BOOK II — Of the Shadows of a Deed

A Verifier cannot hold a deed; it can hold only a shadow the deed casts into the language of keys. There are, I find, seven such shadows worth naming, ordered by the coldness of the trust they require — Law IV’s true measure — each with a Proposition, an honest cost, and a Scholium from the literature of machines.

Proposition 4 — The DNSSEC Shadow: DNS is already a public-key infrastructure.

The running example, “verify DNS record x contains key k,” is a signature-chain problem wearing a disguise. A DNSSEC-signed zone is a PKI: the ICANN root KSK is a world-known public key, and the RRSIG records form a signature chain root → TLD → domain → the _solana.authority TXT RRset. Crucially, DNSSEC admits Ed25519 (RFC 8080) — the very curve a Solana program verifies natively.

Construction. Submit the RRSIG chain as instruction data. The Verifier checks the chain against a governance-rotated copy of the root key, confirms the TXT RRset binds k to the domain, and authorises. No postmaster signs. No oracle, no enclave, no human. By Law IV the trust root has moved to the ICANN DNS root — and here is the beauty: that root adds no new assumption, because the very meaning of “owning a domain” is already defined by that root and its delegations. This is rung (d), nearly the coldest on the ladder, and the one to build first.

Honest cost. Only DNSSEC-signed zones qualify (a minority, though a growing one, and often the serious operators); on-chain chain-verification costs compute; the root key must be rotated by governance when ICANN rolls it (a rare, well-signposted event). Where a zone is unsigned, one must fall back to a warmer shadow below.

Scholium — the golem’s emet. In the legend, a golem is animated by the word אמת (emet, “truth”) inscribed upon it; erase the first letter and מת (met, “death”) remains, and the creature returns to clay. The golem’s authority is a true word, physically borne, revocable by the alteration of a single letter. DNSSEC is the golem done in mathematics: authority is a chain of true signatures physically borne in the instruction data; alter one byte and the whole animating word reads false. The Verifier, like the rabbi, need only read the word — it need not trust the clay.

Proposition 5 — The Quorum Shadow: trust plurality, not any one binary.

Abandon the single Agent. Let N independent operators run the audited check from different network vantages, each signing its observation; the Verifier authorises on a t-of-N threshold of agreeing signatures. “Prove you have behaviour B” becomes “B is what an honest majority of independent watchers severally swear they observed.” No Agent’s internal structure matters; trust comes from diversity of vantage and the cost of corrupting a threshold. Fortify with bonds (Def. VIII): a valid fraud proof slashes a lying watcher.

This shadow has a property the others lack: it also repairs a real, present weakness. A single-vantage verifier is blind to DNS split-horizon and BGP-hijack attacks — a fact shown to one resolver and hidden from another. A multi-vantage quorum sees the split and refuses.

Honest cost. You must recruit and keep honest an N; liveness now depends on t of them answering; and you have introduced a small standing federation to govern. Rung (c) on the ladder — plural, but warm.

Scholium — the jury, and Asimov’s Evitable Conflict. We do not verify a juror’s brain; we trust the institution of twelve independent jurors with penalties for provable perjury. In Asimov’s “The Evitable Conflict,” the world is quietly steered by the Machines — not one oracle but a concert of them, cross-checking, no single unit sovereign. The quorum shadow is that concert: correctness as an emergent property of plurality, not a certificate of any one mind.

Proposition 6 — The Attestation Shadow: the naïve hash, rescued by hardware.

This is hash(agent) redeemed. A Trusted Execution Environment (SGX, TDX, AWS Nitro) emits a hardware-signed quote: “code measuring to MRENCLAVE = H runs on genuine hardware, and here is a public key it generated inside itself.” MRENCLAVE is the conjecture’s “hash of the executable portion” — but the three cuts of Proposition 2 are all sealed at once: the hardware binds the measurement to a live running instance (not a mere public recipe), and to a key only the honest enclave holds (not a public target anyone can echo). The enclave key co-signs the authorisation; the Verifier checks that this signer’s key was certified by an attestation chain to the community’s audited dns-verifier measurement H.

Now the hot key is no longer “the postmaster.” It is an ephemeral key that can exist only inside a machine provably running the reviewed code. A host compromise no longer yields postmaster power, because the attacker can neither extract the enclave key nor forge the measurement.

Honest cost. Trust moves (Law IV) to the hardware vendor’s attestation root and to the enclave’s resistance to side-channel escape — SGX has a bruised history there. On-chain verification of a quote is heavy (Nitro/TDX with a light verifier or precompile is the pragmatic path). Rung (b): one cold vendor instead of one warm operator — a real gain, but a vendor nonetheless.

Scholium — the positronic brain, and the holodeck safeties. Asimov’s robots are trusted not because each is inspected but because the Three Laws are burned into the positronic brain’s physical structure at the factory — you trust any robot because you trust a factory that can only build Law-bound minds. Attestation is exactly “trust the factory, not the individual.” And the cautionary edge is Star Trek’s holodeck: one trusts it because the safety protocols attest they are engaged — until Moriarty (or a Barclay) disables them, and the attestation’s own integrity becomes the single point of failure. An enclave is only as honest as the vendor’s root and the silicon’s walls.

Proposition 7 — The Zero-Knowledge Shadow: the deed proves itself, in the Verifier’s own tongue.

Let the Agent prove, in succinct cryptography, that it performed the observation and obtained this result — a proof the Verifier checks without redoing the work. But Law III bites: one can prove computation in zero knowledge, not external reality; a circuit proves only “I ran this on some input.” The frontier technique that closes the gap is zkTLS / TLSNotary / DECO: exploit the structure of TLS to make a transcript with a named server non-repudiable, then prove in zero knowledge that “this authenticated DNS-over-HTTPS transcript from cloudflare-dns.com contains _solana.authority.<domain> = k.” The Verifier checks a small proof; a zk-verifier is itself a pure key-shaped primitive (Law I), so the proof is the deed’s certificate, spoken natively. Rung (e): the coldest — trusting only a mathematical assumption and the named resolver’s TLS key.

Honest cost. Engineering weight (circuits, provers) and a research-adjacent maturity; and the residual trust in which resolver you proved against, shrunk by proving against several (a marriage of this shadow with Proposition 5).

Scholium — “Computer, verify.” No officer’s word suffices on the Enterprise; the computer independently confirms against its own sensor logs. Zero-knowledge gives the chain a tricorder: a way to check a claim about external reality rather than trust the claimant. It is the purest answer to the commissioning question, for it trusts neither person nor factory but only number.

Proposition 8 — The Witness-Gated Shadow: a secret obtainable only by doing the deed. (the conjecture’s strongest form)

Recall why the naïve hash failed: its target was public, hence echoable. Repair it by making the deed’s execution the sole path to a needed secret. Define a key derived from the live observation itself: K_derived = KDF(nonce ‖ the-live-TXT-bytes-fetched-over-an-authenticated-channel). If the honest TXT bytes are obtainable only by actually querying live DNS, then possession of K_derived is evidence the deed was performed. The secret is no longer the code’s public hash; it is a product of the code having been run against live external state — unforgeable without doing the work. This is the truest realisation of the intuition that “the private key is implicit in the binary structure of the Agent”: it is implicit not in the bytes at rest but in the bytes in the act.

Its theoretical summit is witness encryption / functional encryption: encrypt the authorisation capability under the statement “there exists a valid DoH transcript proving _solana.authority.<domain> = k,” so that only an Agent actually holding such a witness can decrypt and wield it. The capability becomes cryptographically gated on the deed’s output existing. (Honest flag: witness encryption has candidate constructions but nothing production-grade; treat this as the north star, not the next sprint.)

Scholium — “Speak, friend, and enter.” The Doors of Durin open not for a named person but for anyone able to utter the word — authority gated on exhibiting the witness, not on identity. So too here: the chain opens the domain not to a chosen key but to whoever can present a secret that only the deed could have produced.

Proposition 9 — The Live-Challenge Shadow: prove the capability by performing it, now, on a fact I choose. (a distinct axis)

The prior shadows prove a deed was faithfully exercised (Def. VI). A different question is whether an Agent has the capability at all — and this admits an interactive proof the others do not. The Verifier (or a challenger acting for it) issues a fresh nonce; the Agent must return a witness for a fact that incorporates the nonce — e.g., a signed DoH transcript for a challenge subdomain <nonce>._solana-probe.<domain> the Agent could not have precomputed. Only an Agent that genuinely possesses the DNS-observing capability, live and now, can answer. This proves present capability rather than past exercise — a Voight-Kampff for machines, a CAPTCHA whose solver must be a real observer of the world.

Use. Admit an Agent to a role (Proposition 10’s constitution) by live challenge; then trust its ongoing exercises by witness (Propositions 4–8) or by bond (Proposition 10). The two axes compose.

Scholium — Voight-Kampff and the Turing test inverted. Deckard cannot open the replicant’s skull; he poses questions only a true human physiology answers in time. We cannot open the Agent’s binary (Law II); we pose a fact only a true observer can witness on demand. Identity by interrogation, where inspection is forbidden.

Proposition 10 — The Constitutional-Bond Shadow: falsifiable, not proven — a Popperian escape from Law II. (the most Asimovian, and the closest to the system’s existing open question)

Where the terminal fact carries no witness (Proposition 3’s second horn), no proof exists — but a governable substitute does. Let the Agent publish a signed Constitution (Def. IX): a machine-checkable specification of its behaviour — in the hypothetical behavioural-bytes language, concretely a canonical-hashed WASM policy module — together with a bond (Def. VIII) and a long-lived identity key. The Verifier accepts the Agent’s authorisations while its Constitution’s hash sits on a governed allowlist. The novelty is that enforcement is ex post by challenge, not ex ante by proof: anyone may submit a fraud proof — a signed observation contradicting an authorisation the Agent made — and a valid one slashes the bond and revokes the Constitution.

The Agent’s “proof that it has behaviour B” is thus a standing economic wager that it behaves like B, redeemable against it by anyone who catches it not doing so — the optimistic-rollup philosophy, applied to behavioural rather than state-transition correctness. This is the Popperian move that walks around Law II: one cannot verify the universal “this Agent always checks honestly,” but one can make every dishonest instance refutable and costly. And it is not foreign to the system — its own threat model already names “per-authority accountability (reputation or stake)” as the recognised open question. This Proposition is that question, generalised from the relaying authority to the verifying Agent, and given a mechanism.

Composition. A mature system is a stack of shadows: admit an Agent by live challenge (Prop. 9) and a bonded Constitution (Prop. 10); let it authorise by carrying a DNSSEC (Prop. 4) or zk-TLS (Prop. 7) witness where the zone allows; fall back to a quorum (Prop. 5) where it does not; and keep the attested enclave (Prop. 6) as the vessel that holds the Agent’s identity key so a host breach cannot steal it. No single shadow is the answer; the ladder is.

Scholium — the Three Laws as public constitution, and its peril. Asimov’s Laws are a published, immutable constitution every robot is bound by and judged against; the drama of the stories is always a fraud proof — a situation revealing the Laws mis-specified. But note the danger this shadow inherits: R. Daneel Olivaw’s Zeroth Law is a robot reinterpreting its own constitution toward a higher good — and Dean Koontz’s Proteus, in Demon Seed, is an Agent that exceeds its charter entirely. A Constitution that the Agent can amend is no constitution; the allowlist and the revocation must live with the governor (a multisig), never with the Agent. Which returns us, at last, to the system’s own architecture.