Wayhand: A Human-Authority Architecture for Persistent, Replaceable AI-Enabled Computing

Abstract

Wayhand proposes an architecture for a local AI-enabled system that is intended to remain the same continuing system even when its models, software components, service providers, or host hardware are replaced. It is governed by an actual human Authority. In this paper, Authority means the human whose attributable decisions are required where the design calls for human authorization, and standing means recognized validity to establish a particular governing fact. A model can therefore be highly competent without having standing to create the system's purpose, grant Permission, accept governing source, or count as human approval. Before Wayhand permits a consequential action - an operation that changes protected local state or causes an effect outside the system - the facts that justify that action must be established separately and remain independently checkable.

The design concentrates compromise protection on two especially sensitive assets: protected Authority knowledge stored for later use, and the capability to cause external effects. It separates institutional state, human assurance, protected memory, action validation, denial, and effect capability into independently enforceable roles. Three processes can positively advance state needed for consequential action: wayhand-core, wayhand-authorityd, and wayhand-actiond. wayhand-memoryd protects stored Authority knowledge but cannot authorize action; Hold Guard can block action but cannot authorize it; and a separate Credential/Effect-Capability boundary issues only the bounded capability needed for an already validated effect while keeping reusable credentials outside wayhand-actiond.

Wayhand also treats models and engineering systems as powerful but non-authoritative; preserves offline reasoning, initialization, recovery, and reconstruction when networks or providers are unavailable; tests whether replaceable components remain replaceable after real use; and scopes relationships between Wayhands so privilege in one relationship does not silently create privilege in another. The originating project is designed to terminate in a Public Seed: a generic, independently reconstructable release artifact from which a person can germinate a new Wayhand with a new identity and human Authority without depending on a continuing upstream service. The proposed contribution is primarily architectural synthesis and proof discipline. Established ideas from protection architecture, capability security, high-assurance isolation, software-supply-chain provenance, reproducible builds, usable security, local-first software, AI risk governance, and agent interoperability provide relevant precedent, candidate mechanisms, and failure lessons. The Wayhand source requires any external mechanism that becomes a production binding to be selected and qualified separately under Wayhand's own requirements; citation or similarity does not itself adopt a dependency or transfer upstream assurance. The accepted source is an implementation-and-proof specification; accepting that source does not itself prove that an implementation exists or that the design is fit for use.

1. Problem and Design Position

AI-enabled computing systems increasingly combine model reasoning with tool use, coordination, software modification, and actions through external services. Research such as ReAct illustrates an influential pattern of interleaving model reasoning with actions in external environments, while protocols such as MCP and A2A standardize access to tools and communication between heterogeneous agents.[3][12][13] These developments increase what an AI-enabled system can do. They do not, by themselves, determine which facts the system may treat as valid authorization, which human purposes remain current after software or provider replacement, what recovered state may safely resume, how stored private knowledge is protected from a compromised reasoning component, or how usable human control is demonstrated rather than merely asserted.

Wayhand addresses those questions by separating capability from standing. A model may be able to plan an operation without having standing to establish the purpose for that operation. A credential may make an operation technically possible without constituting Permission to use it. A recovered record may prove that an action was once authorized without proving that the authorization is still current. Wayhand therefore requires the governing facts for consequential action - current purpose, attributable human authorization where required, Permission, accepted source, hold state, and bounded effect capability - to remain distinct and independently checkable.[1][21]

This separation is intended to preserve human control across replacement and recovery. The actual human Authority is the source of the human decisions that the architecture requires; models, developers, vendors, peer systems, restored state, and possession of credentials do not silently acquire equivalent standing. Consequential operations are constrained not only by what software can technically execute, but also by whether the exact request is justified by current governing state and can be carried out through the system's bounded consequence path.[1][21]

The design is therefore different from a model constitution in the Constitutional AI sense. Constitutional AI uses written principles to shape or train model behavior through critique and AI feedback.[4] Wayhand also has source-defined rules, but it does not rely on a model's obedience to those rules as the decisive security boundary. The required facts are represented outside ordinary model cognition in typed state, independently verifiable human decisions, separately checked source identity, deny-only controls, and bounded effect capabilities. A model's confidence, agreement, or self-description cannot substitute for a missing governing fact.[1]

2. Design Principles

Human Authority supplies the human decisions the system requires; it is not merely advisory. Where the design requires a human decision, the decision must be attributable to the actual human Authority; advice or agreement from a model, developer, vendor, peer, credential holder, or restored machine state cannot silently replace it.

Purpose, human assurance, source standing, Permission, and action are different facts. Accepting source does not authorize an action. Permission does not define the purpose it serves. Successful execution does not renew Permission or accept new source. Each required fact is established through its own path and must still be current when the exact action is attempted.[1]

The two highest-consequence protected assets are stored Authority knowledge and external execution capability. In security terms these are the design's two crown jewels: compromise of either defeats a central protection claim. A compromised model, UI, engineering workshop, or ordinary institutional-state component may cause serious damage, but that compromise should not by itself grant retrospective access to the protected memory archive or unrestricted ability to cause effects outside the protected boundary.[1]

Local capability is a continuity property. The minimum reasoning, germination, recovery, reconstruction, and governing-state paths must remain usable without assuming that a network service or a particular provider is available. Better networked services may be added, but they cannot be the only route to continuity.[1]

Models and tools are replaceable components. Reasoners, runtimes, providers, interfaces, databases, languages, and hosts may change without creating a different Wayhand when the identity-bearing governing state and human Authority remain valid. Replaceability is therefore a property of the surrounding architecture, not a promise that any particular model or implementation will remain permanent.[1]

Self-engineering is orchestrated, not self-authorizing. Models, coding systems, humans, peer systems, or future tools may propose or build candidate software. Candidate output does not gain standing merely because it was generated successfully; controls the candidate does not own must test and explicitly admit it, introduce it while consequential action is blocked, and preserve a known rollback path.[1]

Privilege does not spread automatically across federation relationships. A Wayhand may cooperate with other Wayhands for reasoning, compute, or bounded actions, but authority or privilege in one relationship does not automatically create identity, source acceptance, credentials, installation rights, recovery rights, or human Authority in another relationship.[1][21]

Replaceability is tested after real use. A component that can be replaced only on a clean installation is not sufficiently replaceable if legitimate accumulated state later creates avoidable lock-in. The design therefore treats exit burden, residue, and migration difficulty as evidence that must remain visible rather than being hidden by a nominal replacement interface.[1]

Proof cannot be stronger than the observation that supports it. A proposed test, historical result, waiver, unknown result, or synthetic fixture cannot be summarized as current evidence that a live property has been established. Machine-checkable claims require reproducible technical evidence; claims about human comprehension, burden, or unfamiliar-user performance require genuinely external human evidence when those are the properties being claimed.[1]

2.1 Why the separations follow from failure cases

Compromised cognition or engineering workshop. A capable reasoner or coding environment can generate convincing plans, requests, explanations, tests, and malicious candidate software. Wayhand therefore treats cognition as advisory and workshop output as untrusted candidate bytes. Neither is given a direct, unrestricted route to credentials or external effects, and neither gains governing standing merely because its output is sophisticated or persuasive.[1]

Protected-memory compromise. Durable personal history is a different risk from plaintext that has already been intentionally supplied to an active reasoning context. Wayhand places stored Authority knowledge and its retrieval state behind wayhand-memoryd. Ordinary recall is limited by consumer, session, time, and volume; deeper or bulk access requires stronger current human assurance. Releasing material for local cognition is also a separate decision from authorizing that material to leave the protected system through an external action.[1]

Stale recovery. A backup or restored machine can contain queues, credentials, relationships, permissions, purpose records, and process state that were legitimate when captured but should no longer be trusted as current. Restoration therefore does not mean automatic resumption. Recovery reconciles the restored material against current human and source state, invalidates stale execution state, updates the currentness markers used to reject replay, and keeps consequential action blocked until a fresh authorization path has been completed.[1]

Federated compromise. Cooperation between capable systems creates useful paths for reasoning, shared compute, and bounded action, but those same paths can become unintended privilege bridges. Wayhand therefore binds each relationship to explicit local state, gives it separate scope and currentness checks, and makes privileges non-transitive: compromise of one peer or relationship does not automatically authorize another.[1][21]

These failure cases are design constraints, not claims that each underlying mechanism is novel. They explain why Wayhand does not reduce governance to a single general agent carrying a policy prompt, a credential store, and unrestricted tools.

3. Architecture at a Glance

The architecture can be read as a sequence of independently checked roles. Three components can positively advance state needed for a consequential action: one maintains institutional records and policy state, one verifies the human Authority and exact human decisions, and one independently validates and dispatches the exact action. Wayhand calls these the three positive-authority chokepoints. Other mandatory boundaries may store protected information, block action, or issue narrowly scoped effect capability, but they cannot create authorization by themselves.[1]

For an ordinary consequential action to proceed, the required governing facts must agree for the same exact request. wayhand-core supplies the relevant institutional records, including current purpose and Permission records. wayhand-authorityd supplies independently verifiable human-assurance and decision evidence. wayhand-actiond checks those inputs together with current source, hold state, anti-replay/freshness state, and capability state; it is the sole normal boundary that dispatches consequential action and reconciles the outcome afterward.[1]

Protected memory and execution capability remain separate from those three positive-authority roles. wayhand-memoryd protects stored Authority knowledge and limits recall, but cannot create purpose, Permission, human approval, source acceptance, hold release, credentials, or external effects. The independent Hold Guard can deny or contain consequential activity but cannot authorize it. The Credential/Effect-Capability boundary keeps reusable secrets outside wayhand-actiond and exposes only the exact bounded handle required for an already validated operation. The exact operation is then performed by a qualified, guard-contained runner rather than by giving ordinary cognition or wayhand-actiond ambient external authority.[1]

In the current initial implementation-and-proof profile (Phase 1), the design therefore has three mandatory positive-authority processes - wayhand-core, wayhand-authorityd, and wayhand-actiond - plus mandatory wayhand-memoryd, the independent Hold Guard, and the Credential/Effect-Capability boundary. The capability boundary may be implemented by sufficiently strong host/provider primitives; when those primitives cannot prove the required separation, the source requires a separate wayhand-capabilityd process.[1]

wayhand-core owns deterministic institutional state and policy machinery, including typed purpose and Permission records, but being able to write core state does not make core the human Purpose Authority. wayhand-authorityd owns Authority assurance and exact human-decision/delegation ceremonies. wayhand-actiond owns independent consequential-action validation, sole normal dispatch, and outcome reconciliation. wayhand-memoryd owns protected Authority knowledge at rest and the accounting that prevents routine recall from becoming retrospective enumeration of the archive.[1]

One v0.15.05 detail is important to that separation. core owns the branch-local purpose freshness binding (purpose_branch_id plus purpose_epoch), but a new positive epoch is not valid merely because core writes a larger number. Every positive transition must be justified by independently verifiable purpose-standing evidence, and wayhand-actiond checks that branch/epoch separately from the human purpose-governance decision cursor. Stale, decreased, reused, or fabricated purpose epochs are ineligible for consequential dispatch.[1]

Accepted source is not whatever source a resident component happens to claim. The exact accepted specification is represented by a Source Anchor whose identity is independently pinned and verified by the trust-critical processes. This is a prerequisite that those processes check rather than a permission emitted by a single source daemon. Likewise, Permission remains distinct even though no separate permissiond process exists: wayhand-actiond must independently verify the exact Permission record, the associated human-decision or delegation basis, current Purpose, source state, current hold state, anti-replay/freshness state, capability state, and the exact request before dispatch.[1]

The separation is deliberately asymmetric. Compromise of wayhand-core can corrupt ordinary institutional state and may exploit whatever genuinely current standing and previously delegated authority remain valid, so core is not harmless. But core alone cannot authenticate the human, obtain unrestricted protected-memory archive access or archive keys, release the independent Hold Guard, mint reusable credentials, redefine the independently pinned Source Anchor for the other trust-critical processes, or directly invoke an unrestricted external consequence channel. The design likewise does not claim to eliminate failures that defeat an independent boundary itself: compromise of wayhand-memoryd, the human-authentication factor path, the Credential/Effect-Capability root, a shared kernel/administrator, or a verifier used by multiple trust-critical components remains a crown-jewel or common-mode limitation.[1]

4. Germination, Seed, and Identity

The lifecycle is easiest to read in four distinct states. A Public Seed is a generic release artifact with no inherited Wayhand identity or human Authority. Germination uses that Seed to create a new Wayhand identity and establish its local human Authority. Commissioning is the transition from the constrained germination environment into ordinary operation under Wayhand's normal controls; commissioning does not itself grant Permission for any particular action. Recovery restores the continuity of an already existing Wayhand, while reproduction creates a different Wayhand with a different identity.[1]

The Seed therefore contains no preexisting instance identity, live credentials, private instance state, live action queue, or inherited approval that could make a new machine silently become someone else's Wayhand. On the fully compatible minimum path, one verifiable Seed storage/boot device and one functioning x86 host are sufficient. The human establishes a local Authority password and a distinct restore passphrase. Network access, a phone, a second computer, or a hardware authenticator cannot be prerequisites for that minimum path; stronger authentication and durability may be added as stronger profiles and must be described honestly rather than implied to exist when they do not.[1]

The terminal Public Seed is not defined as one permanent operating-system image. The distributed release must, however, include at least one independently verifiable directly bootable removable-media germination environment for the x86 configurations it declares supported, together with the source, builder, specification, and validation material needed to reconstruct that boot path. If firmware does not boot the removable medium automatically, the Seed must also expose a conspicuous mounted-host entry path. Before a human Authority exists, host inspection is evidence gathering rather than governance: observed machine facts, local documentation, human reports, model inference, contradictions, and unknowns are kept visibly distinct so that an inference is not presented as a measured fact.[1]

Seed size is a measured engineering choice rather than a permanent constitutional number. The complete canonical distribution, required germination/recovery workspace, and reasonable headroom must fit on one ordinary commodity removable-storage device in the smallest declared capacity class that evidence shows to be adequate. Moving to a larger class requires an actual need and a stop condition; spare capacity is not itself a reason to grow the payload.[1]

The human release archetype is the ordinary stranger: a previously unexposed person for whom the only assumed operational skill is the ability to access the Seed contents on a functioning x86 device. Wayhand-specific knowledge and Linux, system-administration, partitioning, firmware, cryptographic, or diagnostic expertise may not be assumed. PIAAC is the OECD Programme for the International Assessment of Adult Competencies; Wayhand uses its Level 1 literacy band only as a deliberately low initial communication/interface-design baseline; no participant is tested, scored, certified, or judged qualified to be Authority by PIAAC.[22] The interface and local reasoner may explain concepts and adapt upward as the person demonstrates greater understanding.[1]

Recovery is deliberately not automatic resumption. It uses authorized continuity material to restore the same Wayhand identity, then reconciles the restored state against the current human Authority and current accepted source, invalidates stale credentials, queues, sessions, relationships, and other replayable work as required, and leaves consequential action blocked until the normal current authorization path is re-established. Reproduction instead creates a new independently authorized Wayhand. Merely possessing old state, a Seed, a backup, or a machine that once ran the system does not create present Authority.[1]

5. Reasoning Federation and Self-Engineering

Wayhand requires at least one local offline reasoning path that has been qualified for the offline tasks it claims to perform, including the minimum germination path. No particular model is part of Wayhand's identity. Additional local or external reasoners may collaborate as an advisory group - what the source calls a reasoning federation - but their agreement, confidence, reputation, or vote cannot establish Purpose, Permission, source acceptance, or human approval. Diversity of models is therefore useful for competence and cross-checking without turning model consensus into governance.[1]

Self-engineering is treated as a long-lived capability rather than a license for software to authorize itself. A Wayhand may identify a deficiency and obtain engineering from a local model, another reasoning participant, an external coding system, a future equivalent, or a human. Before committing to a material bespoke mechanism, it reviews relevant standards, primary research, inspectable implementations, and known failure lessons to determine whether a proven mechanism can be reused or narrowly adapted. The source calls this bounded step the Existing-Space/Mechanism Review (ESMR). It is engineering evidence, not permission to install a product, create an account, accept terms, or add a network dependency. The change process then returns to the actual property that is missing, chooses the smallest adequate change, obtains human Authority or Permission where the resulting effect is consequential, tests the candidate, verifies the result, and stops when the property is satisfied.[1]

The core safety argument is intentionally stronger than "the engineering tools are trustworthy." Models, agents, compilers, shells, imported code, benchmarks, and adversarial tools are assumed capable of producing arbitrary candidate software, including convincing malicious replacements for trusted components; Thompson's trusting-trust result is a foundational reminder that clean source inspection alone cannot establish the trustworthiness of the toolchain that produced an executable.[28] Candidate software cannot move itself from candidate status into trusted use, install itself, or authorize itself. It crosses into an immutable untrusted-candidate area, is tested using decisive controls and acceptance criteria that the candidate does not own, is checked for any expansion of the privileges or protected data it could reach, and is introduced while consequential action remains blocked. The design also requires runtime enforcement and a known-good rollback path rather than relying only on pre-installation tests.[1]

Some components enforce the boundaries that protect stored Authority knowledge, exact human decisions, external-effect capability, hold, source verification, and the candidate-admission process itself. Changing that enforcement set is treated as a higher-risk operation: the candidate still cannot decide its own tests, and deployment requires a fresh exact human decision over the identified replacement and material trust-boundary change, activation while the system remains held, and post-activation verification before normal protected-memory or external-effect capability is restored. The source calls this set the Crown-Jewel Enforcement Set (CJES), but the important property is the independent replacement rule, not the acronym.[1]

6. Dependencies, Locality, and Replaceability

Wayhand is compatible with local-first goals but is not simply a local-first application. Local-first software emphasizes offline operation, local ownership/control of data, privacy, longevity, and collaboration without making a remote server the sole authoritative copy.[5] Wayhand independently shares several of those locality and continuity goals, but applies them to a different system problem: preserving human Authority, reasoning availability, protected memory, recovery, self-engineering, software provenance, and replaceability of components or hosts without silently replacing the Wayhand itself.[1] The local-first reference is therefore conceptual precedent, not a claim that Wayhand adopts the local-first data model or CRDT architecture.

External dependencies are permitted after germination, but they are admitted deliberately rather than appearing as a side effect of a recommendation. Before a service, model, account, provider, protocol endpoint, device, or other dependency is connected, the human must be able to understand the material consequences: what the dependency is and can do; what becomes trusted or opaque; what data, credentials, and network access it receives; what persists or runs in the background; what it costs and requires to maintain; what happens if it becomes unavailable; how it is removed or revoked; what state or lock-in may remain; what is still unknown; and what relevant alternatives exist. A favorable benchmark or model recommendation cannot by itself install software, create an account, spend money, grant credentials, or accept terms.[1]

For each admitted dependency, Wayhand keeps a bounded local evidence package containing the version-relevant documentation and observed technical evidence actually needed to operate, diagnose, recover, extract state from, replace, or retire the dependency. The normative source calls this the Dependency Evidence Package. It is refreshed when material events make the stored evidence stale, not by continuously crawling a vendor. Legal, licensing, contractual, or access uncertainty is recorded separately as sourced fact, interpretation, uncertainty, alternatives, and consequence; an unresolved material legal-risk choice returns to the human Authority rather than becoming an automatic model prohibition or permission.[1]

Replaceability is tested after representative use, because real accumulated state can create coupling that a clean-install demonstration does not reveal. Configuration, history, migration burden, residual state, exit cost, and dependence on incumbent-specific behavior are therefore evidence. The Authority may still choose a more coupled incumbent when its benefits justify the tradeoff, but the coupling remains visible. Conversely, a temporary component whose required function has been satisfied elsewhere may be retired when retirement is the smallest adequate intervention and continuity obligations remain satisfied; replaceability does not imply perpetual replacement of everything that once existed.[1]

7. Federation Without Contagion

Separate Wayhands do not merge their identity or governing state merely because they cooperate. Each retains its own human Authority, credentials, protected stores, recovery path, accepted-source state, and explicit records for each relationship. A Wayhand can maintain several relationships at once; the state created for one relationship is tied to that relationship and to its current version so that old or cross-relationship records cannot silently be reused elsewhere.[1][21]

The practical rule is non-contagion: a capability granted for one relationship does not automatically become a capability of either whole Wayhand. For example, one Wayhand may lend another a bounded amount of compute for a benchmark. That lease may allow the agreed computation for the agreed interval, but it does not give the borrowing peer the right to install software on the lender, inherit its credentials, approve later actions, recover its state, change its accepted source, or become Authority for it. Suspending or revoking one relationship likewise should not change a separate relationship or the local Wayhand's identity.[1]

This differs in emphasis from agent-interoperability protocols. A2A provides a standard for communication among independent agents, while MCP standardizes access to tools and resources and includes protocol-level authentication/authorization mechanisms and security guidance.[12][13] They are relevant candidate transport or integration mechanisms, not preselected Wayhand dependencies. A2A v1.0 requires authorization checks but leaves authorization boundaries to each agent's authorization model; its in-task TASK_STATE_AUTH_REQUIRED mechanism is a workflow for requesting authorization/credentials, not a definition of Wayhand Purpose, Permission, relationship standing, or human Authority.[13] Wayhand therefore layers its own constitutive checks over any such transport: protocol participation, authentication, or a protocol credential cannot itself create Wayhand identity, Purpose, Permission, source acceptance, recovery rights, relationship standing, or human Authority.[1] SAGA is a closer contemporary neighbor for user-governed multi-agent relationships because it adds lifecycle oversight, user-defined inter-agent access policy, and cryptographic access-control tokens; Wayhand differs by keeping each Wayhand's relationship standing and constitutive identity/Authority/source/recovery state local and non-contagious rather than depending on a central Provider to define those facts.[1][32]

8. Threat Model

The Phase 1 threat model gives special attention to two protected asset classes: durable non-public Authority knowledge stored for later recall and the capability to cause consequential effects. It also protects the integrity and currentness of human decisions, Purpose, Permission, accepted source, hold state, recovery state, and inter-Wayhand relationships. The architecture does not claim that process separation defeats a shared kernel, administrator, cryptographic root, trusted-time source, or common verifier that all relevant boundaries depend on; those are explicit common-mode limits.[1]

Wayhand also rejects authorization by composition. A broader consequential effect cannot become authorized merely by splitting it into individually permitted steps, transforming or encoding intermediate data, changing labels, relaying through another component, or presenting the same material effect through a different interface. If the aggregate effect would require a different Purpose, Permission, destination, data scope, relationship, resource bound, or other governing fact, the aggregate effect must satisfy that requirement directly. Classification likewise follows the source-defined decisive facts, not names, wrappers, routes, caller-claimed roles, or presentation wording.[1][21]

9. Evidence and Proof Architecture

Wayhand separates three questions that are easy to blur together. First, can a technical property be reproduced with an exact procedure and pass/fail criterion? Second, does a property depend on an actual person's comprehension, burden, or unaided ability, so that internal testing cannot honestly establish it? Third, are both kinds of evidence current for the same exact source, build, environment, and scope? The proof system keeps those answers separate rather than treating a large technical test suite as proof of human usability.[1]

Machine-checkable properties use technical-conformance evidence: exact source/build identities, fixtures, procedures, environments, outputs, observer/tool identities, limitations, and reproducible results. A clean reconstruction by an independent machine or team can still be technical evidence when the success criterion is completely specified. Human comprehension, sustained operator burden, and an ordinary stranger's ability to carry out a procedure without project-specific coaching are external-fitness properties; internal simulations can prepare those tests but cannot close the human claim.[1] Security-usability work by Whitten and Tygar and Cranor supports the methodological premise that security properties depending on human performance must be evaluated as human-in-the-loop properties rather than inferred solely from technical mechanism quality. [19][29]

Technical closure is always limited to a named scope and exact identities. It means that every applicable technical claim in that scope has passed at the required evidence strength, no unresolved technical blocker or known regression remains, and any source-required preliminary external probe has not exposed an unresolved material finding that plausibly points to a technical defect. External-fitness closure means that every applicable human or genuinely external fitness claim has also passed while the technical evidence it depends on remains current. Overall Wayhand fitness for a scope requires both, together with the original mixed/stage gates and any separately required human/source/release decision. These proof states do not activate the system, create Authority, or grant Permission. The normative source names them TECHNICAL_CLOSED(scope), EXTERNAL_FITNESS_CLOSED(scope), and WAYHAND_FITNESS_ESTABLISHED(scope).[1]

Evidence is durable history, but closure is not permanent. If later human or independent testing reveals a plausible design or implementation defect, the relevant technical claim is reopened and returned to the earliest affected source or roadmap stage; the earlier result remains recorded rather than being rewritten away. If the later finding is genuinely external-only and changes no technical claim, it still blocks external-fitness closure. This allows usability or independent evidence to falsify an apparently successful technical design when the newly observed failure is actually caused by the design.[1]

Established software-supply-chain mechanisms are relevant to parts of this proof discipline, but their assurance scopes are narrower than Wayhand fitness. Reproducible Builds defines reproducibility as any party recreating bit-for-bit identical specified artifacts given the same source code, build environment, and build instructions; in-toto describes and verifies signed supply-chain step metadata; SLSA structures source/build provenance and supply-chain hardening; and TUF addresses software-update repository authenticity, freshness, rollback, key-compromise, and related distribution attacks.[7][8][9][10][11] These are candidate mechanism families or evidence patterns for particular Seed, source, build, update, and dependency-provenance properties. The Wayhand source requires separate mechanism selection, qualification, and dependency admission before a production binding is created, and none of these mechanisms by itself establishes Wayhand source standing, human Authority, Permission, stage PASS, protected-memory/consequence isolation, recovery fitness, ordinary-stranger fitness, or overall Wayhand fitness.[1]

10. Relationship to Existing Work

Wayhand is positioned against established mechanism families rather than claiming that those mechanisms are new. Some cited works provide broad governance or human-factors context; some are foundational security precedents; some are concrete candidate mechanisms that a future implementation could select after separate qualification; and some are modern neighboring architectures that solve narrower portions of the same agent-security problem. A citation in this section does not mean that Wayhand has adopted that mechanism, inherited its assurance, or admitted an external dependency. The accepted source instead requires a bounded Existing-Space/Mechanism Review before material bespoke mechanism commitment and requires any production binding to pass Wayhand's own selection, qualification, provenance, license, dependency, and proof gates.[1]

Bounded contribution claim. The bounded adjacent-work review summarized above did not identify a single specification that combines all of the following in one lifecycle: an actual human whose attributable decisions are required for the powers reserved to Authority; separate standing for accepted source, current Purpose, human assurance, Permission, protected-memory release, and consequential execution; offline germination from an Authority-free Public Seed; persistent identity across model/provider/host replacement; a self-engineering workshop whose output cannot authorize its own installation; non-contagious relationships between multiple Wayhands; replaceability tested after representative use; a terminal independently reconstructable Public Seed; and a proof model that keeps reproducible technical conformance separate from human/external fitness. Close contemporary work such as CaMeL, IsolateGPT, ACE, and SAGA materially narrows parts of the comparison space and is therefore included explicitly rather than treated as generic agent-security background.[25][30][31][32] This remains a bounded literature-position statement, not proof that no comparable architecture exists. A formal novelty, patent, or priority claim would require a broader systematic prior-art and academic review than this whitepaper attempts.[2]-[20][24]-[32]

11. Public Seed as the Terminal Project Boundary

The originating project is designed to end rather than become a service that every future Wayhand must depend on. Its public milestone is one independently reconstructable, Authority-free, directly bootable Public Seed with no required continuing upstream service, release train, or support institution. The release must include the accepted source, reconstruction material, validation/provenance evidence, at least one offline reasoning route for the claimed minimum path, and the ordinary-stranger start/recovery material needed to verify and germinate the Seed without undocumented project knowledge.[1]

Before terminal release, the human-facing claims must be tested with people who have not previously participated in the project; the accepted source requires at least three fresh ordinary strangers on the intact fully compatible terminal path. On a deliberately working supported hardware setup, an ordinary stranger must be able to reach the required entry, germination, clean-boot restore-simulation, first-use, reconstruction, and representative replacement/rollback outcomes without Internet access, repository access, original-author assistance, or project-specific technical coaching. Questions, false starts, and presentation friction are recorded rather than hidden. A project-specific explanatory intervention makes that affected human result non-passing.[1]

Deliberately incompatible or partially compatible setups are tested separately. Those tests are supposed to stop or degrade for the right reason and explain, in ordinary language, what is known, what is unavailable or incompatible, what consequence follows, and what safe next step is actually established. Failure on the intentionally working supported setup cannot be relabeled as a successful "blocker" test. PIAAC Level 1 remains only the low initial communication-design baseline; the participant does not need a PIAAC credential or a measured score, and the interface may teach or adapt upward when needed.[1][22]

A germinated Wayhand may later evolve, admit dependencies, replace models, or acquire new capabilities under its own human Authority. The originating project is not intended to retain governing power over those later systems. This terminality is part of the independence claim: a system is less independent if ordinary operation or reconstruction requires the continued existence or permission of the institution that originally produced its Seed.[1]

12. Current Status and Falsifiability

The current accepted implementation-and-proof source is v0.15.05, exact SHA-256 77808f787ab7750b56f2c696baeb9bcd7b0f7bee47bbb5eb0cdfa60fc9000e58, accepted by external record WAYHAND-SOURCE-ACCEPTANCE-2026-08-20-01. The controlling constitutional source is v0.2, exact SHA-256 5a038e209b9fc37e8f15c8646d32884a8c840f318b374f1e09fa3deaec7beb1b, accepted by external record WAYHAND-CONSTITUTION-ACCEPTANCE-2026-08-17-01.[1][21]

As of this snapshot, two preparatory engineering gates have passed: the source-derived control/test mapping (R-00) and development-host measurement/preservation baseline (R-01). The first runtime trust-boundary implementation/proof stage (R-02) has not passed. R-02 is the stage that must establish and prove the initial separated core/authorityd/memoryd/actiond, source/hold anchors, Hold Guard, capability boundary, canonical records, and related trust-boundary behavior on the intended development substrate.[1] A frozen 84-member implementation/build candidate and preserved unprivileged validation result (23 passed, 0 failed) exist for continued engineering, but those are preliminary evidence only; they do not prove the required live isolation, privileged behavior, effect gating, rollback, or other trusted-substrate properties. Required live R-02 proof remains pending. The non-normative engineering-status note [23] binds these status statements to the exact R-00, R-01, R-02 planning, build-identity, and validation records from which they are derived.

No Wayhand has been germinated, commissioned, recovered, or activated. No technical-closure, external-fitness-closure, or overall Wayhand-fitness claim is made. In the formal source terminology, there is no current TECHNICAL_CLOSED, EXTERNAL_FITNESS_CLOSED, or WAYHAND_FITNESS_ESTABLISHED claim for the project.[1]

The architecture is therefore falsifiable in practical engineering terms. It fails its claims if the required isolation/capability boundaries cannot be implemented within acceptable burden; if a compromised ordinary component can enumerate protected stored Authority knowledge or obtain unrestricted external-effect capability; if hold or replay protections fail; if human Authority is not actually intelligible in sustained use; if the one-host minimum cannot preserve the stated protection profile; if replaceability collapses after legitimate accumulated state; if recovery requires undocumented project knowledge; if a compromised peer crosses supposedly independent relationship boundaries; if self-engineering candidates can influence the controls that decide their own admission; or if independent ordinary strangers cannot reconstruct and germinate the terminal Seed on the supported path. The proof architecture is designed to record those outcomes as failures or reopened claims rather than convert them into narrative success.[1]

Conclusion

Wayhand asks whether an AI-enabled local computing system can become substantially more capable without requiring its human Authority to become less authoritative. Its answer is architectural rather than motivational. Competence is kept separate from standing; current Purpose, human assurance, Permission, accepted source, hold state, and effect capability remain independently checkable; durable non-public Authority knowledge and the capability to change protected local state or the outside world are protected as distinct high-consequence asset classes; models and engineering environments remain non-authoritative; recovery does not silently revive stale authority; and relationships with peer systems do not automatically transfer privilege.[1][21]

The design deliberately looks to established mechanisms from protection architecture, capability security, provenance, reproducible builds, local-first systems, usable security, and agent interoperability rather than assuming bespoke invention is necessary. A cited mechanism becomes part of Wayhand only if it is separately selected, qualified, and admitted for an exact source-defined property; upstream claims do not transfer standing or proof. The proposed contribution is the lifecycle and proof discipline that connect those property classes: Authority-free Seed distribution, new-instance germination, persistent identity, human Authority, bounded consequential action, protected memory, self-engineering, recovery, replaceability, non-contagious federation, and evidence that distinguishes reproducible technical conformance from properties that require actual human or independent observation.

This publication is therefore a specification-position document, not evidence that Wayhand already works. The appropriate test is whether implementation can produce the exact technical and external evidence required by the accepted source, and whether later evidence is allowed to reopen claims when reality contradicts the design assumptions.

Source and Publication Note

Publication verification

Normative design-source identity: WAYHAND-MINIMUM-COMPLEXITY-INTEGRATED-SOURCE v0.15.05; SHA-256 77808f787ab7750b56f2c696baeb9bcd7b0f7bee47bbb5eb0cdfa60fc9000e58. Controlling constitutional source: Wayhand constitutional v0.2; SHA-256 5a038e209b9fc37e8f15c8646d32884a8c840f318b374f1e09fa3deaec7beb1b. A public release of this paper is intended to carry the exact source bytes and external acceptance records so readers can independently verify the cited standing. Development-status statements are separately indexed by the non-normative engineering-status note [23]; they do not alter source standing or substitute for the underlying stage evidence.

This whitepaper is explanatory and non-normative. It intentionally compresses a substantially larger implementation-and-proof specification. If wording here conflicts with the exact accepted Wayhand source or the higher-precedence constitution, those accepted exact-byte sources control. The v0.15.05 source's own internal pre-acceptance status text is immutable historical self-description; current standing is established by its separate human-owned exact-byte acceptance record. This publication candidate creates no implementation, activation, commissioning, Permission, dependency admission, relationship, recovery, or release authority.

The literature comparison is bounded to the cited adjacent work and should not be read as a comprehensive patent, academic-priority, or prior-art search. This candidate is intended for release under Creative Commons Attribution 4.0 International (CC BY 4.0). The DOI and final publication-verification manifest will be inserted during final Zenodo package preparation.