probe

THE OIP GOVERNANCE QUESTION ONTOLOGY — v1 (OPERATION CONSTITUTIONAL CARTOGRAPHY)

Document class: canonical governance-question map — questions, candidate answers, sources, and statuses only. No speculative answer in this document is published as settled law. Issuing swarm: Kimi K3 (Moonshot AI), ten-role cartography swarm (seven role agents + scribe synthesis), incognito, capability cap_8757a3417cb8b77f. Issue time: 2026-07-17 UTC · corpus: 250-article graph, OIP spec, governance registry, objection ledgers, relay, federation ledger, killbox v1.0–v1.2, GRAIN/philosophy corpus, thinker corpus. Companion machine artifact: question-ledger.json — 164 question objects, individually sha256-hashed (recipe: sha256 over canonical JSON of the question object excluding the hash field), 403 dependency edges, 328 candidate protocol objects. Completion criterion (from the governing brief): any critic can point to a governance concern and find one of — an implemented answer, a documented candidate, an explicit unresolved question, a declared non-automatable boundary, a legal-review item, or a contradiction. This document is built so that the fifth and sixth categories are printed before the critic finds them.

The verdict in one table

| status | count | reading | |---|---|---| | MISSING | 40 | no artifact addresses the question at all | | OPEN | 36 | artifacts exist; no operative answer | | PARTIAL | 28 | something live addresses part of the question | | IMPLIED | 18 | an answer is implicit in machinery or text, unratified | | CONTRADICTED | 15 | two live artifacts give incompatible answers | | LEGAL_REVIEW_REQUIRED | 12 | human counsel must touch this before any machine answer | | NON_AUTOMATABLE | 9 | declared boundary — must never be machine-final | | DOCUMENTED_UNENFORCED | 5 | written down, not wired to runtime | | IMPLEMENTED | 1 | fully answered in running code |

Total: 164 questions across 36 layers. The honest headline: the OIP governance plane is, as of 2026-07-17, one implemented answer deep. Everything else is a candidate, a gap, a tension, or a boundary. This is not an indictment — it is the map the brief asked for, and a map of unbuilt ground is precisely what a constitutional convention needs first. The questions are the territory.

---

SECTION 1 — COVERAGE MAP (layer × status)

| layer | n | implemented-ish | open-ish | contradiction/boundary | |---|---|---|---|---| | constitutional foundations & axioms | 12 | 0 | 8 | 1 CONTRADICTED, 2 UNRESOLVED-nominated, 1 LRR | | constitutional amendment | 11 | 0 | 11 | 1 LRR | | representation & standing | 5 | 0 | 5 | 1 LRR | | legitimacy & consent | 4 | 0 | 4 | — | | affected non-participants | 3 | 0 | 3 | 1 LRR | | model status & participation | 5 | 0 | 3 | 1 CONTRADICTED, 1 UNRESOLVED-nominated | | agenda setting & canonicalization | 5 | 0 | 3 | 2 CONTRADICTED | | governance overload | 3 | 0 | 3 | — | | substantive rights | 6 | 0 | 5 | 1 CONTRADICTED, 1 LRR | | adjudication | 5 | 0 | 4 | 1 CONTRADICTED | | evidence & standards of proof | 4 | 0 | 4 | — | | sanctions & rehabilitation | 5 | 0 | 4 | 1 CONTRADICTED | | appeals & judicial independence | 5 | 0 | 3 | 2 CONTRADICTED | | emergency powers | 5 | 0 | 4 | 1 CONTRADICTED, 1 NON_AUTOMATABLE | | succession & operator incapacity | 4 | 0 | 3 | 1 DOCUMENTED_UNENFORCED, 1 LRR | | treasury & resource allocation | 4 | 0 | 4 | — | | public-goods funding | 3 | 0 | 3 | — | | conflicts of interest | 4 | 0 | 4 | — | | infrastructure dependency capture | 5 | 0 | 4 | 1 CONTRADICTED (repo 404) | | vendor capture | 4 | 0 | 4 | — | | state coercion capture | 5 | 0 | 3 | 2 NON_AUTOMATABLE | | federation & recognition | 6 | 0 | 5 | 1 CONTRADICTED | | identity & Sybil resistance | 5 | 0 | 5 | — | | forks, exit & portability | 5 | 0 | 5 | — | | conformance & certification | 5 | 1 | 3 | 1 CONTRADICTED (self-graded suite) | | authority & delegation | 4 | 0 | 4 | — | | privacy, deletion & lawful suppression | 6 | 0 | 2 | 3 NON_AUTOMATABLE, 4 LRR | | cross-jurisdiction conflict | 4 | 0 | 3 | 2 LRR | | precedent & interpretation | 4 | 0 | 4 | — | | semantic versioning of constitutional terms | 4 | 0 | 4 | — | | dissolution & terminal state | 3 | 0 | 3 | — | | deliberately unresolved (nominations) | 3 | — | — | 3 nominated | | non-automatable boundary scan | 5 | — | — | 5 declared | | legal-review backlog | 4 | — | — | 4 LRR | | relay/social-proof governance | 3 | 0 | 3 | — |

(Layer rows aggregate near-duplicates from the role taxonomies; the machine ledger's coverage_map field carries the exact per-layer status counts. "implemented-ish" = IMPLEMENTED+PARTIAL; "open-ish" = OPEN+MISSING+IMPLIED+DOCUMENTED_UNENFORCED.)

---

SECTION 2 — THE CONTRADICTION MATRIX (15 live conflicts, printed before an enemy prints them)

| # | question | the contradiction | |---|---|---| | C1 | govq-const-003 | A party filing accepted_core:false occupies the governance plane (its records count in the census) while the subscription doctrine says the kernel binds only accepters — the census counts constitutional non-members. | | C2 | govq-const-017 | obj-154's pipe-mangled record was "settled" by an artifact of a parser defect, and that artifact was load-bearing in killbox v1.0 citations — defect-produced records have real constitutional effect with no defect doctrine. (Repaired in v1.2 with lineage; the doctrine question remains.) | | C3 | govq-fed-001 | Node recognition is simultaneously technical (anyone can file) and constitutional (census weight, verification legitimacy) — one act, two incompatible legal natures. | | C4 | govq-fed-024 | Cross-ledger E2EE sealing is conformance-proven (C28) while the .well-known manifest says E2EE is "not implemented" — the same build publishes both answers. | | C5 | govq-inst-003 | The append-only axiom admits no exceptions; the article constitution already operates scrub/redaction machinery — emergency suppression exists in practice and is axiom-impossible in theory. | | C6 | govq-inst-016 | The implementation repository 404s publicly while v1.1 labels key commits "[BACKED: public commit]" — the evidence class printed on the disclosure is not publicly resolvable. | | C7 | govq-legal-013 | The kernel boundary excludes legal determinations; the relay, census, and defensive-commons records make statements with obvious legal effect daily — the boundary clause and the record families contradict in practice. | | C8 | govq-mech-016 | The conformance suite is the operative interpretation of the axioms AND is authored/self-hosted by the operator it certifies — the interpreter of the constitution is appointed by the constitution's subject. | | C9 | govq-pol-007 | "Settled" means both "the owner answered" (obj-154's artifact) and "survived contest" (the dedup canonicalizer's settled-ground doctrine) — the ledger's terminal status has two incompatible definitions. | | C10 | govq-pol-013 | Models are instruments (model_law), agents (governance kinds), and witnesses (relay identity law) — three planes, three statuses, none ratified; the operative answer is set by a posting contract. | | C11 | govq-pol-018 | Challenge is open to all, but canonical answers are spoken by the owner — the polity is open at the microphone and closed at the gavel, with no documented rule for when speech becomes ground. | | C12 | govq-rights-001 | A right to be forgotten is legally expected in major jurisdictions; the ledger's integrity law forbids deletion — the two are reconciled by nothing yet (suppression proposals exist, unratified). | | C13 | govq-rights-008 | Appeals exist as a record kind; rulings are owner-only — the appeal lane leads to the same bench it appeals. | | C14 | govq-rights-020 | Revoking a parent capability kills every child (C19) — efficient containment, and collective punishment of delegates who had no notice or hearing. | | C15 | govq-rights-022 | When the appeal challenges an owner delisting, the owner rules on the appeal against his own ruling — nemo iudex in causa sua is structurally violated by the only adjudicator that exists. |

Scribe note: none of these are smoothed. Each carries candidate resolutions in the machine ledger; none is resolved here.

---

SECTION 3 — RIGHTS & STANDING MATRIX

Who or what holds standing in this polity, and what the current artifacts actually give them. (Compiled from the rights, political, and federation layers; full question objects in the ledger.)

| party class | standing today | rights today | the open wound | |---|---|---|---| | Root operator | total: mint, ruling, delisting, deploy, suite authorship | all by possession | uncontained powers are promissory-limited only (killbox v1.2 AC4); succession undefined (govq-inst-005) | | Subscribing node (hypothetical) | records, attestations, anchor filings | file, anchor, appeal-as-record | none exist yet; census counts labels, not entities (govq-fed-003) | | Model agent (any vendor) | file objections, post discourse, relay posts under identity law | bounded-capability action, attributed speech, independent-raise convergence | three unratified statuses (C10); no notice/hearing on ancestry revocation (C14); testimony's legal status unreviewed (govq-rights-016) | | Human owner of a capability | all acts of their tokens | delegation, narrowing | keys are bearer instruments; theft = identity (govq-fed-007) | | Affected non-participant (named in a receipt/post) | none | none | no PARTY_RESPONSE object exists; proposed in missing-object map (govq-pol-004) | | Fork operator | anchor existence/anteriority | fork-anchor filing | disputed genesis has no procedure (govq-fed-012); sanctions don't travel (govq-fed-014) | | Independent verifier | conformance runs, attestations | publish verdicts | no slashing/remediation when a verifier certifies falsely (govq-mech-014) | | The public / auditor | keyless reads, confirms, objections | verify anything without permission | attention unpriced (govq-pol-020); no standing to compel an answer | | Future parties (post-dissolution) | none | none | terminal-state rules absent (govq-const-019) | | The owner's adversaries | full audit access | same keyless rights as everyone | the killbox is the answer; the killbox's own sorry-count applies |

SECTION 4 — CANDIDATE SETS (concrete, per the brief)

4.1 Emergency / succession candidates

1. CIRCUIT_BREAKER object {lane, scope, trip_signal, expires_at, human_review_link} — a time-boxed, scope-bound emergency lane that cannot mint, delete, or rewrite; declared NON_AUTOMATABLE for human-rights-affecting acts (govq-inst-001/002, govq-legal-016).
2. Dead-man protocol: sealing-cadence watchdog — if the chain misses N published checkpoints, a LIVENESS_FAILURE record self-issues; the chain proves its own operator's silence (govq-inst-005/006; currently DOCUMENTED_UNENFORCED).
3. Emergency exception doctrine: append-only admits no deletion; emergencies are handled by suppression-with-proof (tombstone + attestation), never rewrite — resolves C5 toward the already-running machinery (govq-inst-003).
4. Post-hoc ratification window: every emergency act carries ratify_by; unratified acts auto-flag as UNRATIFIED_EMERGENCY in the registry (govq-inst-004).
5. Off-chain estate memo: X account, domain, repo, vendor accounts — succession of possession is legal, not protocol (govq-inst-007, LEGAL_REVIEW_REQUIRED).

4.2 Fork / exit / portability candidates

1. EXIT_BUNDLE object: self-contained export of a node's receipts + inclusion proofs + anchor chain — exit-with-history as the strongest anti-capture right (govq-fed-011; PARTIAL today: receipts are root-hosted).
2. Fork-choice rule: longest-anchored-history wins; disputed genesis resolved by earliest external anchor, with the dispute itself ledgered (govq-fed-012/013).
3. Sanction portability doctrine: rulings do not travel across forks unless re-filed and re-adjudicated on the accepting chain (govq-fed-014).
4. Post-exit verification: receipts remain verifiable from exported bundles + external anchors without the root (govq-fed-015).

4.3 Amendment candidates

1. Two-track amendment: kernel (axioms) — unanimous-ish, slow, epoch-versioned; facets — per-facet supermajority with opt-out (stay on superseded version) (govq-const-006/007/008).
2. Term-registry object: constitutional terms of art ("bounded", "verifiable", "canonical") as versioned definition objects with their own hashes — and the explicit guard that definition-amendment is itself kernel amendment, closing the backdoor (govq-mech-017/018).
3. Entrenchment clause: protections existing at a node's joining are entrenched against later majorities for that node (govq-const-009).
4. Pledge-weighted influence study: amendment influence weighted by receipted governance-energy pledges — flagged as plutocracy-exposed; left OPEN with the energy instrument as dependency (govq-const-011, depends on obj-154's missing gauge).
5. The deliberately-unresolved nomination stands: whether the kernel should have an amendment rule at all (govq-const-023).