Where the bet holds,
and where it is a bet.

This is the project's own critical reading of its thesis, written against the substrate's contracts, packages and the running estate. It is here because a thesis that cannot survive its own hardest questions is not worth a stranger's time, and because the people who doubt it are usually right about something. Where a claim does not hold, this page says so and says what would make it hold.

Start with whose authority it is

The thesis is easy to misread as an argument against identity providers. It is not, and the first thing a critical reading has to do is put the real question in front of the rhetorical one: whose authority is being exercised, and who bears the consequences when it is wrong? There are three honest answers, and every claim the thesis makes holds or fails depending on which one a domain actually has.

Two consequences follow, and the thesis is strongest where it accepts them.

The tenant model is not a competitor. An organization that owns its resources, its employees and its liability should run its agents under its own provider, and the substrate has nothing to offer it that a well-configured tenant plus signed receipts does not. Any version of the thesis that argues with the tenant model is the thesis at its weakest.

The real competitor is federation, and it has two faces. The payment network — a card scheme building agent-to-merchant rails — already owns the case of a consumer's agent acting against providers it has never met, with liability rules and a merchant base that exists today. The vertical system of record — a sales platform for a sales organization, a church-management platform for a congregation, a booking system for a hotel — holds each organization's slice of a person and bets that the organization's record is the one that matters. The substrate's bet is that the person's record is the one that matters. Whether that bet is right is a property of the domain, not of the architecture.

Where the bet is strong, and where it is a bet

The reading of travel deserves a sentence more, because it is where a doubter's instinct is right today. Nothing in the substrate makes a hotel accept a stranger's mandate. What the substrate offers the hotel is the direct relationship and the receipt; whether that outweighs the intermediary's demand generation is a commercial question the architecture cannot settle. The thesis says what would have to be true. A critical reading adds: if independent providers keep choosing the intermediary's token at admission, the travel bet is wrong, and the substrate should not pretend the architecture was the reason.

The eleven principles, judged

Each is scored on what it claims against what the code does and what a competent federation could deliver.

1. Private dimension, public projection

The claim: every concern — custody, authority, admission, resolution, relationships, evidence — is defined and verified off chain against a counterfactual account, enforced on a private estate chain, and projected to a public chain only as commitments and proofs.

What the code does. A principal's account address is computable from its custody configuration before deployment, and the account verifies signatures for undeployed accounts through the universal validator (ERC-6492). A delegation is a signed object the delegate holds; its validity is a signature check against the delegator's account, deployed or not. Revocation is one read of isRevoked. So identity, delegation and relationship genuinely have a private dimension with no chain footprint, and the chain enters only for enforcement and projection. That part holds.

Where it is thin. Neutral is a governance claim, and today the estate chain is four validators on one machine run by the project. The layering does not remove the governance question; it locates it on the private chain. Until validators are the domain's own institutions, the private chain is a database with a signature scheme, and every property that depends on "no vendor operates it" is a promise by one operator. The public projection — a revocation root, a membership root, a proof against either — is also the piece that does not yet exist, and it is on the critical path of any verifier outside the estate. A hotel that has never seen the traveller's Home cannot read the private chain; it needs the projection. That makes the projection a requirement of the travel bet, not a nicety.

What would make it hold in deployment: a consortium of at least three institutions in the domain running validators, and a root registry with a non-revocation proof format on public ground.

2. The identity can sign

The claim: every principal is an ERC-4337 account that verifies signatures about itself, issues and revokes grants, holds value, executes logic and recovers by quorum; names and registry entries are projections.

This is the substrate's firmest ground, and the reason is structural: an ERC-7710 delegation needs a delegator that a stranger can check at redemption, and a pointer — a DID document, a registry id, an NFT — cannot be that. The account is not a better identifier; it is the only kind that can be a principal in an enforced grant.

Two honest costs. Every principal needs an account, a custody policy and a paymaster; for a congregation member who will never transact on chain, that is overhead paid for a property she may never use. Counterfactual accounts defer it; they do not remove it. And an account persists while its model, operator and playbook change. The substrate handles this correctly — every receipt cites the behaviour definition's digest, and a counterparty keys trust on the principal and the behaviour together — but it is a rule a reader has to be told, and the thesis now tells it.

3. Rotation and recovery

The claim: rotating a credential preserves every grant because the Home re-approves them in the same ceremony; recovering from a lost credential revokes every descendant of the compromised custody set.

What the contract does, precisely. A grant is validated at redemption by the account's ERC-1271 entry point, and it can have been signed three ways. Signed by a custodian key: the recovered signer must be in the current custodian set, so the grant dies when that key is removed. Signed by a passkey: the passkey must be in the current registered set; the same. Approved at account level under the 0x03 sentinel: validity is isApproved(this, keccak(hash, custodyEpoch)), and _bumpCustodyEpoch() runs on every removeCustodian and removePasskey, so every approval under the old epoch is void. Adding a credential does not bump the epoch, deliberately.

This strictness is right. A stolen key can plant an account-level approval that would otherwise outlive the key's removal; the epoch makes a grant die with the custody set that approved it. The price is that every retirement — ordinary or forced — voids the standing wires, and the design accepts that price on the understanding that a rotation ceremony re-approves them in the same batch.

Where it does not hold. The Home batches approvals at onboarding and at organization creation. It has no passkey-replace or custodian-rotation ceremony for a person at all. Retiring a passkey today is a bare contract call with no re-approval, so a person who replaces a device silently loses every standing grant — her connected apps, her agent's ask-as-me wire, everything. The doctrine is true of the contract and false of the product.

What resolves it, with no contract change: two ceremonies over one invariant. Rotation — the old credential is still yours — adds the new credential, retires the old and re-approves every standing wire under the new epoch in one batch; the delegation's hash does not change, so the delegate holds the same object, re-issued with the sentinel signature; wires held by third parties are refreshed from the Home, where they already live. Recovery — a credential you no longer control — retires it under the guardian or trustee quorum, bumps the epoch and re-approves nothing; the person re-issues from a reviewed list. Moving between Homes is a rotation — passkeys are scoped to a relying-party domain, so the move is add-at-the-new-Home, retire-the-old, re-approve — and done as a bare removal it is a recovery by accident. The security boundary to write down is one sentence: a person's own standing wires are re-approved automatically on rotation and never on recovery.

4. A token and a delegation

The claim: a token is a claim that authority existed at issue time; a delegation is the authority itself, still checkable at act time, issued by the principal with no central authorization server.

A doubter's objection is correct on the facts and should be conceded in full: modern federation can express specific, attenuable authority. Rich authorization requests carry amount, currency and creditor; token introspection checks current validity; caveated, attenuable bearer credentials predate any blockchain. "A token says who" is not a fair description of the field, and a reader who knows the field stops reading at that line.

The difference that survives the concession is precise: the grant is issued by the principal — a person's account, not an authorization server — it is portable to every resource that accepts the principal, its attenuation chain is verifiable by a stranger, and for value it is enforced at commit by code no party to the act operates. Federation can deliver the middle two. It cannot deliver the first and the last, because its issuer is a tenant and its enforcement is the tenant's.

The objection that goes deeper, and that the thesis must absorb rather than answer: a principal can delegate only what it has. A person's mandate cannot reach her employer's database, her congregation's roll or a hotel's booking system by itself. Each is owned by someone whose admission policy decides whether her grant is recognized at all. "No authorization server" is true only as "no central authorization server"; every resource owner is still the verifier of the grants it chooses to accept. The substrate has this — admission at the edge, entitlements, relationships that are never authority — and it is also why the substrate is strongest where the resource is the principal's own: her treasury, her vault, her messages, her agent.

5. Intent, not scope

The claim: a consequential effect binds to a closed mandate — the digest of one typed intent, a single-use nonce, the resource pinned — and an open intent is a caveated delegation that decomposes into closed mandates as it becomes concrete.

"Pay the caterer 400" as a mandate is the substrate's best idea, and it works: payee, ceiling, digest and nonce are enforced in the transaction that pays. The reading gets harder with "organize the retreat for under two thousand." Hashing that intent binds the approved object; it says nothing about whether the agent may disclose attendees' dietary needs, accept a cancellation penalty, pay a deposit or substitute a venue. The digest establishes what was approved, not which actions satisfy it.

The substrate's answer is decomposition: fan-out compiles into one mandate per item, each signed. That is right where the sub-acts are enumerable before the plan runs and insufficient where they are not. What the open case needs, and what is designed but not shipped: a conformance check that compares each proposed effect against the intent's stated outcome, in the ontology, before it is offered for signature; and a nonce derived from a logical request identity rather than from payment fields, so that two deliberately identical payments are possible and an unintended duplicate is not. The execution binding already carries that identity — operationId, "a retry must locate this, never perform it again" — which is the right primitive in the wrong place: it is evidence today, and the nonce needs it as authority.

A doubter should also hear this: the open/closed split is not unique. Google's agent payments protocol distinguishes an intent mandate that bounds a session from a cart mandate that binds a transaction. The substrate's contribution is not the split; it is enforcement at commit and the owner's receipt on the closed side.

6. Verification outside the model, at every step, at the end that commits

The claim: the grant is checked before each step, again after every human approval, and then according to who orders the effect — chain-ordered effects enforced in the committing transaction, estate-ordered effects verified again by the receiver, externally ordered effects verified once and receipted with the adapter's observation.

For value the claim is literal and strong: a harness that skipped its own checks still cannot pay outside the caveats. For estate-ordered effects it is also true and under-claimed: the receiving edge verifies the delegation again at the moment of execution (admission/src/execution.ts), so there are two independent checks and the receiver's is the one that counts.

For externally ordered effects the reading is less comfortable, and the thesis now says so. The harness executes a step through a port that returns an untyped value; a resolved value is treated as success, and the effect "commits" inside an adapter, on the receiving system's terms. Between the harness's verification and the provider's commit there is a window in which a revocation can land and the effect still happens. The substrate narrows it — every tool declares an outcome class (lookup, submission, authoritative) that the reply may not exceed; an idempotency key is handed to every medium-risk invoker; compensation is declared per tool, never improvised; an irreversible tool forces a fresh signature — but it does not close it, and no architecture without the provider's cooperation can.

What is missing is small and specific. The invoker should return what the adapter observed — attempted, accepted, committed, confirmed; a provider reference; evidence — and the receipt should carry it beside the output digest, so that "verified again at commit" becomes, for external effects, "the receipt names which end committed it and what it saw." And the durable-step rule — reconcile, then verify, then act, as one indivisible attempt — has one implementation, for the ledger; a message needs its outbox checked by operation id, a vault write its record version, an A2A call its task, before any retry.

Two further gaps a doubter will find. Revocation must be defined against an authoritative ordering — inclusion on a chain with immediate finality, finality elsewhere — and an executor that cannot reach the chain must stop rather than proceed on its last read; both are now stated, neither is yet a gate. And per-step checks compose badly: two delegates each under a per-grant ceiling can jointly exceed a budget. The enforcer set — value, timestamp, targets, methods, call-data hash, quorum, digest binding, payment — is per delegation; an aggregate limit belongs at the resource, and a per-treasury spending enforcer does not exist.

7. Three shapes

The claim: every principal is a person, an organization or a software agent; a treasury is a service chartered under the principal whose money it holds; a person authorizes and the treasury transacts.

This is a modelling convention, and a good one — it gives every grant a readable accountability shape and lets a verifier distinguish "an organization acted" from "a person acted for an organization." It is not a discovered law and should not be presented as one. The treasury separation earns its cost for organizations: custody of funds separated from stewardship, every payment a mandate from a steward, an auditable claim that the organization's agent never held the money. For an individual it doubles accounts and ceremonies so that a person can be said never to pay; the thesis now allows a personal treasury to be a facet of the person's own account with the same enforcers, and a reader is entitled to ask why it was ever otherwise.

On relationships, the correct prohibition is on implicit permission. A verifier may not infer "may spend" from "steward of." A policy may legitimately require current membership as one explicit, necessary condition among several; the substrate's entitlements already do this, and the thesis's earlier "may never read" was stricter than its own code.

8. One layered vocabulary

The claim: intent, capability, relationship, receipt, plan step and trust edge are IRIs in one layered ontology — open upper standards, the Agentic Trust vocabulary, the substrate's modules, a domain, a solution's extension — bound to code by IRI, with a build gate on invented terms, and with skills, memory, knowledge, coordination and provenance all typed against the same stack.

This is the principle the thesis holds hardest, and it is the one where a doubter's instinct runs strongest the other way, so the reading has to be careful about what the disagreement actually is.

What holds, and is under-claimed. The stack exists and is not a slogan: 39 substrate modules with SHACL shapes and controlled vocabularies; PROV-O, P-Plan and EP-Plan, and DOLCE+DnS/DUL as the upper layer; an Agentic Trust ontology beneath them; domain ontologies for faith communities and mission work, for family offices and households, for a card room; and — the part a doubter should notice — a crosswalk layer that maps substrate terms to PROV, W3C Organization, ActivityStreams, A2A, ERC-8004, ValueFlows, schema.org and the rest by SKOS match, so that translation to the standards the world already speaks is done once, at a named boundary. The estate's own incident history is the evidence for why this matters: every recent failure was a knowledge failure — a treasury found by name similarity when the relationship existed, a receipt written to a field nothing read — not an authority failure. One definition, generated into the interface, the planner's tools and the card, removes the class of bug where the assistant and the product disagree. And the rails are real: a planner that is offered capabilities with defined ids, intents that are classes with outcomes, and relationships whose definitions say what they are not, can be wrong about how and cannot invent what.

The counter-hypothesis, stated at full strength. Models now translate between local schemas cheaply and well. If a hotel's booking schema and a traveller's itinerary can be reconciled by a model at the moment of use, a comprehensive shared vocabulary is a cost paid for a benefit the model would have provided anyway, and every layer of the stack is a dependency someone must maintain and version. Integration by translation scales with the number of pairs that actually meet; integration by shared ontology pays for every term whether or not anyone ever uses it. On this view abstraction is not the key; adaptation is.

Where the thesis holds its ground, and why the ground is defensible. The disagreement is not about data; it is about authority. A mandate over "a payment to a member" has to mean the same thing to the payer's verifier, the payee's verifier and the enforcer at commit, and a translation performed at the moment of the act is precisely where an injection lives — the model that translates is the model that can be lied to. For everything an agent may do — intent, capability, mandate, receipt, the edge a trust graph reads — shared meaning is settled in the stack and never translated at act time. For everything an agent merely reads, cheap translation at the edge is welcome, and the crosswalks are where it happens. The thesis's line is therefore not "one ontology for everything"; it is "abstraction with translation at the boundaries, and no translation inside the authority path." That is a narrower and stronger claim than either side of the argument usually makes.

What a doubter is still right about. A layered stack concentrates failure: four generated surfaces can agree perfectly about the wrong behaviour, and a build gate catches an invented term, not a valid term used wrongly. Independent behavioural validation — the live gates with their negative twins — is the only answer, and it should be named as load-bearing. A mandate that binds an intent digest but not the ontology version or the adapter that interprets it can be reinterpreted after approval; version binding in the mandate is designed and not shipped, and until it ships the compiler and the release process are security-critical. And across organizations the stack settles what "member" means within a domain layer; it does not settle it between two organizations that have each extended the domain differently, and the thesis's own rule — resolve it once, at the domain layer, with both meanings named — is a procedure, not yet a demonstrated practice.

What would prove it. Two independent teams integrate a new domain — a second faith tradition, a travel provider — against the stack and against a schema-and-adapter baseline, and the stack wins on time to first working mandate and on semantic defects found by the negative-twin gates. Until that is run, the ontology is the thesis's best-argued principle and its least-measured one.

9. Records belong to the owner

The claim: records that would be a bereavement if lost live in the owner's vault; an organization is a principal with a vault; a shared record has a side in each signer's vault; a relationship is a vault credential, a private-chain record where a gate must follow it, and on the public chain only a commitment.

For a person's own notes, messages and receipts, the vault model is right and the rebuild-or-bereavement test is the best sentence in the thesis. The reading gets harder for shared records — a conversation, an organizational grant, a joint plan — where subject, author, controller and permitted reader are different parties. The rule the thesis states is the right one: each principal's vault holds that principal's side; nothing is one party's alone if two signed it; a departing member keeps her receipts and not the organization's records. What is not yet built is the vault form of a relationship: today member-of, steward-of and chartered-under are records on the private estate chain, which is the right place for enforcement and the wrong place to stop. Their public projection — a set root, a membership proof, never the edge — is the piece on the critical path.

Portability is also more than bytes: usable keys, compatible schemas, preserved permissions, reconciliation of shared records, restorable task state. The substrate has the schema (every record is bound to a class by IRI) and the keys (per-record data keys released under a decrypt grant); it does not yet have a demonstrated move of a live person between two separately governed Homes.

10. Evidence travels with the owner

The claim: every protected act leaves a PROV receipt in the owner's vault, recomputable without the runtime; the run's bundle digest is anchored so completeness is provable.

A signed receipt proves that its signer said so; whether it proves the event depends on what the signer could observe. The substrate distinguishes, on the tool contract, what a step's evidence establishes — but the receipt itself does not yet say which of four things it attests: that the act was attempted, that the provider accepted it, that state changed, that the intended outcome occurred. It should. Selective disclosure is handled better than the thesis once claimed: a run's bundle digest is anchored on chain by the receipt anchor registry, so a verifier has an authoritative head and withholding is visible. And the behaviour definition is attested for identity — the right claim, since an attested binary proves which binary, not who may act — while environment attestation is admitted as one more evidence edge for the reader to appraise.

11. Trust is a graph

The claim: no score at the index, no ranked list beyond relevance, no index above the registries; signed edges returned separately; the reader computes.

The refusal of a score at the index is correct and the thesis's own logic proves it: publish the evidence, let the reader compute. A reader who computes a task-specific estimate from relevant edges and cost, and ranks a shortlist, is doing what the principle asks. The prohibition is on a mandatory global number from nobody's vantage point, and on an index ranking by anything but relevance.

Where a doubter is right: canonical identities establish continuity, not independence. An attacker can mint accounts, sign mutually reinforcing attestations and route circular payments through them. A graph resists this only where edges cost something — a payment that happened, an admission with a real bar, an attestation from a party with its own standing — and the substrate has the edge types without yet stating which edges count against collusion. The public evidence that unfiltered reputation averages fail at scale supports the refusal of a score at the index; it does not show that an account-based graph would resist the same attacker, and the thesis should not lean on it for more than it says.

The two places the thesis had to change to be true

Rotation. The contract kills grants on every credential retirement, by design, and the thesis once promised the opposite. The contract is right; the thesis now matches it; the Home has not built the rotation ceremony that makes the promise true in the product. Until it does, replacing a device is a silent revocation.

Commit. The thesis once said "again at commit" for every effect. That is literal for value, true at both ends for estate-ordered effects, and a declared window for external providers. The thesis now carries the three-way split. The receipt does not yet carry the adapter's observation that would let it claim the third case honestly.

Neither is a mechanism problem. Both are gaps between doctrine and product, and both are closed by work in the Home and the harness, not in the contracts.

What this means for focus

Focus. Person-centric domains with many small organizations and no incumbent intermediary — faith communities, mission work, mutual care — where the person is the paying principal and the competitor is a vertical system of record. Then travel at the long tail, as a bet with a stated test.

Do not pursue. Enterprise workflow inside a tenant. Card-cleared commerce as it stands. Arguing with identity providers about the ground they own.

Build next, in order of leverage. The Home's rotation ceremony and wire refresh. The invoker's observation on the receipt, and reconcile per effect kind. The public projection of a private grant — a revocation root and a non-revocation proof on public ground. Version binding in the mandate. A per-treasury aggregate enforcer. The vault form of a relationship. A consortium of validators for the estate chain.

Stop claiming. That a single-operator estate is decentralized. That the combination is necessary rather than advantageous. That any of the eleven principles is a law.

What would prove it

The same workflow — a person giving to a congregation, joining a mission team, being invited by a steward, paying a caterer — built three ways and run against the same failures. First on familiar parts: a provider per organization, specific approvals, resource-side checks, exportable signed receipts. Then with portable delegation and durable principal references added. Then the full substrate. The failures: revoke authority during execution; compromise a key that has issued child grants; retry an external act whose response was lost; change a schema after approval; mint colluding identities with plausible receipts; migrate a live agent without the former operator's cooperation.

Two results settle it in the substrate's favour. On the cases that cross an organization boundary — the invitation, the migration, the compromise with descendants — the familiar builds either cannot complete or complete by trusting an operator, and the substrate completes with a receipt a third party can check. And two separately governed organizations, on separately governed estates, finish that work and prefer it. Until the second exists, the substrate has demonstrated an integrated platform, and the thesis should be read as a well-argued bet.

To the doubter

You are right that most of this could be delivered incrementally on infrastructure that exists. You are right that a signature verified by a stranger does not make the stranger accept your authority over its resources. You are right that a digest binds an object and not the actions that satisfy it, that a private chain run by one operator is not neutral, that persistence is not independence, and that a product with one estate has proven a product and not a decentralization. The thesis is better for each of those, and this page exists so that none of them has to be said from outside.

What you may not yet have seen is the part that does not decompose: a grant issued by the person, enforced by code no vendor operates, receipted into a record the person carries — and a person who belongs to three organizations and is a customer of a fourth, whom no tenant can serve and no intermediary wants to. That is the claim worth defending, and the experiment above is how it gets defended.