The Invariants

Eleven rules that cannot bend.

The repository fixes eleven invariants that bound all future evolution. They are not style preferences or aspirations — each is enforced by a validator, a compliance check, or the CI pipeline itself. A change that violates one is wrong even if every test passes.

"There is no score, no endorsement count, no activity volume anywhere in the schema — and, by standing invariant, there never will be. An identity that cannot show its accountable principal has not anchored identity; it has asked to be trusted. This system is built so it never has to ask."

I101

No reputation.

No score, endorsement, ranking, or activity-volume field appears anywhere in the schema — ever. Trust is a function of authorization and accountability, never of a number that can be farmed, purchased, or Sybil-inflated. A regulator cannot cite a reputation score; PRAXIS gives them something they can.

enforced byschema · standing invariant
I202

The document is the source of truth.

The token holds only a hash commitment plus cheap discovery fields. Authoritative identity data never moves on-chain — the full record lives on Arweave, and the anchor exists only to say which version is authoritative, who controls it, and whether it is live.

enforced byanchor / document split
I303

Indexers are never authoritative.

Anything fetched off-chain — from a gateway, a cache, or an indexer — is re-hashed against the on-chain commitment before reliance. A convenient index can speed discovery, but it can never be believed on its own. The bytes always answer to the anchor.

enforced byverifyAgainstAnchor
I404

Two hash rules, both non-circular.

A verifier checks both the per-version chain links and the constant genesis root — defense in depth. Each hash is defined over a preimage that excludes itself, so neither falls into a fixpoint and both remain well-defined and checkable forever.

enforced bycontentHash + genesisHash
I505

Append-only, never delete.

Versions supersede; they never overwrite. Revocation is a terminal status flip, not an erasure — the chain and the token are retained so the full history stays replayable. Nothing that once existed can quietly vanish.

enforced byversion chain · retained token
I606

No hidden clocks.

Every temporal decision takes an explicit instant parameter. Status is never "now" as read from an ambient system clock — it is the effective status at a stated point in time, so two parties evaluating the same question at the same instant always agree.

enforced byeffectiveStatus(doc, at)
I707

Fail closed.

The default is deny. An unwired capability throws rather than returning a plausible-but-fake result. A mock never masquerades as a verified answer; the absence of a check is treated as a failure, not a pass.

enforced bydefault-deny · throwing stubs
I808

Canonicalization is sacred.

Byte-exact canonical JSON — recursively sorted keys, no floats, no undefined, UTF-8, SHA-256 — is identical in every implementation. Hash verification is meaningless if two verifiers serialize differently, so the encoding is frozen and conformance-tested.

enforced bypraxis-canonical-json/1
I909

Soulbound, controller-vested, two-step handoff.

The NFT is never transferable, and token custody never implies control. Authority vests in the recorded controller, and a change of controller requires a deliberate two-step handoff — so seizing the token seizes nothing.

enforced byFA2_TX_DENIED · two-step handoff
I1010

Standards alignment is enforced, not decorative.

Every cited control — DID-core shapes, SP 800-63 assurance floors, NCCoE properties, OWASP NHI mitigations — is backed by a validator or compliance-evaluator check. Citing a standard without wiring its check is treated as a defect, not a credential.

enforced byevaluateCompliance
I1111

Honesty about boundaries.

Stubs, mocks, and unaudited components are stated plainly; a mock is never presented as real. Every status label on this site — SHIPPED, PARTIAL, ROADMAP, VISION — is drawn from the repository's own vision-to-code cross-reference, and a claim reads SHIPPED only if the pipeline exercises it today.

enforced bystatus legend · CI cross-reference
The standing rule

A change that violates one is wrong — even if every test passes.

Tests prove behavior; invariants bound design. The two are not the same, and when they conflict the invariant wins. This is what keeps a trust system honest as it grows: not the promise that it works today, but the guarantee about what it will never become.

Rules are only real if something enforces them. Watch one.

Run the verifier The threat model The AID standard