SOURCE RELATION
Three Affiliated Tribes of the Mandan, Hidatsa, and Arikara Nation
A political reality forged through confederation, shared governance, pressure, and endurance.
Diagnosis
The artifact problem
A partial representation becomes artifact-producing when it circulates as adequate to the thing it names while the remainder it cannot carry is treated as absent rather than still governing. The first four dimensions identify mechanisms of that transformation; the fifth identifies its recurrent downstream signature.
SYSTEM OUTPUT
Hidatsa
A true constituent affiliation forced to impersonate the whole the field claims to record.
Hard rule: No real protected information may be entered or embedded anywhere in this site.
Prerequisite governance protocol
Digitization Viability Assessment
DVA governs a proposed digitization, not an intrinsic class of things. The governing process scopes the proposal, identifies material persistence conditions, enters a determination for each proposed operation, and issues a signed record.
This worksheet organizes considerations. It does not decide. Viability is a governance determination, not an arithmetic outcome.
Bounded transmission
Warrant signature demonstration
A warrant is a signed, versioned transmission of a bounded governance determination. It carries only what must travel safely. A short-lived capability, not the warrant, grants one exact action.
Keys are generated in-page and ephemeral, demonstrating the signature/verification mechanism. Production requires key custody in an HSM/KMS under community control.
A signature proves who signed bytes; it does not prove that the governance process was legitimate or that the claims are true.
Immutable outward payload
RFC 8785 canonical form
Signature
What does not travel
- No names of elders, keepers, witnesses, dissenters, or protected standing.
- No full DVA record, approval history, disagreement topology, or protected reason.
- The remainder is booleans only: unencoded conditions remain; online community decision required.
Decision procedure
Gate evaluation
The gate illustrates the decision an enforcement system would apply. It performs real signature, schema, date, scope, policy, obligation, and capability checks; infrastructure-dependent steps are stubbed and labeled.
Synthetic scenarios
SELECTED FIXTURE
Expected:
Short-lived capability
Sender-constraining (mTLS/DPoP) and atomic key release require a real service; this model demonstrates the token lifecycle and scope-checking.
A gate DENY publishes nothing. Gate decisions, public statements, restricted notes, contests, and DVA determinations are distinct object types in distinct in-memory stores.
Constraint-preserving movement
No unauthorized transformation
Fidelity is not a total ordering. A receiver may not weaken or tighten community-defined policy without a trusted, versioned translation. Tightening can defeat affirmative duties such as teaching, return, circulation, or descendant access.
Permissions
Prohibitions
Affirmative obligations
Temporal conditions
Audience boundaries
Derivative rules
Retention and deletion
Source policy
Receiver-accepted policy
INDETERMINATE never releases the resource. An ordinary safeguard such as encryption at rest is compatible only when it alters no permission and frustrates no obligation.
Visibility is a governance determination
Refusal without an extraction map
A public refusal is a deliberately authored political statement. A restricted note belongs in a separate community-controlled store. Non-disclosure-of-existence writes no resource-specific entry to either structure.
External-query response-shape demonstration
For an unauthorized external query, the synthetic NDE-protected matter and a nonexistent matter return the same status, body, and byte length.
In a real deployment, equivalence across timing, caching, rate-limiting, logs, and backups must be measured under adversarial testing; it cannot be inferred from code. This model demonstrates the response shape only.
PublicRefusalStatement store 0
No public statement has been authored.
RestrictedGovernanceNote store 0
No restricted note has been authored.
This separate browser-memory structure demonstrates separation only. It is not access control or secure storage.
Threat model
What the model assumes and what it cannot prove
The assets at risk include content, existence, protected standing, disagreement topology, warrants, revocation histories, query patterns, logs, backups, and derivatives. Adversaries include curious institutions, malicious receivers, compromised keys, insiders, coercive contracts, legal compulsion, and external attackers.
Official path
A deployment may constrain its official release path, reject unsupported receivers, minimize shared records, and make policy alteration evident. It cannot control every person who has already received plaintext.
Protected standing
Ceremonial, kinship, and other sacred statuses remain inside the governance boundary. The external system receives a bounded decision, not a durable description of who holds standing.
NDE
No resource-specific shared entry is created. Timing, cache, rate-limit, traffic, backup, endpoint, and human-disclosure equivalence remain production testing obligations.
Capture
A valid signature cannot make a captured process legitimate. Software may behave exactly as specified while amplifying an exclusionary or coerced governance process.
The claim is not computational undeniability. SRA can make violations harder through an official path, easier to detect and attribute, and less institutionally deniable under stated assumptions. It cannot make relation invulnerable by turning it into code.
Modeled versus real
The boundary is part of the model
The browser demonstrates mechanism and decision shape. It does not host, enforce, or protect real resources.
Demonstrated for real
- Web Crypto key generation, canonical signing, and gate verification.
- CSPRNG identifiers, strict date and schema validation, and fail-closed decisions.
- Constraint-preserving compatibility, contest scoping, and obligation due-date evidence checks.
- Short-lived, exact-scope, signed, single-use capability lifecycle.
- NDE non-recording in shared registry structures and identical response shape.
Modeled and labeled
- Principal authentication: assume an authenticated synthetic principal; no identity provider is contacted.
- Community-decision-service consult: a labeled synthetic response; no real service is contacted.
- Separated public and restricted stores: distinct in memory, not production isolation.
- NDE external query: response shape only, not timing-channel equivalence.
Not attempted
- HSM/KMS key custody, rotation, or compromise response.
- mTLS/DPoP sender-constrained transport or atomic key release.
- Separated production databases, service accounts, keys, and backups.
- Statistical NDE timing-equivalence testing, receiver federation, or deletion enforcement.
- Any storage of real protected data.
Relation before data
What this reference model is for
SRA asks a prior question before access control begins: can this proposed digital relation maintain the conditions under which the pattern remains what it claims to be?
A dam is not a false record of a river. It is a material intervention capable of destroying a riverine pattern's persistence conditions. Artifact production occurs in the classificatory and administrative apparatus that renders river as water inventory, bottomland as acreage, and relation as title, then circulates those outputs as adequate accounts of what is there.
The same discipline governs the more-than-human case. A human steward does not authenticate beaver or stream consent. A warrant can be a bounded human undertaking about human action, based on sustained ecological witnessing and collective recognition, while remaining corrigible by the relations it claims to have witnessed. It can encode observations, provenance, limits, and precaution. It cannot exhaust the stream's authority.
DVA is a governance determination. NDE is non-recording at the shared boundary. Transport is constraint-preserving: receivers may not weaken or tighten community-defined conditions without authorization. A warrant transmits a bounded decision; a capability grants one action. A gate DENY creates no public statement.
The mathematics in the paper may describe a proposed invariant. This browser does not establish that invariant or validate the theory. It makes the distinctions inspectable and shows that they can be connected as executable decision logic without pretending that a partial relay contains the thing.
Darren Edward Lone Fight
MHA Nation · Dickinson College · Center for the Futures of Native Peoples
The preprint is entirely the author's work. This browser model was built with AI assistance and revised here to make its demonstrated mechanisms and limits match the paper's argument.