SOURCE RELATION
Three Affiliated Tribes of the Mandan, Hidatsa, and Arikara Nation
A political reality forged through confederation, shared governance, pressure, and endurance.
A relation changes. What must continue?
What must continue?
Follow a fictional teaching excerpt from proposal to permission. Then change its use. What remains permitted—and owed?
Each case has six stages. A shared case link opens the authored example afresh, without saved actions.
Preparing the fictional cases…
A few terms, in plain language
- Bounded relay
- A partial representation that stays answerable to the relations it cannot carry.
- Artifact production
- An encounter in which a representation stands in for its source while what it omits stops governing its use.
- DVA
- Digitization Viability Assessment: a governing process assesses this proposed transformation in this environment.
- Warrant
- A signed, limited record of a determination. Its signature does not prove the legitimacy of the process.
- Capability
- A short-lived grant for one exact action. A token's expiry is not the expiry of a relation.
- Relational remainder
- What still governs even though it is not encoded. Some actions require a further decision; others remain subject to continuing obligations.
- NDE
- Non-disclosure-of-existence: no resource-specific trace at the shared boundary. A community-held note is a separate choice.
- Affirmative obligation
- Something that must be done, such as teaching or return. Extra restriction can obstruct it.
This version develops alongside the September 12, 2026 working draft. The linked public preprint is a separate earlier release. No private manuscript or real governing record is included here.
Inspect the reference model
Inspect a mechanism below, or follow a connected case.
Ephemeral cryptographic key status
Generating ephemeral signing key...
Diagnosis
The artifact problem
A partial representation becomes artifact-producing when it circulates as adequate to the thing it names while the remainder it cannot carry is treated as absent rather than still governing. The first four dimensions identify mechanisms of that transformation; the fifth identifies its recurrent downstream signature.
SYSTEM OUTPUT
Hidatsa
A true constituent affiliation forced to impersonate the whole the field claims to record.
Hard rule: No real protected information may be entered or embedded anywhere in this site.
Prerequisite governance protocol
Digitization Viability Assessment
DVA governs a proposed digitization, not an intrinsic class of things. This advanced worksheet demonstrates issuance mechanics using fictional entries. It does not confer authority. For a connected example, choose Follow a case.
This worksheet organizes considerations. It does not decide. Viability is a governance determination, not an arithmetic outcome.
Bounded transmission
Warrant signature demonstration
A warrant is a signed, versioned transmission of a bounded governance determination. It carries only what must travel safely. A short-lived capability, not the warrant, grants one exact action.
Keys are generated in-page and ephemeral, demonstrating the signature/verification mechanism. Production requires key custody in an HSM/KMS under community control.
A signature proves who signed bytes; it does not prove that the governance process was legitimate or that the claims are true.
Inspect the signing key
- Algorithm actually used
- Generating...
- Opaque issuer
- Generating...
- Public-key fingerprint
- Generating...
Inspect or export the signed evidence
Immutable outward payload
RFC 8785 canonical form
Signature
What does not travel
- No names of elders, keepers, witnesses, dissenters, or protected standing.
- No full DVA record, approval history, disagreement topology, or protected reason.
- The remainder is booleans only: unencoded conditions remain; online community decision required.
Decision procedure
Gate evaluation
The gate illustrates the decision an enforcement system would apply. It performs real signature, schema, date, scope, policy, obligation, and capability checks; infrastructure-dependent steps are stubbed and labeled.
Synthetic scenarios
SELECTED FIXTURE
Loading synthetic scenario…
Expected:
Simulation time:
Exact simulation time
Inspect the twelve decision points
Short-lived capability
Sender-constraining (mTLS/DPoP) and atomic key release require a real service; this model demonstrates the token lifecycle and scope-checking.
A gate DENY publishes nothing. Gate decisions, public statements, restricted notes, contests, and DVA determinations are distinct object types in distinct in-memory stores.
Constraint-preserving movement
No unauthorized transformation
Fidelity is not a total ordering. A receiver may not weaken or tighten community-defined policy without a trusted, versioned translation. Tightening can defeat affirmative duties such as teaching, return, circulation, or descendant access.
Policy comparison dimensions
- Permissions
- Prohibitions
- Affirmative obligations
- Temporal conditions
- Audience boundaries
- Derivative rules
- Retention and deletion
Inspect the complete policy payloads
Source policy
Receiver-accepted policy
INDETERMINATE never releases the resource. An ordinary safeguard such as encryption at rest is compatible only when it alters no permission and frustrates no obligation.
Visibility is a governance determination
Refusal without an extraction map
A public refusal is a deliberately authored political statement. A restricted note belongs in a separate community-controlled store. Non-disclosure-of-existence permits no resource-specific shared trace; a community may separately choose an internal note. The empty-store NDE example below is one simplified convention.
External-query response-shape demonstration
For an unauthorized external query, the synthetic NDE-protected matter and a nonexistent matter return the same status, body, and byte length.
In a real deployment, equivalence across timing, caching, rate-limiting, logs, and backups must be measured under adversarial testing; it cannot be inferred from code. This model demonstrates the response shape only.
PublicRefusalStatement store 0
No public statement has been authored.
RestrictedGovernanceNote store 0
No restricted note has been authored.
This separate browser-memory structure demonstrates separation only. It is not access control or secure storage.
Threat model
What the model assumes and what it cannot prove
The assets at risk include content, existence, protected standing, disagreement topology, warrants, revocation histories, query patterns, logs, backups, and derivatives. Adversaries include curious institutions, malicious receivers, compromised keys, insiders, coercive contracts, legal compulsion, and external attackers.
Official path
A deployment may constrain its official release path, reject unsupported receivers, minimize shared records, and make policy alteration evident. It cannot control every person who has already received plaintext.
Protected standing
Ceremonial, kinship, and other sacred statuses remain inside the governance boundary. The external system receives a bounded decision, not a durable description of who holds standing.
NDE
No resource-specific shared entry is created. Timing, cache, rate-limit, traffic, backup, endpoint, and human-disclosure equivalence remain production testing obligations.
Capture
A valid signature cannot make a captured process legitimate. Software may behave exactly as specified while amplifying an exclusionary or coerced governance process.
The claim is not computational undeniability. SRA can make violations harder through an official path, easier to detect and attribute, and less institutionally deniable under stated assumptions. It cannot make relation invulnerable by turning it into code.
Modeled versus real
The boundary is part of the model
The browser demonstrates mechanism and decision shape. It does not host, enforce, or protect real resources.
Demonstrated for real
- Web Crypto key generation, canonical signing, and gate verification.
- CSPRNG identifiers, strict date and schema validation, and fail-closed decisions.
- Constraint-preserving compatibility, contest scoping, and obligation due-date evidence checks.
- Short-lived, exact-scope, signed, single-use capability lifecycle.
- NDE non-recording in shared registry structures and identical response shape.
Modeled and labeled
- Principal authentication: assume an authenticated synthetic principal; no identity provider is contacted.
- Community-decision-service consult: a labeled synthetic response; no real service is contacted.
- Separated public and restricted stores: distinct in memory, not production isolation.
- NDE external query: response shape only, not timing-channel equivalence.
Not attempted
- HSM/KMS key custody, rotation, or compromise response.
- mTLS/DPoP sender-constrained transport or atomic key release.
- Separated production databases, service accounts, keys, and backups.
- Statistical NDE timing-equivalence testing, receiver federation, or deletion enforcement.
- Any storage of real protected data.
Relation before data
What this reference model is for
SRA asks a prior question before access control begins: can this proposed digital relation maintain the conditions under which the pattern remains what it claims to be?
A dam is not a false record of a river. It is a material intervention capable of destroying a riverine pattern's persistence conditions. Artifact production occurs in the classificatory and administrative apparatus that renders river as water inventory, bottomland as acreage, and relation as title, then circulates those outputs as adequate accounts of what is there.
The same discipline governs the more-than-human case. A human steward does not authenticate beaver or stream consent. A warrant can be a bounded human undertaking about human action, based on sustained ecological witnessing and collective recognition, while remaining corrigible by the relations it claims to have witnessed. It can encode observations, provenance, limits, and precaution. It cannot exhaust the stream's authority.
DVA is a governance determination. NDE is non-recording at the shared boundary. Transport is constraint-preserving: receivers may not weaken or tighten community-defined conditions without authorization. A warrant transmits a bounded decision; a capability grants one action. A gate DENY creates no public statement.
The current working draft uses carefully bounded analogies, not a mathematical proof of relational continuity. This browser makes authored cases and executable checks inspectable. A technically successful path does not validate the theory or establish the legitimacy of a governing process.
Darren Edward Lone Fight
MHA Nation · Dickinson College · Center for the Futures of Native Peoples
This interactive companion explores Darren Edward Lone Fight’s Persistence Conditions through fictional cases and inspectable decision logic.