Wiki · Architecture & Decisions
Phase 5 — The witness: an anchor the writer cannot reach, and a seat that only projects
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
Status: EXECUTED 2026-07-26 → PHASE-5-RESULTS.md · item 5.1's premise was FALSE until L2 was stabilised; 5.6 remains a standing known-fail · Written from: PHASE-4-RESULTS.md, not from Phase 4's expectations
Bound: SP.ControlPlane.Witness in the root zero-dep app, the first real Control Plane ledger, and one new Gaia seat in viewer/gaia/.
Authorises: ADR-0002, ADR-0006
0. What Phase 4 changed about this phase
- The anchor is local, and a local anchor cannot outrank a local writer. A test performs that attack and asserts it succeeds. Item 5.1.
- The Control Plane can record its own mutations and never has. Capability is not practice — this programme has now made that distinction twice about the anchor, and it applies here unchanged. Item 5.2.
- Four pre-registered phrases have been wrong on contact, one per phase. So every item below states the assumption it rests on and the check that would show it false, and item 5.0 exists.
0.1 Item 5.0 — check the premises before building on them
Before any code:
| premise | check | if false |
|---|---|---|
| a second machine on the mesh can hold an anchor the writer cannot reach | reach it read-only and confirm the writer has no credential to it | fall back to a signed anchor and record why |
gaia_lint.cjs will actually fail a summarizing seat |
write the summarizing fixture and watch it fail, before writing the real seat | the lint is decorative and its repair is this phase, not the seat |
| Gaia's seat pattern admits a new source without changing GAIA LAW | read organic-operator and science as the worked examples |
STOP_PROTOCOL_CHANGE_REQUIRED |
Recording the check is part of the item. A premise assumed is a premise that turns out wrong at the worst moment.
1. Pre-registration — written before execution
| # | item | expected outcome | falsifier |
|---|---|---|---|
| 5.0 | Verify the three premises above | each confirmed against a live read, or the phase re-plans | an item is built on an unchecked premise |
| 5.1 | SP.ControlPlane.Witness — an anchor the ledger's writer cannot reach |
the store's anchor is mirrored somewhere the writing process has no write credential for; the tamper attack from Phase 4 now fails | the tamper attack still succeeds, or the witness lives where the writer can rewrite it |
| 5.2 | The first real Control Plane ledger — record this programme's own history | phases 2–5 land as entries, persisted and anchored, each with actor, authority, prior, resulting and evidence; Store.attest/1 passes over it |
the ledger is a demo fixture rather than the real record, or it is written by hand |
| 5.3 | gaia_lint.cjs proven to bite before the seat exists |
a deliberately summarizing fixture (a total field, a rank, a computed count) makes gaia_lint FAIL, recorded red |
the lint passes a summarizing fixture — in which case the lint is the defect and the seat waits |
| 5.4 | A Gaia seat projecting the Control Plane ledger verbatim | every signal carries locator, ISO captured_at, sha256 and byte length; verify_gaia still passes 12/12; the seat is declared in caps.cjs, the signal enum and GAIA.md |
any Gaia-derived count, rank, rollup or verdict appears |
| 5.5 | The seat surfaces the residual, not just the state | if the witness disagrees with the local anchor, that is a drift signal with both sides carried, never a bare boolean | a disagreement is rendered as a single true/false |
| 5.6 | Inherited: mix format --check-formatted |
still a standing known-fail with its reason, or lib/sp/brain/language.ex is reformatted in its own commit proposed on its own terms |
the reformat is buried inside a Phase 5 evidence commit |
Standing expectation: pure, offline, deterministic Elixir for Witness. No
hex dependency. No Phoenix. No ui/ change. No row is written to
evidence/gates.ndjson — item 3.1's authorisation was specific to it and does
not carry forward. Any gate row this phase would like to write is proposed to
the operator, not appended.
GAIA LAW is not negotiable here. The seat projects; it never computes. A source's own verdict carried verbatim is projection. A count Gaia computes is a build defect even if it looks harmless.
2. Red tests, named before they are written
| test | must fail before the code exists, for this reason |
|---|---|
test/sp/control_plane/witness_out_of_reach_test.exs |
the tamper attack from Phase 4 still succeeds with a witness present |
test/sp/control_plane/witness_disagreement_is_two_sided_test.exs |
a witness/anchor disagreement reduces to a boolean |
test/sp/control_plane/control_plane_ledger_is_real_test.exs |
the recorded ledger is a fixture, not this programme's actual history |
viewer/gaia/fixtures/summarizing_seat_fixture.cjs (+ lint run) |
gaia_lint PASSES a fixture carrying a computed total |
test/sp/control_plane/seat_projects_verbatim_test.exs |
a projected signal differs from its source bytes |
Each committed red with its output recorded. Standing procedure: a guard that passes vacuously in red is not counted until a mutation proves it bites, and any test that passes red is named in the receipt with the reason.
And a new standing rule, earned in Phase 4: a canary that fires is replaced by what it was guarding, never deleted. Deleting a canary is how a limit quietly stops being tracked.
3. Verification
cd ~/Documents/UNI.Minecraft
mix format --check-formatted # repo-wide FAILS on lib/sp/brain/language.ex — known, item 5.6
mix compile --warnings-as-errors --force
mix test
mix test test/sp/control_plane
git diff mix.exs # MUST be empty
sha256sum evidence/gates.ndjson # MUST be unchanged — this phase writes no row
node viewer/gaia/gaia_lint.cjs # 0 violations, AND proven to fail a summarizing fixture (5.3)
node viewer/gaia/verify_gaia.cjs # 12 checks PASS, including every-emitted-seat-declared
Acceptance: all five red tests recorded red then green · every vacuous guard
mutation-tested · mix.exs unchanged · evidence/gates.ndjson byte-identical ·
verify_gaia still 12/12 with the new seat declared in all three places ·
gaia_lint 0 violations and demonstrated to fail a summarizing fixture.
Rollback: Witness is additive. The Gaia seat is additive and removable from
collectors.cjs plus its three declarations. The Control Plane ledger written by
5.2 is append-only and is not rolled back by deletion — a correction is a
further entry, which is the discipline working.
Stop conditions: STOP_TEST_REGRESSION · STOP_PROTOCOL_CHANGE_REQUIRED if
the seat cannot be added without changing GAIA LAW · STOP_DESTRUCTIVE_ACTION_REQUIRED
before any write to the real gate ledger or to any host the witness lives on.
4. Explicitly not in this phase
Rooms, airlocks and keys. The lab view. Any Phoenix code. Any ui/ change. Any
write to evidence/gates.ndjson. Moving a P-level. Authoring a verdict about any
real scientific claim.
5. The corrections this programme has accumulated, carried so they are not re-made
priormay benullat anyseq— a creation event has no prior state wherever it lands. (Phase 3)- Eleven corrective rows, not twelve — a count repeated from memory is not a count. (Phase 3)
language.exis unformatted, not merely CRLF-terminated — the symptom was read as the cause. (Phase 3)- A run's identity is not its record — two executions differ, and must. (Phase 4)
- A local anchor cannot outrank a local writer. (Phase 4)
- Capability is not practice — said twice about the anchor, and true again about the ledger. (Phase 4)
6. Exit condition — the phase ends by starting the next
Phase 5 is complete only when PHASE-6.md exists, is committed, and is
pre-registered in this same form — written from Phase 5's observed results.
PHASE-6.md must carry:
- Every Phase 5 disposition, including each falsifier that fired.
- Whether the tamper attack now fails, and where the witness actually lives.
- Whether
gaia_lintwas proven to bite before the seat was added — and if it was not, what was done about the lint. - The first Control Plane ledger's digest and entry count, and whether
Store.attest/1passes over it. - The Phase 6 build items — rooms, airlocks and keys, F19–F22 — each with a red test named before it is written.
- Its own §6 requiring
PHASE-7.md.
A phase that closes without its successor has stopped, and stopping is legitimate only under a declared STOP condition.
sha256 2c8a8b02e5255477 — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
For the fifth phase, the plan came from what the fourth observed. Its results are recorded separately, and the status line already warns that one item's premise turned out to be false.
The phase has three aims. Put an anchor somewhere the process that writes the ledger — the list of results, only ever added to — cannot reach, so that a local tamperer can be convicted by something outside. Write the body's first real ledger — this programme's own history, rather than a demonstration fixture. And add one seat to the projecting body that carries that ledger word for word, adding nothing of its own.
The most instructive item comes before any code. Four phrases written down in advance had already been wrong on contact, one per phase, so this plan opens by listing the premises it rests on, the live check for each, and what to do if a check fails. Recording the check is part of the item. The plan states the reason simply: a premise assumed is a premise that turns out wrong at the worst moment.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 2c8a8b02e5255477
Clear — written for this website, not the source document
The fifth-phase plan was pre-registered before it ran, written down in advance, and drawn from the previous phase's observed results. Its status line already says one item's premise was false until something else was stabilised, and that an inherited failure remains a standing known failure.
The opening section says what the previous phase changed here. A local anchor cannot outrank a local writer, and a test already performs that attack and asserts it succeeds. The body can record its own changes and never has; the page repeats a distinction this programme has now made twice: capability is not practice. And four phrases written in advance had been wrong on contact, one per phase, so every item states the assumption it rests on and the check that would show it false.
That leads to the item before any code: check the premises first. Three are listed, each with its live check and its fallback if the check fails. That a second machine can hold an anchor the writer cannot reach. That the projecting body's linter will actually fail a summarising fixture. And that a new seat can be added without changing that body's law. Recording the check is part of the item, and the reason given is that a premise assumed is a premise that turns out wrong at the worst moment.
The table then covers the build items. The witness must mirror the anchor somewhere the writing process has no credential for, so that the earlier tamper attack now fails. What would show that wrong: the attack still succeeds, or the witness lives where the writer can rewrite it. The first real ledger — the list only ever added to — must record this programme's own history, persisted and anchored, with actor, authority, prior state, resulting state and evidence. What would show that wrong is its turning out to be a demonstration fixture, or written by hand. The linter must be shown to bite before the seat exists, by making a deliberately summarising fixture fail — and if it passes, the linter is the defect and the seat waits. The seat must project verbatim, with locator, timestamp, digest and byte length on every signal, and what would show that wrong is any count, rank, rollup or verdict the projecting body computed itself. And a disagreement between witness and local anchor must be surfaced with both sides carried, never as a bare true or false.
Standing expectations follow: no dependency, nothing web-related, and no row written to the real gate ledger, because an earlier authorisation was specific and does not carry forward. Any row this phase would like to write is proposed to the operator rather than appended. The projecting body's law is not negotiable here: the seat projects and never computes, and a count it works out itself is a build defect even if it looks harmless.
A table names each test before it is written. Two standing procedures are restated: a guard that passes vacuously is not counted until a mutation proves it bites, and a canary that fires is replaced by what it was guarding rather than deleted.
Verification, acceptance, rollback and stop conditions follow, with the note that the ledger written here is only added to and is not rolled back by deletion — a correction is a further entry. A section then carries forward every correction the programme has accumulated, so none is made twice, and the exit condition requires the next plan to exist and answer named questions.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 2c8a8b02e5255477