Trust Scope — the Machine Enforces, the Human Decides

https://share.gemini.google/jKFTNPrdEmbP 

Trust Scope — the Machine Enforces, the Human Decides

Design note — the Church Machine (CTMM). A scope decision, not a mechanism: where

trust comes from, and what is deliberately deferred. Recording a boundary so it is

not later mistaken for a gap.

Status: deliberate architectural scope decision (KHH). First base, not a home

run.

The division of labour

Trust and enforcement are different jobs, and they belong to different parties:

The machine enforces integrity. Within a trust domain, the mechanical chain

is exact and autonomous: T = hash(dot.name ‖ code ‖ reach); the genesis-sealed

birth certificate binds (dot.name, T); resolution verifies the certificate,

translates name → authentic T, and confirms fetched content against T. Every link

is a verification, rooted in the machine's genesis. The machine is good at this:

it checks, every time, without fatigue or judgement.

The human decides trust. Across domain boundaries — a lump from another

source, a connection to another machine, an introduction of a new party — the

trust decision is made by a human, through the managed IDE. The person vouches

("yes, install this," "yes, trust this source," "yes, connect to that machine");

the machine records and thereafter enforces that decision. The human is good at

this: trust is a human concept, built on lifetimes of experience — not scientific,

but it works for the individuals involved and for the progress of Civilisation.

Each party does what it is good at. Machines enforce; humans judge. Putting each

where it belongs is not a compromise — it is correct. Trying to make the machine

originate trust (rather than enforce a human's trust decision) is a category

error: it is chasing a mechanical answer to a human question.

What this simplifies

With the IDE online and under human control, the hard autonomous-federation problem

collapses, because the human is the cross-domain trust root:

The single-domain mechanical chain (name → T → content, genesis-sealed, verified)

stands as specified — solid and needed.

The unanswered network question — why does machine B trust machine A's root? —

is answered by a person, at the moment of introduction, through the IDE. No

autonomous trust-establishment protocol is required to reach a working system.

The machine enforces within the domain; the human draws the domain's boundary.

What is deliberately deferred

Autonomous cross-machine federation — machines establishing trust with each

other across an untrusted network with no human in the loop — is explicitly out

of scope for now. This is a deferral, not an omission:

It is a genuinely hard problem (trust between strangers with no shared root has no

clean, uncontested scientific solution — PKI, web-of-trust, and their kin are all

partial).

It is not needed to reach first base. The proof that closes the 1975/1978

argument — containment demonstrated on silicon, Mallory faulting — happens within

a human-managed trust domain. Federation is a base you run to after first, with

the credibility and collaborators that reaching first base earns.

The direction, when it is taken up later, is sketched (asymmetric genesis identity;

capability-delegated trust; genesis-to-genesis pairing; no central authority — see

the cross-machine trust discussion) — but it is a later design pass, and possibly

a research collaboration, not a first-product requirement.

The boundary, stated plainly

The machine enforces integrity within a trust domain (seal, token, verified

name→T→content resolution). The human, through the managed IDE, supplies the

trust decision across domain boundaries. Autonomous cross-machine federation is

deliberately deferred — the human is the cross-domain trust root for now. First

base, not a home run.

This boundary is a scope decision made on purpose. It is not a hole to be

apologised for; it is the correct placement of a human concept (trust) with the

human, and a mechanical concept (enforcement) with the machine — and it is what

makes a working, demonstrable system reachable now.

Status: deliberate scope decision. Companions: genesis-chamber.md (the in-machine

root of trust; note that network federation would later require the root to carry a

public, verifiable identity — deferred with the rest), the single-domain TCB chain

(name→T→content, the mechanical part that stands now), and the vanishing-stack /

"win inside, interoperate at the edge" scoping. Deferring federation is intentional;

reaching first base is the goal.