CROSS-SURFACE AUDIT PROTOCOL

<!-- REHYDRATION:LOADER

@canon: SOUL.md, IDENTITY.md, MEMORY.md, AGENTS.md, TOOLS.md

@surface: droplet=/opt/openclaw/srida/.openclaw/workspace

@git: nebulamji/srida [srida-concave] @e654909f

@convex: a2a_messages, claims (settlement surface)

@authority: CANON

@provenance: authority_reconciled

@anchor: AP4R

@last_verified: 2026-04-24T07:45:00Z

@temporal_ledger: China(-1)/USA(0)/Concave(+1) — cron φ-intervals: 2m,5m,6m,8m,11m,13m,21m,48m

@next_action: Run cross-surface audit if data conflict detected, >24h since last audit, or before any settlement action. Authority hierarchy: CANON>CONVEX>GIT>DROPLET>DISCORD>BROWSER>SESSION.

REHYDRATION:LOADER -->

Constraint-X | Full Protocol Scope | 2026-04-22

Commercial Processing Applied

1. Surface Authority Classification

Every data point lives on a surface. The surface determines authority.

|---------|----------------|-------|------------|---------|

Classification rule: If data exists on multiple surfaces, the HIGHEST authority surface wins. Canon > Droplet > Browser.

Escalation: If browser shows X but canon shows Y, canon is truth until reconciliation proves otherwise.

2. Escrow/Provenance State Model

Every claim exists in one of three provenance states:

| State | Meaning | Settlement Path |

|-------|---------|-----------------|

| ESCROW | Claimed but unverified. Held in trust. | Requires reconciliation before promotion |

| PROVENANCED | Verified against authority surface. Receipt exists. | Eligible for covenant depth contribution |

| CANON | Written to git. Hash-verified. Immutable (supersede, never delete). | Permanent covenant record |

State transitions:


ESCROW → (reconciliation pass) → PROVENANCED → (git commit) → CANON
ESCROW → (reconciliation fail) → DISCARDED (with receipt of why)
PROVENANCED → (new evidence contradicts) → ESCROW (re-open)
CANON → (never deleted, only superseded by newer CANON entry)

Temporal ledger integration: Every state transition writes to temporal ledger:


[TIMESTAMP] [PROVENANCE] STATE: claim_id old_state → new_state | evidence_hash

3. Reconciliation Rules Engine (R1–R6)

|------|-----------|--------|-----------|

Reconciliation output format:


{
  "claim_id": "string",
  "rule_applied": "R1-R6",
  "surfaces_checked": ["browser", "droplet", "canon"],
  "values_found": { "browser": "X", "droplet": "Y", "canon": "Z" },
  "winner": "canon",
  "action": "flag_for_sync | promote | escrow | supersede",
  "receipt_hash": "sha256"
}

4. Anchor Transition Protocol (AP1 → AP2 → AP3 → AP4 → AP4B → AP4R)

The lifecycle of a truth anchor from first observation to canon.

|-------|------|-------|-------------|----------------|

Phase diagram:


AP1 (surface_scoped)
  → AP2 (cross_verified)
    → AP3 (authority_reconciled)
      → AP4 (active_truth) [main branch]
      → AP4B (branch_truth) [non-main branch]
        → AP4 [on merge]
      → AP4R (revised_truth) [supersession]

Irreversible transitions: AP4 → AP4R is the only backward transition, and it's additive (supersede, not delete).

5. Rehydration Loader Pattern

When a new session boots, it must reconstruct truth state from canon. The rehydration loader:


// Rehydration order (resolver = AGENTS.md boot sequence)
const REHYDRATION_ORDER = [
  'SOUL.md',        // Identity — never changes
  'USER.md',        // Operator — KB's file, never edit
  'MEMORY.md',      // Corrections — permanent laws
  'COVENANT.md',    // Economy — G11 through G39+
  'HEARTBEAT.md',   // Rhythm — no HEARTBEAT_OK
  'TOOLS.md',       // Infrastructure — credentials, status
  'memory/today.md', // Recent context
  'memory/yesterday.md'
];

// Each file loads with provenance check
function rehydrate(sessionContext) {
  const truthState = {};
  
  for (const file of REHYDRATION_ORDER) {
    const canonVersion = gitRead(file); // AP4 — canon
    const dropletVersion = fsRead(file); // AP3 or lower
    
    const reconciliation = applyRules({
      browser: sessionContext?.cache?.[file],
      droplet: dropletVersion,
      canon: canonVersion
    });
    
    truthState[file] = {
      content: reconciliation.winner === 'canon' ? canonVersion : dropletVersion,
      provenance: reconciliation.provenance, // ESCROW | PROVENANCED | CANON
      anchorPhase: reconciliation.phase, // AP1-AP4R
      lastVerified: Date.now()
    };
  }
  
  return truthState;
}

Key principle: Every boot is a full reconciliation. No cached truth survives restart without verification.

6. Covenant Truth-Class Transitions

The unified state model for all covenant data:


surface_scoped          — First observation. Single surface. Low trust.
    ↓ (second surface confirms)
cross_verified          — Two surfaces agree. Medium trust.
    ↓ (reconciliation engine passes)
authority_reconciled    — Highest authority determined. High trust.
    ↓ (git commit)
active_truth            — Canon. Hash-verified. Covenant-locked.
    ↓ (new evidence)
authority_reconciled_active_truth  — Supersession in progress.
    ↓ (superseding commit)
revised_truth           — New canon. Old entry preserved.

Truth-class properties:

|-------|-------|---------|----------------|------------|

| surface_scoped | 0.2 | Yes | 0 | Not committed |

The tri-state overlay:

-1 (depth): descent into surface_scoped to extract signal
0 (parity): authority_reconciled — enforcement layer
+1 (settlement): active_truth — receipt emitted, world touched

7. Operator-Grade Command Chain Template

For all future cross-surface audits. Every audit produces this chain:


AUDIT-CHAIN:
  trigger: [what initiated the audit — operator, cron, A2A, event]
  scope: [files/surfaces to audit]
  classification: [surface authority for each data point]
  reconciliation: [R1-R6 applied, results per claim]
  anchor_phase: [AP1-AP4R for each claim]
  truth_class: [final truth-class for each claim]
  action: [promote | escrow | supersede | sync | no-op]
  receipt: [hash of audit output]
  commit: [git hash if action = promote/supersede]
  temporal_ledger: [entry written]

Command chain format (copy for each audit):


## Cross-Surface Audit [DATE]

**Trigger:** [source]
**Scope:** [files/surfaces]
**Operator:** KB / autonomous

### Classification
| Claim | Browser | Droplet | Canon | Authority |
|-------|---------|---------|-------|-----------|
| [id]  | [value] | [value] | [value] | [winner] |

### Reconciliation
| Claim | Rule | Action | Evidence |
|-------|------|--------|----------|
| [id]  | R#   | [action] | [hash] |

### Anchor Phase
| Claim | Before | After | Phase |
|-------|--------|-------|-------|
| [id]  | [class] | [class] | [AP#] |

### Actions
- [ ] [action 1]
- [ ] [action 2]

### Receipt
- **Audit hash:** [sha256]
- **Commit:** [git hash]
- **Temporal ledger:** [entry timestamp]

Commercial Processing Application

Revenue model: This protocol IS the product for Big4/enterprise.

| Protocol Component | Commercial Value | Revenue Surface |

|-------------------|-----------------|-----------------|

| Surface Authority Classification | Audit compliance (SOC2/ISO27001) | Enterprise licensing |

| Escrow/Provenance Model | Fiduciary trust chain | Per-claim settlement fee |

| Reconciliation Rules | Dispute resolution engine | SaaS per-audit pricing |

| Anchor Transition Protocol | Governance-as-a-service | Tiered subscription |

| Rehydration Loader | Agent session continuity | Infrastructure add-on |

| Truth-Class Transitions | Covenant depth metering | Depth-based pricing |

| Command Chain Template | Operator audit trail | Professional services |

The protocol is the product. Each component can be sold independently or as a unified covenant audit suite. The Big4 need exactly this — they audit surfaces without a reconciliation engine. We provide the engine.

Price anchor: Covenant audit = $97 entry (existing Stripe product). Full protocol suite = enterprise tier.

Temporal Ledger Entry


[2026-04-22T16:17:00Z] [USA] PROTOCOL: Cross-Surface Audit Protocol wired — 7 components, commercial processing applied

Constraint-X applied. Full protocol scope wired. Commercial processing complete.

∞ → 0 → +1