THE SOURCE AND ITS RELATIONS
An invented teaching encounter
A teacher chooses a short excerpt for one lesson. Review continues, and there is a duty to teach it within that scope.
A relation changes. What must continue?
What must continue?
Follow an invented language program from proposal to permission. Then change one thing at a time and see what is still permitted, and what is still owed. Each case is mapped to the essay's claims in Using this with the essay, and the Reference view inspects the parts one at a time.
Preparing the invented cases…
Using this with the essay
Each line starts with a claim from the essay. Its links open the matching case at the right step, with any earlier actions cleared.
- The three outcomes of an assessment. Machine-enforceable: one approved file, one public deposit · Hybrid: the language program · Non-digitizable: the proposed catalog is never made
- A partner archive requires fresh approval for every lesson. The governing process can turn the archive away, and the program's own teaching goes on. The partner archive
- A correctly working control can still stop authorized teaching. The return falls due without evidence · The required decision is unavailable
- A withheld decision is neither permission nor a community refusal. The required decision is withheld
- The declared remainder binds without another consultation. Why the language program needs no approval for each lesson
- Non-disclosure of existence, and what the model cannot show about response timing. No disclosure of existence · Two outside queries, one answer
- Receivers may neither loosen nor tighten the conditions on their own. A receiver loosens · A partner tightens · The process that set the terms revises them
- A format can work exactly as approved and still teach the wrong thing. The governing process then replaces its decision (supersession). The approved format answers · The determination is superseded
- A neighboring Nation's contest is not an outsider's claim. A neighboring Nation's contest
Key terms, in plain language
- Persistence conditions
- The relations through which knowledge stays itself as it moves and changes form, such as who may teach it, when, and for what. Communities define them for their own knowledge.
- Artifact problem
- A receiver treats a partial account as enough to speak for the relations behind it, or as permission to use it. The file can be accurate; the failure is in how it is used.
- Receiver
- Any institution or system that takes in a record and acts on it, such as an archive, a repository or a learning portal. The receiver has to show that it can honor the conditions.
- Relay
- A receiver's way of carrying a partial account faithfully. It says what the account leaves out and stays answerable to those relations.
- DVA
- Digitization Viability Assessment. A governing community asks whether one proposed making or use can uphold its persistence conditions, and the institution that wants to proceed has to show that it can.
- Determination
- The governing process's answer to one proposal, operation by operation: one of the three outcomes an assessment can reach. The process writes it and signs it, and it stays open to review and replacement. The software never computes it.
- Hybrid governance
- One of the three outcomes of an assessment. Technical checks cover part of the requirements. Community judgment at the points the determination names, or the institution's own enforceable undertakings, cover the rest. The undertaking says what follows a breach; a remedy is not what makes the arrangement acceptable.
- Warrant
- A signed record of one bounded decision: what is allowed, required or forbidden, for whom and until when. It can also name the governing process it recognizes, when the decision comes back for review, and how it can be replaced. The signature shows who signed, not that the process was legitimate.
- Declared remainder
- The part of a warrant that marks obligations that bind even though no rule a gate can check encodes them. It can name what the receiver has undertaken, without the protected reasons for it, and it does not by itself require another consultation.
- Undertaking
- What a receiver has declared it will do, accepted by the governing process: report misuse and apply agreed remedies, for example, or account for where copies remain. The declared remainder can carry it, without the protected reasons. It also names what follows when a duty falls due without evidence, so the remedy comes from the undertaking, not from the gate.
- Governing process
- The community body that makes a determination under the community's own law and practice: a council, a society, a family, keepers or elders, as the community recognizes. The software can record its decision. It cannot decide who the process is.
- Originating process
- The governing process that made the original determination. Only it can authorize a change to the conditions that travel with a warrant.
- Gate
- The check that runs before each action. It looks at the warrant, the exact scope, any dispute and any duty that has come due, then allows or withholds that one action. Where keeping a condition takes acts no system can perform or judge, the gate leaves that duty to the receiver's undertaking and the governing process.
- Community decision service
- The site's term for the community-side answer the gate asks for when a determination says a use must return to community judgment each time. It gives a bounded yes or no for one action without disclosing anyone's standing. The model uses a labeled, invented answer; in a real deployment a service the community controls, such as a community-run credentialing service, would supply it.
- Grant
- A one-time permission for one exact action. The cases use both names. When it expires, the obligations behind it continue.
- Contested status
- An interim hold that a recognized process places on a disputed action, such as publication, while other duties like teaching and return continue. Time passing never turns a contest into consent.
- Supersession
- The governing process replacing its own determination with a new one. The old warrant stops working, and anything issued under it has to pass the new terms. Only a new decision from the governing process can do this; time passing cannot, and neither can a receiver's own judgment.
- NDE
- Non-disclosure of existence. Shared systems hold no trace that the matter exists, not even a count; a community's own internal note is a separate choice.
- Disclosure posture
- Who may learn of a determination. The worksheet offers three summaries: a public determination, one held by the community, and no disclosure of existence (see NDE). A real process decides this in its own terms, down to whether anyone outside may learn that the matter exists.
- Affirmative obligation
- Something that must be done, such as teaching or returning a copy. Extra restriction can block it. The undertaking names the remedy if it falls due unmet.
- Return
- Giving back what a use owes the community, such as copies, reports or benefits. Like teaching, it is a duty that extra restriction can block.
This is version 2026-10-18.1 of the learning model. It follows the author's current revision of the essay, which is not yet published; the March 2026 preprint (earlier version) remains the published text. To cite this version, use its frozen copy at /sra/v/2026-10-18.1/, which will not change. The earlier versions are still available at /sra/v/2026-10-17.2/, /sra/v/2026-10-17.1/, /sra/v/2026-10-16.1/, /sra/v/2026-10-15.1/, /sra/v/2026-09-30.1/ and /sra/v/2026-09-12.1/. The preprint's “strengthen-only” transport rule has since been revised: receivers may now neither loosen nor tighten the conditions without the originating process's authorization. No private manuscript or real governing record is included here.
Inspect the parts one at a time
Each tab shows one mechanism with invented data. For a connected story, follow a case instead.
Signing key status
Creating a temporary signing key…
A true record, the wrong use
The artifact problem
A receiver produces an artifact when it treats a partial account as enough to speak for the relations behind it, or as permission to use it on terms those relations do not allow. The essay names four mechanisms of this failure and one consequence downstream. Choose an example and reveal the author's analysis.
WHAT THE RECEIVER HOLDS
The same short excerpt
A partial account carried as a relay. The receiver says what it leaves out and keeps the governing conditions in force.
Rule for this site: never enter or embed real protected information anywhere here.
Before anything is made
Digitization Viability Assessment
DVA judges one proposed digitization, not a kind of knowledge. This worksheet shows how a signed determination is issued, using invented entries. It gives no one authority. For a connected example, choose Follow a case.
This worksheet organizes what to consider. It does not decide. Viability is a governance determination, not the result of a calculation.
Carrying a decision
Signing and checking a warrant
A warrant is a signed record of one bounded determination. It carries only what can travel safely. It does not permit an action by itself: a short-lived grant does that, one action at a time.
The keys are created in this page and disappear when you leave. They show how signing and checking work. A real deployment needs keys held under community control in dedicated key hardware (a hardware security module or key-management service).
A signature shows who signed these bytes. It does not show that the governing process was legitimate or that the claims are true.
Inspect the signing key
- Algorithm used
- Creating…
- Issuer (an opaque identifier)
- Creating…
- Public-key fingerprint
- Creating…
Inspect or export the signed warrant
In plain terms: this is the warrant exactly as signed, first as readable JSON, then as the canonical bytes the signature covers.
What the warrant says (JSON)
The exact bytes that were signed (RFC 8785)
Signature
What does not travel
- No names of elders, keepers, witnesses or people who disagreed, and no one's protected standing.
- No full DVA record, approval history, record of disagreement or protected reason.
- The declared remainder says whether obligations remain that no rule encodes, and whether a community decision is required for each use. It can also name, in a few plain statements, what the receiver has undertaken. It never carries the protected reasons.
Before each action
The gate checks one action
The gate walks through the checks an enforcing system would run before one action. The checks on signatures, structure, dates, scope, policy, duties and grants are real code. Steps that would need real infrastructure are stand-ins, and they are labeled. Nothing here enforces anything outside this page.
Invented scenarios
SELECTED SCENARIO
Loading an invented scenario…
Written to show:
Model clock:
Exact model time
Inspect the twelve checks
In plain terms: each of the gate's twelve checks in order, with its exact message. Stand-in steps are marked.
One-time permission (a grant)
In a real system, a grant would be tied to the one party allowed to use it (for example with mTLS or DPoP), and using it would release the content in one step that cannot be interrupted. That needs a real service. This model shows the grant's life cycle and its scope checks.
When the gate withholds an action, nothing is published. Gate decisions, public statements, restricted notes, contests and DVA determinations are different kinds of records, kept in separate stores in memory.
Constraint-preserving transport
Passing it on without changing the terms
More restrictive is not always more faithful. A receiver may neither loosen nor tighten the conditions without a signed, versioned change from the originating process. Tightening can block duties the community requires, such as teaching, return, circulation or renewal through use.
What the comparison looks at
- Permissions
- Prohibitions
- Duties (affirmative obligations)
- Time limits
- Who may receive it
- Rules for derivatives
- Retention and deletion
Inspect the full conditions on both sides
In plain terms: the conditions the source requires, beside the conditions this receiver says it accepts.
The source's conditions (JSON)
What the receiver accepts (JSON)
If the result cannot be determined, nothing is released. An ordinary safeguard such as encryption at rest passes only when it changes no permission and blocks no duty.
Who gets to know
Refusal without an extraction map
A record of refusals can turn into a map of what to go after, so each kind of visibility is its own decision. A public refusal is a statement the community chooses to make. A restricted note belongs in a separate store the community controls. Non-disclosure of existence (NDE) allows no shared trace of the matter at all, though a community may keep its own internal note. The NDE example below uses one simple convention: an empty shared store.
Questions a governing process answers, and this model does not
- Who has the standing to say no, for whom are they saying it, and who witnesses the decision?
- Is a refusal durable or provisional, and who may overturn it, on what showing and under what process?
- Who bears the cost of refusing, and of the assessment itself?
A finding that a proposal is not viable, a contest, and a gate that withholds an action each leave nothing shared behind on their own. A reply that confirms nothing says nothing about whether the matter exists. Saying no in public is a separate choice the community makes.
Two outside queries, one answer
An outsider asks about two identifiers: one the community holds under NDE, and one that never existed. Both queries go through the same lookup, and both get the same status, body and length.
Matching responses are not the whole job. In a real deployment, timing, caching, rate limits, logs and backups must also be tested by someone trying to tell the two apart; code alone cannot show this. This model shows the response shape only.
Public refusal statements 0
No public statement has been written.
Restricted governance notes 0
No restricted note has been written.
This separate structure in browser memory shows only that the records are kept apart. It is not access control or secure storage.
Threat model
What the model assumes and what it cannot prove
What could be exposed: content, the fact that something exists, protected standing, who disagreed with whom, warrants, revocation histories, query patterns, logs, backups and derivatives. Who might expose it: curious institutions, bad-faith receivers, stolen keys, insiders, coercive contracts, court orders and outside attackers.
Official path
A deployment can control its own release path, turn away receivers that cannot honor the conditions, keep shared records to a minimum, and make any change to a policy visible. It cannot control people who already hold the plaintext.
Protected standing
Ceremonial, kinship and other protected standing stays inside the governing process. The outside system receives a bounded decision, never a lasting description of who holds standing. Even so, bounded grants repeated for the same person can map standing that no single record names.
NDE
No shared entry about the matter is created. Whether timing, caching, rate limits, traffic, backups, endpoints and staff behave the same for both kinds of query still has to be tested in production.
Captured process
A valid signature cannot make a captured process legitimate. Software can do exactly what it was told while amplifying a governing process that shut people out or was coerced.
Signatures and checks have limits. A signature exposes any change to a policy, and evidence about a receiver's setup can be checked, but neither guarantees that the receiver will obey. What this architecture offers is an official path and help detecting and attributing violations, alongside the receiver's own undertakings. It cannot make a relation safe by turning it into code.
Modeled versus real
What the model does for real and what it does not
The browser shows how the decisions work. It does not host, enforce, or protect real resources.
Demonstrated for real
- Key creation with Web Crypto, canonical signing, and signature checks at the gate.
- Random identifiers from a secure generator, strict checks on dates and structure, and a default of holding the action whenever something is missing or malformed.
- Receiver compatibility checks, disputes that hold only their own scope, due-date checks on duties, and file-digest checks.
- Short-lived, exact-scope, signed grants that can be used once.
- No shared record of an NDE matter, and outside responses that match in status, body and length (timing is not tested).
Modeled and labeled
- Who is asking: the model assumes an authenticated, invented person. No identity provider is contacted.
- Community decisions: a labeled, invented answer, used only when the determination requires one. No real service is contacted.
- Separate public and restricted stores: separate in memory, not isolated the way production systems are.
- The NDE outside query: response shape only, not timing.
Not attempted
- Hardware key custody (a hardware security module or key-management service), key rotation, or response to a stolen key.
- Tying grants to their holders in transit (mTLS or DPoP), or releasing content in one step that cannot be interrupted.
- Separate production databases, service accounts, keys and backups.
- Statistical testing of NDE timing, receivers that exchange decisions with one another, or enforced deletion.
- Checking that the governing process has currently assessed a receiver's storage, audit, deletion and return arrangements.
- Deciding whether a claim from a Nation missing from the configured list needs adjudication. That belongs to the recognized process.
- Storing any real protected data.
Relation before data
What this learning model is for
DVA asks a prior question, before any access control: can this proposed making or use uphold the conditions under which the knowledge stays itself? SRA carries the answer into the systems that would act on it. This model lets you watch that happen with invented cases.
A dam does not misdescribe a river. It is a physical intervention, and it can end the conditions a river's life depends on. The artifact problem lives in the paperwork: accounts in which the river becomes an inventory of water, the bottomland a number of acres and the relation a title, passed off together as a full description of what is there.
The same care applies to more-than-human relations. A human steward cannot confirm a beaver's or a stream's consent. A warrant here can only be a bounded human undertaking about human action, grounded in sustained witnessing, recognized within the community, and open to correction by the relations it claims to have witnessed. It can record observations, sources, limits and precautions. It cannot exhaust the stream's authority.
A few rules run through every case. DVA is a governance determination, made by a governing process and never computed. NDE means nothing about the matter is written anywhere shared: no entry, identifier, reason or revealing count. Transport is constraint-preserving: receivers may neither loosen nor tighten the conditions without the originating process's authorization. A warrant carries one bounded decision; a grant permits one action. When the gate withholds an action, it publishes nothing.
This browser opens written cases and executable checks to inspection. It is not a proof. A technically successful path does not validate the theory or show that a governing process is legitimate.
Darren Edward Lone Fight
MHA Nation · Dickinson College · Founding director, Jim Thorpe Center for the Futures of Native Peoples
This interactive companion to Darren Edward Lone Fight’s essay Persistence Conditions follows invented cases and lets you inspect the decision logic.