The agreement
The type is shared; the version in force is private
foedus is two repositories with a publication boundary between them, and holds nothing that belongs to a party.
The type
Conditions, violations, the change procedure, the annex, endorsement semantics, scenarios and coverage. Shareable: any party can read what it is held to.
The instance
The version in force, under its digest. Private: it names uids, hosts and live exposures. Only the owner signs a version and puts it in force.
The parties' own parts
Each party keeps its annex, its check scripts and its contract vectors in its own tree. foedus holds no copy; it cites them through the party's bond.
Three levels of proof
A condition is proved only by a test that can fail
Every check comes with a refutation: a deliberate break under which it must fail. A check whose refutation passes proves nothing, and the condition it watches counts as not proven.
Unit
A check on one condition, in one party, alone, with its refutation. Owned by the party that runs it.
Contract
The vectors of each interface a party provides. Owned by the provider, used by the consumer: they prove two parties fit without the other alive.
Integration
A scenario's runnable walk, with one planted violation per condition it engages, in each mode. Owned by foedus: every condition holds along a real case.
Offline is a level with no network, no warden and no authority: a check that means nothing there says so, rather than passing by absence.
The harness
A scenario passes only when its violations fail
Mount
The harness mounts the parties' fixtures, with a fresh build directory per copy.
Walk
It runs each scenario's runnable walk in each of its modes. Each step runs as its own identity and calls the party script it names.
Plant
For each refutation it plants the violation and walks again: the walk must fail at that step, naming that condition.
Judge
Pass only when the clean walk passes and every planted violation fails where it should. A walk that needs an identity the harness cannot assume reads unknown, never pass.
Coverage
One report, three levels, every gap named
The report reads the instance and the annexes it can reach through bonds. An annex read from anywhere else enters only when passed explicitly, labelled not-bonded, and never counts as valid.
- Conditions without a check.
- Provides without a vector, and consumes with no counterpart.
- Scenarios without a runnable walk, declared walks counted apart.
- Steps where a condition is engaged but no check of that condition observes it, and, per mode, observed steps with no check valid in that mode.
A version is named by a digest over its export and over the bytes of the schema and every file it imports, so a change in the type changes the version every party binds to.
Where it stands
Drafted, measured, not yet in force
Version 1 is a draft
No version is in force until the owner signs one. The shape of a check and the party types are provisional in foedus until ontoref's protocol publishes them.
The baseline
Measured from the round's sources: 37 conditions and 311 checks across ten parties; 31 scenarios in 96 scenario × mode cells; 28 declared walks, none of them runnable yet.
Not yet bonded
ontoref does not resolve foedus as a domain yet, and no party is bonded to it, so every annex the report reads today is labelled not-bonded.
Boundaries
What foedus is not
Not a signer
It neither signs nor endorses a version: only the owner does. warden operates the agreement's signatures and events; it does not provide the domain.
Not the parties' checks
Each party writes and runs its own checks and vectors. foedus says what must be proved and measures what is.
Not a central copy
It is federated: no annex, script or vector is copied into foedus. A party's part stays where the party governs it.
ontoref Gov
One domain in three layers: how a project governed by ontoref governs itself.
What it is
Gov is ontoref's own domain. It holds the arrangement — what a project's boundary declares, its members, which artefacts a consumer inherits — and the exercise — what work is committed and how an act is delivered. Its name is the root of governance, governability and government, and elects none of them.
Why
A decision, a boundary or a delivery that lives only in someone's memory binds no one. In Gov each one is a declaration a project can be held to, and what holds it is a mechanism, not a good intention.
What for
A project reaches Gov by bond, never by imposition, and takes only the parts it needs. In signature governance each project carries one: the contract, the operations of work, the signature, the dossier, the agreement and the signing on an agent's behalf. Beside them, the capabilities any state of governance uses: the host boundary, deployment, the observed session and the opening by name.
How governance is layered
Protocol · base
ontoref's base: bonds and planes, content bound by digest, the unsigned work order, the check form, and mandatum's types. Every project is written in it; a project can bond without adopting any governance.
Management and governability · gov
The gov domain, in ontoref: how the constellation is organised, its management modes, and decisions held by validators.
Signature governance · foedus
The foedus domain, provided by the foedus project and operated by warden: the agreement, each party's annex and the tests that prove it. A project is here because it is a party to the agreement.
Isolation, provisioning, wuwei and openbyname are capabilities any state of governance uses — the agent's boundary, deployment, sessions, and running tasks locally — not governance: governance needs them, they do not need governance.
Each project chooses its governance mode
Governability (coherence) · ontoref alone
Coherence only: ontoref checks that the declarations hold together. No signature.
Auditable governance · signature
The person signs. It detects a departure; it does not prevent it.
Applied governance · signature + isolation
Signature and isolation together. It prevents.
The parties, and the rest of the system
signature governance
Custody
A safeguarded project is held to a contract, one axis at a time. Custody states it; implementations hold it.
A party, with its own annex and checks.
custody.ontoref.dev →
iter
An owner and an agent work in one store. gov decides what each class of change requires; iter carries it out.
A party: it proves the conditions on accept and publish.
iter.ontoref.dev →
Signatio
A signature grants a declared reach. Signatio produces that grant and checks it.
A party: the authority whose attestations the agreement relies on.
signatio.dev →
SpecDossier
SpecDossier keeps the terms of a Statement of Work, not its execution, and brings them to landing.
A party, with its own annex and checks.
specdossier.dev →
warden
No agent holds a key: warden signs for it, only inside a core the owner signed.
A party that operates the agreement: it signs, chains and exports its events, and does not provide the domain.
warden.ontoref.dev →
capabilities
Isolation
Owner and agent share the same trees. What the agent may not do, the host refuses.
A party: it proves the host boundary's conditions.
isolation.ontoref.dev →
openbyname
openbyname lets a link on a web page open a file on your own machine, by name and safely: the link carries only names, and your machine's declarations decide what it may do.
A party, with its own annex and checks.
openbyname.dev →
wuwei-observer
Agent sessions, observed without forced intervention.
A party, with its own annex and checks.
wuwei.observer →
Many parties, one agreement.
The federated compliance agreement: each party holds its own part, and nothing counts as proven until a test has failed where it should.