ADR 0028 — the authority model is single-root: one logical truth, no operational authority; federation is subtree delegation

Status: accepted
Date: 2026-06-18
Builds on: 0012 (the admissible basis), docs/space.md (the space model this makes explicit)
Amends: 0021 / 0022 (corrects their "root-to-root / cross-polity" wording to single-root); resolves the federation/translation outsider recorded open in 0013 §4 and theory/0003 / theory/0004
Relates: 0029 (builds the kosmos custodian role on this model)

The constellation has ONE root and one global logical truth. That is centralized logically and decentralized operationally, and keeping the two apart is the whole resolution. stele is only the memory — the carrier of the one truth; correctness comes from the thesmos law over re-checkable proofs, so no operator adjudicates. "No central authority" means no central operator, not "no single logical order." Holding a key is power-of-agency (act as an identity), never power-over-truth (you cannot make the law admit a false thing, and every act is an auditable fact) — custody is operational, truth is logical. Federation therefore needs no translation theory between roots: a self-hosted member is a subnode on a delegated subtree of the one tree, and "federation" is just downward delegation. The multi-root / root-to-root framing is resolved against.

Context

0013 §4 and theory/0003 recorded federation / translation — "your proof bottoms out in a root I don't accept; mapping authority between polities" — as the most consequential open outsider, leaning that the no-central-authority thesis "structurally leans on root-to-root trust mapping." theory/0004 posed the fork explicitly: "does 'global' force a translation theory between roots, or can a single root with imports suffice?" — and left it open.

That framing conflates two different things under "central authority":

logical — is there one coherent order that every proof bottoms out in? and
operational — is there an operator who adjudicates what is true?

Once separated, the multi-root horn loses its motivation: the constellation's thesis is no central operator, which a single logical root satisfies on its own, because the root is not operated — it is the origin of a verifiable order, not a party. The conflation is what made root-to-root mapping look structurally required.

The stale framing has already leaked past the proposed ADRs into accepted ones: 0021 §6 and 0022 state cross-subtree references are "resolved by the same root-to-root authority mapping … any cross-polity fact read," while their own consequences describe single-root behavior ("global re-enters as a root-placed binding, not a flat namespace"). docs/space.md already implies the resolution — "authorization is a corollary of storage, not a parallel system," agreement is "a theorem rather than a hope" — but never states it.

Decision

1. One root, one logical truth. Every grant chains to the single root (the empty space path); every proof bottoms out there; a proof checked at (target_space, fact_index) means the same thing to every conforming implementation. This is logically central — and that is the point, not a defect: it is what makes "global" coherent.

2. Logically central, operationally no authority. stele is the memory — the carrier of the one truth; it never acts. Correctness is supplied by the thesmos law over proof-carrying, re-checkable facts: the law + the proofs decide, and anyone can re-check. No operator sits at the root or adjudicates. "No central authority" = no central operator, not "no single logical order."

3. Custody is operational; truth is logical. A private key is the ability to sign — to author facts/grants as an identity. Holding a key (including custodially, for others) is power-of-agency: the holder can act as that identity. It is never power-over-truth: nothing signed becomes true unless the law admits it, and every act is an auditable fact on the record. So custody can be centralized (a default custodian — convenience) and delegated (self-custody) without centralizing authority over truth. A compromised custodian can abuse agency (bounded by each identity's real authority, and auditable); it can never rewrite the law, forge a proof, or escape the record.

4. Federation is subtree delegation — there is no translation theory. A self-hosted member (its own stele carrier, its own kosmos, its own provider) is a subnode bound to a delegated subtree of the one tree, not a new root. Its authority chains to the one root; its facts are re-checkable against the one law. So "federation" is just downward delegation, recursive and self-similar (any holder of authority at space S is, for S's subtree, a sub-authority that delegates further down). Cross-subtree sharing is placement at a common ancestor ("bind it high"), never root-to-root mapping — because there are not two roots to map between.

5. Resolve the federation outsider in favor of single-root. The "federation / translation — authority between roots/polities" outsider of 0013 §4 / theory/0003 / theory/0004 is closed: the answer is "a single root with imports suffices," and no root-to-root translation theory is adopted. The resource/scarcity and temporality/freshness outsiders are untouched (and resource is now visibly distinct from authority — see Consequences).

6. Correct the stale wording. 0021 §6 and 0022: "root-to-root authority mapping / cross-polity reference" is corrected to single-root — (space, identity) resolved by downward projection within the one tree; truly-global content is bound high (root or a shared ancestor). The mechanism those ADRs describe is unchanged; only the multi-root framing is.

Consequences

One operator-privileged act: genesis. The single seam where a human acts with the root key is the genesis grant root → <member-service> that seeds a member's subtree; everything below is self-served by downward delegation. This is the constitution: one grant, then mechanism.
Self-host = self-custody. Running your own member for a subtree is choosing your custodian; it adds no root and no authority over truth. The custodian role and its boundary are specified in 0029.
Resource is now visibly not authority. Because authority is single-root downward delegation, capacity constraints (quotas, "at most N subtrees") are plainly a separate concern — not expressible in the monotone authority law, and enforced operationally. This sharpens the still-open resource outsider (theory/0003) and is load-bearing for the account-policy layer in 0029.
No repo or topology change from this ADR — it is a model statement. The kosmos registration and the adstrate reframing ride 0029.
Downstream doc edits (separate, non-normative): docs/space.md and the space glossary entry gain a short "logical vs operational / custody vs truth" note stating the resolution they already imply.
The federation property recorded by 0021/0022 is preserved, not capped — it was always single-tree delegation; this ADR just names it correctly, so any future distribution work builds on "one root, many subnodes," not "many roots, mapped."