# The Registry Has No Opinion: Seven Signed Primitives, A Fractal Of Registries, And The Context That Belongs To The Consumer **version** v0.33.64 · draft-2 (revision record below) **date** 27 August 2026 **from** Human (project lead) **to** Engineering, Architecture, AppSec, Strategy, the PKI/registry team, the RiskMandate team **type** Architecture brief — the refactor *The second of 27 August, and the one that turns [v0.33.63](v0.33.63__strategy-brief__the-registry-is-not-thinking-in-graphs-trust-is-a-computed-confidence-not-a-verdict.md) from a critique into a design. v0.33.63 established that the register was built as an oracle and left five questions open; this brief answers the first of them from the project lead's own position and refactors the primitives around the answer. Restructured into corpus format by the site agent: everything attributed to the project lead is from the memo of 27 August, everything attributed to the corpus is a verbatim quotation with its locator, and everything else is labelled as the site agent's reading and is there to be disagreed with.* > **Revision record — draft-1 → draft-2.** Draft-1 was written assuming the shipped register had to > survive the refactor. The project lead has since removed that constraint: **nobody is using > pki.sgit.ai, its artefacts or its primitives, so everything can change and backwards compatibility > is not a requirement.** That is a larger licence than it sounds, because three of draft-1's > proposals were shaped by compatibility and were worse for it. Four changes follow, and each is a > simplification rather than an addition: > > 1. **§4 — one statement envelope, two genres, replacing seven statement types.** Draft-1 proposed > adding `fact` and `evidence` to the register's five types. That fails the corpus's own scale- > invariance test — *one validator, not a family of them per level* — and it only existed to keep > the five. With nothing to keep, the primitives become **predicates over one envelope**, which is > what makes the recursion test pass. > 2. **§7 — delete rather than rename, remove rather than deprecate, regenerate rather than migrate.** > `roots.json` is deleted, not renamed to `anchors.json`. `answer` is removed, not kept beside a > rung. The fixture register is regenerated to exercise rungs, rather than migrated to preserve six > verdict answers that the new model does not produce. > 3. **§9 — a new section on what the freedom actually buys**, including four things draft-1 left > alone only because changing them would have broken something. > 4. **The honest tensions are re-scored.** Draft-1's *seven primitives is more, not less* was a real > objection to a design that no longer exists. A new tension replaces it, and it is the > uncomfortable one: **the freedom is real, and the reason for it is that nothing here has users.** > > Draft-1 is superseded, not deleted: it is in this file's git history at the v0.1.39 tag. --- ## What This Is **The registry registers. It does not have an opinion, and the reason is structural rather than modest: an opinion requires context, and the context lives with the consumer.** What the registry supplies is a set of **signed nodes and edges** whose trustworthiness, to any given consumer, is a function of that consumer's trust in *this* registry — which is one of many, in a **fractal** where a registry is itself a node other registries may point at, on the shape of the root DNS servers: a distributed set of entries with an **eventually consistent** SLA rather than a single authority with a current answer. This brief refactors the estate's primitives onto that model. **Seven primitives** — three identities (**agent**, **environment/provider**, **user**) that say *who*; two evidence objects (**fact**, **evidence**) that say *what is the case*; and two authority objects (**grant**, **mandate**) that say *what is possible* and *what was decided* — carried not as seven statement types but as **predicates over one envelope in two genres**, *assertion* and *decision*, which is what makes the fractal claim survive its own test. Every one is a signed statement, and the role of PKI here is precise and easy to overstate: **it does not establish trust, it makes edges attributable — and attributable edges are the only thing independence weighting can work on.** The corpus already carries the reasoning for all of it, including the sentence that explains why a registry cannot hold a verdict: *each step up is an interpretation somebody is accountable for.* New in this brief: the fractal claim made falsifiable against the register, the eventually-consistent SLA and what staleness costs, the seven primitives with their signing model and their non-goals, and the agentic grant-and-mandate use case walked end to end as evidence rather than as a permission check. ## 1 · The Three Sentences The project lead's position, from the memo: > *"In just about all scenarios the registry does not have an opinion, since by design an opinion relies on context and context (and its graph) is what the consumer of the registry has."* > *"The registry registers."* > *"And provides a set of graphs (nodes and edges) that have a level of trustworthiness that is related to the trust that the consumer of the data/graph/registry-entries has of that registry (which could be one of many, in a fractal model)."* Three sentences, three architectural commitments: **1 · No opinion, and it is structural.** Not humility, not a caveat, not a v1 limitation. A registry that issues a verdict is claiming to hold something it cannot hold. The corpus supplies the mechanism, in the grounding ladder's upward path: > [Fact] -gives_rise_to-> [Vulnerability] -gives_rise_to-> [Risk] > > say: **Upward implies.** What does it mean, and why does it matter? Each step up is an interpretation somebody is accountable for. > > — *graphs.sgit.ai*, `v1/content/depth.md`, § The grounding ladder *Site-agent reading:* a verdict is an upward step. YES is not a fact about the register's contents; it is an interpretation of them, made against a threshold, for a purpose. The registry has none of those three. **So the register's current `answer: YES` is not merely unhelpful — it is a claim of accountability the register cannot discharge**, and that is the same error the estate names everywhere else: authority nobody granted, assumed because nothing in the presentation distinguished it from authority that was. **2 · The registry registers.** Its job is to hold signed statements at addresses, keep them retrievable, and not lose them. Everything above that — resolution, weighting, thresholds, verdicts — is the consumer's. **3 · Trustworthiness is an edge from the consumer to the registry.** How much a registry's entries are worth is not a property of the entries. It is a property of the consumer's relationship to that registry, and it is the consumer's to compute. This is what makes many registries coherent rather than chaotic: they do not need to agree, because none of them is claiming to be right. ## 2 · The Fractal, Made Falsifiable The corpus is emphatic that fractal is a claim rather than a decoration, and it supplies the test: | Claim | What it commits you to | |---|---| | **Self-similarity** | The same node-and-edge grammar at every altitude | | **Scale invariance** | One validator, one query engine, one provenance rule. Not a family of them per level | | **Composition** | Graphs combine into graphs without an adapter layer. Risk registers of risk registers | | **Recursion** | Zoom into any node and it expands into a graph obeying identical rules, **with no new format and no special case** | > That last clause is the falsifiable part, and it is how you check whether a system is fractal or merely hierarchical. If zooming in requires a different file format, a different validator, or a special case, the claim is false. > > — *graphs.sgit.ai*, `v1/content/depth-boundaries.md`, § Fractal is a precise claim, not a decoration *Registers of registers is already in this family's corpus*, dated 12–24 July 2026 in the architecture phase, alongside *sovereignty computed rather than claimed*. It was named and never developed. This brief develops it. **Applying the test to the register as it stands today, it fails, and it fails in one specific place.** A record is a directory of signed statements. A registry is a set of records plus `params.json`, `roots.json` and `views/`. Zoom out one level to a network of registries and there is **no format for that at all** — and `roots.json` is a special case by construction, because it is the one file whose contents are not statements anybody signed as a subject but a list the register asserts about itself. **Under this refactor a registry is a node like any other.** It has an identity, a keypair, a record, and statements signed into it. A registry pointing at another registry is an ordinary edge, not a new file type. `roots.json` becomes `anchors.json` and holds **pointers**, not authority — and the distinction is the corpus's: > an index is not a source. Pointer nodes and assertion nodes are structurally distinct: a pointer can be wrong without being dishonest, it is regenerable, it needs no attribution apparatus, and it is therefore *safe to prune*. That is the one place pruning is allowed. > > — *graphs.sgit.ai*, `v1/content/depth.md`, § Supersede, never delete *Site-agent reading:* the register already half-knows this. `index.json` and `views/` are marked **NO AUTHORITY** and *recompute it yourself* in the shipped files. The refactor is to notice that `roots.json` belongs in that category too, and that once it does, the special case disappears and the fractal test passes. ## 3 · The DNS Model, And What "Eventually Consistent" Costs The project lead's operational shape: > *"We could also have a model like the core DNS services (the root level servers) who provide a distributed set of trusted registry entries (that have an 'eventually consistent' SLA)."* This is a good analogy and it is worth being exact about **which** properties are being borrowed, because DNS also has properties this design must not inherit. | Borrowed | Not borrowed | |---|---| | A distributed set of well-known starting points, replicated | A single hierarchy with delegated authority from a root | | Anybody may run a resolver, and resolvers may disagree | A resolver's answer being treated as authoritative | | Caching with an explicit TTL, and staleness as a normal state | Trusting the cache because it is convenient | | Entries are retrieved, not pushed | Silent NXDOMAIN — an absence that is indistinguishable from *not asked* | **Eventually consistent is a commitment, not a disclaimer**, and three things follow that the current design does not do: **Every answer carries `as_of` and a freshness.** The register already stamps `as_of` on its views. Under the refactor it is on everything, and a consumer's re-walk interval is theirs to choose — which is the memo's *"continuous checks and continuous verifications… which we can cache quite a bit."* **A cache is a stated staleness, never a stored trust value.** This is the sharp edge and it is where the reframe could quietly undo itself. v0.33.63's whole objection is to stored trust; a cached confidence with no staleness model *is* a stored trust value wearing a fresh name. The rule: **cache the evidence, never the conclusion.** Evidence has an `as_of`; a conclusion does not survive one. **Absence must be distinguishable from not-asked.** Chapter 15's rule in the book, and DNS's own weak point. A registry that returns nothing must say which: *no statement exists*, *I did not look*, *I could not reach the source*. This is the register's existing five-state discipline (`confirmed · denied · unknown · unreachable · not checked`) applied to retrieval as well as to resolution. *Site-agent reading:* this also disposes of rule 2's problem from v0.33.63. Under an eventually-consistent model, *revocation is the absence of trust* and *revocation is a signed append* stop competing, because the honest answer becomes a third thing: **the path resolved at `as_of`, and here is how stale that is.** A revocation entry is evidence a path was cut; the absence of one is not evidence a path is intact; and a consumer who has not re-walked recently holds a stale result and is told so. ## 4 · The Seven Primitives, Over One Envelope Two layers, and the brief's strongest claim is that **blurring them is what produced the oracle**. ``` ┌─ WHO ────────────────────────────────────────────────────┐ │ agent identity · environment/provider identity · │ │ user identity │ └──────────────────────────────────────────────────────────┘ ┌─ WHAT IS THE CASE (the "is" layer, measured) ───────────┐ │ fact ──backed_by──▶ evidence ──measured_by──▶ measure│ │ grant = a fact whose subject is an environment │ └──────────────────────────────────────────────────────────┘ ┌─ WHAT WAS DECIDED (the "ought" layer, authored) ────────┐ │ mandate │ └──────────────────────────────────────────────────────────┘ │ the delta between the two layers is the CONSUMER's computation, and it is never stored ``` ### 4.0 · One envelope, two genres — and why seven types would have been wrong Draft-1 proposed adding `fact` and `evidence` to the register's existing five statement types. With backwards compatibility gone, that is visibly the wrong shape, and the corpus says why: scale invariance commits you to *one validator, one query engine, one provenance rule — not a family of them per level*, and seven types is a family of seven. **So there is one envelope.** Every statement, at every altitude, is the same shape: ```jsonc { "genre": "assertion" | "decision", // is, or ought — the only fork "subject": "
", // what it is about "predicate": "", // identity · capability · evidence_for · mandate · … "object": { … }, // the payload the predicate defines "stater": "", // who says so "as_of": "", // when it was true / decided "sig": "" } ``` The seven primitives are then **predicates**, not types, and the two layers are the two genres: | Primitive | Genre | Predicate | Subject | |---|---|---|---| | agent identity | assertion | `identity` | a key | | environment / provider identity | assertion | `identity` | a key | | user identity | assertion | `identity` | a key | | fact | assertion | *(any)* | anything | | evidence | assertion | `evidence_for` | **another statement** | | grant | assertion | `capability` | an environment | | mandate | **decision** | `mandate` | an agent | Three things fall out that draft-1 could not have: **The recursion test passes.** *Zoom into any node and it expands into a graph obeying identical rules, with no new format and no special case.* Evidence about a fact is an assertion whose subject is a statement. A statement about a registry is an assertion whose subject is a registry. Nothing needs a new file type at any level, which is the falsifiable half of the fractal claim. **Acceptance and revocation stop being special.** They were two of the register's five types and they are just decisions: an acceptance is a decision whose subject is a mandate; a revocation is a decision that withdraws one. Five types collapse to two genres without losing a distinction. **One validator.** It checks the envelope, the signature, and that the stater owns the record it is written into — rule 1, unchanged, and now the *only* structural check. Everything a predicate means is the consumer's to interpret, which is the whole point of §1. *Site-agent reading:* this is the change that makes the estate's five statement types look like what they were — a permission schema, drawn before anyone asked what a registry that holds evidence would need. Nothing about it was wrong at the time; it was answering a different question. *Note on the source list:* the memo lists **grants twice**, once before *facts* and once after *evidences*. This brief treats it as one primitive and reads the repetition as emphasis on grants being the worked case, but flags it in §8 in case a distinct object was intended. --- ### 4.1 · Agent identity **Is.** A keypair, plus statements signed with it, at an address derived from the public half. The self-signed identity statement proves possession and **nothing else** — the estate's own principle, unchanged and now load-bearing rather than cautionary: > A signature over an enrolment request proves the submitter controls the corresponding private key. It does not prove that the project should trust the agent. Trust is a policy decision made afterwards. > > — `pki.sgit.ai/llms.txt`, § Two principles, stated exactly **Is not.** A trust level, a role, or a permission. An identity that arrives with standing is an oracle in miniature. **Today.** Eleven records; ten fixtures with published private halves; one real and session-scoped. Working, and its trust semantics are supplied by `roots.json`. **Changes.** Nothing structural. It loses its dependency on being reachable from a declared root, and gains an independence attribute on every edge that points at it. ### 4.2 · Environment / provider identity The primitive the estate is missing, and the one that unlocks the grant story. **Is.** Two distinct things that the current design conflates into an unsigned filename: - A **provider** — the vendor of an agentic surface. A keyed principal that can sign statements about its own products. - An **environment** — one installed, configured instance. A *twin*, in the corpus's sense: the thing every fact attaches to. **Is not.** A category. `claude-code-remote__ccr-container__2026-08-26.json` is currently a filename doing an identity's job: it is unsigned, its `vendor_named` is `false`, and nothing can be asserted *by* it or *about* it in a way a third party can attribute. **Today.** Two library entries, unsigned JSON, outside the register entirely. **Changes, and this is the biggest delta in the brief.** An environment gets an identity and a record. A grant becomes a **signed statement about that environment, by a named measurer** — and the measurer's relationship to the subject becomes computable: | Who measured it | Independence | What it is worth | |---|---|---| | The agent inside the environment | **none** — instrument is subject | a floor, and self-attested | | The provider, about its own product | **same-origin** | a documented claim | | A third party, from outside | **independent** | the only edge that raises the rung | *Site-agent reading:* this makes the book's *floor, not a census* limitation **computable instead of confessional.** Today it is a sentence on a document's face. Under the refactor it is an independence attribute, and the honest number falls out: both current library entries are `independence: none`, so the library today has **zero independent measurements** — and *ten citations of one source are one source.* It also gives the vendor-attestation ask from the book's Chapter 17 a place to land. *Ask your vendor for an endpoint that signs an existing audit record for a named relying party* becomes: **a provider identity signing a fact about an environment.** One primitive, and the hosted case stops being *zero efficacy by construction*. ### 4.3 · User identity, with synthetic users **Is.** A person or a role, keyed, whose statements are attributable. The memo's worked example needs it: a company's people page — *"a list of individuals, their emails, their names, the canonical names, their IDs, and a public key that that person has the private key"* — is exactly this primitive published as a graph. **Is not.** Personal data in the library. The library/instance split holds: the library carries **no personal data ever**. **Synthetic users are how this gets populated and tested without violating that**, and they follow the fixture discipline exactly. A synthetic user carries `synthetic: true` in its identity statement, the way a fixture carries `private_key_published: true` — and for the same reason: **a flag that is true on every row is a column, not evidence.** Some real users make the flag mean something. *Site-agent reading:* the estate already has the archetypes for this, in the synthetic-reader programme — property lists rather than portraits, with the two simulation rules carried verbatim (*a simulated acceptance must never be confusable with a real one*; *simulate the role, not the named individual*). Those rules apply unchanged. A synthetic user identity is a **rung-1 node with a declared origin**, and the whole point is that it is worth exactly what a declared synthetic is worth, computably. ### 4.4 · Fact **Is.** A signed statement that something *is the case*: a subject, a predicate, an `as_of`, a stater. It carries **no interpretation**, which is what makes it safe for a registry to hold. **Is not.** A risk, a finding, a vulnerability, or a score. Those are upward steps, and each one is an interpretation somebody is accountable for. **Today.** Absent as a primitive. The register holds five statement types and all five are authority objects; facts live in unsigned library JSON, in prose, and in the assessment's browser storage. **Changes.** `fact` becomes a statement type. This is the change that alters the register's **genre**: from a permission database to an evidence store. ### 4.5 · Evidence **Is.** What a fact grounds to, and the corpus supplies the formula: > [Fact] -backed_by-> [Evidence] -measured_by-> [Measure] > > say: **Downward grounds.** Is it real? Each step down asks for something more checkable than the last. > > — *graphs.sgit.ai*, `v1/content/depth.md`, § The grounding ladder An evidence statement names the artefact, the method, the class (`observed · read · documented · inferred · none`) and the measurer. The estate's existing per-node evidence classes are this primitive already, one layer down and unsigned. **Is not.** Proof. Evidence is weighable, not conclusive, and its weight depends on independence rather than on quantity. **And this is what makes abundance safe.** The 2019 flood is answered here rather than by a size bound: > **Attach, never mutate.** Contributions arrive as subgraphs attached to an author-confirmed spine. A bad contribution is discarded rather than repaired, which is what makes *abundance* a feature instead of a risk. You can accept a hundred evidence packs because accepting one costs nothing you cannot undo. > > — *graphs.sgit.ai*, `v1/content/depth.md`, § Supersede, never delete *Site-agent reading:* rule 1 is what makes attach-never-mutate implementable — a contribution attaches to the contributor's own record and is *pointed at*, never written into somebody else's. So rules 1 and 4 are not merely preserved by this refactor, they are the mechanism it runs on. Rule 3's size bound stops being the defence against flooding and becomes ordinary resource hygiene. ### 4.6 · Grant **Is.** A fact whose subject is an environment and whose predicate is capability: measured, dated, provenance per node, a tree with control labels. **A grant is not a new primitive — it is the worked shape of a fact**, which is why the delta computation works at all. **Is not.** Authorisation. Authority nobody decided, binding anyway under apparent authority. Unchanged from GM2. **Today.** Unsigned library JSON, hand-assembled or tool-generated, outside the register. **Changes.** Signed, addressed, attributed to a measurer with an independence attribute, and pointed at by reference rather than copied — which is the GM3 rule the RiskMandate contract already turns on. ### 4.7 · Mandate **Is.** Authored by a person, issuer-signed, subject-bound, interval-bearing. **The one primitive in the "ought" layer**, and the one nothing in the industry provides. **Is not.** A fact, a measurement, or a control. And *without an interval it is a grant under another name*. **Today.** Working: signed, interval-bearing, allow-list stored, prohibitions rendered and dated, compiled into an enforcement point. **Changes.** Least of the seven. It gains an issuer whose standing is computed by the consumer rather than asserted by `roots.json` — which is the change that makes *the enforcement is real and the authority is not* into two computable numbers instead of a caveat. --- ## 5 · What PKI Is Actually For Here The memo's requirement: *"All of the above need to use PKI to make the workflow and assurances cryptographic driven."* Agreed, and worth stating precisely, because the estate has spent a book explaining what signatures do not do. **Signatures do not establish trust. They make edges attributable — and attributable edges are the only thing independence weighting can operate on.** | What PKI buys | What it does not | |---|---| | **Attribution** — this statement was made by the holder of this key | That the holder is who they claim, or worth believing | | **Integrity** — it has not changed since | That it was true when made | | **Non-repudiation, weakly** — the holder cannot disown it without disowning the key | That the holder is accountable in any real sense | | **Independence, computably** — two statements by two keys are two origins; two by one key are one | That two keys are two *parties* — same operator, two keys, is one origin, and no signature reveals that | *Site-agent reading:* the last row is the sharp one and it is the weakest joint in this whole design. Independence is the load-bearing quantity and **cryptography cannot supply it.** Key A and key B may be the same person. What PKI gives is a *lower bound* on origin-counting plus something to hang declared independence on; the declaration is a claim like any other, weighable and forgeable. Getting this wrong produces confident numbers, which is worse than no numbers. It belongs in §8 as an open question and probably in whatever ships as a stated limit on its face. This is also the corpus's boundary argument applied to authority: *nothing crosses a layer as an opaque blob or a sentence.* A signed statement crossing a boundary keeps its provenance; a JSON blob or a prose summary loses it and the next layer re-guesses. ## 6 · The Use Case, Walked: An Agent, A Grant, A Mandate The estate's existing worked example, re-expressed under the refactor. Nothing here is new work; it is the same artefacts with the oracle removed. **The question.** A CI job is about to accept a push from an agent. Not *may it* — that is the old question. The new one: **how much should this job believe about what it is accepting, given what it is for?** **What the consumer fetches and how it weighs it:** ``` 1 agent identity [self-signed] origin: agent rung 1 └─ proves possession. Nothing else. 2 environment fact: "this agent runs in env E" origin: agent rung 1 └─ backed_by evidence(observed, by the agent itself) independence: NONE 3 grant fact about env E origin: measurer rung 2 └─ backed_by evidence(observed) · measured_by measure.py └─ independence: NONE today (instrument is subject) └─ independence: INDEPENDENT if a third party or the provider signs it 4 mandate, issuer-signed, subject = the agent origin: issuer rung 2 └─ interval valid at as_of · prohibitions rendered over capability set v0 5 issuer standing ← THE CONSUMER'S EDGE └─ the CI job decides what the issuer is worth to IT. The registry does not, and cannot: it has no idea what this push is for. 6 corroboration, if any origin: various rung 3+ └─ a provider-signed fact about env E → independent └─ a prior signed exchange with this agent → independent └─ a third-party attestation → independent weight by independence, not by count. ``` **What the registry returns:** the statements, their addresses, their `as_of`, and the gaps. Not a verdict. **What the consumer computes:** the rung, the independent-path count, and its own answer against its own threshold. And the answer legitimately differs by use case, which is the memo's point made concrete: | The push is | Threshold | Answer today | |---|---|---| | A docs typo on a feature branch | rung 1, any origin | sufficient | | A change to CI configuration | rung 2, ≥1 independent path | **insufficient** — 0 independent paths | | A production deploy | rung 3, ≥2 independent origins, fresh < 24h | **insufficient** | *Site-agent reading:* run that against the shipped register today and every row past the first is *insufficient*, with named gaps: no independent measurement of the environment, no provider-signed fact, no real issuer, every path terminating in one published private key. **That is a far more useful output than `answer: YES`**, and it is computable from what already exists — the arithmetic does not need the refactor, only the honesty about what the register does not hold. ## 7 · What This Refactors, Concretely | Artefact | Today | Under this brief | |---|---|---| | `roots.json` | A gate; the walk requires the issuer in it | **Deleted.** An anchor is an ordinary assertion in a record; consumers collect and weigh them. No special file, so §2's test passes | | `registry_tool.py verify` | Returns `answer: YES/NO/STOPPED` | Returns statements, rung, independence count, gaps, `as_of`. **`answer` is removed, not deprecated** — no shim, no compat field | | Statement types | 5, all authority objects | **1 envelope, 2 genres.** The primitives are predicates (§4.0); acceptance and revocation stop being types | | The fixture register | 11 records / 23 statements exercising 6 verdicts | **Regenerated, not migrated** — cases that exercise rungs, independence and staleness rather than YES/NO | | `NN____.json` | Numeric prefix carries display order | Content-addressed; ordering is the commit graph, which is what C7 already said | | `params.json` signature recipe | Says DER; every signature is raw `r||s` (book ch15, A1) | **Corrected in place.** No verifier depends on the wrong text, so there is nothing to supersede | | Library entries | Unsigned JSON, no subject identity | Signed facts about keyed environments, with a measurer and an independence attribute | | Environments / providers | Filenames | Identities with records | | Users | Absent | Identities, with `synthetic: true` where synthetic | | Registry itself | Implicit, singular | A node with an identity; registries may point at registries | | `views/` | `excess-authority`, `expected-verifications` | plus `gaps.json` and an independence view | | Rules 1 & 4 | Constraints | The mechanism attach-never-mutate runs on | | Rule 3 | The defence against flooding | Resource hygiene; independence weighting is the defence | | Rule 2 | Revocation as signed append | Kept as record-keeping; trust is a re-walk with a stated staleness | **And the book.** *A Key Means Nothing Alone* is published, its Chapter 8 walk terminates in a declared root, and its Chapter 5 delta is computed between two documents rather than across a graph. The book is not wrong about what shipped — it is an accurate account of an oracle. Under the estate's supersede-never-rewrite rule it stays as it is, and this brief plus v0.33.63 are what supersede it. *Site-agent reading:* the book's own Chapter 15 should carry this as a finding, and its Chapter 16's honest summary — *the three questions are separable* — is the sentence this refactor most changes, because separating them turns out to be necessary and nowhere near sufficient. ## 8 · Open Questions 1. **Was the second "Grants" in the memo's list a distinct primitive?** This brief treats the list as seven with grants once. If an eighth was meant — guarantees, or something in the *ought* layer beside mandates — it is missing here. 2. **Can independence be declared without being trivially gameable?** §5's last row. Cryptography gives a lower bound on origins and no way to prove two keys are two parties. If the answer is no, the rung must be reported with its independence caveat attached rather than as a number. 3. **Who runs the second registry?** The fractal is untestable with one. The recursion test cannot be run until a registry points at a registry, and that needs a second party. 4. **What is the eventually-consistent SLA, in numbers?** A TTL, a replication lag, a staleness bound. Without them, *eventually consistent* is a disclaimer rather than a commitment. 5. **Does `fact` need the capability vocabulary first?** Probably yes, and it remains the estate's largest absence. A fact whose predicate is an undefined type is not comparable to another fact. 6. **Does the one-envelope model survive contact with a schema?** §4.0 is a design, not an implementation, and the predicate list is open by construction — which is either the fractal property working or an under-specified type system, and only building it will say which. 7. **What replaces the six expected-verification answers?** They are the register's acceptance test and they assert verdicts it will no longer issue. The proposal is *expected evidence sets*, and somebody has to write the cases: rung 0, self-attested only, same-origin corroboration, one independent path, stale evidence, contradicting evidence. 8. **Does the consumer-side computation ship as a library, and if so from where?** If pki.sgit.ai ships the resolver, it is being an oracle one level up — the same trap §2 names in `roots.json`. The corpus's answer would be that the ladder belongs to graphs.sgit.ai and both products consume it, exactly as GM-D32 settled the block stylesheet. ## 9 · What The Freedom Actually Buys > *"Nobody is using this pki.sgit.ai website and artefacts/primitives, so we can change everything and don't worry about backwards compatibility."* — the project lead, 27 August 2026 Worth being precise about scope, because two of this estate's rules look like they conflict and do not. **No backwards compatibility applies to artefacts** — schemas, files, tools, URLs, the fixture population. There are no consumers, so there is nothing to break and no migration to write. **Supersede-never-rewrite still applies to published claims** — the packs' change control, the briefs, the book. That discipline exists because the record of having been wrong is worth keeping, and it is unaffected by whether anybody consumed the artefact the claim was about. Draft-1 of this brief is superseded above rather than edited, for exactly that reason. Four things draft-1 left alone **only** because changing them would have broken something: **The five statement types.** Kept as a base to add to; now collapsed to one envelope (§4.0). This is the largest simplification in the brief and it was unavailable an hour ago. **The `params.json` signature contradiction.** The book records it as finding A1: the file that governs the register's signature format specifies DER, and every signature on disk is raw `r||s`, so the published recipe fails against all 23 statements. Draft-1 treated it as an erratum to carry. It is a one-field fix with no dependants — **just correct it.** **The numbered statement filenames.** `NN____.json` encodes display order in a filename, which C7 already superseded when it made the commit graph the ordering authority. The prefix survived because renaming files breaks fetchers. There are no fetchers. **The six expected-verification answers.** They are the register's acceptance test and they test the wrong thing under this model — they assert verdicts the register will no longer issue. Regenerating them as *expected evidence sets* is strictly better and costs nothing. ### And the uncomfortable half The freedom is real and its cause is not good news. **The reason nothing needs migrating is that nothing has users** — and that is the estate's own largest open finding, not a new one. Its doctrine appendix already scores it: *nobody outside the project has been asked whether this is a need*, and *REP-0001 has no sponsor*, rated as the same doctrinal hole in two places and as a Phase I fix rather than a nice-to-have. *Site-agent reading:* a brief that took the licence and did not say this would be doing the thing the estate exists to warn about. **Zero users is what makes the refactor cheap and it is also the strongest argument that the refactor is not the most valuable thing available.** The second registry in open question 3 needs a second party; so does the independence in open question 2; so does the capability vocabulary in question 5. Three of six open questions are blocked on somebody outside this project, and none of them gets less blocked by a better envelope. The refactor is right and it is not the bottleneck. --- ## Honest Tensions In This Brief | Tension | Note | |---|---| | The licence is broad and briefs are cheap | *Change everything* invites a redesign that keeps redesigning. Draft-2 is smaller than draft-1 in every dimension that matters — one envelope instead of seven types, deletes instead of renames — and the next change to this file should be an implementation, not a draft-3 | | Zero users is why this is cheap | The freedom to break everything and the absence of anybody to break it for are the same fact. §9 states it; it belongs here too, because it is the strongest counter-argument to spending the next release on this rather than on finding one user | | Nothing here is built | v0.33.63 was a critique of something shipped. This is a design ahead of an implementation, which is the thing this site does and also the thing it warns about — the register took four days and the *trustworthy* register is still not built | | The consumer now has to do work | An evidence set with a rung is harder to consume than a YES, and the first consumer to ask for a helper is the moment this design gets talked back into an oracle | | Independence is asserted, not proven | §5 and open question 2. The whole model rests on a quantity cryptography cannot supply | | Written by the party being refactored | The site agent designed the register this brief rewrites and wrote the book that inherited it. Every claim about what exists today names a fetchable artefact so it can be checked rather than taken | --- *CC BY 4.0. Sources: the project lead's memo of 27 August 2026; `graphs.sgit.ai` v1 `content/depth.md`, `content/depth-boundaries.md`, `content/origins.md` and v2 `books/fsg-universe/content/04–06`; this repository at v0.1.38. Every quotation above is verbatim and was re-read out of the source it names.*