No agent holds a key.

The key

The signature leaves; the key never does

An agent's session has no key to lose, copy or misuse. Its jj calls warden-ssh-program as the signing program; the program asks warden on its Unix socket, and warden answers with a signature or with a refusal that names its condition.

Before every signature

Each commit is checked against the core it claims

warden signs only inside a core the owner signed and signatio attested. A commit is signed when all of this holds; otherwise it is refused, and the refusal says which condition failed.

• A head warden cannot vouch for reads unknown, never current.
• A parent warden cannot place is refused: a foreign commit above the session's never rides under the agent's signature.
• Each signed commit leaves one signed, chained event under its commit id, which iter reads back.

Why the parent rule: an agent that rebases onto a main which moved after the core was signed presents a parent warden never saw. warden does not widen its own reach; the owner does, with a child core on the new base that supersedes its parent, and the lineage carries the author's earlier signed work into it.

Principles

A signature withheld, never one given

From core to signature

The owner signs the core; warden signs inside it

The owner works with the warden CLI; an agent's session never calls it. Each step below is one of its commands, except the signature itself, which jj asks for.

1. Compose

   warden compose runs every party's check and writes root.json and sections.json for the owner to sign.

2. Sign and store

   The owner signs the root with their own key, outside warden. warden store takes the root, the sections and the owner's signature.

3. Attest

   warden attest attaches signatio's attestation of the root for one project. Until it is attached, the core signs nothing.

4. Sign a commit

   The agent's jj calls warden-ssh-program. warden runs the checks against the core and signs with the key for that (project, author identity), or refuses.

5. Export

   warden export writes the chain to warden's export directory, a checkout of the governance repo.

6. Verify, without warden

   warden verify-export checks an export offline: the core's root under the owner's pin, its attestations under the authority's pin, then the chain, which must continue the state this reader saw before. It exits 0 verified, 1 refused, 4 when the chain was cut or rewritten.

Where it stands

Built, and refusing until the session is known

Boundaries

What warden is not

ontoref Gov

One domain in three layers: how a project governed by ontoref governs itself.

What it is

Gov is ontoref's own domain. It holds the arrangement — what a project's boundary declares, its members, which artefacts a consumer inherits — and the exercise — what work is committed and how an act is delivered. Its name is the root of governance, governability and government, and elects none of them.

Why

A decision, a boundary or a delivery that lives only in someone's memory binds no one. In Gov each one is a declaration a project can be held to, and what holds it is a mechanism, not a good intention.

What for

A project reaches Gov by bond, never by imposition, and takes only the parts it needs. In signature governance each project carries one: the contract, the operations of work, the signature, the dossier, the agreement and the signing on an agent's behalf. Beside them, the capabilities any state of governance uses: the host boundary, deployment, the observed session and the opening by name.

How governance is layered

Protocol · base

ontoref's base: bonds and planes, content bound by digest, the unsigned work order, the check form, and mandatum's types. Every project is written in it; a project can bond without adopting any governance.

Management and governability · gov

The gov domain, in ontoref: how the constellation is organised, its management modes, and decisions held by validators.

Signature governance · foedus

The foedus domain, provided by the foedus project and operated by warden: the agreement, each party's annex and the tests that prove it. A project is here because it is a party to the agreement.

Isolation, provisioning, wuwei and openbyname are capabilities any state of governance uses — the agent's boundary, deployment, sessions, and running tasks locally — not governance: governance needs them, they do not need governance.

Each project chooses its governance mode

Governability (coherence) · ontoref alone

Coherence only: ontoref checks that the declarations hold together. No signature.

Auditable governance · signature

The person signs. It detects a departure; it does not prevent it.

Applied governance · signature + isolation

Signature and isolation together. It prevents.

More about ontoref Gov →

Part of the same system

signature governance

capabilities