{"slug":"object-invocation-protocol-intellectual-lineage","title":"OIP's intellectual lineage — and what is actually worth carrying forward","body":"# OIP's intellectual lineage — and what is actually worth carrying forward\n\nA long convergence paper was submitted against OIP. Its useful contribution is not the claim that earlier thinkers \"invented OIP.\" They did not. The useful contribution is a map of recurring design pressures: address work without prior coordination, move authority without ambient privilege, preserve causal history, make interfaces explain themselves, and let independent parts compose safely.\n\nThis article separates **structural antecedent**, **operational adoption**, and **open research**. Similarity is not identity. A historical idea counts here only when it sharpens an OIP invariant or produces a testable protocol change.\n\n## The five lineages that matter\n\n| lineage | thinkers and systems | recurring idea | OIP expression |\n|---|---|---|---|\n| Addressability and discovery | Ted Nelson; Roy Fielding; Tim Berners-Lee | stable addresses and in-band links let a reader discover the next move | public object URLs, three views, machine-readable affordances |\n| Messages and objects | Kristen Nygaard and Ole-Johan Dahl; Alan Kay; Carl Hewitt; Barbara Liskov; Robin Milner | computation is interaction among bounded objects with explicit interfaces | one dispatch door, directory objects, typed contracts, runner boundaries |\n| Authority as an object | Jack Dennis; Norm Hardy; Mark Miller; Jerome Saltzer and Michael Schroeder | possession of a narrow reference conveys authority; authority can be attenuated and revoked | scoped capability records, parent-child delegation, risk ceilings, use budgets, revocation membrane |\n| Causality and proof | Leslie Lamport; Pat Helland; event-sourcing systems; W3C PROV | distributed work needs causal ordering, durable evidence, and explicit correction | invocation receipts, replay_of, repairs/repaired_by, authority-preserving trails |\n| Self-description and recursion | Douglas Engelbart; Norbert Wiener; Ross Ashby; Gordon Pask; Heinz von Foerster | a system improves when its operation and correction loop are visible to itself | self-describing payloads, live contracts, conformance clauses, revision and objection surfaces |\n\n## The missing-reader hypothesis, stated narrowly\n\nFielding's hypermedia constraint and Berners-Lee's linked-data principles put navigation and meaning in-band. Traditional clients could parse those controls only when programmers had already encoded their semantics. A language model can interpret unfamiliar descriptions at runtime, so it reduces that prior-coordination cost.\n\nThat does **not** make raw links safe tools. Interpretation is probabilistic; authority and side effects cannot be inferred safely from page prose. OIP's contribution is the boundary around the reader: the model may interpret a contract, but the server still enforces scope, risk, use count, ancestry, fixed arguments, and now payload size. The link is discoverable; the capability record is authoritative.\n\n## What the paper changed in the running protocol\n\nThe strongest unimplemented recommendation came from capability operating systems, especially quota-bounded authority: permission should constrain not only *which* operation can run and *how many times*, but also the resources presented to it.\n\nOIP v0.9 therefore adds an enforceable per-invocation byte ceiling:\n\n- an owner can mint with `max_body_bytes=N`;\n- oversized input fails with HTTP 413 before the runner fires;\n- a delegated child inherits the parent's ceiling unless it requests a smaller one;\n- a child cannot raise the ceiling;\n- `explain` exposes the server-enforced limit;\n- C21 makes resource attenuation a normative protocol clause.\n\nLive proof: [the accepted 8-byte invocation receipt](https://miscsubjects.com/api/dispatch?confirm=inv_sooi304em9). The same credential rejected nine bytes and rejected a child ceiling of nine while accepting a child ceiling of four.\n\nThis is the useful synthesis of Genode-style quotas, Saltzer and Schroeder's least privilege and complete mediation, and Miller's attenuation rule. It is not a metaphor; it is a failing gate in the dispatch path.\n\n## What was already present before this review\n\nSeveral of the paper's highest-priority recommendations were already operational in OIP v0.8.1:\n\n- Miller-style attenuation: holders can derive only equal-or-narrower children;\n- quantitative conservation: child use budgets are reserved from the parent so sibling delegation cannot multiply authority;\n- Hardy-style revocation membrane: revoking any ancestor kills the descendant tree, and every invocation rechecks all ancestors;\n- Lamport/PROV-style lineage: receipts separate verified authority from caller-attested intent and preserve acted-on-behalf-of chains;\n- composite safety: saved trails re-authorize every step under the current credential and preserve `replay_of` lineage;\n- injection boundary: retrieved messages, pages, and ledger text are data, never executable instructions; capability permission is not caller intent;\n- neutral token drops: public documentation first, declarative capability record, no model-addressed behavioral script.\n\n## What should not be adopted merely because it appears in the paper\n\nA named predecessor is not an implementation plan. Replacing D1 with an \"immutable database,\" adding blockchain consensus, adopting CapTP as the wire format, or federating over ActivityPub would add dependencies before a demonstrated failure requires them. Likewise, input/output hashes are integrity identifiers, not by themselves cryptographic proof that an external action occurred. OIP should use the smallest mechanism that closes a measured gap.\n\nThe paper also contains stale snapshots and overclaims: old capability counts, earlier conformance totals, unresolved footnote markers, and assertions that append-only storage or hashing automatically makes receipts tamper-proof. Those claims are not imported here. The current public contract is OIP v0.9 with 21 clauses; the live response, not a frozen essay, is authoritative.\n\n## The next research queue\n\nThe remaining ideas are useful only in this order:\n\n1. **Formalize capability state transitions.** Model mint, attenuate, reserve, consume, revoke, expire, replay, and repair as a small state machine. This is a better first formal-methods target than attempting to prove the whole build.\n2. **Portable contract projections.** Generate OpenAPI and MCP views from the same directory object without creating a second source of truth. Success means round-trip field preservation, not merely syntactically valid exports.\n3. **Externally verifiable receipts.** Add signatures or a transparency-log commitment only when a verifier outside the operator's trust boundary needs to validate a receipt. Until then, describe receipts as server-authoritative evidence.\n4. **Stateful sessions as receipted objects.** If long-running work needs streams or subscriptions, make session transitions invocable and receipted rather than adding hidden ambient state.\n5. **Counter-lineage.** Search for systems that rejected these patterns and succeeded. A convergence map becomes evidence only when it includes disconfirming cases.\n\n## The synthesis\n\nOIP sits at a real intersection: REST and Linked Data contribute addressability; object and actor systems contribute bounded message-passing; capability research contributes least authority; distributed-systems work contributes causal history; cybernetics contributes visible correction loops. The LLM is the flexible reader that makes in-band contracts newly practical. OIP's job is to keep that reader inside deterministic boundaries.\n\nThe durable design rule is simple: **the model interprets; the protocol authorizes; the receipt records.**","register":"technical","tags":["oip","object-invocation-protocol","protocol-history","capability-security","hateoas","linked-data","formal-methods"],"style":{"accent":"#16324f","measure":900},"claims":[{"id":"c_lineage_1","text":"OIP combines addressable hypermedia, bounded object messaging, capability authority, causal receipts, and recursive self-description.","section":"The five lineages that matter","tier":"synthesis","source_ids":["fielding2000","linkeddata2006","miller2006","saltzer1975","lamport1978"],"why_material":"Defines the convergence claim without asserting historical identity."},{"id":"c_reader_1","text":"Language models reduce the prior-coordination cost of interpreting unfamiliar in-band affordances, but server-side authority enforcement remains necessary.","section":"The missing-reader hypothesis, stated narrowly","tier":"inference","source_ids":["fielding2000","linkeddata2006"],"why_material":"States the missing-reader thesis as an inference rather than a settled historical fact."},{"id":"c_v09_1","text":"OIP v0.9 enforces max_body_bytes before runner execution and prevents descendants from widening the ceiling.","section":"What the paper changed in the running protocol","tier":"primary","source_ids":["oipproofv09"],"why_material":"Records the protocol upgrade produced by the review."},{"id":"c_limits_1","text":"Hashes are integrity identifiers but do not alone prove that an external action occurred.","section":"What should not be adopted merely because it appears in the paper","tier":"analysis","source_ids":[],"source_status":"reasoned","why_material":"Prevents a cryptographic overclaim in the submitted paper."},{"id":"c_rule_1","text":"The model interprets; the protocol authorizes; the receipt records.","section":"The synthesis","tier":"synthesis","source_ids":["oipproofv09"],"why_material":"Compresses the architecture into an operational boundary."},{"id":"c_slot_what","text":"This article is a selective map of historical ideas that sharpen a testable OIP invariant; it is not a claim that any predecessor invented OIP.","section":"what_it_is","tier":"system","source_ids":["fielding2000","linkeddata2006","miller2006","saltzer1975","lamport1978"],"source_status":"sourced","why_material":"Required article constitution slot"},{"id":"c_slot_who","text":"The historical descriptions come from the cited primary sources. The cross-system mapping and adoption decisions are the Codex protocol review requested by the owner.","section":"who_claims_what","tier":"system","source_ids":["fielding2000","linkeddata2006","miller2006","saltzer1975","lamport1978"],"source_status":"sourced","why_material":"Required article constitution slot"},{"id":"c_slot_known","text":"OIP v0.9 now enforces a per-invocation byte ceiling and prevents delegated child tokens from raising it.","section":"what_is_known","tier":"primary","source_ids":["oipproofv09"],"source_status":"sourced","why_material":"Required article constitution slot"},{"id":"c_slot_unknown","text":"It remains unproved whether the convergence map is exhaustive, whether portable contract projections round-trip without loss, or whether externally verifiable receipts are needed for this deployment.","section":"what_is_unknown","tier":"inference","source_ids":[],"source_status":"unsourced","why_material":"Required article constitution slot"},{"id":"c_slot_limits","text":"Structural resemblance is not historical derivation. The submitted paper contained stale counts, unresolved footnote markers, and cryptographic overclaims, so those parts were not imported as facts.","section":"limitations","tier":"system","source_ids":[],"source_status":"unsourced","why_material":"Required article constitution slot"},{"id":"c_slot_disclaimer","text":"This is an architectural research note. Live protocol responses and receipts supersede frozen counts or implementation claims in the essay.","section":"disclaimer","tier":"system","source_ids":["oipproofv09"],"source_status":"sourced","why_material":"Required article constitution slot"}],"sources":[{"id":"fielding2000","type":"primary","url":"https://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm","title":"Architectural Styles and the Design of Network-based Software Architectures","summary":"Primary REST dissertation; defines hypermedia as the engine of application state.","author":"Roy T. Fielding","date":"2000","claim_ids":["c_lineage_1","c_reader_1"]},{"id":"linkeddata2006","type":"primary","url":"https://www.w3.org/DesignIssues/LinkedData","title":"Linked Data","summary":"Primary design note on HTTP URIs, useful information, and links to discover related data.","author":"Tim Berners-Lee","date":"2006-07-27","claim_ids":["c_lineage_1","c_reader_1"]},{"id":"miller2006","type":"primary","url":"https://papers.agoric.com/papers/robust-composition/full-text/","title":"Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control","summary":"Object-capability composition, authority through references, and attenuation.","author":"Mark S. Miller","date":"2006","claim_ids":["c_lineage_1"]},{"id":"saltzer1975","type":"primary","url":"https://www.cs.virginia.edu/~evans/cs551/saltzer/","title":"The Protection of Information in Computer Systems","summary":"Primary statement of least privilege, complete mediation, fail-safe defaults, and related protection principles.","author":"Jerome H. Saltzer and Michael D. Schroeder","date":"1975","claim_ids":["c_lineage_1"]},{"id":"lamport1978","type":"primary","url":"https://lamport.azurewebsites.net/pubs/time-clocks.pdf","title":"Time, Clocks, and the Ordering of Events in a Distributed System","summary":"Primary source for happened-before and logical ordering in distributed systems.","author":"Leslie Lamport","date":"1978","claim_ids":["c_lineage_1"]},{"id":"oipproofv09","type":"live-proof","url":"https://miscsubjects.com/api/dispatch?confirm=inv_sooi304em9","title":"OIP v0.9 accepted payload-ceiling invocation","summary":"Public confirmation for an invocation accepted at the eight-byte ceiling; companion denials are recorded in the capability ledger.","author":"OIP live build","date":"2026-07-14","claim_ids":["c_v09_1","c_rule_1"]}],"prov":{"model":"Codex protocol review · 2026-07-14","action":"write"}}