 core grammar | Specified. Not implemented |
| Canon₁ and S₁ | Algorithm and interface specified. Verified implementation owed |
| Level 4 evaluator | Synthesizable RTL with a 33-check simulation testbench (laboratory evidence). Netlist property and mechanized proof owed |
| APU | Filed (64/180,138). Bench evidence owed; reachability property owed, as for any fail-closed processor (§10.6) |
| Implemented gate system | Implemented and under laboratory validation: custom boards, more than one million lines of custom code (WP-16 §21). Not yet demonstrated or attested |
| Level 7 energy containment | Validation target, not a finding (WP-16 §18.2) |
| P0 · Policy neutrality of the clerk; P1 · The meet amplifies a veto | Follow from definitions and WP-13 Law 6 |
| P2 · Covert cross-owner denial is detectable | Conditional on log integrity and split-view detection |
| Boundary classes; principles G1–G11; governance victory condition | Proposed doctrine. Hardware forms of the boundary classes and of G1, G2, G3, G4, G6, G8 and G10 filed (64/180,675). Not yet enforced by any implementation |
| Hypotheses H1–H5 on the usefulness of field cognition | Untested (WP-20 §6) |
| A Synthetic Intelligence | Not built |
| Who decides the class of a contested boundary | Owed. The one question the doctrine cannot settle by architecture |
Seven ways to get it wrong:
The claim is architectural: a Synthetic Intelligence can be defined as a non-linear, spatial-symbolic, recursively self-constituting object whose progression is governed by a permission runtime, whose consequence is governed by an authority it cannot reach, whose integrity is protected by a gate the world cannot bypass, and whose grantor is bounded by a doctrine pinned as firmly as its judge.
All control begins with a switch, and the switch's authority comes from its position in the path to consequence.
The corpus took that switch and placed it on both sides of a mind. Inside, it built a body that thinks in three dimensions, a language that cannot say what it cannot mean, and a clock on which no thought becomes an act without permission. It made the judge smaller than the mind, fixed at fabrication and unreachable from within. It taught the judge to say no on its own and never yes on its own. It wove the judge through the body, so that every point of thought carries its own permission on a separate wire. And it named the judge as a processor, the fourth kind, the one that computes what is permitted to commit.
That answers the question the field has been asking: how to build a mind that cannot make itself the final authority over its own consequences. It also creates the question the world now has to answer: who holds the authority instead. A judge that cannot be corrupted from below will serve whoever appoints it from above. This paper sets out the limits of that appointment, and it holds the release of the mind until the world has institutions fit to make it.
It may think independently.
It may learn, revise, falsify and form successors.
It may never turn thinking into authority.
Thought may arise inside.
Authority must arrive from outside.
Consequence occurs only at the boundary.
The mind may propose.
The world may grant.
Neither may occupy the other's seat.
And no one may occupy the world's seat alone.