LAWS 1 · 6 · 11Your memory is yours. What the world sees is proof that you governed it — never the memory itself.read the laws →
ECHO · UNIFICATION · THE FINAL LOCKED PHASE

The trust loop closes. Proof crosses. Data never does.

Everything Echo governs — a consent grant, a minimized slice, a collaboration turn — produces a receipt. Those receipts hold the real content, and they stay in a hash-chained ledger you control. What crosses into the public Transparency Log is only the Kernel ledger head: an opaque commitment that proves the governance ran, while revealing nothing about what it governed.

The Receipt WriterThis is the boundary between the private multi-agent layer and the public trust layer. It owns exactly two things: the private receipt store, and the rule that only a head may cross. Leaking is not discouraged — it is structurally impossible. A public entry that carries content throws before it is ever published.

One click runs the whole governed pipeline live: real consent grants become private receipts, the Kernel head is published to the real Transparency Log, a witness cosigns it, and the boundary blocks a leak. Nothing here is mocked.

Five stages, one boundary

1

Governed action

A consent grant, a minimized slice, a collaboration turn. The real Kernel writes a receipt for every one — allow, deny, refuse, auto-raise.

2

Private receipt

The receipt — with its full content — is folded into a hash-chained ledger that stays entirely under your control. It never leaves the device.

3

Kernel head

The ledger commits an opaque hash of each receipt. The head is a single cryptographic commitment that says 'this happened' without saying what.

4

Publish head only

Only { kind, seq, head, at } crosses into the public Transparency Log. The boundary — assertNoLeak — throws if anything else tries to ride along.

5

Witness cosign

An independent witness cosigns the checkpoint after a consistency proof. Append-only, anti-equivocation — anchored without a blockchain.

THE RULE · assertNoLeak

A published entry may contain exactly { kind, seq, head, at }, and head must match an opaque-commitment shape — a hash, never free text. Any extra field, any non-commitment head, any wrong kind: the function throws. The data cannot cross by construction.

What unification closes

for /consent & /collaborate

Those layers produce receipts. Until now they lived only in memory. The Receipt Writer gives them a permanent, tamper-evident home — and a public commitment that the governance actually ran.

for /transparency

The Transparency Log had sample heads. Now it receives real Kernel heads produced by real governed actions. The log is no longer a demo of a log — it is the endpoint of the whole pipeline.

for /kernel

The Kernel ledger's head becomes externally verifiable. Anyone can prove a head is included under a signed root, and a witness proves the log was never rewritten — without ever seeing a single receipt.

⚠

Honest sharp edges

Unification is the last step of the design order — consent model → collaboration → minimizer → unification. The loop is closed, but honesty about its edges is the whole point.

The head proves that, not what

A published head proves a governed action occurred and that the log is append-only. It cannot prove the action was wise — only that it happened and was recorded honestly. Judgement still lives with the human.

The private ledger is yours to keep

Tamper-evidence detects rewriting; it does not prevent deletion. If you discard your private ledger, the public head still stands but the content behind it is gone. Sovereignty cuts both ways.

One witness is one party

A single witness catches equivocation but is itself one entity. Real anti-equivocation wants many independent witnesses gossiping — and, eventually, an on-chain anchor. That remains the next open problem.

The boundary is only as tight as its schema

assertNoLeak enforces exactly four keys and a commitment shape. It is deliberately strict and deliberately simple. Every future field on a public entry must be scrutinised against the same rule: does this reveal content?

This is where the system finally holds together. The agents can reason, the Kernel can broker, the minimizer can sharpen — and when it is all done, the only thing the world ever sees is a single honest word: proof.