A safeguarded project is held to a contract, one axis at a time.

The contract

One record for every axis, on both sides of a bond

A project does not satisfy custody as a whole (ADR-001). A bonded project declares, in .domains-ontoref/custody/ontology/declaration.ncl, the axes it provides for others and the axes it relies on. Both use the same record, so a claim and the provision it relies on are read with one vocabulary:

• axis is one of four: AgentBoundary, SignedHistory, PrivateOverlay, VerifiedCopy.
• by names the project or tool that holds the axis.
• side is 'Imposed when the OS, the forge or a credential refuses, and 'Oriented when configuration guides an actor who may follow it or not.
• standing is 'Declared until a command observes the mechanism, and 'Enforced after. The contract refuses 'Enforced without observed_by, the command whose exit code witnesses it, and refuses it on an 'Oriented mechanism.

Four axes

Each axis is its own contract, held by its own implementation

No axis is required of every project. Cut to what its first two implementations both held, one project-wide contract was measured empty; per axis, each implementation is held to what it holds, and a gap shows as a 'Declared row instead of disappearing from the contract.

Principles

What the contract refuses

A project under custody

From bond to witness

1. Bond

   The project bonds to the custody domain in .domains-ontoref/custody/bonds.ncl. ontoref resolves the domain from the custody spine, which declares domain_provides with its schema path and its four capabilities: there is no authority entry in ontoref.

2. Declare

   It writes its declaration: the axes it provides and the axes it claims, each with its side and standing. A declaration is valid before its witness exists.

3. Check

   nu code/check.nu lists the bonded projects from ontoref, never from a list kept in custody, exports every declaration against the schema, resolves every claim to its provision, and fails a project whose jj stores hold a second workspace with no SignedHistory declared.

4. Observe

   With --observe, the check runs the witness of every 'Enforced mechanism from the declaring project's root. A non-zero exit breaks the check: it answers whether every enforced axis holds right now, across every bonded project.

On a host

A catalog of components, deployed without SSH

nu deploy.nu <components_dir> compares every component's installer with the host's declaration and exits 1 on a difference; with --apply it converges, dependencies first. The declarations use a provisioning workspace's format, so the same files serve provisioning once it can target the host.

Boundaries

What Custody is not

ontoref Gov

Seven projects, one domain: how a project governed by ontoref governs itself.

What it is

Gov is ontoref's own domain. It holds the arrangement — what a project's boundary declares, its members, which artefacts a consumer inherits — and the exercise — what work is committed and how an act is delivered. Its name is the root of governance, governability and government, and elects none of them.

Why

A decision, a boundary or a delivery that lives only in someone's memory binds no one. In Gov each one is a declaration a project can be held to, and what holds it is a mechanism, not a good intention.

What for

A project reaches Gov by bond, never by imposition, and takes only the parts it needs. Each of the seven carries one: the contract, the host boundary, the operations of work, the signature, the dossier, the observed session and the opening by name.

More about ontoref Gov →

Part of the same system