Evidence-backed admission

One move, written down

Theory 0001 reduces every protected substrate action to a single judgment:

admissible(actor, verb, operand, evidence)

An actor performs a verb on an operand, carrying evidence — the account a challenger can re-check. A fact entering the shared record, a gated read / listen, a transient emit: each is one specialization of admission at a protected boundary, not anything narrower. The point of writing the action this way is that nothing is admitted on trust. Whoever later asks "by what right?" gets an answer made of evidence, not a claim they must believe.

The invariant: check, never search

admissible is a check, never a search. Finding the evidence may be expensive, heuristic, language-specific, even wrong; verifying it must be small, deterministic, and trusted. This is logos's search/check split, and it is what lets the periphery reason in open-ended ways while the core stays safe. The searcher can be anything; the gate that certifies its answer is the only part that has to be trusted.

Concrete: admitting a fact to the record

Two systems make this real today. thesmos is the law — who may do what? It owns the vocabulary is_root, signed_fact, grant, authorized, covers_*, and the program that derives authorized from the root through a chain of grants. stele is the record — the append-only log of signed facts, where that law is applied to live writes and reads.

Map them onto the judgment. The actor is an Ed25519 key. The verb is assert. The operand is a signed fact: who said it, where, what, and the signature warranting it was them. The evidence is a derivation that the actor is authorized under thesmos's program.

stele does exactly two things, and both are logos verbs over that law:

• Admit (write) = check. A writer carries a proof it is authorized; stele re-verifies that derivation via logos check(). Admission is verification — stele never searches for a way to say yes.
• Gate (read) = solve + check. A reader sees a row only if a proof it may read it can be found. The search is untrusted — its candidate is re-derived and re-checked — so only the certifying gate, which is tri-core, has to be trusted.

Walked through stele's CLI, the shape is plain: the root grants a principal, the principal inscribes under that grant, and a gated read returns only what that principal may see.

$ stele -i root grant alice          # root delegates write authority to alice
$ stele -i alice authorize-assert alice greeting hi
$ stele -i alice query alice         # gated read, authenticated as alice
greeting(6869)

Each step is an admission whose account stands in the open. Anyone holding the record can re-run the check; the fact is true on the record because its evidence verifies, not because a server vouched for it.

What ships today, honestly

Theory 0001 is marked exploratory, and its judgment is still partly prose — admissible is not yet written as one logos-checkable relation, and evidence may turn out to be a family of account types indexed by verb rather than one. But the concrete slice is real. thesmos ships the law and a CLI whose verify --authorize builds the canonical proof for a scenario and runs logos check() over it, printing authorized or a reject code. stele ships the runnable store, admission via check, and the per-row read-gate. The realization verbs build / run remain candidates under review, not part of the closed core. What you can re-check today is a fact: admitted at a gate, accounted for by evidence, open to challenge by anyone.