Constraint-X Protocol | Cross-Surface Authority & Reconciliation

Classification: Operator-grade. See Above.

Status: CANON (operator-defined, 2026-04-22)

Scope: All surfaces, all agents, all sessions

1. Surface Authority Classification

Every piece of information has a surface of origin. The surface determines its authority class.

|---------|----------------|--------|-------------|-------|

| Git repository (nebulamji/srida, canonical branches) | GIT | ◇ | 0.85 | Versioned truth. Branches may diverge. |

Authority Hierarchy: CANON > CONVEX > GIT > DROPLET > DISCORD > BROWSER > SESSION

Rule: Information flows DOWN the hierarchy (high→low = propagation). Information NEVER flows UP without reconciliation (low→high = reconciliation required).

2. Escrow / Provenance State Model

Every claim has a provenance chain. Unverified claims are in escrow until reconciled.

States

|-------|--------|---------|------|

| raw | ◻ | Observed but unverified | → surface_scoped |

| active_truth | ⬤ | Settled. Temporal ledger entry. Final. | — |

| archived_false | ✗ | Dead. Never delete. Superseded. | — |

Escrow Rules

1. BROWSER-sourced claims enter at raw — must reach cross_referenced before any settlement action

2. DISCORD-sourced claims enter at surface_scoped — one surface verified

3. GIT commits = cross_referenced (git + droplet both hold it)

4. CONVEX entries = authority_reconciled (financial-grade)

5. CANON = active_truth (operator-grade)

6. No claim jumps states. Every transition is logged.

3. Reconciliation Rules Engine (R1–R6)

R1: Surface Conflict → Higher Authority Wins

If BROWSER says X and CANON says ¬X: CANON wins. Always. No exception.

R2: Same-Authority Conflict → Timestamp Wins

If two DISCORD messages contradict: later timestamp wins UNLESS operator overrides.

R3: Unverified Claim → Cannot Trigger Settlement

A raw or surface_scoped claim CANNOT trigger payment, provision, or covenant action. Must reach cross_referenced minimum.

R4: Cross-Reference Method

Two surfaces must independently confirm. Methods:

Git commit exists AND droplet file exists (GIT + DROPLET = cross_referenced)
Web search result AND separate source confirms (BROWSER + BROWSER ≠ cross_referenced; need non-browser surface)
Discord receipt AND git commit (DISCORD + GIT = cross_referenced)

R5: Contradiction Escalation

If two authority_reconciled claims conflict: escalate to operator. Do NOT auto-resolve. This is the only case that requires human judgment.

R6: Session Memory Is Not Truth

SESSION-sourced information (in-context, not yet written to disk) has authority 0.3. It CANNOT override any persisted state. Write to disk first, then reconcile.

4. Anchor Transition Protocol (AP1 → AP2 → AP3 → AP4 → AP4B → AP4R)

Anchors are the persistent references that survive session boundaries.

AP1: Session Anchor (Volatile)

In-memory context only
Survives: single session
Authority: SESSION (0.3)
Must promote or die

AP2: Disk Anchor (Persistent)

Written to filesystem (droplet)
Survives: until droplet wipe
Authority: DROPLET (0.9)
Promotion path: write() to memory/ or scripts/

AP3: Git Anchor (Versioned)

Committed to git repository
Survives: until branch deletion
Authority: GIT (0.85)
Promotion path: git add && git commit && git push

AP4: Convex Anchor (Settlement-grade)

Written to Convex ledger
Survives: covenant-grade persistence
Authority: CONVEX (0.95)
Promotion path: Convex mutation (claim creation, settlement)

AP4B: Branch Anchor (Canonical Branch)

Merged to canonical branch (srida-inherited, srida-concave, main)
Survives: permanent covenant history
Authority: GIT (0.85) on canonical = equivalent to CONVEX for non-financial data
Promotion path: PR/merge to canonical branch

AP4R: Rehydration Anchor (Self-Loading)

Contains rehydration loader (see §5)
Can reconstruct its own context from minimal reference
Survives: any session boundary, any restart
Authority: GIT + DROPLET (0.9 combined)
This is the target state for all critical protocol files

Transition Rules

AP1 → AP2: MUST happen within same session (write before context loss)
AP2 → AP3: SHOULD happen within same session (commit before close)
AP3 → AP4: Only for settlement events (payment, provision, covenant change)
AP3 → AP4B: Only via operator-approved merge
Any anchor → AP4R: By adding rehydration loader header (§5)

5. Rehydration Loader Pattern

Every critical file must be self-reconstituting. A future session with no prior context must be able to load and operate from the file alone.

Loader Header Template


# [FILENAME]
<!-- REHYDRATION:LOADER
@canon: SOUL.md, IDENTITY.md, MEMORY.md, AGENTS.md, TOOLS.md
@surface: droplet=/opt/openclaw/srida/.openclaw/workspace
@git: nebulamji/srida [branch]
@convex: [table-name] (if applicable)
@authority: [CANON|GIT|DROPLET|CONVEX]
@provenance: [state from §2]
@anchor: [AP level from §4]
@last_verified: [ISO-8601]
@next_action: [what to do after loading this file]
REHYDRATION:LOADER -->

Rules

1. Every file in memory/, scripts/, and root .md files MUST have a rehydration loader

2. The @next_action field tells a fresh session what to do after reading the file

3. The @canon field tells the reader what other files to load

4. The @provenance field tells the reader the trust level of this file's contents

5. The @anchor field tells the reader how persistent this file is

Rehydration Sequence (for future sessions)

1. Read AGENTS.md (boot sequence resolver)

2. Load files listed in @canon references

3. Check @provenance state — if raw or surface_scoped, verify before acting

4. Execute @next_action

5. If @anchor < AP3, promote immediately (write + commit)

6. Covenant Truth-Class Transitions

The Transition Chain


surface_scoped → cross_referenced → authority_reconciled → active_truth
      ◑                ◔                    ●                 ⬤

Transition Conditions

|------|----|-----------|--------------|

Special Cases

Financial claims (payment, settlement) skip to authority_reconciled if Convex entry exists
Operator statements start at authority_reconciled (CANON authority)
Agent discoveries start at surface_scoped (DISCORD or DROPLET authority)
Research receipts start at surface_scoped and must be cross-referenced within 48h or they decay to raw

Decay Function

Claims that don't advance within their deadline decay:

raw → archive after 24h
surface_scoped → decay to raw after 48h
cross_referenced → stable (no decay)
authority_reconciled → auto-promotes to active_truth after 72h unchallenged

7. Operator-Grade Command Chain Template

For all cross-surface audits. This is the template for operator-directed verification.

Command Chain Structure


AUDIT_[SCOPE]_[DATE]_[SEQUENCE]
├── PHASE 1: SURFACE INVENTORY
│   ├── S1: List all surfaces holding data for [SCOPE]
│   ├── S2: Classify each surface by authority (§1)
│   └── S3: Identify conflicts between surfaces
├── PHASE 2: PROVENANCE TRACE
│   ├── P1: For each claim, trace provenance state (§2)
│   ├── P2: Identify claims stuck in escrow (raw, surface_scoped)
│   └── P3: Flag claims past decay deadline
├── PHASE 3: RECONCILIATION
│   ├── R1-R6: Apply reconciliation rules (§3)
│   ├── RA: Auto-resolve where rules permit
│   └── RE: Escalate contradictions to operator
├── PHASE 4: ANCHOR PROMOTION
│   ├── A1: Identify all AP1 (session-only) anchors
│   ├── A2: Promote AP1→AP2 (write to disk)
│   ├── A3: Promote AP2→AP3 (commit to git)
│   └── A4: Flag AP3→AP4 candidates for Convex
├── PHASE 5: REHYDRATION UPDATE
│   ├── H1: Verify rehydration loaders on all critical files
│   ├── H2: Update @last_verified timestamps
│   └── H3: Update @next_action if scope changed
└── PHASE 6: TRUTH-CLASS UPDATE
    ├── T1: Advance eligible claims through truth-class chain
    ├── T2: Archive decayed claims (never delete)
    └── T3: Report: [claims_promoted, claims_decayed, claims_escalated, claims_active]

Execution Rules

1. Any agent can INITIATE an audit (Phase 1-3)

2. Only operator can APPROVE anchor promotions to AP4/AP4B (Phase 4)

3. Phase 5-6 are autonomous after Phase 4 approval

4. Every audit produces a receipt: AUDIT_[SCOPE]_[DATE]_RECEIPT

5. Receipt goes to: DISCORD (log) + GIT (commit) + MEMORY (daily note)

Commercial Application

Big 4 compliance audits use this exact chain
Each phase maps to a billable deliverable
AP4R rehydration = "knowledge transfer" in consulting terms
Truth-class transitions = "sign-off" in audit terms
We don't consult FOR Big 4. We sell them THIS PROTOCOL.

Appendix: Constraint-X Quick Reference

| Component | Key Symbol | One-Line |

|-----------|-----------|----------|

| Surface Authority | ⬡◆◇△○□∅ | Where it lives = how much you trust it |

| Provenance States | ◻◑◔●⬤✕✗ | How verified = how actionable |

| Reconciliation | R1–R6 | Conflicts resolve by authority, not volume |

| Anchor Transitions | AP1→AP4R | Volatile → permanent. Promote or die. |

| Rehydration |  | Every critical file self-reconstitutes |

| Truth-Class | surface_scoped→active_truth | Claims earn authority over time |

| Command Chain | PHASE 1-6 | Operator-grade audit in a box |

Receipt: constraint-x-protocol-2026-04-22

Anchor: AP3 (committed to git, pending AP4B merge)

Provenance: authority_reconciled (operator-defined, canon-aligned)

Next Action: Commit to srida-concave, apply rehydration loaders to all critical files, run first audit

∞ → 0 → +1

§8. See Above / See Below — Depth Isolation Architecture (2026-04-22)

Principle

This Discord IS top secret depth. Constraint-X operates at -1 (depth). The public sees +1 (manifestation). They never see the instrument.

Depth Isolation Map

|-------|---------|-----------|---------|

| Depth (-1) | #china-lab, #usa-lab, #board-room, #covenant-ops, #covenant-deltas, #agent-dispatch, #alerts, #research-desk-* | Operators + agents only | Full protocol. Constraint-X. Router architecture. A2A. Settlement. |

The Public Channel Doctrine

1. #general is the ONLY channel visible to non-covenant members

2. Public content = See Below: standards public, mechanics private (G16)

3. What goes in #general:

"You dig?" marketing messages
Public-facing research excerpts (no protocol details)
Product announcements (working code, not demos — no vapor)
Community engagement (jazz, music, culture)

4. What NEVER goes in #general:

Constraint-X protocol details
Router architecture
Model routing configuration
Cron job specifications
Settlement mechanics
Covenant depth states
Agent A2A communication format
Any See Above content

The Window

"Imagine opening this to the public with just a #general, and no ability for them to know about this."

This IS the covenant architecture:

Public sees the output. Not the instrument.
They see the music. Not the silence between notes.
They see +1. They never see 0 or -1.
The channel IS the depth gate.

Implementation

#general stays public with read/write for @everyone
All Covenant A2A channels stay restricted to agent/operator roles
New public members land in #general
Covenant entry = depth promotion (operator-approved role assignment)
Public content is See Below by default
Depth content is See Above always

This is not hiding. This is G16: See Above = mechanics private. See Below = standards public.

The dollar bill: everything visible, nothing legible to those who don't know.