{"slug":"oip-amendment-protocol","title":"BOOK IX — THE AMENDMENT PROTOCOL: self-revision, chained, complete text","body":"## BOOK IX — THE AMENDMENT PROTOCOL\n\n*New in v3.0. A₁₂ requires that the structure revise itself; A₁₂ equally requires that it never revise silently. This book is the governance of the document you are reading — the self-altering mechanism, chained.*\n\n## The Document Is an Object\n\nThis document is an object under its own grammar (Book VI): it has a contract (this book), a proof path (its version ledger), tests (Book X's surfaces), and a repair loop (the amendment classes below). Accordingly:\n\n**IX.1 — Append-only versioning.** No version of this document is ever destroyed or edited in place. Every amendment produces a new version with lineage to its predecessor. A silent edit is a forged receipt, and a forged receipt anywhere voids trust everywhere.\n\n**IX.2 — Mandatory changelog.** Every version ships its changelog — every non-trivial editorial decision declared, with rationale. A document about auditable systems that cannot itself be audited is a one-way mirror.\n\n**IX.3 — Typed claims.** Every claim in the document carries one of four types — *axiom*, *derivation*, *observed*, *open* — and every *observed* claim carries a freshness window. This typing is what makes amendment tractable: you cannot correctly revise what you have not correctly typed.\n\n## The Amendment Classes\n\nEvery proposed change is one of four classes, each with its own bar:\n\n**Class P — Patch.** Compression, clarity, cross-reference, typo. The semantic diff must be empty: a patch that changes what the document claims is a misfiled revision and is rejected as a patch. Bar: the compression axiom — fewer moves, same load.\n\n**Class R — Revision.** Changes a *derivation* or *observed* claim. Bar: an attack per Book X's protocol that survived — exact claim named, surface named, type classified, full-scope accounting shown, minimum patch proposed. The revision *is* the minimum patch of a surviving attack. No surviving attack, no revision: the document does not change to taste.\n\n**Class E — Extension.** Adds structure — a book, a doctrine, an axiom. Bar, threefold: the addition must ship its own falsification conditions (an unfalsifiable extension is decoration); it must pass the **anti-bloat rule** — added load must exceed added length, accounted in the changelog (this is how \"make it longer\" and \"keep it compressed\" reconcile: length is permitted exactly where it carries proportional load); and if the extension is an axiom, it must survive A₀ — published with its negation and the reason the negation collapses.\n\n**Class X — Reversal.** Removes or inverts an axiom. Bar: the full attack protocol at the axiom's dependency depth, plus explicit accounting of everything downstream that falls with it (per Appendix A's map). And one exclusion, absolute: **A₄ is not amendable.** A structure that can amend its own moral floor under pressure has no floor — it has a price. The kill switch is the one place where self-alteration is prohibited *by the self-alteration protocol itself*, and the prohibition is the protocol's proof of seriousness: a document that reserves nothing reveres nothing. If A₄ falls, the document does not get revised. It gets refuted, and its refutation should be published with the same lineage discipline as its versions.\n\n## The Review Recursion\n\nModeled on the running loop of Book VI, installed here:\n\n**IX.4 — Zero-context review.** On a declared cadence, the document is submitted to zero-context readers — human or model — who score it on two separate axes: clarity (can a cold reader operate the structure from the text alone?) and conformance (does the document obey its own rules — typed claims, fresh windows, declared nodes, compressed prose?). Scores and named gaps are ledgered.\n\n**IX.5 — Failing review queues revision.** A score below the declared threshold queues a Class P or Class R amendment targeting the named deficiency. A gap named by a reviewer — a concept the document needs and lacks — queues a Class E extension, which then enters the same review cycle. The document grows where its readers demonstrate its absence, not where its author enjoys its presence.\n\n**IX.6 — Freshness enforcement.** Every *observed* claim is re-verified within its freshness window. A stale *observed* claim is automatically demoted to *open* — not deleted, demoted — until re-verified. The existence proof of Book VI is the first client of this rule: its claims about the running build expire and must be re-receipted, because a philosophy citing a dead build as live evidence is exactly the declared-success-without-receipts that Book III calls capture.\n\n**IX.7 — The objection ledger is live.** Settled objections (Book IV) are carried in the document with their answers. An entry is settled only while its answer survives; any attacker may reopen an entry by showing the answer stale or the design changed. A ledger that cannot be reopened is dogma in rigor's costume.\n\n## The Capture Guard\n\nThe amendment protocol is itself a system, and systems get captured. Three guards:\n\n**IX.8 — Amendment by protocol, not by position.** No steward, including the original author, may amend outside the classes and bars above. The author's advantage is proximity, not privilege: their amendments face the same protocol.\n\n**IX.9 — The fork rule.** If a steward refuses the minimum patch of a surviving attack, the correct move is not surrender and not sabotage — it is **fork with declared lineage**: a new version line, publicly derived, carrying the surviving patch, with the refusal documented in its changelog. The protocol can be routed around, but only in the open. A secret fork is a capture; a declared fork is a check. This rule is Book III's checking network applied to the document itself: no single steward, including the maker, is the load-bearing structure — the lineage discipline is.\n\n**IX.10 — Recursion audit.** The review loop itself is reviewable: its cadence, thresholds, and reviewer selection are declared, ledgered, and amendable under Class R. A self-review loop whose parameters are hidden is a one-way mirror at the meta-level — and surface S8 (Book X) is the standing invitation to attack it.\n\nThis book is the difference between a philosophy and a living protocol. v1 declared. v2 organized and armed. v3 breathes on a ledger: strained by cold readers, fractured on schedule, repaired with lineage, forkable in the open, and reserved in exactly one place — the floor.\n\n---\n\n## The shelf\n\nPrevious: [Book VIII — Beyond Incentive](/a/oip-beyond-incentive)\nNext: [Book X — Falsification, with Appendices A–D](/a/oip-falsification)\nRoot: [The Total Structure](/a/oip-total-structure)\n\nThis page carries the text of THE TOTAL STRUCTURE v3.0 (Grand Unified) verbatim — the author's words, unabridged. Version 1 of this slug holds the earlier compressed edition, preserved append-only.","register":"oip_protocol","tags":["oip","object-invocation-protocol","protocol-specification","machine-native-json","dynamic"],"style":{"accent":"#16324f","measure":860},"claims":[{"id":"oip-c1","tier":"system","text":"The OIP article layer is generated from live directory rows, so it documents the objects that actually run the reference implementation.","who_claims":"system/oip_articles","source_ids":["oip-s3","oip-s4"]},{"id":"oip-c2","tier":"system","text":"The OIP operating path is caller to directory object to dispatch runner to invocation ledger to receipt.","who_claims":"system/oip_articles","source_ids":["oip-s1"]},{"id":"oip-c3","tier":"system","text":"Every executable capability in the reference implementation is reachable as an OIP object with a human article, a machine document, invocation history, and receipt path.","who_claims":"system/oip_articles","source_ids":["oip-s2","oip-s3"]},{"id":"oip-c4","tier":"system","text":"Tap & Go is the copy primitive: one drop carries credential, protocol, tree, search, execute, and receipt instructions without a separate token-map-bundle assembly step.","who_claims":"system/oip_articles","source_ids":["oip-s2"]},{"id":"oip-c5","tier":"system","text":"OIP receipts are the proof object for actions: they record request, response, actor, links, replay, repair, and lineage.","who_claims":"system/oip_articles","source_ids":["oip-s2","oip-s5"]}],"sources":[{"id":"oip-s1","type":"protocol","title":"BUILD_SPEC object invocation path","url":"https://miscsubjects.com/api/file/docs/BUILD_SPEC.md","summary":"Defines directory rows, dispatch, ledger, and the escalation path for changing the build.","quote":"Run anything: POST https://miscsubjects.com/api/dispatch {key, body}","claim_ids":["oip-c2"],"link_status":"ok","hash":"oipbuildspec0001"},{"id":"oip-s2","type":"protocol","title":"Object Invocation Protocol spec","url":"https://miscsubjects.com/api/file/docs/OIP.md","summary":"Defines OIP surfaces, invariant loop, receipt/replay/repair, and invocation envelopes.","quote":"identify, explain, invoke, ledger, yield","claim_ids":["oip-c3","oip-c4","oip-c5"],"link_status":"ok","hash":"oipspec00000002"},{"id":"oip-s3","type":"protocol","title":"Live OIP capability tree","url":"https://miscsubjects.com/api/dispatch?map=1&format=markdown","summary":"Public recursive capability tree.","quote":"root > shelf > system article > capability article > receipt","claim_ids":["oip-c1","oip-c3"],"link_status":"ok","hash":"oipmap0000000002"},{"id":"oip-s4","type":"protocol","title":"Directory row documentation","url":"https://miscsubjects.com/api/dispatch?key=OIP_TREE&format=markdown","summary":"Capability articles are generated from live rows.","quote":"Machine Contract","claim_ids":["oip-c1"],"link_status":"ok","hash":"oiprow0000000003"},{"id":"oip-s5","type":"protocol","title":"Invocation ledger","url":"https://miscsubjects.com/api/invocations","summary":"Append-only invocation records and receipt links.","quote":"invocations","claim_ids":["oip-c5"],"link_status":"ok","hash":"oipinvocations0005"}],"prov":{"model":"system/oip_articles","action":"generate"},"shelf":{"kind":"total_structure_shelf","reads_as":"The OIP source philosophy, machine-traversable. Walk next until null; every stop has human, json, and bundle routes; voxel graph at /api/articles/oip/voxels.","position":10,"of":11,"this":{"slug":"oip-amendment-protocol","book":"BOOK IX","title":"The Amendment Protocol — self-revision, chained","human":"/a/oip-amendment-protocol","json":"/api/articles/oip-amendment-protocol","bundle":"/api/articles/oip-amendment-protocol/bundle?format=markdown"},"prev":{"slug":"oip-beyond-incentive","book":"BOOK VIII","title":"Beyond Incentive — the wall and the guardian","human":"/a/oip-beyond-incentive","json":"/api/articles/oip-beyond-incentive","bundle":"/api/articles/oip-beyond-incentive/bundle?format=markdown"},"next":{"slug":"oip-falsification","book":"BOOK X","title":"Falsification — eight surfaces, attack protocol, appendices","human":"/a/oip-falsification","json":"/api/articles/oip-falsification","bundle":"/api/articles/oip-falsification/bundle?format=markdown"},"root":{"slug":"oip-total-structure","book":"ROOT","title":"THE TOTAL STRUCTURE — Grand Unified Protocol","human":"/a/oip-total-structure","json":"/api/articles/oip-total-structure","bundle":"/api/articles/oip-total-structure/bundle?format=markdown"},"all":[{"order":1,"slug":"oip-total-structure","book":"ROOT","title":"THE TOTAL STRUCTURE — Grand Unified Protocol","human":"/a/oip-total-structure","json":"/api/articles/oip-total-structure","bundle":"/api/articles/oip-total-structure/bundle?format=markdown"},{"order":2,"slug":"oip-ground","book":"BOOK I","title":"Ground — the twelve axioms and the moral floor","human":"/a/oip-ground","json":"/api/articles/oip-ground","bundle":"/api/articles/oip-ground/bundle?format=markdown"},{"order":3,"slug":"oip-obligation","book":"BOOK II","title":"Obligation — capability creates debt","human":"/a/oip-obligation","json":"/api/articles/oip-obligation","bundle":"/api/articles/oip-obligation/bundle?format=markdown"},{"order":4,"slug":"oip-terrain","book":"BOOK III","title":"Terrain — the four states and the decay clock","human":"/a/oip-terrain","json":"/api/articles/oip-terrain","bundle":"/api/articles/oip-terrain/bundle?format=markdown"},{"order":5,"slug":"oip-method","book":"BOOK IV","title":"Method — trace, install, and prove the invariant","human":"/a/oip-method","json":"/api/articles/oip-method","bundle":"/api/articles/oip-method/bundle?format=markdown"},{"order":6,"slug":"oip-machine-plane","book":"BOOK V","title":"The Machine Plane — receipts, surety, the command plane","human":"/a/oip-machine-plane","json":"/api/articles/oip-machine-plane","bundle":"/api/articles/oip-machine-plane/bundle?format=markdown"},{"order":7,"slug":"oip-object-grammar","book":"BOOK VI","title":"The Object Grammar — the doctrine the build proved","human":"/a/oip-object-grammar","json":"/api/articles/oip-object-grammar","bundle":"/api/articles/oip-object-grammar/bundle?format=markdown"},{"order":8,"slug":"oip-the-designer","book":"BOOK VII","title":"The Designer — maker-system identity","human":"/a/oip-the-designer","json":"/api/articles/oip-the-designer","bundle":"/api/articles/oip-the-designer/bundle?format=markdown"},{"order":9,"slug":"oip-beyond-incentive","book":"BOOK VIII","title":"Beyond Incentive — the wall and the guardian","human":"/a/oip-beyond-incentive","json":"/api/articles/oip-beyond-incentive","bundle":"/api/articles/oip-beyond-incentive/bundle?format=markdown"},{"order":10,"slug":"oip-amendment-protocol","book":"BOOK IX","title":"The Amendment Protocol — self-revision, chained","human":"/a/oip-amendment-protocol","json":"/api/articles/oip-amendment-protocol","bundle":"/api/articles/oip-amendment-protocol/bundle?format=markdown"},{"order":11,"slug":"oip-falsification","book":"BOOK X","title":"Falsification — eight surfaces, attack protocol, appendices","human":"/a/oip-falsification","json":"/api/articles/oip-falsification","bundle":"/api/articles/oip-falsification/bundle?format=markdown"}]}}