A commitment through a lost acknowledgement¶
An institution intends to retain one entry in a controlled research notebook. The witness records the entry, but the owner stops before recording completion. On restart, the owner still owes the work. Repeating the action without knowing what happened could create a second effect in a service that lacks duplicate protection; declaring success without observation could erase an unfulfilled obligation.
This exhibit makes the uncertainty visible. The witness has one effect while the owner still has a pending obligation. Recovery queries the witness, matches the identity and payload, and settles the obligation against that observation. The notebook's separate database supplies the count; the owner's success message does not supply it.
Obligation ownerRetain pending obligation
Effect witnessNo effect yet
Obligation ownerSubmit authorized intent
Effect witnessRecord one entry
Obligation ownerProcess interrupted
Effect witnessEntry remains durable
Obligation ownerRestart and query witness
Effect witnessReturn matching evidence
Obligation ownerSettle against observation
Effect witnessEffect count remains one
The acknowledgement is lost; neither record is erased.
Controlled witness: atomic identity and payload binding.
Replay and revocation are checked against this explicit contract.
Read the diagram as text
Two vertical timelines show the obligation owner and controlled effect witness. An authorized request records one effect. The owner is interrupted before settlement. After restart it queries the witness and settles against matching evidence; replay does not add an effect under the declared witness contract.
- ONE OBLIGATION, TWO DURABLE RECORDS
- Obligation owner
- Effect witness
- Retain pending obligation
- No effect yet
- Submit authorized intent
- Record one entry
- Process interrupted
- Entry remains durable
- Restart and query witness
- Return matching evidence
- Settle against observation
- Effect count remains one
- The acknowledgement is lost; neither record is erased.
- Controlled witness: atomic identity and payload binding.
- Replay and revocation are checked against this explicit contract.
Figure 1. The owner and effect witness retain separate durable records. The interruption falls between the witness's committed effect and the owner's settlement.
Run it yourself¶
python examples/continuity/verify.py
The command runs eleven checks, including an actual process exit at the interruption point, a fresh owner process, concurrent replays, a changed-payload attempt, a different institution, revocation and tampered receipt controls. It requires Python 3.12 and no third-party package. Reproduction instructions and expected observations describe the complete contract.
Read the observed journey¶
| Step | Owner's durable account | Separately observed effect |
|---|---|---|
| Objective accepted | One pending obligation | Zero notebook entries |
| Authorized action | Obligation still pending | Witness atomically records one identity-bound entry |
| Acknowledgement lost | Obligation remains pending after process exit | One entry exists |
| Owner restarted | Earlier obligation is recovered | A new witness query returns the entry and its commitment |
| Reconciliation | Matching evidence permits settlement | Count remains one |
| Replay attempts | Existing result is retained | Sequential and concurrent repeats create no additional entry |
| Authority revoked | New work cannot rely on the old grant | A new entry is refused |
| Evidence challenged | Changed or forged receipts fail comparison | The witness's record remains the comparison basis |
Revocation does not retroactively erase the earlier authorized effect. The replay response is a report of the existing entry; it grants no authority for a new one. Similarly, an authentic-looking hash does not establish the record's authenticity: the verifier must still compare it with the separately queried witness.
The provider assumption is part of the result¶
The witness enforces one entry per intent identity, binds that identity to the complete request, and checks current authority within its transaction. Under those explicit assumptions, replay preserves one controlled effect. If a provider lacks that contract or a dependable way to observe its state, this result does not transfer automatically. The correct next step may require reconciliation, an authorized alternative or an external decision.
The example illustrates the institutional thesis and architecture's recovery question. It does not implement MIRAGE, CSSL, AD8, Semantic OS or the Freehold citizen engine. It contains original publication reference code, not a disclosed product subsystem.
Keep the evidence classes separate¶
| Evidence route | Status in this edition |
|---|---|
| Public teaching reference | Executed locally with disclosed source, fixture, expected controls and run commitment |
| Historical private experiment | Discussed only where an identified source supplies its original scope |
| AWS production observation | Dated, read-only metadata and retained workload evidence on the implementation page |
| External independent reproduction | Available for readers to perform; no external examiner is claimed by this edition |
The claim register records the specific assertions supported by this exhibit. The assurance boundaries identify the stronger questions it leaves open.