custody was planned as one contract a safeguarded project satisfies: an agent boundary, a signed history, a private overlay, a verified encrypted copy, cut down to what its two implementations already hold (formalization-vs-adoption). Measured on 2026-10-12, isolation and cloudatasave held no axis in common: isolation holds the agent boundary, observed by a check, and a pushed overlay; its own history is unsigned. cloudatasave was not a git repository, and its copy exists only in its policy schema — the modes that would run it return before running (src/main.rs). The intersection was empty, and each project held a different axis.
The domain was planned as an authority in ontoref (code/domains/custody/). ontoref already resolves a second-level domain from a registered project that declares `domain_provides` in its manifest (adr-109, adr-117): `domain-root custody` answers the custody spine and the schema directory its `schema_path`.
ONE CONTRACT PER AXIS, NOT ONE PER PROJECT. code/schemas/custody.ncl states four axes — AgentBoundary, SignedHistory, PrivateOverlay, VerifiedCopy — and one Mechanism record for all of them. A bonded project declares, in .domains-ontoref/custody/ontology/declaration.ncl, the axes it `provides` and those it `claims`.
A MECHANISM IS 'Declared UNTIL A COMMAND OBSERVES IT. 'Enforced requires `observed_by`, a command run from the declaring project's root whose exit code witnesses the axis, and requires `side = 'Imposed`: only the OS, the forge or a credential refuses, so only they can be witnessed. An 'Oriented mechanism — configuration the agent may follow or ignore — is declared and never 'Enforced.
A CLAIM ON A BONDED PROJECT RESOLVES TO ITS PROVISION. A claim whose `by` names a bonded project must find that project's `provides` entry for the same axis; code/check.nu fails otherwise, and with --observe runs every 'Enforced witness.
THE DOMAIN IS PROVIDED BY THIS SPINE, REACHED BY BOND ONLY. The custody manifest declares `domain_provides` with `schema_path = "code/schemas"` and the four capabilities; there is no repo_kind activation. The provider cannot bond to its own domain — a governance bond from custody to custody is a cycle the DAG refuses — so it declares its own claims in .ontoref/ontology/custody-declaration.ncl, which code/check.nu reads beside the bonded projects.
The Declaration contract refuses 'Enforced on an 'Oriented mechanism and 'Enforced without observed_by, and accepts a well-formed declaration
Every bonded declaration exports against the schema and every claim on a bonded project resolves to that project's provision
The custody spine carries no bond carrier to its own domain
One contract per safeguarded project, cut to what both implementations hold
Rejected: Measured empty on 2026-10-12; the owner chose contracts per axis.
One contract per project with every axis required
Rejected: No project held all four; it would have formalized past adoption and made every declaration false.
The domain as an authority in ontoref/code/domains/custody/
Rejected: Splits the definition (ontoref) from the specifications (custody/code); a provided domain resolves for bonds and schemas without it.
The provider bonds to itself to be checked like the others
Rejected: `ontoref bond validate` refuses it: governance bonds form a cycle through [custody].