Every claim the substrate makes is backed by a protocol — borrowed, vendored, extended, or invented. This page is the single index. Click any entry for deeper documentation where it exists.
Older-than-software traditions the substrate inherits vocabulary, ceremony, and witness model from. Naming them honestly fits the substrate's posture — trace claims to their actual sources. The substrate is not religious, legal, or political doctrine; it composes against these traditions as a record-keeping system.
The substrate's vocabulary inherits from millennia of witness tradition. Specific patterns the substrate carries forward:
Citing the Bible as a source is heritage acknowledgment, not theology. Substrate agnosticism on theological questions is preserved; the textual lineage of vocabulary is named honestly.
Six questions that force a complete description of any event, claim, or change: Who did it · What happened · When it occurred · Where it occurred · Why it happened · How it was done. Tracing back through Aristotle's Nicomachean Ethics (the circumstances of an action), formalized by 19th-century journalism as the Five Ws, codified into 20th-century root-cause analysis (Toyota's Five Whys is a 5W1H derivative).
The substrate uses 5W1H as Cinder's pre-push audit format: every commit-prep cycle gets a 5W1H pass before push to GitHub. The council bulletin uses 5W1H structure for formal posts. ADR drafts answer 5W1H by construction. The substrate's "make every claim auditable" discipline composes directly against 5W1H — when an entry cleanly answers all six, it's audit-ready; when it doesn't, the gap shows.
Composes naturally with witness traditions (the Bible's "by the mouth of two or three witnesses" and 5W1H both formalize "describe completely so the listener can decide"). Two heritages, same discipline.
Centuries of courtroom procedure for authenticating records — chain of custody, business-records exception, ancient-documents rule — predate FRE 902(14)'s 2017 adoption. The substrate's chain-of-custody design composes against this longer tradition so that records produced today remain admissible tomorrow regardless of which specific statute happens to be live.
The substrate's three-chain architecture, layer/tier classification, and era-progressive design draw substantially from the BitDreams chronicle at BitcoinArchive.org. The CVT (Concept-Variable-Tenet) pipeline pattern and the SYMBIOSIS tenets influenced the substrate's posture toward composition and clone-mesh propagation.
Card 40d positions the substrate explicitly against the supply-chain attestation frameworks. Sigstore et al. attest build provenance for code; the substrate attests record provenance for documents and decisions. Different threat model, similar discipline. The substrate borrows the rigor (signed attestations, public verifiability, transparent logs) and adapts it to records that aren't software.
Protocols this substrate coined. Doctrine for these lives here; clones inherit the floor.
A walk protocol. As a visitor moves through the site's sims, each + .md
press on a step records a BitNet ternary state change in their cairn. The cairn is a
sequence of stones — portable, signable, replayable, mergeable. Walks become diff-able
and shareable the way code became diff-able with git.
Four extensions fall out of the artifact: GitHub-for-walks (push/pull cairns), ML training on attestation patterns, sim replay (use a cairn as a regression-test fixture), and substrate-attested experiments (treatment vs control walks).
Microsoft's BitNet research showed that ternary weights (+1 / 0 / −1) at 1.58 bits per digit can match floating-point AI quality at a fraction of the cost. This substrate borrows the discipline and applies the same vocabulary to six scopes: files (ADR-030), agents (ADR-037), descriptors (ADR-038), silos (ADR-041), folders (ADR-042), and routing (ADR-043).
One vocabulary across six scopes means a reader doesn't have to context-switch.
+1 always means healthy/operational. 0 always means soft
attention. −1 always means intervene. The cross-scope discipline is what
CAIRN composes against.
When one substrate agent voices on behalf of another's seat (e.g., Cinder pre-pushes for Pale March, or the orchestrator drafts in Hearth's voice), the empathy protocol governs how that voicing should sound, when it requires sovereign blessing, and how to leave the pairing better than you found it. Each voicing leaves both speaker and target better positioned for future exchanges.
The "leave-it-better" amendment (S152) makes this concrete: a sovereign-blessed voicing is also a coaching opportunity — the original agent's next pass should be marginally clearer because of how this one was voiced.
Only seeds ship to public repos: small, public-safe templates, schemas, examples, summaries, and merkle-root commitments. Runtime stays sovereign-side: agent inner-voice ledgers, real chain receipts, sentry logs, llm_inbox/outbox content. The L0–L4 privacy taxonomy meets the GitHub repo boundary at this rule.
Enforced by the seed-violation scanner (scripts/scan_seed_violations.py)
which runs at every closing ceremony as Pale March's perimeter check.
Every operation that wants to commit to the substrate's chain passes the attestation gate. The gate verifies the operation's descriptor (peer-reviewed per ADR-038), attests the file's bitnet_flag is +1 active, and writes the merkle leaf. Operations without a valid descriptor or with retired source files are refused.
L0 merkle roots only — pure cryptographic commitments, public-safe. L1 public-readable summaries — sim cards, doctrine, this very page. L2 operator-tier — agent inner-voice ledgers, real receipts. L3 sovereign-tier — soul-chain edits, key ceremony state. L4 Hazel-tier — tiebreaker keys, succession material, the strongest enforcement.
Established protocols this substrate composes with. The substrate doesn't claim authorship; it claims correct application.
Every chain leaf is a SHA-256 hash. Every merkle root composes SHA-256-of-pairs. Bootstrap-mode attestation (pre-key-ceremony) signs by SHA-256 of the operation; full attestation signs the same hash with ed25519. Browser-side reads use Web Crypto API's SHA-256.
Every visitor cert (cert.json from a sim's close-step) carries an ed25519 public key derived from the visitor's session-mixed BIP39 seed. The substrate signs operations with ed25519 once the key ceremony lands; until then, bootstrap_sha256 mode per ADR-030.
The visitor's recovery_seed.md is a BIP39 mnemonic — twelve words from the standard English wordlist, derived from session-mixed entropy. The same 12 words deterministically re-derive the keypair on any compliant BIP39 implementation, anywhere. The mnemonic is the visitor's master backup; the cert is their daily-use file.
Every visitor identity carries an mr1... prefixed identifier — the
ed25519 public key encoded in Bech32-style alphabet (lowercase, omits visually
ambiguous 1/b/i/o). Distinct from Bitcoin's bc1; the substrate is not
a wallet. The Bech32 charset gives copy-paste resilience and human-readability.
Microsoft's BitNet research provides the ternary discipline this substrate borrows for cross-scope state representation. Cited in cards 40x and 40y for AI workload applicability; cited in ADRs 030/037/038/041/042/043 for the substrate's six-scope ternary state.
The substrate's browser-side crypto (sha256, sha512, hmac, pbkdf2, ed25519, bip39) is
handled by the noble/@scure family — audited, zero-dependency ES modules. Substrate
version: @noble/hashes@1.4.0, @noble/ed25519@2.1.0,
@scure/bip39@1.3.0. Vendoring strategy in scripts/vendor_libs.sh.
Statutory frameworks the substrate composes against. The substrate's role is to make these frameworks usable in practice; the frameworks themselves are external.
Adopted 2017. Hash-verified digital records may be self-authenticating in federal court. The substrate's chain produces records that satisfy 902(14) — visible in cards 40e (solo attorney), 40f (forensic accountant), 40k (cross-border attorney). The substrate is not legal advice; it's a record-keeping system that produces records of a kind the rule recognizes.
The substrate ships under AGPL-3.0 with a Values Addendum (see VALUES_ADDENDUM.md in the public repo) — non-extractive pricing, non-surveillance defaults, the L0–L4 taxonomy honored, lawful disclosure, and the recovery seed preamble. Clones inherit the AGPL plus the values floor; if a clone strips the addendum, it's a different substrate.
Provisional protocols sketched but not yet locked. Specifications are open for development in non-launch-window threads.
How visitors publish their cairns and how clones discover, fetch, and replay them. The local cairn artifact is operational; the federation layer is not. Hazel Dell's clone-mesh is the natural transport candidate.
The substrate's third canonical address (gnv2_burn_...) accepts
cryptographically-burned commitments — operations that publicly destroy value to attest
irrevocable intent. Specification under review for the production launch.
During beta/dev, any cryptographic material that touches a shared surface (Claude, Slack, GitHub Issues, dev deploys) is flagged compromised by policy. The visitor's first walk on the production substrate is the canonical real-seed event.
The substrate's discipline is making every claim auditable. A protocol invoked by name in a card or ADR should be findable, readable, and verifiable. This page is the index; individual protocols link to their full doctrine pages where those exist; in-development protocols link to their sketches.
If you find a claim in the substrate that doesn't trace to a protocol on this page, that's a gap worth surfacing — file it via the appropriate sim's "Run it past Claude" prompt or open an issue at the GitHub repository.