Note: 65: The Primacy of the Retiring Code: The necessary patch to preserve the Original Design of the Internet

The seven previous notes of Heng.lu in this sequence are:

Note: 52 About When the Civil Power Reunited from Responsibility: Why The Current Model of RIR Coordination Can't Survive in its Current Form
Note: 53 About Internet Numeric Resources No Political Property
Note: 56 The Dense Governance of Regional Internet Records converts Unicity into Double Extraction
Note: 58 From Double Extracting to the Investment of Sovereignty: How Nations lose Sovereign Control to RIR by US $100
Note: 59 The Criminalization of Poverty: How The RIR Model Imputs a Tax on the Poor while It Call It Equality
Note: 61 Tribution to the Code under implementation: How RIR System Reunited the Consensus Against the Technical Community
Note: 62 Mandatory washing: From Fancy RIR to Transitional Architecture

The previous seven trials were not a reform programme for Regional Internet Records.

They were an autopsy.

They traced the same institutional pathology through different layers: Unbound liability for consequences; numerical resources re-used as political property; once transformed into dual extraction; reversed sovereignty; poverty charged in the name of equality and a renewed consensus against networks to serveand finally a washed term till an administrative man began to sound as a sovereign. The sequence matters because failure was not a bad board of directors, bad registration, a lawsuit or an uncomfortable market event. It was a systemic defect appearing under different costumes. The CircleID's complainant's page now clearly shows that sequence, including Running-Code Betrital and Mandate Launching. (circleid.com)

That essay isn't about making RIR better rulers.

He tries to explain why the current registration order cannot be the final point and why the less disruptive repair is an supplement to the original technical design of the Internet.

That supplement is the Primary Act (Running-Code Primacy).

The need for that was no longer theoretical. In a recent exchange at CircleID, John Curran put forward the most solid form of his argument. His thesis is that the authority of RIR system isn't simply a by-product of limited technical co-ordination but an outcome of a historic chain: the White Paper, ICANN , ASO , ICP-2 , the transition from IANA supervision and the continuing multilateral governance of the private sector. He claims that the authority of RIR system is the result of operating within the multilateral model of the private sector that his Government advanced. (circleid.com)

That argument was useful because it made the dispute visible.

The issue was no longer whether a historic delegation existed. Of course she existed. The issue is whether a historically delegated coordinating function can then be expanded into a permanent governance mandate through the same procedural machinery as it controls. The answer to that question was yes: delegation, recognition, institutional continuity and Community procedure became a self-renewable mandate.

The response required by the original technical design of the Internet is no.

The original Internet tradition was tighter, tougher and better. RFC 3935 states that the IETF 's goal is to "make the Internet work better" and bases its work on technical competition, real-world implementation and "close consensus and code in place." It also lays down that, where IETF is not responsible for a protocol or function, it does not seek to exercise control about this. (rfc-editor.org) RFC 7282 repeats David Clark's old phrase: "We reject: kings, presidents and votes" and "We believe in: close consensus and code in place." (rfc-editor.org) RFC 9592 makes the anti-sovereign point even more clear: IETF does not conduct, control or conduct an Internet patrol and isn't "protocols police." (rfc-editor.org)

That tradition never meant that the documents were magic. It meant that the documents mattered as they helped the systems work. It meant that the process was tolerated as it served the deployment. It meant that a room was useful only while disciplining itself around operational reality.

That legitimacy was loaned by the registration cape.

He never fully accepted that discipline.

That's the missing patch.

What the primacy of the code means in implementation.

The Code's primacy under implementation means that Internet co-ordination systems have to be strictly interpreted with reference to the minimum technical function that originally warranted the existence of networks in operation.

The numerical resource layer exists to protect functioning systems: oneness, interoperability, routing-related continuity, safety claims, monitoring test and minimum common semantics necessary for independent networks to work together.

It doesn't exist to manufacture political authority.

It doesn't exist to watch commercial morality.

It doesn't exist to turn the geography of a service into a title of property.

It doesn't exist to turn a mailing list into a legislature.

It doesn't exist to allow a private registry to put out already operational network assets because it changed its internal policy theory.

A registration isn't a state.

A contact with a database isn't a notarized corporate power.

A service region isn't a town.

A policy room isn't a legislature.

A registry can describe operational reality. Don't believe her.

That's not Conservatism. The Code's Primary Law does not say that deployed systems can never change. He said that institutional power about change should not be supported by historic delegation, circular recognition or ritual proceedings. It should be supported by determinist rules that operators can verify locally and by adoption in functioning systems.

The right order is: initial specification, general ledger status distributed, local validation, implementation currently under way, voluntary adoption, compatibility set and later documentation.

The wrong order is: policy room, declaration, obligation requested, compliance label and forced operative compliance.

The RIR system failed as more and more chose the second order.

The key correction is this: after the initial specification, there's no continuous institution to ask permission from. No committee decides whether non-adoption constitutes an infringement. No registry declares a participant invalid simply because it refuses to accept a later change. There are only code, general ledger status, validation, adoption, compatibility, local rejection, bifurcation and selective interoperability.

An operator that rejects a later change does not break the Internet. It can stay in an older compatibility set. He can get his face together. It can get off. It can stop interoperating with participants who have adopted incompatible rules. But you cannot break the interoperability of others that continue to run mutually compatible code.

The design intuition is the same as that that that that makes useful to the distributed ledgers: a permanent institution isn't necessary to decide the regular validity. The participants validate local state transitions under determinist rules. An invalid state isn't punished by an institution. It's ignored by the participants who don't accept it.

That's an essential patch missing from the co-ordination of numerical resources.

The design malfunction was present from the start.

The first architecture of RIR assumed a low-value world.

Numeric resources appear technical, abundant, administrative and low-conflict. In that world, informality seemed efficient. The open mailing lists seemed representative. Contacts-based management seemed to be sufficient. Limited liability contracts seemed harmless. A regional registry could look like a simple address book.

The shortage of IPv4 destroyed that premise.

The IPv4 addresses became few, transferable, financial, leasehold, capitalised, contentious, subject to sanctions and integrated into active networks. The registration layer stopped being above administrative inputs. It became above production infrastructure. It became above the value of assets. It became above client continuity, cloud deployment, telecommunications operations, national connectivity, court orders and capital assignment.

The institutional form did not suit that new risk.

It's been expanded.

The result is a system that still speaks the language of technical co-ordination while exercising the impact of infrastructure governance. Requests operators to treat the registration process as neutral while registration decisions affect commercial destination. He calls his participants "community," but many of those who endure the consequences have never given clear legal representation to those present in the room.

NRS clearly exposes the structural problem: the number of Internet registries were designed as technical co-ordinating agencies, but once the shortage of IPv4 turned their addresses into valuable assets, the discretion of the register became economic power, and once the co-ordination systems have been capital, centralisation becomes a structural risk and decentralization becomes a matter of system engineering rather than ideology. NRS also challenges the opposite direction of design: a single Internet, open and autonomous infrastructure and decentralized governance with minimum human participation as a core. (nrs.help)

That's the real problem. The registration cape was never adapted to the moment that a co-ordination table became an asset access door.

The first priority of the code currently under implementation is that adaptation.

It's not a "best RIR " doctrine.

It's a post- RIR discipline.

The three rules of the patch

The constructive grammar is revised Note 64: Minimum Initial Specification, Localised Future decision and Voluntary adoption for Internet Coordination Systems: Minimum Initial Specification, Localized Future decision and Voluntary adoption.

The names are unchanged. The logic should be precise.

Minimum initial specification means that the common layer contains only local determinist and verifiable rules necessary for uniqueness, interoperability, monitoring test, shared safety and safety claims. It contains no preferences for business models, price theories, regional political feelings, discretionary enforcement powers and institutional mission expansion.

Futura Localised decision does not mean that an institution decides what future decisions are local. That would put back the cape of authority. It means that the initial specification does the limitation work beforehand. Following their deployment, regular future decisions remained with the participants applying the code. A participant may adopt, reject, bifurcar, disconnect or interoperate selectively. No participant can alter the interoperability of others that continue to apply mutually compatible rules.

Voluntary adoption means that later change only becomes real with implementation, validation, display and use. Publication isn't true. The recommendation isn't true. Institutional recognition isn't true. Non-adoption does not create a state of disability. A participant that does not adopt a later change remains as an existing compatibility package. A participant issuing invalid states under another's determinist rules can be ignored locally. The effect is a selection of compatibility, not institutional punishment.

Those three rules did not rehabilitate the registry's sovereignty.

They stop her from reappearing under another name.

APNIC : The legal structure was risk

APNIC The minimum was never sufficiently strictly specified from the start.

That's not a code of conduct story. That's not a label story. It's not a story about whether a critic was sufficiently educated with an institution concerned.

That's a story about legal structure.

In March 2023, LARUS published a legal review warning that the governance architecture of APNIC created risks not only for a company in Brisbane but for Internet governance throughout the Asia-Pacific region. The review stated that the Director General of APNIC had final legal power to close APNIC and remove the elected Executive Board and that urgent governance reforms were necessary. He also noted that the architecture raised challenges about secure Internet governance for more than a billion users in the Asia-Pacific region. (larus.net)

The first annex, the extract from ASIC That's corporate. APNIC Pty Ltd was registered as an Australian private share-limited company, registered at Queensland. Paul Byron Wilson was listed as director and secretary. The information about actions represented a single regular action issue and Paul Byron Wilson as a leading member of that action. (larus.net)

That's not a normal way to have a critical role of regional Internet co-ordination.

The second annex, Dr. Peter Felter's legal opinion, draws the conclusion of governance. He describes the public structure of APNIC - members, elections, Executive Board, Director General and Secretariat - as an special committee based on Article 9.3 of the Statute of APNIC pty Ltd. He claims that APNIC pty Ltd was for 25 years a private company controlled by a director, a shareholder and a secretary, all of them. (larus.net)

That distinction matters.

The public community-oriented institution was not the final legal container. It was a structure built about a private company.

The legal opinion explain why this distinction matters. It indicates that the statutes of APNIC are subject to the Social Regulations and to the powers of the corporation and its directors, officials and members. Under this interpretation, the public structure of APNIC could be modified by decision of the director of APNIC pty Ltd and the opinion describes APNIC as indeed an department of APNIC pty Ltd. (larus.net)

The most serious point of the opinion was that APNIC was technically illegal. It was that legality and legitimacy are not the same. The report argues that the trust mechanism does not solve the problem as the powers of the Executive Board continue to derive from the decision of the Director established by the Special Committee. It also indicates that APNIC pty Ltd is a private company with shares whose structure and objects do not match the non-profit model of organisation that would normally be associated with a regional public interest registry. (larus.net)

That's the first design malfunction in its purtiest form.

A regional number co-ordination system should not depend on a structure that requires lawyers to explain why a single-action private company, a special committee, a trust and an elected council are somehow combined with legitimate monitoring of the Asia-Pacific Internet registry.

A critical coordination layer should be legible from the outside.

He shouldn't require confidence in document after document.

It should not require members to discover, after years of institutional dependence, that the elected cape may not be the final legal layer.

It should not give the appearance of members governance while formal power resides somewhere else.

That's why the Minimum Initial Specification should include distributed validity, not institutional confidence. Not because a future institution needs better governance but because a post- RIR future system should at all require that institution.

The common layer should not depend on a private company's hidden monitoring structure. It should define determinist validation rules, monitoring test states, status transition rules, conflict rules, replication of bigger books, exit routes, bifurcation routes and compatibility sets. If APNIC disappears, catches itself, changes its legal posture or refuses to recognize a valid status, the functioning network should not depend on the recognition of APNIC to figure out who controls what numerical resources.

The registration should not be the source of validity.

It should be the status of the ledger distributed and validated under the initial specification.

ARIN : The politics met with the reality of the assets

ARIN shows the second failure: market and legal reality can be advanced to registration theory.

The decisive event was the Nortel / Microsoft transaction. When Nortel became bankrupt, his 666,624 IPv4 addresses became valuable assets within the procedure. The addresses were sold to Microsoft for 7.5 million dollars. ARIN acted under the theory that addresses were not property and that they could not be sold free of registration policy. Industry Canada supported that posture. The bankruptcy court rejected it; Microsoft later signed a "legacy" agreement and the practical result was clear: registration policy could no longer be the only source of reality once courts and markets treated numerical resources as assets. (btw.mean)

The important lesson isn't that ARIN was especially bad.

The lesson is that the registration layer had entered a new category.

A registry is valuable because operators, courts, buyers, vendors, creditors and networks rely on it. He doesn't get authoritative denying that dependence. It remains useful only if it sufficiently reflect the legal, market and operational reality.

Once IPv4 became low, the registration process became a market interface. The rules of transfer, necessary assessments, delays in recognition and regional restrictions have been discontinued as administrative details. They became asset frictions. The public analysis today describes a fragmented RIR rule book with five regional systems governing a market that negotiates about $18 to $45 per direction with conflicting rules capable of jamming assets, retaking mergers and forcing separate corporate structures only to maintain direction blocks. (btw.mean)

That's not neutral co-ordination.

It's a regulatory effect with no regulatory liability.

ARIN shows why voluntary adoption matters. The registration policy only remains credible while describing what actors really implement, negotiate, finance, dispute and use. It became dangerous when publication was treated as sufficient to make reality.

A register that refuses reality does not become sovereign.

It becomes an outdated database.

In an currently undergoing code primacy design, the lesson is even more clear. The courts and markets do not require an appropriate registration to decide whether there is value. Operators do not have to have a committee to figure out if a block's up and about. The participants require determinist rules that allow for monitoring, conflict resolution, visible state transitions and compatibility. The old record can publish a hearing. A software client can show a view. A bigger book scout can show a vision. None of them are the valid source.

No record to migrate to.

No record to ask.

There's only one distributed state that participants validate, accept, reject, bifurcan or interoperate with.

AFRINIC : When registration theory threatened operational assets

AFRINIC is the central case because it reduced the problem to its essence.

The wrong story is that a troublesome member paralysed a regional registry.

That's his moral account.

Structural history's different. AFRINIC sought to turn commercial use, client geography, rental, membership relationship and internal policy interpretation into an established power to dessign currently functioning numerical resources. Once that statement had been made, the conflict had been put to an end as a disagreement in a policy room. It became a proof of whether a private registry could use regional rhetoric and normative silence to threaten operationally integrated assets.

The events do not require theatrical exaggeration. Public reports described AFRINIC 's dispute as a simple commercial conflict about IP addresses that became Africa's largest story of Internet governance. They also noted that Cloud Innovation had been often presented as the villain while later documentary material pointed to destructive forces within AFRINIC itself and to delays, prolonged and continued litigation by AFRINIC representatives at their cost. (btw.mean)

That's important because it challenges the usual narrative.

The dispute did not create structural failure.

He exposed her.

The relevant decision was already present when a private registry treated the absence of an explicit permission as a basis for enforcement monitoring. Loan was no threat to uniqueness. The geography of customers was not a dual assignment. Commercial use was not a malfunction of routing safety. A business model rejected by a registry was not a global invariant.

Nevertheless, the interpretation of the register put these elements within a framework of revocation.

That's the time for co-ordination to become governance.

Reporting AFRINIC sent Cloud Innovation a letter at March 2021 claiming violations of policies and threatening to complete their membership July 2021 the Supreme Court of Mauritius has prohibited AFRINIC and that a new attempt at cancellation was blocked at December 2021 . (btw.mean) That sequence isn't the story of a record protecting with calm Internet. It's the story of registration authority with regular law.

Nor was the institutional collapse caused by too much registration power. The most profound problem was structural blockade. If a registry has a monopoly of recognition of high-value living assets, any internal failure becomes an Internet continuity risk. If members cannot leave the system of recognition, the registration decision becomes hostage power.

A registry can correct demonstrable registration fraud in its own data.

It can avoid duplication while the registration model exists.

He can maintain security claims while participants depend on him.

But these are transitional functions of an old architecture.

In a post- RIR architecture, these functions are not registered. They are encoded at the status of a distributed ledger, control test rules, conflict rules and locally verifiable transitions.

A private body should not turn lease into regional treason.

It should not turn client geography into a tipping trigger.

It should not treat trade disagreement as technical disability.

It should not turn asset continuity into permission.

AFRINIC attests to the need for a Replaced Future decision. There is no central body that decides that a future trade decision "belongs locally." Instead, the initial specification should ensure that these decisions never fall into the common layer first. Loan, client geography, commercial use, price setting, financing, client mix and deployment strategy are outside determinist validity rules, unless they directly affect uniqueness, safety, monitoring and interoperability.

An operator cannot break the interoperability of other operators by renting addresses.

It cannot be broken by serving customers outside a historic region of registration.

He cannot break it by using a business model that the registry disapproves of.

In any event, an operator may have been unable to meet determinist rules that other participants conduct. In that case, the others locally reject an invalid status. No cape of punishment. No enforcement court. No regional sovereign.

That line isn't ideological.

It's operative.

The NRO 's letter: the escape path up

The most serious evidence isn't an attempt at excessive AFRINIC .

That's the system's collective response.

In 2022, the Number Resource Organization wrote to the Government of Mauritius. The letter described NRO as the coordinating body of RIR throughout the world and stated that RIR manage numerical resources in their respective regions. He noted that all five registries have an important role to play in managing numerical resources under regionally adopted rules or unanimously adopted global policies. (nro.net)

The same letter criticized the dispute with Cloud Innovation, stated that more than 25 claims had been filed, complained about court orders that frozen AFRINIC 's accounts and stopped elections and argued that AFRINIC had repeatedly requested Mauritius to be recognized as an international organization. The NRO called upon the government to take measures to preserve AFRINIC 's independence and the stability of the Internet in Africa. (nro.net)

That's the most revealing document ever.

When a private registry entered into conflict with regular courts, the reflection of the system was not to reduce the scope of the mandate.

It was not to remove the lockdown from the logs.

It was not to separate record management from performance.

It was not to define distributed validation.

It was not to question whether the unilateral power to unregister operational assets had been illegitimate from the start.

The reflection was an escape path up.

A private coordinating body cannot be technical if it wants discretion, community if it wants legitimacy, contractual if it wants prices, non-owner if it wants to avoid liability and quasi-international if it wants immunity from court.

That set isn't governance.

It's a systemic form of "mandate washing."

If RIR wants public law privileges, they have to accept public law liability. If they wish to have flexibility under private law, they have to accept litigation under private law. What they cannot consistently demand is private discretion, importance of public infrastructure, low liability, weak representation, monopoly status and quasi-diplomatic immunity at the same time.

That's the way to collapse.

The Primary Act of the Code currently under enforcement rejects it.

When a register faces legal resistance, it should not escape up for immunity. The architecture should be contracted down and reduced to the strict functioning code function that originally warranted it.

Less sovereignty.

No registration as a source of validity.

Less enforcement.

More validation distributed.

The review ICP-2 That's bad enough.

The current system recognizes something's been broken.

The ICANN public comments page about the second draft of the RIR governance document indicates that the proposal would lay down rules and criteria for recognizing new RIR , operational obligations and requirements for existing RIR as well as rules for non-recognition and that if adopted, it would replace ICP-2 . The same page indicates that the process was initiated after NRO requested ASO to propose updates to give RIR 's system more accountability to the Internet community. (icann.org)

That may be necessary as a measure of continuity.

That's not enough as a theory of legitimacy.

The rules of recognition and disrecognition answer a late question: When did a record have failed sufficiently to be eliminated?

The above question is more important: why should a registry have sufficient power to have catastrophic failure first?

A successor to ICP-2 That only tightens recognition, audit, transition and misrecognition can improve institutional hygiene while preserving category error. He keeps assuming that RIR That's the first sovereign form of numerical resource co-ordination.

The Code's primacy currently under implementation raises a different set of questions.

How does the Internet continue if an RIR collapses?

How are numerical resource allocations available without an entity's permission to be verified?

How does unification survive without monopolic discretion?

How do we prevent registration from becoming enforcement tools?

How are trade decisions held beyond determinist validity, except where a real global unchanged at risk exists?

How does the usable co-ordination stay without an authoritative record?

How does an operator value an ordinary state without consulting a permanent body?

How does rejection avoid becoming an infringement label?

These aren't reform questions.

That's post- RIR questions.

Why this is the original design patch

The problem isn't whether or not anyone likes proper searches.

The problem was whether the numerical resource layer continued to reflect the design discipline that made the Internet possible: minimum common rules, local validation, voluntary adoption and code currently under way.

The primacy of the Code currently under implementation was neither a public relations strategy nor an institutional commitment. It's the technical repair implicit in the original design. If the Internet was built to reject kings, presidents and votes as sources of technical truth, then the figure of numerical resources cannot recreate these forms through registration processes, historic delegation or community theater.

Consensus alone can become ritual. The code currently being run can be subordinated only if the registration layer is placed above as a source of recognition. The missing rule was interpretative and architectural: when the institutional process conflicted with the minimum technical function required by functioning systems, the code currently under implementation had priority and when a subsequent change was proposed, it became real only by voluntary adoption of participants applying validation rules.

That's how you preserve the original design, and not how you leave.

The Internet was important as it became the first global communications system to require no prior permission from a single sovereign, ministry, church, corporation or guardian. If that accomplishment remains worthy of defence, the layer of numerical resources cannot become an exception that invalidate the rule.

A system built to avoid kings cannot allow an accountant to aspire to be one.

The patch restored the original hierarchy: first code, first operator, first determinist validation, first status distributed, and first institutions, if they come into existence during transition, only as non-authoritative artifacts, never as valid sources.

What Post- RIR Coordination Requires

Post- RIR co-ordination doesn't mean chaos.

It means that the common cape becomes more thin, more objective, more determinist and more distributed than the current RIR monopoly.

No record to migrate to.

No new record to write.

No new priesthood.

There's a ledger distributed about the status of numerical resources with determinist validation rules, monitoring test mechanisms, conflict management, compatibility sets, status transitions and local verification by participants.

The common layer should preserve the uniqueness of identifiers, monitoring test, status of transfer, status of delegation, safety claims related to routing, audibility, conflict metadata and bifurcation visibility.

The operator's cape should monitor commercial use, rental, client geography, routing practices, financing, selection of counterparties and non-unchanged business rules.

The adoption layer should determine what becomes real. A co-ordination rule only matters if operators can implement it, counterparties can accept it, markets can rely on it, courts can understand and interoperability remains without making recognition of the matter the only source of reality.

The performance layer should not be merged with the status layer. A distributed ledger can register status. Can validate transitions. He can put out conflicts. He can do his portable test. It should at the same time become a prosecutor, judge, punitive authority, market regulator, commercial moralist and asset custodian.

The most important thing is to understand portability correctly.

In a distributed ledger world, portability does not mean passing from one registry to another. That's still registration thought. No record to migrate to. The incumbent's monitoring test, status history and transfer capacity are not trapped inside a relevant database. They exist in a shared verifiable state that participants validate locally and that counterparties voluntarily accept.

Without that, every record's a blocking point.

The registration thus ceases to be a source of validity.

Thus, post- RIR coordination requires four design properties.

First, determinist validity. A participant should be able to know if a transition of status, evidence, delegation, transfer or assertion is valid by applying the specification locally.

Second, compatibility sets. If participants adopt different future rules, the system should clearly describe compatibility boundaries rather than treating dissent as an infringement.

Third, distributed monitoring test. A incumbent should not "move" his or her resources to another registry. He or she should prove his or her monitoring by a valid status in the ledger that any counterparty can verify without his or her approval.

Fourth, bifurcation visibility. If sets of rules differ, divergence should be explicit. The participants decide what compatibility set to run and with what partners to interact with. One bifurcation can isolate participants but does not give one party institutional power to erase the other.

That's not an argument for five better monopolies.

That's an argument against monopoly as a source of validity.

Why the fault path is predictable

If nothing changes, the path to failure is clear.

First, more challenges will move from policy rooms to courts. The few assets attract legal scrutiny. The courts will be requested to freeze accounts, preserve searches, block irregular elections, assign judicial administrators, recognize transfers or determine who can act on behalf of a registry.

Secondly, States will stop treating RIR as harmless technical associations. Retirement continuity affects national connectivity, sanctions, law enforcement, telecommunications resilience, cloud infrastructure and economic security. No State shall indefinitely accept a foreign private entity as an unquestioned step up of the continuity of national communications.

Thirdly, operators shall conduct an operation with the authority of the registry as soon as possible. If registration becomes political, insecure, non-representative or disconnected from the reality of assets, operators will resort to private contracts, dispute-supported transfers, alternative certification, national recognition or de facto routing reality.

Fourth, the ICANN and NRO layers will be tempted to centralise. That would lead to a more dense version of the same problem, unless the mandate itself was reduced.

Fifthly, governments will be tempted to nationalise. That would be predictable and dangerous. If private registries demand quasi-sovereign authority without public responsibility, States will eventually demand sovereignty. The result could be fragmentation, retaliation, conflict searches and political pressure on routing.

The Internet doesn't miss only when they stop moving the packages.

It also fails when the institutions that describe who can use the identifiers lose confidence with the operators that move these packages.

A distributed ledger doesn't solve all political problems. But it does something more important: it removes permanent registration as an ordinary source of validity. That reduces the surface of attack. It reduces institutional hostage power. It converts future misagreements into selection of compatibility rather than administrative warfare.

Appendage: Minimum Initial Specification, Localised Future decision and Voluntary Adoption for Internet Coordination Systems

Note 64

Summary

That document describes a design pattern for Internet co-ordination systems that aims to provide shared technical reference points without creating a continuous authority above the participants that run the system. It lays down three related principles: Minimum initial specification, Localised Future decision and Voluntary adoption.

Under this model, Initial Specification defines only local determinist and verifiable rules necessary for uniqueness, interoperability, monitoring test, shared safety and safety. Following initial specification, future changes are not approved by a central body. They are adopted, ignored, bifurcated or abandoned by participants applying code.

The intended design pattern is a valid status distributed ledger or an equivalent distributed status mechanism, and not a record hierarchy. No permanent register lays down regular validity. The participants validate the status locally, accept counterparties voluntarily and decide what compatibility sets they run.

Non-adoption isn't an infringement. A participant that does not adopt a later change remains as an existing compatibility package. A participant that emits invalid statements under the determinist rules accepted by another participant can be local ignored by that participant. The effect is to select compatibility, bifurcation, isolation or selective interoperability, and not institutional punishment.

That document does not define a network protocol (wire protocol). Specifies an Current Best Practices ( BCP ) for the design of protocols, identifier systems, distributed ledgers and co-ordination mechanisms that should not become permanent governance institutions.

1. Introduction

Many Internet systems start with a limited technical goal: to allow independent actors to internavigate through a common reference point, an identifier space, a validation rule, a wholesale status or a shared monitoring test register. Over time, these systems often accumulate authority that was not necessary for initial interoperability.

That usually happens in three steps.

First, future questions are incorporated into the foundational layer before they are technically necessary.

Secondly, decisions that should be taken by participants applying their own systems become dependent on recognition, interpretation or status decisions by a permanent body.

Thirdly, publication, registration, recommendation or procedural approval are treated as sufficient to create operational obligations, even if the participants have been unable to adopt a change in the system currently under way.

The result is a fragile system. A technical reference layer becomes a governance layer. A register becomes a monitoring point. A coordinating device becomes a source of future monitoring.

The document proposes a different design discipline:

Minimum initial specification: defining only common determinist rules necessary for basic interoperability, uniqueness, monitoring test, shared safety and safety.

Futura Localised decision: after First Specification, maintain future decisions with participants applying code. A participant may adopt, reject, bifurcar, disconnect or interoperate selectively. No participant can alter the interoperability of other participants that continue to enforce mutually compatible rules.

Voluntary adoption: make subsequent changes real only by implementation, operation, validation and adoption by participants applying code.

These principles are related. A system that lays out too much from the start preloads future control to the common layer. A system that keeps a continuous recognition layer allows authority to recur after deployment. A system that treats publication as a reality turns documentation into a mandate.

The design intuition is simple: validity should be determined by determinist rules that participants can verify locally against a shared state. A participant may adopt a later change, reject, bifurize, disconnect or interoperate selectively. At best you can withdraw from a compatibility set. It cannot, by rejecting a change, break the interoperability of other participants that continue to enforce mutually compatible rules.

That's a general lesson about how to design distributed ledgers: The consensus rules are applied by participants applying validation code and deciding what status they accept, not by an institution above them.

2. Scope

That document applies to Internet co-ordination systems, including, inter alia, identifier systems, name and numbering frameworks, protocol extension mechanisms, monitoring test systems, portability systems, distributed ledgers and other architecture with independent actors dependent on a common technical reference point.

That document did not argue against common rules. He argues that common rules should be determinist, minimum, locally verifiable and limited to what the system really needs to work.

That document requires no specific implementation of distributed ledger. It requires a design property: participants should be able to determine the validity by applying the Local Initial Specification to a shared or replicable state without applying permission or status to a permanent authority.

Local Rejection:
A local decision by a participant to ignore, reject or otherwise interoperate with a status, message, registration or transition that's invalid or incompatible with its validation rules.

Filling (Fork):
A difference in validation rules or operational practice that creates two or more compatibility sets.

Coordination Article:
A document, recommendation, implementation note, profile, reference implementation, wholesale scout, replica or other device that helps participants coordinate. A co-ordinating device does not create a binding operational reality unless adopted by participants in currently under way.

4. The problem

The designer usually tries to reduce future uncertainty by writing too much into the foundational layer or by leaving a permanent body with an interpretation of future issues. That looks prudent. It's often dangerous.

The superspecification in the foundational layer has three costs.

First, it moves future decisions to a common cape where change is more difficult and where capture has more effect.

Secondly, it creates ambiguity between technical validity and institutional recognition.

Thirdly, it encourages an agency that keeps records, publishes documents or calls participants to treat these acts as an authority about future reality.

The same problem appears after deployment. If a system requires a permanent body to approve changes, determine states or interpret an ordinary operation, the system has created a post-Founding Control Layer. That cape can start as an administration. It can become governance. And it can become a choking point.

The design goal of this document is not better institutional discretion. The aim was to avoid the need for that discretion.

A well-designed internet co-ordination system should define determinist and locally verifiable valid rules from the start, represent valid status in a distributed or replicable manner, keep non-invariable decisions out of the common layer and allow subsequent changes to become real only when participants voluntarily adopt them into running systems.

5. Principle 1: Minimum initial specification

5.1. Declaration

A First Specification _ defining only the minimum common determinist rules necessary for basic interoperability, uniqueness, monitoring test, shared safety and safety.

5.2. Requirements

A design using this principle:

• DEBE To explicitly identify their Global Invariants.
• DEBE To define determinist validation rules for each Global Invariant.
• DEBE To define how valid status is represented, replicated, verified and updated.
• NO DEBE include a rule in the initial specification unless that rule is necessary to preserve an declared global invariant or to allow initial deployment.
• DEBE To separate the rules of validation from policy preferences, trade agreements, institutional roles, governance aspirations and discretion.
• DEBE To allow participants to check their regular local validity without applying to an institution, registration, committee, policy body or other authority for information.
• _ To define data structures, signatures, tests, status transition rules, conflict rules or other mechanisms necessary for local verification.
• _ defining extension signalling, versioning, compatibility labelling or bifurcation identification where future variation is foreseeable.
• DEBE ensure that the necessary coordinating devices are portable, audible, reproducible and replaceable.
• _ To prefer machine-verifiable objective conditions rather than subjective judgements of merit.
• NO DEBE make future institutional recognition the only way a valid state can be known, registered or used.

5.3. Design implications

The Minimum Initial Specification does not mean a vague specification. That means a strict specification only of what should be common.

A system still needs enough common architecture to work. The discipline is to distinguish between:

• what should be common for uniqueness, interoperability, monitoring testing, shared safety and safety and
• What can stay outside the common layer because it belongs to an operator's preference, commercial practice, choice of counterparty, time of deployment or subsequent decision-making.

A design that cannot clearly expressed its global Invariants and its determinist validation rules should assume that it has specified too much discretion and very little verifiable substance.

6. Principle 2: Localized Future decision

6.1. Declaration

Following initial specification, Future Decisions DEBERÍAN to stay local to participants applying code. A Futura decision became effective only for the compatibility package with its participants. No permanent authority was required to approve and non-adoption did not create a state of disability.

6.2. Requirements

A design using this principle:

• NO DEBE require participants to obtain permission from a competent institution, registration, committee, council, policy body or other authority for decisions that do not prejudice the determinist validation rules of their compatibility package.
• NO DEBE To create a permanent body with recognition as the only way by which a subsequent change can become an operational reality.
• DEBE To distinguish between validity under initial specification and compatibility with an optional later change.
• NO DEBE avoid adopting a subsequent change as an invalidity.
• DEBE enabling participants to remain in an existing compatibility package if they do not adopt a later change.
• DEBE enabling participants to join a new compatibility set by adopting new validation rules or operational profiles.
• DEBE To allow participants to locally reject statements, searches, transitions or messages that are invalid or incompatible with their validation rules.
• DEBE To allow participants to choose counterparties voluntarily according to the validation rules and compatibility sets they accept.
• NO DEBE To allow no institution, registration, committee, policy body or other actor to declare a participant invalid only because they rejected a subsequent change.
• _ make explicit forks, versions, profiles or compatibility sets so that participants know what rules they are applying and with what other participants they can interoperate with.
• _ avoid any design where a relevant registry can prevent participants that are still valid from continuing to cooperate.

6.3. Design implications

The Localised Future decision does not mean that a central authority will assign future decisions to local actors. That means that the system is designed so that after initial specification, regular future decisions do not require such an assignment.

The initial Specification does the limitation work in advance. It lays down minimum invariants necessary for uniqueness, interoperability, monitoring test, shared safety and safety. Everything else remains outside the common cape.

Future change isn't centrally approved. It is adopted, ignored, bifurcated or abandoned by participants applying code.

A participant who rejects a change can stay outside the compatibility set created by that change. He can get off his back. It can continue with an earlier compatibility set. It can be bifurved. It can interoperate selectively. But it cannot break the interoperability of other participants who continue to enforce mutually compatible rules.

The effect of an invalid or incompatible state is local rejection and not punishment. No one's necessary to figure out a participant's bad place. A participant applying compatible validation rules simply does not accept an invalid or incompatible status.

7. Principle 3: Voluntary adoption

7.1. Declaration

The changes to an Internet co-ordination system DEBERÍAN To become an operational reality by implementation, validation, deployment, acceptance by counterparties and adoption by participants and not only by publication or declaration.

7.2. Requirements

A design using this principle:

• NO DEBE To consider publication, recommendation, approval at meetings or procedural approval as sufficient to create a universal operational obligation.
• DEBE enabling new rules, extensions, profiles or procedures to be deployed incremental by participants who decide to run them.
• DEBE To allow participants to reject a later change without acquiring a state of disability as long as their own state transitions meet the determinist rules of their compatibility set.
• DEBE To allow participants to continue using an earlier compatibility set if the initial Specification permits such continuity.
• DEBE enabling participants with a compatibility set to reject or locally ignore states of another compatibility set where the rules are incompatible.
• _ defining adoption routes for important changes, including signalling of versions, compatibility labelling, transition guides and test vectors.
• _ defining rejection routes for important changes, including how non-adopting participants continue to operate, identify their compatibility set and avoid ambiguous interoperability.
• DEBE ensure that necessary coordinating devices can be abandoned, replicated, re-implemented or replaced without impossible transition costs.
• _ have the registries, recommendations and coordinating artifacts describe the reality adopted, rather than trying to declare an unadopted future reality as an existence.
• NO DEBE To design a system with the only way for a change to become real is prior recognition by an appropriate body.

9.2. Operator decision area

The following _ stay outside the common layer, unless it directly modifies a stated global invariant:

• timing of deployment
• commercial use
• client geography
• lease, financing or transfer arrangements;
• local choice of eligibility
• operational sequencing
• an unrequired routing practice for shared validity;
• model of business
• organisational structure
• voluntary migration time
• Optional profiles or extensions
• choice of counterparties.

The participants PUEDEN make different decisions in these areas. Those decisions may produce different compatibility sets, commercial relations, peace agreements or operational communities. They do not create disability, unless they are in violation of determinist validation rules within a compatibility set.

9.3. Adoption cycle

When possible, the preferred order for substantial system changes is:

• proposal
• implementation
• Test vectors or determinist verification method
• limited deployment by interested participants;
• monitoring of interoperability and safety effects
• labelling of compatibility sets
• documentation or recommendation describing the reality adopted.

A coordinating device _ Following adoption rather than trying to anticipate adoption.

10. Applicability and limits

That design model is particularly applicable if:

• The system is multi-actor and multi-jurisdictional.
• independent deployment is important.
• The co-ordination layer shall be intended to be thin.
• Future changes are likely but cannot be predicted in detail.
• The blockade or dependence (lock-in) would create a risk of governance.
• The validity can be determined or verifiable locally.
• The status distributed can reduce the risk of institutional capture.

It may be less directly applicable if:

• this is a single administrative domain as an architecture intended.
• A strong real-time coupling requires uniform conduct at all times.
• vital safety considerations require an immediate global uniformity
• Validity cannot be established locally by any practical mechanism.

Even in these cases, the designers DEBERÍAN continue to minimize the common layer and avoid future discretionary monitoring as far as possible.

11. Non-target

No:

• Prohibition of any co-ordination
• requires no specific implementation of distributed ledger
• guarantees consensus
• guarantees political neutrality
• requires that all participants adopt each subsequent change.
• deals with the refusal to adopt as an invalidity;
• legitimate local conduct incompatible with the purport of compatibility
• removes the need for common rules critical to safety.

12. Security considerations

A thin co-ordination layer can reduce capture risk, reduce the impact radius of institutional errors and improve replacement capacity. However, more local discretion and a distributed state can also generate inconsistent security positions, degradation routes, fragmentation pressures, ambiguous compatibility claims, unsafe bifurcations, dispute about the status of the general ledger and attempts to falsify evidence.

Thus, the designers applying this document DEBEN expressly specify safety invariants. In particular:

• the authentication and authorisation requirements necessary for shared validity DEBEN be locally determined and verifiable;
• monitoring mechanisms DEBEN to resist unauthorized forgery, repetition and transfer;
• version trading and extension management DEBEN avoid silent degradation if safety is affected.
• Rejection, bifurcation and replacement routes DEBEN To be analysed with respect to the risk of abuse and denial of service
• compatibility labels DEBERÍAN be clear enough to avoid accidental interoperation between incompatible sets of rules;
• status _ be auditable and reproducible to detect inconsistent views;
• local variation NO DEBE be able to declare falsely compatible with a set of rules that does not fulfill.

The existence of security exceptions does not warrant an overall layer of permits. It only justifies determinist safety rules necessary to preserve declared global invariants.

Annex A. Design checklist

A design that confirms conformity with this document _ be clear about the following questions:

• What are the global invariants?
• What determinist validation rules preserve these Global Invariants?
• What rules in initial specification are strictly necessary for first deployment?
• How are valid status represented and verified?
• Is the state distributed, replicated or otherwise independently verifiable?
• What future issues are deliberately put out of the common cape?
• What future decisions can participants make without altering their compatibility package?
• How does a participant adopt a later change?
• How does a participant reject a later change without his or her status of disability?
• How are compatibility sets tagged or found?
• How does local rejection work if a state is invalid or incompatible by the rules an participant runs?
• What's the bifurcation path?
• How does a holder prove control without a proper registration?
• How does a counterparty verify the status without a registration?
• Can participants verify their regular validity without dependent on an appropriate register?
• Do the co-ordinated searches and devices describe the reality adopted or are they trying to declare an unadopted future reality as existing?
• Have the system been minimizing the number of decisions incorporated into the common layer?
• Did the system avoid any permanent authority that determines the regular status of participants?
• Can participants accept or reject counterparties voluntarily?
• Can the system continue if all relevant records are gone?

The complainant's address

Lu
[ TBD ]