
Each estate is developed in Lean: a dependently typed functional programming language and interactive theorem prover for writing formally verified mathematical proofs and programs.
| ESTATE | SPECIFICATIONS |
|---|---|
| SPINE | Across the Spine, every interacting entity operates as a persistent cryptographic principal (key + record) whose sessions are opened and closed by the gate, whose encounters are stamped at the directory with the active rule and dual-jurisdiction-anchored head hashes, and whose permissions are bound in a signed authorization hypergraph (MATRIX) alongside an immutable session and packet trail (SPOOR)—ensuring that doctrine components and signed facts of record circulate at machine tempo while every agent's identity, authority, and obligations remain deterministically reconstitutable (REHYDRATION) under the published root. |
| ENGINE | The Tribunals Engine is an operational estate under the Cohereon Imperium that renders authoritative legal instruments into machine-verifiable facts of record without paraphrase. It cuts verbatim propositions from current depositary texts, seals them by cryptographic hash, and pairs them with the signatures of identity-proofed human adjudicators. Emitted as signed packets alongside persistent, reconstitutable machine-principal histories, its output will allow any third party holding one published root number and a standalone checker to independently verify the exact treaty words, signatory, source currency, and acting agent without relying on the operator's word. |
| GUARD | The Guard is a separate enforcement installation that executes the non-self-grading verification and type-gating battery across all builds and emitted Engine packets under IMP-COH-100 Part A. For builds, it runs the 707-objective gate battery under a pinned interpreter with bytecode suppressed across both the active tree and a scratch-rehearsed installation—stopping at the first refusal, blocking unlicensed writes to measured paths, and requiring byte-for-byte deterministic regeneration of derived artifacts before a package can be accepted. At the directory and session boundary, the Guard validates every payload against vendored shapes with zero silent fallback, verifies that each emitted packet carries the active rule_hash and head_hash, and deterministically refuses foreign-installation packets, unsigned alterations, rehearsal runs, and any turn that contradicts a sealed provision. |
| WITNESS | An independent verification installation held in external custody by either publicly announced or silent, anonymous custodians that performs adversarial validation of the Engine’s corpus and emitted packets without requiring the operator’s word, consent, or cooperation. Holding only the shipped standalone verifier, the publisher-signed pins, the artifact or packet trail, and the one published root number, a Witness executes verify(artifact, root) -> PASS or FAIL to independently confirm that every cited proposition matches the verbatim depositary bytes, every fact carries a proofed human adjudicator’s signature within its cited evidence, every packet bears the active rule_hash and dual-jurisdiction-anchored head_hash, and every acting machine principal (SPOOR and MATRIX) is deterministically reconstitutable. Because a Witness may announce its verdict or remain silent—where "one who stays silent is the reason the count is honest"—it locks the operating estate into a non-repudiable commitment where neither the operator nor an adversary can alter or dispute the legal and operational record after the fact. |
| KIT | The Kit is the guided installation and reproducible-build harness that enables any party to reconstitute the entire estate from bare metal to emitted packet without relying on a central authority or the publisher's license. Governed by the supply-chain, build, and installation clauses of IMP-COH-100 Part A, the Kit fetches every build input strictly against a version- and hash-pinned dependency registry, keeps installation-specific population values beside the tree so the template root remains constant across deployments, and establishes the initial installation snapshot baseline (while reserving the acceptance baseline exclusively for the operating organization's deliberate human command). Before accepting a build, the Kit executes a scratch rehearsal installation and runs the full 707-objective gate battery across both tree states—refusing the package unless the package and material hashes match the rehearsal's byte-for-byte—and enables full adversarial reconstitution (reconstitute(spoor, matrix, head)) from the measured root all the way to verified packet emission. |
| SURFACE | In the Cohereon Generation II estate, a surface is the published presentation and delivery boundary—such as cohereon.io (designated as the human doctrine surface, Surface v1.0.0) or the machine-native Imperium Manifold—where the posted rule, head, and clause are served first at the door. Under IMP-COH-100 Part A, every surface serves artifacts bound to a single content-hashed manifest (/manifest.sha256) and publisher-signed root, with every stamp carrying the rule and head hashes current at issue so any reader or agent can verify the exact revision served. |










