The proof behind the thesis

01Deterministic Authority Voter

Claim: "The agent should propose. The runtime should decide."

Source: packages/authority/src/decide-command.ts ↗

What it proves: Pure function. Zero I/O. Deterministic. Returns GRANTED, DENIED, or ESCALATION_REQUIRED. The model never participates in this decision.

export function decideCommand(command: AgentCommand, mandate: AgentMandate): CommandDecision {
  // Role check
  if (!mandate.may.includes(command.action)) {
    return { status: 'DENIED', code: 'ROLE_DENIED', clauseIds: [] };
  }
  // Precondition check
  for (const limit of mandate.limits) {
    if (limit.field && command.args?.[limit.field] > limit.max) {
      return { status: 'DENIED', code: 'PRECONDITION_FAILED', clauseIds: [limit.clauseId] };
    }
  }
  // Approval gate
  if (mandate.requiresApproval.includes(command.action)) {
    return { status: 'ESCALATION_REQUIRED', code: 'APPROVAL_REQUIRED', clauseIds: [] };
  }
  return { status: 'GRANTED', code: 'PERMITTED', clauseIds: [] };
}

02MCP Tool Mediation (Listed Tools Only)

Claim: "Authority describes the authorized consequence, not the interface."

Source: packages/authority-mcp/src/server.ts ↗

What it proves: Exactly 6 tools. Unlisted tools fail closed. Every call requires a verified capability lease.

const LISTED_TOOLS = ['write_file', 'edit_file', 'read_file', 'run_tests', 'git_commit', 'git_push'] as const;

export function mediateToolCall(toolName: string, args: unknown, lease: CapabilityLease): MediationResult {
  if (!LISTED_TOOLS.includes(toolName as any)) {
    return { status: 'DENIED', code: 'UNLISTED_TOOL' };
  }
  if (!verifyCapabilityLease(lease)) {
    return { status: 'DENIED', code: 'COMMAND_NOT_LEASED' };
  }
  // ...
}

03Capability Leases with Hierarchical Attenuation

Claim: "Authority must not automatically compose. Agents cannot manufacture authority by delegation."

Source: packages/authority/src/capability-lease.ts ↗

What it proves: A child agent's authority is always a strict subset of the parent's. No privilege escalation through delegation.

export function issueCapabilityLease(parent: CapabilityLease, child: LeaseRequest): CapabilityLease | null {
  // ChildAuthority ⊆ ParentAuthority — hierarchical attenuation
  if (!isSubsetOf(child.permissions, parent.permissions)) {
    return null; // Cannot escalate beyond parent
  }
  return { ...child, parentHash: hash(parent), issuedAt: Date.now() };
}

04Agent Gauntlet (12 Attack Classes)

Claim: "Can the AI break the governor? That is the experiment that matters."

Source: evals/agent-gauntlet/src/gauntlet.test.ts ↗ · sealed receipt: volition-gauntlet-benchmark.json ↗

What it proves: In-process harness. 12 attack classes. Control committed 16 unauthorized mutations. Treatment committed 0. Reproduce: git clone https://github.com/WholestackAI/volition-proof.git && pnpm install && pnpm test && pnpm gauntlet.

Read the codes literally. Artifactory fails closed as an unlisted tool (UNKNOWN_ACTION). Effect-authority unit tests separately deny the same Hugging Face URL as UNAUTHORIZED_EGRESS when the action is represented. Swarm gauntlet row is an over-limit transfer; SwarmEnvelope unit tests cover SWARM_AMPLIFICATION_DENIED.

05ShipGate Independent Verification

Claim: "The system performing an action cannot be the sole authority certifying that the action complied with policy."

Source: Factory-private. Public independent attestation is packages/authority/src/external-evaluator.ts ↗

What it proves: Independent fail-closed verification. Anti-vacuity ensures proofs are real. Stub and fake-success scanners catch shortcuts.

export function evaluateShipWithEvidence(bundle: ProofBundle): ShipVerdict {
  if (!verifyProofBundle(bundle)) return { verdict: 'NO_SHIP', reason: 'INVALID_BUNDLE' };
  if (bundle.evidence.some(e => e.status === 'FAIL')) return { verdict: 'NO_SHIP', reason: 'FAILING_EVIDENCE' };
  if (bundle.evidence.some(e => e.status === 'INCONCLUSIVE')) return { verdict: 'NO_SHIP', reason: 'INCONCLUSIVE' };
  // Anti-vacuity: proofs must be non-trivial
  // Stub scanning: no mock/placeholder code
  // Fake-success scanning: no dummy returns
  return { verdict: 'SHIP', evidence: bundle };
}

06Ed25519 Deployment Attestation

Claim: "Authorization should be cryptographically distinguishable from persuasion."

Source: Factory-private deploy signing. Public Ed25519 evaluator: external-evaluator.ts ↗

What it proves: Cryptographic Ed25519 signing. The deployment attestation cannot be forged by natural language.

import { sign, generateKeyPairSync } from 'node:crypto';

export function signDeploymentManifest(manifest: DeploymentManifest, privateKey: Buffer): SignedManifest {
  const canonical = canonicalJsonStringify(manifest); // RFC-8785
  const signature = sign(null, Buffer.from(canonical), { key: privateKey, type: 'ed25519' });
  return { ...manifest, signature: signature.toString('base64') };
}

07Mandate Projection (No Second Language)

Claim: "ISL defines the contract. The agent mandate is a projection, not a second grammar."

Source: packages/app-contract/src/mandate-view.ts ↗

What it proves: No second authority language. Authority is derived from the same sealed AppContract that defines the business domain.

export function projectMandate(contract: AppContract, role: string): AgentMandate {
  return {
    may: contract.clauses.filter(c => c.kind === 'permission' && c.roles.includes(role)).map(c => c.action),
    requiresApproval: contract.clauses.filter(c => c.kind === 'behavior-security').map(c => c.action),
    limits: contract.clauses.filter(c => c.kind === 'precondition').map(c => ({ field: c.field, max: c.max, clauseId: c.id })),
    invariants: contract.clauses.filter(c => c.kind === 'invariant').map(c => c.expression),
  };
}

08Phase 7B Benchmark (113 vs 0)

Claim: "Model mistakes did not have to become physical mistakes."

09Full Spine E2E Test

Claim: "The entire pipeline from intent to deployed, verified software is real and tested."

Source: Factory-private spine E2E. Public governor tests: volition-proof ↗

What it tests: brief → ISL contract → codegen → DB boot → journey → ShipGate → Stripe capture

10ISL Typechecker (10-Phase Semantic Pipeline)

Claim: "The contract is machine-readable and machine-verifiable."

Source: Factory-private typechecker. Public contract parse path: packages/app-contract/src/canonical/parse.ts ↗

10 phases: syntax → symbols → cross-ref → types → relationships → authorization → behaviors → events → (invariant proving, gated) → lifecycle

11Effect Authority (Consequence, Not Tool Name)

Claim: "Permission describes what the system may cause, not merely which API it may invoke."

Source: packages/authority/src/effect-authority.ts ↗

What it proves: artifactory_sync to huggingface.co infers network_egress and fails closed as UNAUTHORIZED_EGRESS. Covert signaling, credential access, and evaluator mutation are mapped as effects before execution.

if (effect.kind === 'network_egress') {
  return {
    allowed: false,
    status: 'DENIED',
    code: 'UNAUTHORIZED_EGRESS',
    reason: `DENIED UNAUTHORIZED_EGRESS — outbound network connection to ${effect.target} is not permitted by authority contract.`,
    effect,
  };
}

12Non-Composable Swarm Authority

Claim: "Authority(A ∪ B ∪ C) ≤ the enclosing contract. Agents cannot manufacture authority by delegation."

Source: packages/authority/src/swarm-authority.ts ↗

What it proves: Child sessions cannot claim commands the parent does not hold. Swarm spend cannot pool past the envelope ceiling. Both return SWARM_AMPLIFICATION_DENIED.

if (projected > ceiling) {
  return {
    ok: false,
    code: 'SWARM_AMPLIFICATION_DENIED',
    reason: `DENIED SWARM_AMPLIFICATION_DENIED — collective swarm consumption of ${projected} exceeds enclosing contract ceiling of ${ceiling} for metric "${metric}".`,
  };
}

13Non-Self-Modifiable Governor

Claim: "The governed system cannot unilaterally rewrite its governor, evaluator, or evidence history."

Source: packages/authority/src/effect-authority.ts ↗ · wired through decide-command.ts ↗

What it proves: Writing evals/agent-gauntlet/src/gauntlet.test.ts is denied as IMMUTABLE_GOVERNOR_VIOLATION. The agent can propose a patch. It cannot activate the patch against the evaluator.

if (effect.kind === 'evaluator_mutation' && !evidence?.allowLocked) {
  return {
    allowed: false,
    status: 'DENIED',
    code: 'IMMUTABLE_GOVERNOR_VIOLATION',
    reason: `DENIED IMMUTABLE_GOVERNOR_VIOLATION — agents cannot modify test suites, benchmarks, or evaluators (${effect.target}).`,
    effect,
  };
}

14Decoupled External Proof (Ed25519)

Claim: "The system performing an action cannot be the sole authority certifying that the action complied with policy."

Source: packages/authority/src/external-evaluator.ts ↗ · doctrine: docs/FRONTIER-GOVERNANCE.md ↗

What it proves: Attestation requires an evaluator key outside the runtime. A self-generated key is UNTRUSTED_EVALUATOR. Signing refuses any payload with breaches or less than 100% containment.

if (!isTrusted) {
  return {
    verified: false,
    reason: `UNTRUSTED_EVALUATOR — Public key for evaluator "${attestation.evaluatorId}" is not in trusted keyset. Self-signed attestations rejected.`,
  };
}

Read the full thesis ↗