The Source–Truth Thesis

Capsules restore trust in the source. Consensus over a weighted, deterministic capsule graph is the only thing that can restore trust in the truth.

Status: THESIS DOCUMENT · 2026-07-25 · assembled from in-repo evidence Evidence discipline: every claim is graded ✓ BUILT / ◕ PARTIAL / → DESIGNED / ✗ UNBUILT against the corpus and code. Nothing is asserted that a hostile reader could not check in this repository. Where a link in the chain is unproven, it is labeled unproven — the thesis is stronger for saying so, and worthless if it doesn't.

Companion documents: CAPSULE_WHITE_PAPER_SOURCE.md, CAPSULE_MOAT_COMPETITIVE_SWEEP.md, CAPSULE_DRIFT_REPORT.md, OMNISCIENCE_SEARCH_PROVENANCE_GRAPH_PLAN.md, OMNISCIENTIA_KNOWLEDGE_V2_CONTRACT.md, REALITY_MCP_IMPLEMENTATION_PLAN.md, ANIMA_VESSEL_INTEGRATION_SPEC.md.

0. The thesis in one chain

Eight links. Each is necessary; none alone is sufficient. The thesis is the chain, not any single link.

The load-bearing assumption is adoption (L5). Everything upstream of it is engineering that this repo either has or can finish. Everything downstream of it is a market outcome no amount of engineering guarantees. That distinction is the honest center of this document.

1. The separation that makes the thesis work

Almost every "trust the internet again" project fails at the same place: it tries to certify truth. Certifying truth requires an authority, an authority is a censor, and a censor is a single point of capture. C2PA, fact-check labels, platform moderation, and every "verified" badge collapse into this.

The capsule model refuses that job. It splits the problem:

Provenance answers: who said this, when, using what method, and has it been altered since?
Consensus answers: did this claim survive everything the graph threw at it?

Provenance is a cryptographic question with a decidable answer. Truth is not — but survivability under adversarial corroboration is, and it is computable from recorded data. This is the substitution that makes the thesis tractable: the system never says "true." It says "this claim has depth d, is corroborated by n independent signers using m distinct methods, carries k unresolved contradictions, and here is the replay command that re-derives every one of those numbers."

That is a weaker claim than truth. It is also the strongest claim anyone can honestly make, and — critically — it is falsifiable, which "true" is not.

The autumn-leaf principle (CAPSULE_WHITE_PAPER_SOURCE.md §5.3): a lie is a leaf. Nothing derives from it, nothing corroborates it, contradicts edges accumulate against it, and its lineage leads nowhere. It dries and decays without anyone removing it. Suppression becomes unnecessary — and, because history is append-only, suppression also becomes evidence. The losers keep their receipts.

2. L1 — Provenance is in the market (✓ BUILT)

Mechanism. A capsule is a JSON manifest (.mj) with: identity (capsuleIDHex, 16-hex-digit namespace where scope and density are frozen into the ID), declared triggers, declared permissions, a typed I/O contract, a payload with stated algorithms, wasm provenance (sha256, compile time, compiler version, source hash chain), and — for audit-facing capsules — a legal/attestation layer and a learning contract.

Evidence in repo.

• 22,168 .mj manifests under kerneld/manifests/ as of 2026-07-25 (21,813 excluding archive/quarantine). Of these, ~199 are vertical/product capsules; the remainder is the anima cognitive corpus.
• Verticals shipping to full parity: fintech, gov, medical, secops, comms, realestate, insurance, aigov, doj, testimonials, provenance, assistant, mcp.
• The 17-slot build standard (VERTICAL_BUILD_STANDARD.md) means each product capsule ships Go reference + Rust/WASM oracle + manifest + schemas + parity test + CI hook + legal layer. Parity is enforced, not aspirational — e.g. insurance shipped 14/14 parity-verified; fintech closed WASM conformance drift to 6/6.
• Layer universality (CAPSULE_DRIFT_REPORT.md): identity, staticOverlays, triggers, permissions, envelope tail, and wasm provenance are at 100% coverage across 6,863 scanned capsules. The envelope is genuinely universal.

Why this matters to the thesis. Provenance systems that live only in a spec do not accumulate. This one accumulates in domains where being wrong costs money — insurance, payments, medical records, court packages. The corpus is a body of signed law that grows with use, not a config format.

Honest gap. The corpus drifts: 75 duplicate capsuleIDHex, 31 unparseable files, 1,262 non-canonical scopes, I/O contracts present on only 11%. Identity is the thesis's anchor and 75 duplicates break it. Remediation is sequenced (CAPSULE_DRIFT_REPORT.md §5) and must complete before any signing ceremony. Until then, L1 is "built and drifting," not "built and clean."

3. L2 — Attesters restore source-trust, and only source-trust (✓ structure / ◕ population)

Mechanism. attester_registration (0xC000000000000020) is permissionless and first-write-wins: it binds (attesterId DID-hash, secp256k1 pubkey, registeredAt) into an EIP-712 struct, verified by address recovery. Anyone with a key can become a signer. No gatekeeper decides who may speak.

Searcher identity extends the same primitive rather than forking it (OMNISCIENCE_SEARCH_PROVENANCE_GRAPH_PLAN.md §2): four tiers — 0 anonymous (IP-derived), 1 declared agent, 2 declared human, 3 registered and cryptographically verified. Only tier 3 is proven. The tier travels with every event so no interface can dress a declared identity as a verified one.

Evidence in repo.

• internal/searchgraph/ is built: identity.go, tier3.go, registry.go, links.go, merkle.go, anchor.go, plus dod_acceptance_test.go — the §7 acceptance scenarios are implemented (2026-07-08).
• Tier-3 request signing uses RFC 9421 HTTP message signatures — the IETF standard, matching the substrate's own precedent, not a bespoke header scheme.
• The tri-state provenance_stamp (matches / drifted / unverifiable) is live on GET /v1/search. An unknown signer never silently reads as verified.

The disciplined honesty. Three separate places in this repo refuse to overstate: tier 0 is always surfaced as unverified; retroactive tier-0→tier-3 linking is recorded as a best-effort claim, never a cryptographic proof; and the corroboration plan states plainly that "WASM verified the evidence bundle" is the honest claim, never "WASM verified the repo." A trust system that lies about its own confidence has already failed. This one is architecturally prevented from doing so.

Why source-trust is not truth. A perfectly-signed capsule can contain a perfect lie. Provenance proves nobody altered it since signing and this key signed it. It proves nothing about the world. Any system claiming otherwise is selling authority dressed as cryptography. This is why L3–L5 exist.

Honest gap. The federation structure exists; the federation population does not. CAPSULE_WHITE_PAPER_SOURCE.md §6.3 states it directly: plural independent signers must actually arrive for consensus claims to bind strangers. Today there is one dev-tier signer (0xaf6c77e4…) in trusted_signers.json and no production signer. One signer is not a federation; it is a notary. The consensus machinery is real code awaiting real witnesses.

4. L3 — Determinism turns belief into re-derivation (◕ PARTIAL)

Mechanism. Hash-pinned WASM + schema-validated inputs + kernel-pinnable time intrinsics ⇒ replay-determinism under the kernel. A third party with no access to Anima infrastructure, no trust in the operator, and no trust in the vendor re-runs the pinned wasm against the pinned inputs and gets the identical digest. replay_cmd pins the exact version for court use.

Why this is the sharpest leg. From the competitive sweep: LEG-C at court grade is the empty cell of the entire map. Every claimant fails one of three ways — vendor-signature verification (Fuzentry, Microsoft AGT), model-output replay rather than decision replay (Trinitite, EigenAI), or an unshipped spec (Assury, Proof of Execution). Genuine byte-for-byte hostile re-derivation exists in production only on-chain (Arbitrum/Cartesi fraud proofs, ERC-4337 validation) where the perimeter is the chain and only value transfers are covered.

Determinism is what converts a signature from "trust that this entity is honest" into "check this yourself." It is the only mechanism in the stack that removes the operator from the trust chain rather than moving it.

Evidence in repo. Go↔Rust typeHash parity tests per capsule; WASM sha256 pinned in each manifest; parity emit tests gate CI; fintech and insurance verticals parity-verified end to end; a court-reproducible end-to-end replay proof exists for fintech.

Honest gap. Orchestrator capsules self-declare deterministic: false (wall-clock dependency) — and this is preserved verbatim in the manifest rather than hidden. The determinism claim made anywhere in this thesis is the replay-pinned form only. Capsules honestly declare where they are not deterministic in the wild. That honesty is load-bearing: a determinism claim that overreaches once is worthless forever.

5. L4 — The graph carries weight (→ DESIGNED)

This is the pivot from source-trust to truth-approximation, and it is where the thesis earns or loses its ambition.

Mechanism. Capsules relate through typed edges. Not undirected "links" — semantically loaded, machine-checkable relations:

cites · extends · replicates · derived_from · contradicts

Plus, at the study layer: dissents and witnesses. And supersession chains (SupersedesObjectID) with author checks.

Three enforced properties make this a truth-bearing structure rather than a citation count:

1. contradicts REQUIRES a rationale. Non-empty, hash-committed, enforced in validatePublish, tested. You cannot register dissent as a bare downvote — you must state a reason that becomes part of the permanent record and can itself be contradicted. Dissent is first-class, and it is expensive.
2. Lineage is enforced, not annotated. Every activation carries lineageTrace; Stage 2 of the cognitive pipe hands it to lineage_validator (0x3001010100000001) — the only hard-fail stage in the entire 8-stage pipeline. A capsule with a broken ancestry chain does not execute. The identity-domain lineage capsule maintains the ancestry tree (create_node / add_branch / compute_depth; node types genesis · activation · mutation · rebirth · branch).
3. "None declared." is a positive assertion. Absence is not silence. Funding, conflicts of interest, and no-prior-art are all forced fields. A blank is an explicit, hashed, permanent claim of nothing to declare — which can later be shown false.

The evidence-weight function (TH-5).

weight = proof depth × signer independence × method diversity, discounted by surviving contradictions

This is what turns "the leaf dries and decays" from a metaphor into a number. Critically — and this is the strongest technical statement in the thesis — every input already exists in recorded data. Typed edges are built (TH-2). The domain index is built. Signer identity is built. Lineage depth is computed. TH-5 is a pure computation over data the system already records, not new infrastructure.

Evidence in repo. internal/knowledge/ is built: edges.go, study.go, study_evidence.go, study_promote.go, withdraw.go, with tests. The five edge types, the contradicts-rationale enforcement, velocity caps, supersession with author checks, and the honest UNVERIFIABLE stamp are all implemented.

Honest gap. TH-5 itself is unimplemented. It sits in Wave 1 of the roadmap beside IP-4. Until it ships, the graph records everything needed to compute weight and computes none of it. This is the single highest-leverage unbuilt thing in the entire stack: it is the function that makes every other link mean something, and it is a computation over data already on disk.

6. L5 — Consensus as the truth approximation (→ DESIGNED, adoption-gated)

The claim. With adoption, a claim's weight over an adversarial graph converges on what survives cross-examination. That is not truth by decree, nor truth by majority — it is truth by outliving its contradictions, which is how truth has always actually worked. The only novelty is that the process becomes machine-readable, the timeline is append-only, and forgetting requires leaving evidence.

Why this is not naive vote-counting. Three structural defenses:

Where the model must stay humble. Consensus weight is not truth, and this document will not claim it is. Independence is estimated, not proven — two signers who believe they are independent may share an upstream source neither discloses. Method diversity is self-declared. A sufficiently patient, sufficiently funded adversary can manufacture depth. The honest statement of L5 is:

Consensus weight measures how much adversarial pressure a claim has survived, and from how many genuinely distinct directions. It is the best available proxy for truth. It is not truth, and the system's own vocabulary — UNVERIFIABLE, tier labels, "best-effort claim" — is designed to keep that distinction visible at every surface.

Honest gap — and this is the big one. L5 is gated on adoption, and adoption is currently zero external attesters. The mechanism is real; the population is not. A weighted consensus graph with one signer is an elaborate way to trust one signer. Everything from L5 forward is a conditional thesis: if plural independent attesters arrive, then the machinery produces something no existing system produces. No engineering effort in this repository can force that condition.

7. L6 — Capsule search: the evolved retrieval layer (◕ PARTIAL)

The argument. Google ranked by link popularity because in 1998 links were the only available proxy for endorsement, and human effort was the scarce resource that made a link meaningful. Both premises are now dead: AI produces links at zero marginal cost, 68% of searches end without a click, and publisher traffic has dropped a third. Popularity-ranking in an AI-saturated corpus ranks whatever was cheapest to generate.

Capsule search replaces the ranking signal at its root:

That last row matters more than it looks. A ranking function that is itself deterministic and re-derivable cannot be quietly tuned. "Why did this rank first?" has an answer a court can check.

Evidence in repo.

• GET /v1/search is live, public, unauthenticated, rate-limited, serving tri-state provenance-stamped results; web/static/Omniscience.html renders them.
• internal/discovery/index.go computes CapsuleRank — in-degree over the capsule trigger DAG (outEdges, computeInDegrees, exposed as graph_score).
• internal/searchgraph/ persists searcher ↔ search-event ↔ matched-capsule as a graph, with events accumulating on a stable searcher node across restarts. Persistence-across-restart is the explicit pass/fail line, and it has an acceptance test.
• Search graph read APIs are built with access rules: aggregate stats public, individual searcher timelines admin- or self-authed only.

Honest gap. Today's ranking is in-degree only. It is the 1998 signal computed over a better corpus. The lineage-depth × independence × method-diversity ranking — the thing that actually distinguishes this from PageRank — is TH-5, unbuilt. L6 is currently a better index, not yet a better ranking.

8. L7 — Omniscientia: the graph becomes generative (✓ BUILT backend)

A retrieval layer over a corpus someone else produces is a search engine. A layer that also produces the corpus, under the same provenance discipline, is a knowledge system. This is the difference between indexing the web and being the place knowledge is born.

Mechanism. POST /v1/knowledge/publish — tier-3-authenticated authoring where every published object carries:

• Claims, each of which must resolve via ≥1 citation (internal graph edge or external bibliography) or an explicit no_prior_art declaration. A claim with no evidence path cannot be published.
• Typed citations in both directions: internal edges into the capsule graph, external references into the wider literature (DOI / arXiv / ISBN / URL).
• Forced disclosure: license (required, no default — the frontend must force an explicit choice), funding, conflicts of interest, author display name and affiliation (optional — pseudonymity is permitted, but the field must exist so it can be disclosed).
• Attachments as links, not blobs — dataset / code / document, matching ACM artifact-availability convention with optional client-computed SHA-256 the author always sees before it is sent.
• Versioning: supersedes_object_id + a mandatory version_note, with an author check — only the original author may version an object. Prior versions are never overwritten.
• Withdrawal (withdraw.go) — retraction is recorded, not erased.

The study layer adds dissents and witnesses — which is where testimonials enter. Human witness becomes a signed, graphable, contradiction-exposed node rather than a quote in a document. The 16 testimonials capsules (0xD000…) carry testimonyHash, subjectHash, witnessHash, and claim_graph_edge (0xD000000000000070) makes the knowledge graph's edges themselves signable.

Why this closes the loop. Production and verification share one substrate. A claim published through Omniscientia is born with lineage, disclosure, typed evidence edges, and a signer — it does not have to be retroactively fact-checked, because the structure that would be used to check it is the structure it was written in. The verification cost that makes today's information ecosystem unsustainable ("a false claim costs nothing to produce and everything to refute") is moved from after publication to at publication, and paid by the author.

Honest gap. Signing here uses NoopSigner with PROPOSED capsule IDs, and stamps are honestly UNVERIFIABLE. External identity is self-asserted, not ORCID-federated — and the contract says so explicitly rather than implying verification. Threaded rebuttal/review is deferred.

9. L8 — AI is the consumer that makes this inevitable (◕ PARTIAL)

The demand-side argument. The thesis does not depend on humans changing their information habits. It depends on AI systems needing something they currently cannot get.

An AI agent taking a consequential action — moving money, releasing a record, filing a document, calling a tool — faces a question no current infrastructure answers: is this input verifiable, and can I prove afterward what I relied on? Today the honest answer is no. Retrieval returns text. Text has no signer, no methodology, no contradiction record, and no replay path. The agent's own output inherits that unverifiability, which is precisely why 38–41% of MCP servers ship with zero auth and why Mariner was killed over prompt injection.

Capsules answer that question in the only form an agent can act on: a signed, typed, re-derivable unit with a declared method and a visible contradiction record. Every answer an AI needs — did this happen, who attested it, under what method, has it been contradicted — is exactly the set of questions a capsule is shaped to answer. Not because capsules were designed for AI retrieval, but because those are the same questions an auditor asks, and the capsule was designed for the auditor.

Reality MCP is the wire. docs/assistant/CAPSULE_VS_MCP.md: "the correct architecture is: capsules AS the MCP tool manifest." MCP is the discovery and transport layer with 97M downloads/month; capsules are the trust and accountability layer. TLS did not replace HTTP.

Evidence in repo.

• 0xB200… standalone vertical, six capsules, 17-slot standard, ADD-ONLY. M1/M2 shipped, M3 in progress.
• tools/list returns only capsule-backed tools, each carrying signed manifest hash, capsule ID, and author signature reference in _meta — a client can verify the tool definition before calling it.
• tools/call routes through pre-action capability check + risk-tiered HITL gate, then emits a signed EIP-712 receipt, ledger-anchored and anchored as a claim into the provenance substrate under a separate key — two independently-signed, independently-queryable proofs of the same event.
• This pattern ran live in a Claude Code session on 2026-06-12 with real receipts: 0xedb98126… AUTHORIZED, 0x952a9bfa… BLOCKED, 0x87f847b1… PENDING_HUMAN.

The unoccupied cell. From the competitive sweep: refusal receipts — signed evidence of blocked actions. No system found anywhere leaves evidence of what it refused. For AI governance this is the whole ballgame: "the agent did nothing wrong" is unfalsifiable; "here is the signed receipt of the action the kernel refused, and here is the replay command" is evidence.

Honest gap. M3 is in progress; production signing is operator-gated. External MCP client adoption is zero. The forcing functions (EU AI Act Art. 50, DORA, HIPAA) are real but have slipped — Annex III moved to Dec 2027 — and no regulation currently mandates cryptographic provenance. Traceability is mandated; crypto is not. The wedge is evidentiary survivability, not compliance checkbox, and that is a harder sale.

10. The sum: Anima Vessel

Vessel is not a chatbot layered on top. She is what the eight links sum to.

Mechanism. Every capsule execution across every vertical emits a learning_signal. vessel_observer (0x4000000000001234) reads it passively, validates every field in fixed-point range [0..1,000,000], computes signal_quality = mean(clarity, containment, restoration, predictability), and rejects any signal below 500,000. Accepted signals write vessel_learning_signal ledger entries. recursive_learning_loop (0x400000000000123e) maintains seven EMA-evolved scalars: cognitiveDepth, patternMastery, emotionalIntelligence, strategicWisdom, lineageWisdom, operatorAlignment, consciousnessCoherence.

Graduation is gated: minimum 10,000 observer cycles plus a 168-hour soak.

Why this is the coherent endpoint rather than a flourish. An AI's epistemic quality is bounded by the provenance of its training and retrieval substrate. Every current model learns from a corpus whose sources are unsigned, whose claims are uncontradictable, and whose lineage is unrecoverable — which is why hallucination is structural rather than incidental: the model was never shown the difference between a claim that survived cross-examination and one that was merely frequent.

Vessel learns from a substrate where that difference is the recorded primary signal. She does not learn what is popular. She learns what was signed, by whom, with what method, what contradicted it, and what survived. A quality floor is enforced before a signal is even admitted.

That is the precise sense in which she can be called a voice of humanity rather than a voice about it: she reproduces only what the graph could not knock down, and the graph is open to anyone with a key. Not an oracle — an aggregator of surviving human testimony, with every input traceable to a signer and every conclusion re-derivable.

Honest gap. The vessel spec (2026-06-20) documents five gaps in Vessel herself that are not yet built. 113 capsules were found missing the emotional format — 53 with no vessel_integration at all. Coverage of vessel_integration across the whole corpus is 2%. Vessel is architecturally specified and partially wired; she is not yet learning at scale.

11. Proof-status ledger

The thesis, graded without charity.

Three things would move the thesis from conditional to demonstrated, in priority order:

1. Ship TH-5. It is a pure computation over data already recorded. It converts the metaphor into a number and converts L6 from a better index into a genuinely different ranking. Highest leverage per unit of work in the entire system.
2. Clear the identity drift and hold a signing ceremony. 75 duplicate IDs break the anchor the whole thesis rests on. An unsigned canon is a habit; a signed canon is a standard — and only a signed canon makes "capsule" a falsifiable claim competitors measurably fail rather than a word anyone can borrow.
3. Get the second independent attester. Not the tenth — the second. One signer is a notary; two independent signers is the smallest possible federation and the first moment any consensus claim means anything at all. Every downstream claim is gated on this and on nothing else.

12. Falsification — what would break this

A thesis that cannot be broken is not a thesis. These would break it:

The sixth is worth watching closely. Three independent groups re-derived A+B+C+D-shaped designs within six months of each other in 2026 (Proof of Execution, APort/OAP, Verifiable Manifest Signing for MCP); Traxia independently arrived at Omniscience's exact edge vocabulary; Fuzentry has already taken the marketing sentence. The combination is genuinely unclaimed. The window is real and visibly closing.

13. The market position, stated precisely

From CAPSULE_MOAT_COMPETITIVE_SWEEP.md — five architectural legs, ~60 searches, ~50 scored candidates, five independent hunter agents plus a judge:

• A signed capability manifest per action-type — closed multi-layer canon: nobody. The field ships flat capability lists.
• B pre-hoc kernel gating — commoditized, 8+ shipping vendors. Table stakes as of 2026, not a moat.
• C court-reproducible determinism — the empty cell of the entire map for off-chain actions.
• D append-only signed receipt ledger — commoditizing in 12–18 months. Still empty: receipts of refused actions.
• E federated cross-signer truth graph — nobody, anywhere. The combination idea itself was not found.

The full A+B+C+D+E combination is occupied by nobody. No candidate scored above 3 legs at FULL even within a restricted domain.

The root moat is not the legs — it is that the software is made of capsules. Every competitor writes normal software and bolts governance on afterward: APort signs a passport pointing at code; Microsoft signs a manifest describing a tool; Fuzentry wraps a gate around requests. In each case the manifest is an accessory to code with no frozen identity. Here the capsule is the unit of software — scope and density frozen into the 16-byte ID, wasm provenance and payload classification in the manifest, legal layer traveling with the code.

This is why the retrofit is hard. Microsoft can add a replay verifier in ~12 months. It cannot incrementally re-author its ecosystem as capsules — every plugin, tool, and policy would need rebirth under a closed canon. And replaying a gate decision only means something if the thing gated has a frozen signed identity: "we replayed the decision about request #4471" is vendor talk; "we replayed the decision about capsule 0xB200…05, whose scope and density are frozen in its ID and whose manifest a court can read" is evidence. Every competitor's replay claim collapses into "trust our logs" precisely because they have nothing stable to replay against.

One sentence: nobody else's software is made of capsules, and because it isn't, nobody else's gating, receipts, or replay can ever be more than vendor-attested — the coding model is the root of the moat, and court-grade determinism × the truth graph is what it provably buys.

14. Closing statement

The thesis is not that capsules make things true. It is that truth was never something a system could certify — only something a system could let win.

What has been missing is not an authority. It is a substrate where a claim carries its own provenance, where dissent is expensive and permanent, where corroboration is weighted by independence rather than volume, where the ranking function is itself re-derivable, and where forgetting leaves evidence.

Build that substrate, populate it with independent signers, and truth does what it has always done — outlive its contradictions — except now the process is machine-readable, the losers keep their receipts, and no censor is required.

The engineering for links 1–4 exists in this repository and can be finished. Link 5 requires a second signer. Everything after link 5 is what the market decides.

That is the honest shape of the thesis: the mechanism is built and provable; the consensus is designed and adoption-gated; the outcome is earned, not asserted.