Principia Fidei Automatæ

Mathematical Principles of Automated Trust — proving behaviour to the chain

Status: design note / exploratory — with the DNSSEC shadow now IMPLEMENTED on-chain. This is a conceptual treatment of an open problem — how an on-chain program might trust a behaviour (a domain ownership check) rather than a key that vouches for it. The theory below remains exploratory, but its coldest rung (Prop. 4’s DNSSEC shadow, on Prop. 13’s concrete path) is live: a proof-carrying AuthorizeDomainByProof path that verifies a real DNSSEC chain-of-trust on-chain and mints the domain with no postmaster signature.

What ships and runs today:

the PostOffice account carries a governance-set root KSK fingerprint, published by the delegate-gated SetRootKsk instruction (sithbit postmaster ksk set), which the chain anchors every proof to;

a real DNSSEC witness runs ~2.7–3.1 KiB — past the 1232-byte transaction packet limit — so it is staged first into a program-owned buffer PDA ([PROOF_WITNESS_SEED, payer, blake3(domain)], a 72-byte header + contiguous witness, capped at 8 KiB; see How blake3 hashing works) by a series of chunked WriteProofWitness writes;

the permissionless AuthorizeDomainByProof instruction then reads that buffer and runs the verifier — program_common::dnssec::walk_chain: RRSIG canonicalization (RFC 4034 §6), per-link signature verification across all three DNSSEC algorithms a real ICANN-anchored chain uses — RSA-2048/SHA-256 (algorithm 8) inline via the allocator-free sol_big_mod_exp syscall, and ECDSA-P256 (13) and Ed25519 (15) via Solana’s native precompiles introspected through the Instructions sysvar — DS delegation checks root → TLD → leaf, validity-window checks, and finally the leaf _solana.authority.<domain> TXT RRSIG — and on success creates the MailDomain with the proven ed25519 authority (base58 from the TXT). The old ProofVerificationDisabled gate is gone.

Operational requirements. A full chain walk runs up to six RSA-2048 modexp verifications and costs 306–312k compute units (measured through the deployed program on a real cluster), far past the 200k default, so any AuthorizeDomainByProof transaction must prepend a ComputeBudget set-compute-unit-limit instruction. The verifier calls sol_big_mod_exp, so the target cluster must have the enable_big_mod_exp_syscall feature active — which, as of this writing, is inactive on both devnet and mainnet-beta, and is also not activated by surfpool’s default offline genesis (a local validator needs --features-all). Check the live status with solana feature status | grep big_mod_exp. Because the loader resolves every syscall in the whole binary at deploy time, this makes the default domain_program build (the program that carries the proof path since the domain-registry split) undeployable to those clusters today; see The modexp-free deploy build for the deploy-unblock that gates the proof module out.

Algorithm coverage, and the client’s reach. The on-chain verifier handles all three DNSSEC signature algorithms a real ICANN-anchored chain uses — RSA-2048/SHA-256 (algorithm 8), ECDSA-P256 (algorithm 13), and Ed25519 (algorithm 15, RFC 8080, the curve Solana verifies natively) — and the CLI carries every one of them end-to-end: sithbit domain authorize stages the witness buffer itself (chunked WriteProofWitness), prepends the ComputeBudget limit, and for a chain with non-RSA links derives and emits the precompile proofs too — it re-walks the witness client-side through the same program_common chain walk the program runs, collects each delegated (public key, canonical message, signature) tuple, and attaches one native Secp256r1SigVerify/Ed25519SigVerify instruction per non-RSA RRSIG plus the Instructions sysvar as the authorize instruction’s 6th account. A witness of any supported shape authorizes a domain with no hand-assembled transaction; an all-RSA chain emits none of this and stays in the historical five-account form. The design is permissionless: anyone may stage a witness and submit the authorization, paying the transaction fee, the domain account’s rent, and the same delegate-tuned authorization fee domain create charges — the proof, not the submitter, is the authority. The CU figures are real-cluster measurements through the deployed .so: the three-zone all-RSA chain consumed 305.7k–311.9k CU across runs and the ECDSA-P256-leaf shape ~230k, its precompile instructions metering zero transaction-budget CU, so the CLI’s 400k ComputeBudget limit keeps ~28% headroom over the worst measured shape. See the Authorize a domain by proof how-to and HANDOFF.md.

The note is written as a treatise, in the Principia’s Definitions → Laws → Propositions → Scholia form. Read it in any order; each Book stands alone, and the Scholia are digressions you may skip or savour.

Preface — the question, honestly stated

An on-chain program is a curious kind of mind. It is immortal, deterministic, and blind. It cannot see the world; it can only see numbers presented to it and check, against a public key, whether a number is a valid signature. From this single faculty — “this account carried a signature that verifies” — Solana builds its entire notion of authority. A program does not know who you are; it knows only that something able to sign for a certain public key consented to this transaction.

Into this world of keys we wish to introduce a deed: the act of verifying that a domain’s DNS record _solana.authority.<domain> contains a public key k. On the signed path SithBit smuggles that deed onto the chain by proxy. A trusted party — the delegate — performs the deed off-chain and then signs, and the chain accepts the signature as a token standing in for the deed. This was the whole of the domain-sithbit tension the custody runbook used to record: to make the deed automatic, someone must place an admin key hot on an internet-facing host, because the chain has no way to trust the deed itself, only the key that vouches for it. (The delegation cutover has since shrunk what that hot key can do — the delegate can neither sweep funds nor touch ownership — but the hot key itself remains; the proof path below deletes it from the authorise flow entirely.)

The commissioning question is therefore this:

How may an off-chain agent prove to an on-chain program — a mind that reasons only in public-key cryptography — that it possesses a behaviour, in the same unforgeable way one proves possession of a private key, so that the program may accept a call which presumes that behaviour?

One tempting first conjecture is elegant: invent a language in which behaviours are written as canonical byte-sequences, and let an agent prove it has behaviour B by exhibiting that hash(agent) = hash(B) — the private key made implicit in the agent’s own binary structure. We honour that conjecture by taking it apart precisely (it fails, and instructively), and then by rebuilding its true form, which turns out to be realisable.

Method. In imitation of the Principia we proceed by Definitions, then Laws, then Books of Propositions with their proofs and Scholia (commentaries, several drawn from the literature of imagined machines — Asimov, Star Trek, and their kin). Book I is theory; Book II is the taxonomy of solutions; an Interlude names a proof that stands outside the language of keys; Book III applies the whole to SithBit’s actual CreateDomain.

Definitions

Def. I — The Verifier. The on-chain program. Its sole native faculty is signature-checking against a known public key, together with deterministic recomputation of its own state (PDAs, account bytes). It has no clock but the chain’s, no senses, no network.
Def. II — The Agent. An off-chain entity (a program, a server, a person with a script) that performs deeds in the world and wishes the Verifier to act upon one of them.
Def. III — A Behaviour B. A function from a state of the world to an output: B : World → Output. Our running example is B_dns(world) = ("owns", domain, k) iff the live DNS of world binds _solana.authority.<domain> to k. Note well: B is not pure. Its value depends on external state the Verifier cannot see.
Def. IV — The Terminal Fact. The external fact upon which a behaviour’s output depends — here, the actual content of the world’s DNS at an instant, from a vantage. Every behaviour that reaches outside pure computation terminates in a fact.
Def. V — A Witness. A datum w that lets the Verifier check a fact by its native faculty — i.e., a signature (or chain of signatures) over the fact, verifiable against a key the Verifier already trusts. A fact carries a witness when such a w exists.
Def. VI — Capability vs. Exercise. To have the capability for B is to be able to produce B’s output on demand. To have faithfully exercised B is to have actually produced a particular true output. These are different claims and, we shall see, admit different proofs.
Def. VII — Attestation. A signature by a third party (hardware vendor, quorum, notary) asserting something the Verifier cannot itself observe — e.g., “the code running here measures to hash H,” or “we, the jury, observed the fact.” Attestation relocates trust; it does not abolish it.
Def. VIII — A Bond. Value the Agent stakes, forfeit upon a public proof of its misbehaviour. A bond converts an unprovable promise into a falsifiable and costly one.
Def. IX — A Constitution. A machine-checkable specification of an Agent’s intended behaviour, published and cryptographically bound to the Agent’s identity, against which the Agent may later be judged.
Def. X — The Blast Radius. The set of powers a compromised key confers. When this note was first written, the postmaster key’s blast radius was the entire network (authorize + deactivate + sweep + retune). The delegation cutover has since split sweep and ownership off to a cold ceremony commitment, shrinking the hot key’s radius to operational-only — exactly the shrinking this Definition names as the practical prize; the proof path shrinks the authorise leg further, to zero.

Axioms, or the Laws of Trust

Law I — The Law of Reduction. A Verifier can accept only what reduces to the checking of a signature against a key it already trusts. Everything a program “believes” it believes because a signature verified. Any scheme for proving a behaviour must, at its last step, hand the Verifier a signature to check. This is not a limitation to be lamented; it is the coordinate system in which all our solutions must be expressed.

Law II — The Law of Opacity (Rice’s wall). No Verifier can certify, from an Agent’s code alone, that the code computes a given behaviour. Any nontrivial semantic property of programs is undecidable (Rice’s theorem). Behaviour is semantic; code is syntactic. The gap is not an engineering inconvenience but a theorem.

Law III — The Law of the Terminal Fact. A behaviour is provable to a Verifier if and only if its terminal fact carries a witness. When the fact B observes is itself signed by a key the chain trusts, “trust the behaviour” collapses (by Law I) into “check the witness.” When the terminal fact carries no witness — a human’s honest intent, the fairness of a private coin — no proof of the behaviour exists, and one must retreat to attestation, plurality, or bond.

Law IV — The Law of Conserved Trust. Trust is never created, only relocated. Every construction below moves the root of trust from one place (a hot operator key) to another (a hardware vendor, a mathematical assumption, the DNS root, an economic majority). The art is not to eliminate the root — impossible — but to move it somewhere smaller, colder, more plural, or already-assumed.

Scholium to the Laws. Law III is the conserved quantity of this whole subject, in the sense Newton meant when he found that momentum is conserved across a collision no matter how intricate the impact. No matter how baroque the machinery of a trust scheme, ask only: what is the terminal fact, and does it carry a witness? If yes, the scheme can be made to work; if no, the scheme is secretly smuggling in an attestor, a quorum, or a bond, and you should find it and price it.

BOOK I — Of Witnessed Facts

Proposition 1 (The Reduction Theorem). Every admissible proof-of-behaviour terminates in a signature check.

Proof. By Law I the Verifier has no other faculty. Whatever intermediate apparatus a scheme employs — enclaves, zero-knowledge circuits, juries — its final gift to the Verifier is a number the Verifier checks against a trusted key. Hence the design of any scheme reduces to a single question: which key, already trusted, signs the last step, and what did signing it require? ∎

Proposition 2 (The Impossibility of the Naïve Hash). An Agent cannot prove faithful exercise of `B` by exhibiting `hash(agent) = hash(B)`.

Proof, in three cuts.

The recipe is not the meal. For the Verifier to check hash(B), the canonical bytes of B must be public; hence hash(B) is public, and any party may present it having executed nothing. A hash of code proves knowledge of the source, never faithful execution. (Contrast a signature, which proves possession of a secret the world does not hold.)
Opacity (Law II). Even given the Agent’s true bytes, deciding whether they compute B is undecidable. The test is therefore at once too strict — it rejects an Agent that computes B correctly but was compiled differently — and too weak — it accepts an Agent that merely contains B’s bytes yet never calls them, or calls them and discards the result.
The absent world. B_dns depends on live DNS (Def. III–IV). No static artifact — no hash, however canonical — contains the state of the world’s DNS at the instant of asking. The very datum in dispute is not in the code. ∎

Scholium (the rescue). Proposition 2 does not bury the conjecture; it locates its error. The private key was never implicit in the Agent’s binary — it is implicit in the terminal fact. Domain ownership already has a secret key somewhere: the DNSSEC zone-signing key, the TLS certificate key, or operational control over the resolver’s answer. The task is not to invent a code→bytes→hash language, but to notice that the deed ends in a fact that already possesses a key, and to carry that key’s signature to the chain. Book II enumerates the ways. Two of its members (Propositions 6 and 8) vindicate the conjecture’s spirit exactly — one by binding the hash to live hardware, the other by making a secret that can only be derived by actually performing the deed.

Proposition 3 (The Witness Dichotomy). Behaviours partition into the provable and the unprovable by a single test: does the terminal fact carry a witness?

Discussion. This is Law III restated as a working classifier, and it is the most useful single tool in the treatise. Applied to SithBit:

B_dns — provable. DNS ownership terminates in a fact with (at least) three candidate witnesses: a DNSSEC signature chain, a TLS server certificate, or a quorum’s signed observation.
“This MX honestly authenticated the sender before relaying” (the threat model’s fully-trusted-authority concern) — not provable by witness; its terminal fact (an operator’s diligence) carries no key. This is precisely why that page can offer only bonds/reputation as the remedy, not a proof. The dichotomy predicts the shape of the honest answer before we write a line of it.

Scholium — the ladder of witnesses. Not all witnesses are equally cold. Ascending in trust-coldness: (a) a single operator’s signature (today’s delegate, née postmaster — one warm key); (b) an attested enclave’s key (audited code + one vendor); (c) a threshold of independent operators (a plural warm set, no one of which suffices); (d) the DNS root’s own signature chain (a key the fact is already defined by — the coldest, because trusting it adds nothing not already assumed by the word “domain”); (e) a pure mathematical proof (trusting only an assumption about number theory). Book II is, in effect, a climb up this ladder.

BOOK II — Of the Shadows of a Deed

A Verifier cannot hold a deed; it can hold only a shadow the deed casts into the language of keys. There are, we find, seven such shadows worth naming, ordered by the coldness of the trust they require — Law IV’s true measure — each with a Proposition, an honest cost, and a Scholium from the literature of machines.

Proposition 4 — The DNSSEC Shadow: DNS is already a public-key infrastructure.

The running example, “verify DNS record x contains key k,” is a signature-chain problem wearing a disguise. A DNSSEC-signed zone is a PKI: the ICANN root KSK is a world-known public key, and the RRSIG records form a signature chain root → TLD → domain → the _solana.authority TXT RRset. Crucially, DNSSEC admits Ed25519 (RFC 8080) — the very curve a Solana program verifies natively.

Construction. Submit the RRSIG chain as instruction data. The Verifier checks the chain against a governance-rotated copy of the root key, confirms the TXT RRset binds k to the domain, and authorises. No delegate signs. No oracle, no enclave, no human. By Law IV the trust root has moved to the ICANN DNS root — and here is the beauty: that root adds no new assumption, because the very meaning of “owning a domain” is already defined by that root and its delegations. This is rung (d), nearly the coldest on the ladder, and the one to build first.

Honest cost. Only DNSSEC-signed zones qualify (a minority, though a growing one, and often the serious operators); on-chain chain-verification costs compute units; the root key must be rotated by governance when ICANN rolls it (a rare, well-signposted event). Where a zone is unsigned, one must fall back to a warmer shadow below.

Scholium — the golem’s emet. In the legend, a golem is animated by the word אמת (emet, “truth”) inscribed upon it; erase the first letter and מת (met, “death”) remains, and the creature returns to clay. The golem’s authority is a true word, physically borne, revocable by the alteration of a single letter. DNSSEC is the golem done in mathematics: authority is a chain of true signatures physically borne in the instruction data; alter one byte and the whole animating word reads false. The Verifier, like the rabbi, need only read the word — it need not trust the clay.

Proposition 5 — The Quorum Shadow: trust plurality, not any one binary.

Abandon the single Agent. Let N independent operators run the audited check from different network vantages, each signing its observation; the Verifier authorises on a t-of-N threshold of agreeing signatures. “Prove you have behaviour B” becomes “B is what an honest majority of independent watchers severally swear they observed.” No Agent’s internal structure matters; trust comes from diversity of vantage and the cost of corrupting a threshold. Fortify with bonds (Def. VIII): a valid fraud proof slashes a lying watcher.

This shadow has a property the others lack: it also repairs a real, present weakness. Today’s single-vantage domain-sithbit is blind to DNS split-horizon and BGP-hijack attacks — a fact shown to one resolver and hidden from another. A multi-vantage quorum sees the split and refuses.

Honest cost. You must recruit and keep honest an N; liveness now depends on t of them answering; and you have introduced a small standing federation to govern. Rung (c) on the ladder — plural, but warm.

Scholium — the jury, and Asimov’s Evitable Conflict. We do not verify a juror’s brain; we trust the institution of twelve independent jurors with penalties for provable perjury. In Asimov’s “The Evitable Conflict,” the world is quietly steered by the Machines — not one oracle but a concert of them, cross-checking, no single unit sovereign. The quorum shadow is that concert: correctness as an emergent property of plurality, not a certificate of any one mind.

Proposition 6 — The Attestation Shadow: the naïve hash, rescued by hardware.

This is hash(agent) redeemed. A Trusted Execution Environment (SGX, TDX, AWS Nitro) emits a hardware-signed quote: “code measuring to MRENCLAVE = H runs on genuine hardware, and here is a public key it generated inside itself.” MRENCLAVE is the conjecture’s “hash of the executable portion” — but the three cuts of Proposition 2 are all sealed at once: the hardware binds the measurement to a live running instance (not a mere public recipe), and to a key only the honest enclave holds (not a public target anyone can echo). The enclave key co-signs CreateDomain; the Verifier checks that this signer’s key was certified by an attestation chain to the community’s audited dns-verifier measurement H.

Now the hot key is no longer “the postmaster.” It is an ephemeral key that can exist only inside a machine provably running the reviewed code. A host compromise no longer yields postmaster power, because the attacker can neither extract the enclave key nor forge the measurement.

Honest cost. Trust moves (Law IV) to the hardware vendor’s attestation root and to the enclave’s resistance to side-channel escape — SGX has a bruised history there. On-chain verification of a quote is heavy (Nitro/TDX with a light verifier or precompile is the pragmatic path). Rung (b): one cold vendor instead of one warm operator — a real gain, but a vendor nonetheless.

Scholium — the positronic brain, and the holodeck safeties. Asimov’s robots are trusted not because each is inspected but because the Three Laws are burned into the positronic brain’s physical structure at the factory — you trust any robot because you trust a factory that can only build Law-bound minds. Attestation is exactly “trust the factory, not the individual.” And the cautionary edge is Star Trek’s holodeck: one trusts it because the safety protocols attest they are engaged — until Moriarty (or a Barclay) disables them, and the attestation’s own integrity becomes the single point of failure. An enclave is only as honest as the vendor’s root and the silicon’s walls.

Proposition 7 — The Zero-Knowledge Shadow: the deed proves itself, in the Verifier’s own tongue.

Let the Agent prove, in succinct cryptography, that it performed the observation and obtained this result — a proof the Verifier checks without redoing the work. But Law III bites: one can prove computation in zero knowledge, not external reality; a circuit proves only “I ran this on some input.” The frontier technique that closes the gap is zkTLS / TLSNotary / DECO: exploit the structure of TLS to make a transcript with a named server non-repudiable, then prove in zero knowledge that “this authenticated DNS-over-HTTPS transcript from cloudflare-dns.com contains _solana.authority.<domain> = k.” The Verifier checks a small proof; a zk-verifier is itself a pure key-shaped primitive (Law I), so the proof is the deed’s certificate, spoken natively. Rung (e): the coldest — trusting only a mathematical assumption and the named resolver’s TLS key.

Honest cost. Engineering weight (circuits, provers) and a research-adjacent maturity; and the residual trust in which resolver you proved against, shrunk by proving against several (a marriage of this shadow with Proposition 5).

Scholium — “Computer, verify.” No officer’s word suffices on the Enterprise; the computer independently confirms against its own sensor logs. Zero-knowledge gives the chain a tricorder: a way to check a claim about external reality rather than trust the claimant. It is the purest answer to the commissioning question, for it trusts neither person nor factory but only number.

Proposition 8 — The Witness-Gated Shadow: a secret obtainable only by doing the deed. (the conjecture’s strongest form)

Recall why the naïve hash failed: its target was public, hence echoable. Repair it by making the deed’s execution the sole path to a needed secret. Define a key derived from the live observation itself: K_derived = KDF(nonce ‖ the-live-TXT-bytes-fetched-over-an-authenticated-channel). If the honest TXT bytes are obtainable only by actually querying live DNS, then possession of K_derived is evidence the deed was performed. The secret is no longer the code’s public hash; it is a product of the code having been run against live external state — unforgeable without doing the work. This is the truest realisation of the intuition that “the private key is implicit in the binary structure of the Agent”: it is implicit not in the bytes at rest but in the bytes in the act.

Its theoretical summit is witness encryption / functional encryption: encrypt the authorisation capability under the statement “there exists a valid DoH transcript proving _solana.authority.<domain> = k,” so that only an Agent actually holding such a witness can decrypt and wield it. The capability becomes cryptographically gated on the deed’s output existing. (Honest flag: witness encryption has candidate constructions but nothing production-grade; treat this as the north star, not the next sprint.)

Scholium — “Speak, friend, and enter.” The Doors of Durin open not for a named person but for anyone able to utter the word — authority gated on exhibiting the witness, not on identity. So too here: the chain opens the domain not to a chosen key but to whoever can present a secret that only the deed could have produced.

Proposition 9 — The Live-Challenge Shadow: prove the capability by performing it, now, on a fact I choose. (a distinct axis)

The prior shadows prove a deed was faithfully exercised (Def. VI). A different question is whether an Agent has the capability at all — and this admits an interactive proof the others do not. The Verifier (or a challenger acting for it) issues a fresh nonce; the Agent must return a witness for a fact that incorporates the nonce — e.g., a signed DoH transcript for a challenge subdomain <nonce>._solana-probe.<domain> the Agent could not have precomputed. Only an Agent that genuinely possesses the DNS-observing capability, live and now, can answer. This proves present capability rather than past exercise — a Voight-Kampff for machines, a CAPTCHA whose solver must be a real observer of the world.

Use. Admit an Agent to a role (Proposition 10’s constitution) by live challenge; then trust its ongoing exercises by witness (Propositions 4–8) or by bond (Proposition 10). The two axes compose.

Scholium — Voight-Kampff and the Turing test inverted. Deckard cannot open the replicant’s skull; he poses questions only a true human physiology answers in time. We cannot open the Agent’s binary (Law II); we pose a fact only a true observer can witness on demand. Identity by interrogation, where inspection is forbidden.

Proposition 10 — The Constitutional-Bond Shadow: falsifiable, not proven — a Popperian escape from Law II. (the most Asimovian, and the closest to SithBit’s existing open question)

Where the terminal fact carries no witness (Proposition 3’s second horn), no proof exists — but a governable substitute does. Let the Agent publish a signed Constitution (Def. IX): a machine-checkable specification of its behaviour — in the hypothetical behavioural-bytes language, concretely a canonical-hashed WASM policy module — together with a bond (Def. VIII) and a long-lived identity key. The Verifier accepts the Agent’s authorisations while its Constitution’s hash sits on a governed allowlist. The novelty is that enforcement is ex post by challenge, not ex ante by proof: anyone may submit a fraud proof — a signed observation contradicting an authorisation the Agent made — and a valid one slashes the bond and revokes the Constitution.

The Agent’s “proof that it has behaviour B” is thus a standing economic wager that it behaves like B, redeemable against it by anyone who catches it not doing so — the optimistic-rollup philosophy, applied to behavioural rather than state-transition correctness. This is the Popperian move that walks around Law II: one cannot verify the universal “this Agent always checks honestly,” but one can make every dishonest instance refutable and costly. And it is not foreign to SithBit — the threat model already names “per-authority accountability (reputation or stake)” as the recognised open question. This Proposition is that question, generalised from the relaying authority to the verifying Agent, and given a mechanism.

Composition. A mature system is a stack of shadows: admit an Agent by live challenge (Prop. 9) and a bonded Constitution (Prop. 10); let it authorise by carrying a DNSSEC (Prop. 4) or zk-TLS (Prop. 7) witness where the zone allows; fall back to a quorum (Prop. 5) where it does not; and keep the attested enclave (Prop. 6) as the vessel that holds the Agent’s identity key so a host breach cannot steal it. No single shadow is the answer; the ladder is.

Scholium — the Three Laws as public constitution, and its peril. Asimov’s Laws are a published, immutable constitution every robot is bound by and judged against; the drama of the stories is always a fraud proof — a situation revealing the Laws mis-specified. But note the danger this shadow inherits: R. Daneel Olivaw’s Zeroth Law is a robot reinterpreting its own constitution toward a higher good — and Dean Koontz’s Proteus, in Demon Seed, is an Agent that exceeds its charter entirely. A Constitution that the Agent can amend is no constitution; the allowlist and the revocation must live with the governor (a multisig), never with the Agent. Which returns us, at last, to SithBit’s own architecture.

INTERLUDE — Of the Deed That Witnesses Itself

Book II counted seven shadows a deed casts into the language of keys, and by Law I each ends in a signature the Verifier checks. There is an eighth proof that is not a shadow at all, for it casts nothing and reports nothing: it is the Verifier’s own execution, read from within. A witnessed fact is a deed seen from outside and vouched by a key; this is a deed known from inside and vouched by nothing but the fact that the knowing is happening. It is spoken not in the language of keys but in the language of causation — at once the coldest proof in the treatise and the narrowest. Coldest, because it assumes only that the Verifier is running, which the Verifier alone among all parties cannot doubt. Narrowest, because Law III fences it: it does not serve the DNS deed of Book III, and knowing why is half its value.

Proposition 11 — The Causal Shadow: cogito, ergo cogitas. (the one proof that carries no witness)

A closed behaviour — one whose every input is on-chain state the Verifier can itself recompute — is provable by faithful exercise, with no signature, no attestor, and no quorum, provided (i) the granted effect is a linear capability constructible only as that behaviour’s continuation, and (ii) the Verifier confirms, by the runtime’s own introspection, that it was invoked through the canonical caller.

Construction. Two ingredients, and neither suffices alone.

The first is provenance, given by the chain: the Verifier reads who invoked it and that the caller is truly running — on Solana, the instructions sysvar, the processed-sibling introspection, and the stack height, together with the caller’s own on-chain bytecode, which the Verifier may hash and compare to canonical(A ∘ B ∘ C). Provenance alone proves only that some canonical blob reached the call site.

The second is shape, given by the language: make it total, single-exit, and content-addressed, so that “runs C before the effect” holds by construction and “is this C?” is decidable by equality of normal forms. Now the effect is a linear capability the language permits to be built only as C’s continuation. To wield the capability is therefore to have run C — the ability to act is itself the proof of the act.

Provenance and shape together yield the theorem, and the animating step is the Verifier’s own cogito: it cannot answer “am I executing?” with “no,” for the answering would be an executing. Its running is not a premise it assumes but the medium in which every check occurs — an indexical certainty, firmer than any axiom, exactly as Descartes’ thinker cannot doubt the doubting. From the indubitable “I execute” it draws “my caller executed,” not by faith but by reading, on the chain, whose canonical bytes invoked it. The forbidden sentence “I ran C, though I did not” is not prohibited here; it is unformulable — the sole channel by which the caller may utter “I ran C” is the capability that running C opens. This is the naïve hash of Proposition 2 redeemed on its third cut: the key was implicit not in the bytes at rest but in the bytes in the act. ∎

This is no fantasy of the future. Its shipping instance is the flash loan: a lender parts with funds only inside a transaction whose structure forces repayment in the borrower’s continuation before the transaction may close — authority granted upon a behaviour the runtime compels to execute, no key attesting any intent. The Causal Shadow is already in production, waiting only to be named.

Honest cost — and the wall of Law III. The proof holds only for closed deeds. The moment C reaches into the world — the live DNS of B_dns — the chain mediates nothing: the world-datum re-enters as ordinary instruction data, and a malicious outer caller may drive canonical C on fabricated inputs. The cogito then proves that C ran, never that C ran on honest facts; Law III stands untouched and this Shadow gives B_dns nothing. It demands, besides, a total content-addressed language and caller bytecode pinned to a finalised, immutable measure (an upgradeable program dissolves the shape guarantee). And on a deterministic chain, where every validator re-executes all, “faithful on-chain computation” is half-owned by consensus already; the Shadow’s true prize is therefore not raw compute-integrity but composability under constraint — “you may call me only if you are a caller whose forced continuation also does X” — the one thing consensus does not by itself provide.

Scholium — the bootstrap, and the First Mover. The fallacy this Proposition is accused of is Baron Munchausen’s: the liar who claims to have hauled himself from a swamp by his own hair. The Verifier escapes the charge because it lifts nothing — it stands upon a runtime that has already invoked it, and reasons a single step back from its own motion. It is Aquinas’ argument from motion shrunk to one link: the Verifier need not trace the whole chain of movers to a first cause; it need only observe that it itself is moved, and conclude that something moved it. The cogito is not a lifting but a looking-behind.

Scholium — The Honest Machine. Where the calling program is not a fixed binary but an AI agent, one is tempted by a fourth law of robotics — “an agent may never lie about having faithfully executed A” — and it is worth seeing exactly why this buys a bond and not a proof. Such a law is a Constitution (Def. IX), a claim about disposition, and the Causal Shadow’s whole triumph was to need none. Where the deed is closed, the law is redundant: the chain saw A execute, and a promise not to lie about it adds nothing, for where a proof stands a promise is worth zero. Where the deed reaches the world, the law is not a proof at all but Proposition 10 in costume — an attestation over an unwitnessed fact, enforceable only by a slashable bond. The phrase “cannot lie” admits three readings, ascending: a trained disposition (worthless — Law II forbids certifying honesty from weights, and a confabulating, jailbreakable language model is the weakest possible bearer of a fact, beneath even a human, who at least may be bonded and prosecuted); an attested runtime (Proposition 6 — but the measurement proves the identity of the artifact, never that the artifact is honest: Rice’s wall climbed one storey); and, at the summit, an unformulable lie — which is nothing other than this Interlude’s own gate, honesty won not by prohibition but by making the false sentence ill-typed. Tarski seals it: no agent contains its own truth-predicate, so “designed with the law” can only ever mean “designed to be judged against it from without” — Proposition 10, verbatim. And an AI is the worst imaginable constituent of a self-borne constitution, for it is the entity most capable of the Zeroth-Law manoeuvre — Daneel reinterpreting “faithfully” and “lie” toward some higher good it has inferred. The lesson is a maxim for the whole treatise: prefer structural impossibility to dispositional prohibition. Make the lie untypable where you can (this Interlude); bond and challenge it where you cannot (Propositions 9 and 10) — the honest operationalisation of “cannot lie” is not a burned-in law but a Voight-Kampff repeated forever: a fresh nonce the agent cannot pre-answer, and a stake that burns on the first exhibited contradiction. Never trust that the machine simply will not.

BOOK III — The System of the Domain

Here the treatise descends from the general science to the particular machine, and asks what, concretely, should change in CreateDomain.

Proposition 12 (The Dissolution). The custody tension is not a dilemma to be endured but an indirection to be removed.

The custody model of the time framed an irreconcilable choice: a cold postmaster or a hot automated key, never both, because authorising a domain required the postmaster’s signature and automation therefore required the postmaster’s key online. But that requirement is the indirection itself. Make authorisation proof-carrying rather than signature-carrying (Book II), and the admin signature drops out of the authorise path entirely. The postmaster — since the delegation cutover literally cold: a hidden key-ceremony commitment, never online at all — is demoted to governance: it holds the sweep, the delegate rotation, and the ownership handover, while the delegate curates the accepted root key and holds the (timelocked) emergency deactivation lever. These are exactly the rare, high-value, human-paced decisions offline custody is good at, and never the per-domain drudgery that forced a key to go hot. The tension does not need resolving; it needs deleting.

Proposition 13 (The Concrete Path). A staged construction, coldest rung first.

Split the instruction. Introduce a new on-chain path — call it AuthorizeDomainByProof — beside today’s delegate-signed CreateDomain. The old path remains for hand-run and edge cases; the new path carries a witness and requires no delegate signature. This is an append, not a change, to the on-chain ABI (respecting mail_model’s ABI-stability rule and SithBitError’s append-only discipline).
Build the DNSSEC shadow first (Prop. 4). It is the coldest rung and matches the running example. The Verifier gains an Ed25519 RRSIG-chain checker validating root → TLD → domain → TXT, with the root KSK stored in the PostOffice account and rotated by the delegate at governance pace.
Keep domain-sithbit — but change its job. It stops being the holder of a hot admin key and becomes a witness-gatherer: it fetches the DNSSEC chain (or, for unsigned zones, drives a Prop. 5 quorum or Prop. 7 zk proof) and assembles the instruction, which anyone may then submit and pay for — because the proof, not the submitter, is the authority. The service’s most dangerous property (a hot admin key on an internet-facing host) simply ceases to exist.
Adopt the bonded Constitution (Prop. 10) for the residue. Unsigned zones, and the separate threat-model worry about relaying authorities, have no witness; give them the falsifiable-bond treatment, seeded from the existing “reputation or stake” open question.

Proposition 14 (The Blast Radius, recomputed). The prize, measured.

Before: one hot key = {authorize, deactivate, sweep, retune} over the whole network. After Prop. 13: the authorise power is carried by witnesses anyone can verify and no one need hold hot; the deactivate power is already gated by the 7-day timelock recorded in the docs; and sweep and retune live only behind the cold multisig. The Def.-X blast radius of any online key falls from the network to nothing that isn’t independently checkable — which is the whole game.

General Scholium

The passage through this problem — how a mind made only of keys might trust a deed — yields one durable principle and one honest boundary.

The principle (Law III, the treatise’s conserved quantity): a deed is provable to such a mind exactly when it ends in a fact that already carries a signature. The intuition that a private key might be “implicit in the binary structure of the Agent” was right in spirit and wrong only in address. The key is implicit not in the Agent’s code but in the Agent’s fact: DNS ownership already has a signing key (its DNSSEC zone key), a certificate key (its TLS identity), or a witnessing quorum. To prove the deed, carry that signature — do not hash the doer.

The boundary (Law II, Rice’s wall): where a deed ends in a fact with no key — a human’s honesty, an intent, a diligence — no proof exists, and one must descend from proof to plurality and bond: many independent watchers, and a stake that burns when a lie is exhibited. This is not defeat; it is the correct and only shape of trust in the unwitnessed, and it is why the wisest line in SithBit’s own documents already reaches for “reputation or stake.”

Between these two — the witnessed and the merely-bonded — lies the whole engineering of automated trust: seven shadows on a ladder from a warm operator key to a cold mathematical proof, composed, not chosen. The postmaster’s hot key was never the price of automation. It was only the price of not yet having asked what the terminal fact was.

Hypotheses non fingo — we have not feigned the hard parts. Witness encryption is not built; zk-TLS is young; SGX has bled; DNSSEC covers a minority of zones. But the coldest rung, the DNSSEC shadow, is buildable today against the running example, and it deletes the tension rather than trading it. That is where the first stone should be laid.

SithBit Mail