THE SOURCE AND ITS RELATIONS
An invented teaching encounter
A teacher chooses a short excerpt for one lesson. Review continues, and there is a duty to teach it within that scope.
A relation changes. What must continue?
What must continue?
Follow an invented language program from proposal to permission. Then change one thing at a time and see what is still permitted, and what is still owed.
Preparing the invented cases…
Using this with the essay
Each line starts with a claim from the essay. Its links open the matching case at the right step, with any earlier actions cleared.
- The three outcomes of an assessment. Machine-enforceable: one approved file, one public deposit · Hybrid: the language program · Non-digitizable: the proposed catalog is never made
- A partner archive demands fresh approval for every lesson. The governing process can reject the archive while the program keeps teaching. The partner archive
- A correctly working control can still stop authorized teaching. The return falls due without evidence · The required decision is unavailable
- A withheld decision is neither permission nor a community refusal. The required decision is withheld
- The declared remainder binds without another consultation. Why the language program needs no approval for each lesson
- Non-disclosure of existence, and what the model cannot show about response timing. No disclosure of existence · Two outside queries, one answer
- Receivers may neither loosen nor tighten the conditions on their own. A receiver loosens · A partner tightens · The process that set the terms revises them
- A format can work exactly as approved and still teach the wrong thing. The governing process then replaces its decision (supersession). The approved format answers · The determination is superseded
- A neighboring Nation's contest is not an outsider's claim. A neighboring Nation's contest
Key terms, in plain language
- Persistence conditions
- The relations through which knowledge stays itself as it moves and changes form, such as who may teach it, when, and for what. Communities define them for their own knowledge.
- Artifact problem
- A receiver treats a partial account as enough to speak for the relations behind it, or as permission to use it. The file can be accurate; the failure is in how it is used.
- Receiver
- Any institution or system that takes in a record and acts on it, such as an archive, a repository or a learning portal. The receiver has to show that it can honor the conditions.
- Relay
- A receiver's way of carrying a partial account faithfully. It says what the account leaves out and stays answerable to those relations.
- DVA
- Digitization Viability Assessment. A governing community asks whether one proposed making or use can uphold its persistence conditions, and the institution that wants to proceed has to show that it can.
- Hybrid governance
- One of the three outcomes of an assessment. Technical checks cover part of the requirements. Community judgment at the points the determination names, or the institution's own enforceable undertakings, cover the rest.
- Warrant
- A signed record of one bounded decision: what is allowed, required or forbidden, for whom and until when. The signature shows who signed, not that the process was legitimate.
- Declared remainder
- The part of a warrant that marks obligations that bind even though no rule a gate can check encodes them. It can name what the receiver has undertaken, without the protected reasons for it, and it does not by itself require another consultation.
- Originating process
- The governing process that made the original determination. Only it can authorize a change to the conditions that travel with a warrant.
- Gate
- The check that runs before each action. It looks at the warrant, the exact scope, any dispute and any duty that has come due, then allows or withholds that one action.
- Grant
- A one-time permission for one exact action. The cases use both names. When it expires, the obligations behind it continue.
- Contested status
- An interim hold that a recognized process places on a disputed action, such as publication, while other duties like teaching and return continue. Time passing never turns a contest into consent.
- NDE
- Non-disclosure of existence. Shared systems hold no trace that the matter exists, not even a count; a community's own internal note is a separate choice.
- Affirmative obligation
- Something that must be done, such as teaching or returning a copy. Extra restriction can block it. The undertaking names the remedy if it falls due unmet.
- Return
- Giving back what a use owes the community, such as copies, reports or benefits. Like teaching, it is a duty that extra restriction can block.
This is version 2026-09-30.1 of the learning model. It follows the revised essay. To cite this version, use its frozen copy at /sra/v/2026-09-30.1/, which will not change. The earlier version, 2026-09-12.1, is still available at /sra/v/2026-09-12.1/. The March 2026 preprint linked above is an earlier release. Its “strengthen-only” transport rule has since been revised: receivers may now neither loosen nor tighten the conditions without the originating process's authorization. No private manuscript or real governing record is included here.
Inspect the parts one at a time
Each tab shows one mechanism with invented data. For a connected story, follow a case instead.
Signing key status
Creating a temporary signing key…
A true record, the wrong use
The artifact problem
A receiver produces an artifact when it treats a partial account as enough to speak for the relations behind it, or as permission to use it on terms those relations do not allow. The essay names four mechanisms of this failure and one consequence downstream. Choose an example and reveal the author's analysis.
WHAT THE RECEIVER HOLDS
The same short excerpt
A partial account carried as a relay. The receiver says what it leaves out and keeps the governing conditions in force.
Rule for this site: never enter or embed real protected information anywhere here.
Before anything is made
Digitization Viability Assessment
DVA judges one proposed digitization, not a kind of knowledge. This worksheet shows how a signed determination is issued, using invented entries. It gives no one authority. For a connected example, choose Follow a case.
This worksheet organizes what to consider. It does not decide. Viability is a governance determination, not the result of a calculation.
Carrying a decision
Signing and checking a warrant
A warrant is a signed record of one bounded determination. It carries only what can travel safely. It does not permit an action by itself: a short-lived grant does that, one action at a time.
The keys are created in this page and disappear when you leave. They show how signing and checking work. A real deployment needs keys held under community control in dedicated key hardware (a hardware security module or key-management service).
A signature shows who signed these bytes. It does not show that the governing process was legitimate or that the claims are true.
Inspect the signing key
- Algorithm used
- Creating…
- Issuer (an opaque identifier)
- Creating…
- Public-key fingerprint
- Creating…
Inspect or export the signed warrant
In plain terms: this is the warrant exactly as signed, first as readable JSON, then as the canonical bytes the signature covers.
What the warrant says (JSON)
The exact bytes that were signed (RFC 8785)
Signature
What does not travel
- No names of elders, keepers, witnesses or people who disagreed, and no one's protected standing.
- No full DVA record, approval history, record of disagreement or protected reason.
- The declared remainder says whether obligations remain that no rule encodes, and whether a community decision is required for each use. It can also name, in a few plain statements, what the receiver has undertaken. It never carries the protected reasons.
Before each action
The gate checks one action
The gate walks through the checks an enforcing system would run before one action. The checks on signatures, structure, dates, scope, policy, duties and grants are real code. Steps that would need real infrastructure are stand-ins, and they are labeled. Nothing here enforces anything outside this page.
Invented scenarios
SELECTED SCENARIO
Loading an invented scenario…
Written to show:
Model clock:
Exact model time
Inspect the twelve checks
In plain terms: each of the gate's twelve checks in order, with its exact message. Stand-in steps are marked.
One-time permission (a grant)
In a real system, a grant would be tied to the one party allowed to use it (for example with mTLS or DPoP), and using it would release the content in one step that cannot be interrupted. That needs a real service. This model shows the grant's life cycle and its scope checks.
When the gate withholds an action, nothing is published. Gate decisions, public statements, restricted notes, contests and DVA determinations are different kinds of records, kept in separate stores in memory.
Constraint-preserving transport
Passing it on without changing the terms
More restrictive is not always more faithful. A receiver may neither loosen nor tighten the conditions without a signed, versioned change from the originating process. Tightening can block duties the community requires, such as teaching, return, circulation or renewal through use.
What the comparison looks at
- Permissions
- Prohibitions
- Duties (affirmative obligations)
- Time limits
- Who may receive it
- Rules for derivatives
- Retention and deletion
Inspect the full conditions on both sides
In plain terms: the conditions the source requires, beside the conditions this receiver says it accepts.
The source's conditions (JSON)
What the receiver accepts (JSON)
If the result cannot be determined, nothing is released. An ordinary safeguard such as encryption at rest passes only when it changes no permission and blocks no duty.
Who gets to know
Refusal without an extraction map
A record of refusals can turn into a map of what to go after, so each kind of visibility is its own decision. A public refusal is a statement the community chooses to make. A restricted note belongs in a separate store the community controls. Non-disclosure of existence (NDE) allows no shared trace of the matter at all, though a community may keep its own internal note. The NDE example below uses one simple convention: an empty shared store.
Two outside queries, one answer
An outsider asks about two identifiers: one the community holds under NDE, and one that never existed. Both queries go through the same lookup, and both get the same status, body and length.
Matching responses are not the whole job. In a real deployment, timing, caching, rate limits, logs and backups must also be tested by someone trying to tell the two apart; code alone cannot show this. This model shows the response shape only.
Public refusal statements 0
No public statement has been written.
Restricted governance notes 0
No restricted note has been written.
This separate structure in browser memory shows only that the records are kept apart. It is not access control or secure storage.
Threat model
What the model assumes and what it cannot prove
What could be exposed: content, the fact that something exists, protected standing, who disagreed with whom, warrants, revocation histories, query patterns, logs, backups and derivatives. Who might expose it: curious institutions, bad-faith receivers, stolen keys, insiders, coercive contracts, court orders and outside attackers.
Official path
A deployment can control its own release path, turn away receivers that cannot honor the conditions, keep shared records to a minimum, and make any change to a policy visible. It cannot control people who already hold the plaintext.
Protected standing
Ceremonial, kinship and other protected standing stays inside the governing process. The outside system receives a bounded decision, never a lasting description of who holds standing. Even so, bounded grants repeated for the same person can map standing that no single record names.
NDE
No shared entry about the matter is created. Whether timing, caching, rate limits, traffic, backups, endpoints and staff behave the same for both kinds of query still has to be tested in production.
Capture
A valid signature cannot make a captured process legitimate. Software can do exactly what it was told while amplifying a governing process that shut people out or was coerced.
Signatures and checks have limits. A signature exposes any change to a policy, and evidence about a receiver's setup can be checked, but neither guarantees that the receiver will obey. What this architecture offers is an official path and help detecting and attributing violations, alongside the receiver's own undertakings. It cannot make a relation safe by turning it into code.
Modeled versus real
The boundary is part of the model
The browser shows how the decisions work. It does not host, enforce, or protect real resources.
Demonstrated for real
- Key creation with Web Crypto, canonical signing, and signature checks at the gate.
- Random identifiers from a secure generator, strict checks on dates and structure, and a default of holding the action whenever something is missing or malformed.
- Receiver compatibility checks, disputes that hold only their own scope, due-date checks on duties, and file-digest checks.
- Short-lived, exact-scope, signed grants that can be used once.
- No shared record of an NDE matter, and outside responses that match in status, body and length (timing is not tested).
Modeled and labeled
- Who is asking: the model assumes an authenticated, invented person. No identity provider is contacted.
- Community decisions: a labeled, invented answer, used only when the determination requires one. No real service is contacted.
- Separate public and restricted stores: separate in memory, not isolated the way production systems are.
- The NDE outside query: response shape only, not timing.
Not attempted
- Hardware key custody (a hardware security module or key-management service), key rotation, or response to a stolen key.
- Tying grants to their holders in transit (mTLS or DPoP), or releasing content in one step that cannot be interrupted.
- Separate production databases, service accounts, keys and backups.
- Statistical testing of NDE timing, receivers that exchange decisions with one another, or enforced deletion.
- Checking that the governing process has currently assessed a receiver's storage, audit, deletion and return arrangements.
- Deciding whether a claim from a Nation missing from the configured list needs adjudication. That belongs to the recognized process.
- Storing any real protected data.
Relation before data
What this learning model is for
DVA asks a prior question, before any access control: can this proposed making or use uphold the conditions under which the knowledge stays itself? SRA carries the answer into the systems that would act on it. This model lets you watch that happen with invented cases.
A dam is not a false record of a river. It is a physical intervention that can destroy the conditions a river's life depends on. The artifact problem lives in the paperwork: accounts that render river as water inventory, bottomland as acreage and relation as title, then pass those accounts off as a full description of what is there.
The same care applies to more-than-human relations. A human steward cannot confirm a beaver's or a stream's consent. A warrant here can only be a bounded human undertaking about human action, grounded in sustained witnessing, recognized within the community, and open to correction by the relations it claims to have witnessed. It can record observations, sources, limits and precautions. It cannot exhaust the stream's authority.
A few rules run through every case. DVA is a governance determination, made by a governing process and never computed. NDE means nothing about the matter is written anywhere shared: no entry, identifier, reason or revealing count. Transport is constraint-preserving: receivers may neither loosen nor tighten the conditions without the originating process's authorization. A warrant carries one bounded decision; a grant permits one action. When the gate withholds an action, it publishes nothing.
This browser opens written cases and executable checks to inspection. It is not a proof. A technically successful path does not validate the theory or show that a governing process is legitimate.
What changed in version 2026-09-30.1
Changes since version 2026-09-12.1, made so the model follows the revised essay:
- The gate no longer asks for fresh permission just because some obligation is unencoded. It asks only when the determination requires renewed judgment, and the declared remainder still binds.
- Outcome names now match the essay: digitizable under machine-enforceable requirements, digitizable through hybrid governance, and non-digitizable under the proposed conditions.
- The teaching case is now a thirty-day language program. Its hybrid determination rests on the program's undertaking, with no approval needed for each lesson.
- Two new cases: one approved file in one public deposit, and a teaching archive whose answer follows the approved format exactly, until review finds it turns a recollection into a rule and the determination is replaced.
- New comparisons: a partner archive that demands fresh approval for every lesson, a receiver that drops the no-commercial-use rule, a return that falls due without evidence, a warrant revoked before its permission is used, a lapsed deposit authorization, and a neighboring Nation's contest.
- Remedies for a missed duty now come from the undertaking. The gate pauses access only when the undertaking names a pause; otherwise it lets the action go ahead and reports that the governing process must be told. The declared remainder can also name what the receiver has undertaken.
- The gate now checks a file's digest, shows withheld and unavailable decisions as what they are, and names the first check that stopped an action. Both NDE outside queries run through the same lookup.
- The artifact panel now follows the essay: four mechanisms, including context stripping, and one downstream consequence, in place of five dimensions.
- Private signing keys can no longer be exported from the page, and links can open one named comparison. Each released version stays at its own address under /sra/v/.
- The text was rewritten in plainer language, with a longer glossary and a map from the essay's claims to the cases.
Darren Edward Lone Fight
MHA Nation · Dickinson College · Center for the Futures of Native Peoples
This interactive companion to Darren Edward Lone Fight’s essay Persistence Conditions follows invented cases and lets you inspect the decision logic.