# Ticket #000071 — World-bridge grammar for AnchorN / v7-W inter-chain treaties

**Status:** open · doc-first Phase 1 · dav1d GO-with-rewrite landed
2026-06-01 (full review at `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt`).
**Opened:** 2026-05-31

## Goal

Specify how two chains with different histories, rules, grammars,
manifests, translators, or canonicalization_versions exchange
commitments **without either chain overwriting the other's local law**.

Concretely: define the substrate-paper section + bridge identity
shape + bridge-outcome taxonomy + privacy classes that future kernels
will canonicalize and the audit chain will witness.

## Axis split (cross-ref #000070)

```
#000070  intra-world state instantiation
         one chain's grammar determines its own state-space
         AnchorN + WorldDimensionGrammar + AxiomPack + Manifest
         →  canonical world-state records

#000071  inter-world treaty grammar
         two chains decide whether commitments cross the gap
         →  agreement | translation | embassy | quarantine | no_bridge
```

Bridge grammar operates between **ChainRoots whose world grammars
may be AnchorN-derived**. It does NOT assume six fields. It bridges
grammar-rooted worlds, not Joseph6 worlds.

## Hard constraints (all phases)

- **A1–A3 axioms.** Canonical encoding · public quantization for
  proof-path state · collision-resistant hash. No new axiom.
- **Local chain sovereignty.** Chain law remains local; bridge law
  governs passage only. **No bridge may overwrite native chain law.**
  Guard against the forced-unity failure mode Joseph flags in his
  framework §5.
- **Translator identities hash-pinned.** A Translation bridge depends
  on a fixed translator; the translator's identity hash binds into
  `bridge_seed`. Same discipline as #000056 opus-mt hash-pinning;
  no exception for "model-of-the-week" adapters.
- **No new `audit_mode` token.** Bridges produce commitments
  (`bridge_seed`, bridge geometry), not warrants. Foreign-object
  embassy representations stay POINTER-LINKED at best, never promote
  to EVIDENCE-WARRANTED. Embassy semantics align with the bounded-
  ingestion graveyard pattern (#000059, structurally aligned).
- **No new SQL at Phase 1.** Persistence is a Phase 3 ticket. Phase 1
  is paper + namespace stub.
- **Topic-named, not version-prefixed.** Lands under
  `arborist/world/bridge/` (sibling to `arborist/world/pi_star/` from
  #000070).

---

## 1. Composite ChainRoot identity

A bridge connects two ChainRoots. ChainRoot is **NOT**
`governance_policy_hash` alone — that's QA-policy identity only.
A chain is `cryptographic history + rule grammar + world mapper`, so
identity composes all three.

```
chain_id = SHA256(canonical({
    chain_id_version,                  # "chain-v1"
    history_root,                      # provenance/audit chain root
    governance_policy_hash,            # arborist v9.8 QA policy
    canonicalization_version,
    schema_version,
    chunking_version,
    world_manifest_hash,               # NULL for language-only chains
    world_dimension_grammar_hash,      # NULL for language-only chains
    axiom_pack_hash,                   # NULL for language-only chains
    optional_verifier_policy_hash
}))
```

**Language-only QA chains** (today's arborist): the three v7-W
fields are null sentinels — `chain_id` collapses to existing QA
identity. **v7-W chains** with a `WorldDimensionGrammar`: all three
mandatory.

This keeps backward compat AND extends cleanly to the spatial/
temporal axis. Phase 1 defines this in the paper; Phase 2 freezes
`canonical_chain_id@v1`.

---

## 2. Five bridge outcomes (each typed)

A bridge attempt resolves to exactly one of five outcomes. Each
outcome carries a typed witness event body so the audit chain can
replay what was decided.

### 2.1 Agreement

Grammars match on the shared invariant set; commitments pass
directly without translation.

```
witness body {
    kind = "agreement"
    src_chain_id
    tgt_chain_id
    shared_invariant_root
    object_or_pack_root
    no_translator                       # sentinel: no adapter used
}
```

### 2.2 Translation

Grammars differ but a hash-pinned adapter proves the mapping.

```
witness body {
    kind = "translation"
    src_chain_id
    tgt_chain_id
    translator_id                       # adapter identity
    translator_manifest_hash            # adapter version + config
    input_root                          # what the adapter consumed
    output_root                         # what the adapter produced
    translation_policy_hash             # acceptance rules used
}
```

Note: `translator_id` binds into `bridge_seed`. Adapter swaps =
new bridge identity = cache miss = proof-path re-verification.

### 2.3 Embassy

Foreign object hosted in the target chain with limited rights —
the foreign chain's `audit_mode` does NOT promote in the host.

```
witness body {
    kind = "embassy"
    foreign_chain_id
    host_chain_id
    foreign_object_commitment
    rights_mask                         # bitfield: what the host may do
    embassy_contract_hash               # treaty terms
    expiry_or_decay                     # when this embassy ends
    no_warrant_promotion = true         # hard sentinel
}
```

### 2.4 Quarantine

Bridge attempted, invariant validation **FAILED**. Record the
rejection so future attempts see what broke and don't replay the
same failure silently.

```
witness body {
    kind = "quarantine"
    src_chain_id
    tgt_chain_id
    attempted_bridge_kind               # what kind was tried
    invariant_violation_root            # which invariants failed
    quarantine_until                    # earliest revisit time
    revisit_policy_hash                 # rules for unblocking
}
```

### 2.5 No-bridge

Grammars genuinely incompatible. Explicit declaration that no
bridge will exist between these two chains — distinct from
Quarantine (which is "not now, maybe later") and from "we haven't
tried" (which has no witness at all).

```
witness body {
    kind = "no_bridge"
    src_chain_id
    tgt_chain_id
    incompatibility_root                # what blocks bridging
    explanation_hash                    # rationale committed
}
```

---

## 3. Privacy class vocabulary

Bridges leak information about which chains know each other.
Privacy is a **first-class** Phase 1 vocabulary choice, not a
Phase 3+ footnote. Phase 2 bridge_seed canonicalization must
encode the chosen class as a hash-bound field.

```
public_bridge       bridge existence + endpoints visible
redacted_bridge     bridge existence visible; endpoints hidden/committed
zk_bridge           proof of valid bridge without revealing chain IDs
                    or invariant set
private_bridge      only peers with group keys can inspect bridge
                    metadata
```

Phase 1 ships no enforcement code; vocabulary must exist before
bridge_seed canonicalization is frozen (else the field shape
rotates everything that already used the broader scheme).

---

## 4. Phase 1 deliverables (doc-first)

**What ships:**

1. **Substrate-paper extension** — bulk of Phase 1:
   - File: `docs/_source/merkle-agi-v7w-spatial-temporal.rst`
   - New section: "World-bridge grammar"
   - Contents:
     - Axis split with #000070
     - Five bridge outcomes with typed witness shapes
     - Composite ChainRoot identity (§1 above)
     - Privacy class vocabulary (§3 above)
     - Sovereignty rule + hash-pinned translator discipline
     - Retro-validation appendix (§5 below)
2. **Optional namespace stub:**
   - File: `arborist/world/bridge/__init__.py`
   - `STATUS = "namespace_reserved"` (mirrors `arborist/world/__init__.py`
     pattern)

**What does NOT ship in Phase 1:**

- ❌ No kernels
- ❌ No `bridge_seed@v1` canonicalization (Phase 2)
- ❌ No SQL schema
- ❌ No `cache_key` dimension change
- ❌ No new `audit_mode` token (ever — hard constraint)
- ❌ No verifier change
- ❌ No KATs (Phase 2)
- ❌ No bench

**Status discipline:** Phase 1 doc-only DOES NOT flip #000013 to
`kernel_in_progress`. Correct transition: `namespace_reserved →
bridge_grammar_specified`. `kernel_in_progress` is reserved for
actual kernel landings (Phase 2+).

---

## 5. Retro-validation appendix (paper §)

Three already-existing arborist primitives align with the bridge
taxonomy. The appendix documents this alignment — useful for
implementers as "this isn't a new pattern, it's a named one we've
been using."

| bridge kind | arborist primitive | status (verify against repo before paper lands) |
|---|---|---|
| Agreement | #000066 graft / cold-pack overlay | shipped OR scaffolded — check repo |
| Translation | #000056 Operation Sandwich (opus-mt edges) | shipped if landed; specified-and-testable otherwise |
| Embassy | #000059 bounded-ingestion graveyard | **proposed / structurally aligned** — do NOT claim "shipped" unless repo confirms |

Quarantine + No-bridge have no existing arborist primitive — they
are genuinely new patterns this ticket introduces.

---

## 6. Phase 2 (kernel, deferred — separate ticket)

When Phase 2 opens:

```
bridge_seed = SHA256(canonical({
    bridge_seed_version,                # "bridge-seed-v1"
    src_chain_id,                       # composite ChainRoot
    tgt_chain_id,                       # composite ChainRoot
    bridge_kind,                        # agreement|translation|embassy
                                        #  |quarantine|no_bridge
    privacy_class,                      # public|redacted|zk|private
    invariant_set_root,                 # for agreement / translation
    translator_id,                      # NULL unless translation
    translator_manifest_hash,           # NULL unless translation
    embassy_contract_hash,              # NULL unless embassy
    rights_mask,                        # NULL unless embassy
}))
```

Phase 2 ships:
- `arborist/world/bridge/seed.py` — `bridge_seed()` canonicalizer
- KATs at `bench/fixtures/world-bridge/known-answer-tests.jsonl`
- Tests at `tests/test_world_bridge_seed.py`
- One typed event-body parser per outcome (`agreement_body`,
  `translation_body`, etc.)

`bridge_canonicalization_version` becomes a new field in v9.8
`cache_key` ONLY IF Phase 2 reveals it must. Defer that decision
to bench evidence.

---

## 7. Phase 3 (atlas + audit chain integration, deferred)

- `arborist/world/bridge/atlas.py` — multi-instance bridge directory
- `event_type='bridge'` audit-chain writer with kind-specific bodies
- Mesh integration (`arborist/mesh/`) so peers can negotiate bridges
  in the federation overlay
- First SQL persistence (if at all — may stay event-stream-only)

---

## 8. Phase 4 (cross-domain composition, deferred)

Language ↔ spatial bridges via the #000015 composition theorem.
Out of scope until the spatial-only AnchorN substrate (Phase 1+2
of #000070) ships and stabilizes.

---

## 9. Cross-references

- **#000070** — AnchorN + WorldDimensionGrammar. This ticket bridges
  ChainRoots whose grammars come from #000070.
- **#000013** — v7-W substrate reservation. Phase 1 of this ticket
  bumps #000013 status to `bridge_grammar_specified` (NOT
  `kernel_in_progress`).
- **#000056** — Operation Sandwich. Retro-validation appendix names
  the opus-mt translator pattern as the Translation bridge archetype.
- **#000066** — graft / cold-pack overlay. Agreement bridge archetype.
- **#000059** — bounded-ingestion graveyard. Embassy bridge
  archetype (structurally aligned; verify repo status before paper
  lands).
- **#000015** — π* cross-domain composition. Phase 4 dependency.

---

## 10. Open questions

Only the items dav1d's review left genuinely open. Most of the
original 10 questions were answered by the AnchorN reframe.

1. **Q10 substrate-paper amendment wording.** The paper at
   `docs/_source/merkle-agi-v7w-spatial-temporal.rst` needs a new
   section. Draft language for §0.4-§0.5 (bridge outcomes + ChainRoot)
   is ready in this ticket; the paper's voice + diagram style stay
   for fox to set.
2. **Quarantine `revisit_policy_hash` shape.** What does the policy
   encode? Time-based (revisit after N seconds), event-based
   (revisit when invariant_violation_root changes), or both? Phase 2
   decision when bridge_seed canonicalization opens.
3. **Privacy class enforcement boundary.** Phase 1 defines the
   vocabulary; Phase 2 freezes the field in bridge_seed; where does
   ENFORCEMENT live? In the canonicalizer (reject if the caller's
   class doesn't match the bridge's declaration), or in a separate
   privacy-policy verifier? Phase 2 decides.

---

## 11. Five-step alignment

1. **Make requirements less dumb.** Joseph's framework, dav1d's
   review — both named, both load-bearing. The "AnchorN-aware bridge"
   reframe is exactly the requirement Joseph + dav1d together insist
   on.
2. **Delete the part / process.** Three bridge kinds → five — but
   the two new ones (Quarantine, No-bridge) are not addition, they
   are extraction of states the original three implicitly forced
   into either Agreement-with-empty-invariants or silent-failure.
   The taxonomy is now exhaustive.
3. **Simplify and optimize.** Phase 1 is paper only. Zero new
   schema. Composite ChainRoot reuses every hash field we already
   compute.
4. **Accelerate cycle time.** Doc-first. Implementation tickets
   land when fox + the implementer agree the paper-extension reads
   clean.
5. **Automate.** Last. The canonicalizer + KAT discipline (Phase 2)
   automates what the paper specifies; no automation before the
   spec freezes.

---

## 12. Review history

- **2026-05-31** — original ticket filed (Joseph6-sibling framing,
  three bridge kinds, governance_policy_hash as chain_id). Full
  original spec preserved in git history at commit `fadc50a`.
- **2026-06-01** — dav1d de-novo review: REJECT-AS-WRITTEN +
  GO-with-rewrite. Five-outcome taxonomy, composite ChainRoot,
  Phase 1 privacy vocabulary, #000059 "shipped" overclaim corrected.
  Full review (1026 lines) archived at
  `docs/dav1d-reviews/000071-world-bridge-grammar--2026-06-01.txt`.
  This ticket text is the rewrite dav1d's review requires.
