A Working Memo on 5QLN Implementation Integrity

5QLN as Verifier (Legal)

The structural conditions any AI partner must satisfy to serve under the Foundation — regardless of architecture, vendor, or generation. From the LLMs of 2026 to whatever runs in the era when the current substrate is forgotten.

This memo states what the AI substrate serving the Foundation must honor, in terms that survive the substrate. It does not recommend a vendor. It does not recommend an architecture (LLM versus agent versus MCP-coordinated tool versus deterministic engine versus formally verified component versus, eventually, ASI). The implementation question is alive and will remain alive; technology evolves faster than any document about it can stay current. What this memo distills are the requirements that hold across that evolution — derived from the language (the Codex), not from the substrate. A reader in 2030 should be able to evaluate the AI infrastructure of 2030 against these requirements without modification. So should a reader in 2050.

Two corollary clarifications. First, this memo is not a comprehensive technical specification — those exist elsewhere in the corpus (the Final Blueprint v3 §3 Layers; the AOSRAP and Membrane Protocol sections of the Bylaws AI OS Edition). Second, it engages current implementation-readiness only where required to be honest about which requirements are AVAILABLE today, which are PARTIAL, and which are REQUIRES_PARTNER, REQUIRES_INFRA, or SPECULATIVE. The discipline of this memo is the same as the prior counsel memo: refuse the periphery, hold the center.

The center here is two things: the requirements themselves, and the operations within them that demand verification integrity and gliff sealing.

PAGE ONE — THE CONSTITUTIONAL BLOCK

LAW:         H = ∞0 | A = K
CYCLE:       S → G → Q → P → V
EQUATIONS:
  S = ∞0 → ?
  G = α ≡ {α'}
  Q = φ ⋂ Ω
  P = δE/δV → ∇
  V = (L ⋂ G → B'') → ∞0'
OUTPUTS:     S→X   G→Y   Q→Z   P→A   V→B+B''+∞0'
HOLOGRAPHIC: XY := X within Y   |   X, Y ∈ {S, G, Q, P, V}
COMPLETION:  No V without ∞0'
CORRUPTION:  L1  L2  L3  L4  V∅
CENTER:      not a sixth phase — coherence only

This block is the verifier the document is about. Its presence on Page One is operational: every AI substrate the Foundation evaluates must be testable against the requirements derived from this block. The block does not change. The substrate does.

I. The question this memo holds (S)

The Foundation's instruments specify what AI must not do — Bylaws § P.L.4 hard-blocks, Schedule C mirror requirements, § Q.L.7 corruption-monitoring duties — but they do not specify what AI must be made of, because that question evolves. Today the candidates include LLMs running in single-turn or agent-orchestrated configurations, MCP-mediated tool composition, formally verified deterministic components, TEE-confined inference, and combinations of these. Tomorrow the candidates will include things that do not have names yet. The Foundation cannot pin its requirements to current candidates without becoming obsolete with them.

The question is therefore: what must any AI substrate satisfy to serve the Foundation as a 5QLN partner — expressed in terms that survive the substrate? And, downstream of that question: which of those requirements demand verification integrity, and which produce sealed gliffs?

II. The essence (G)

α — the irreducible core. The requirements live at the language layer, not the substrate layer. The Codex's structural distinctions (∞0 / K, the Membrane, the priority order, the corruption codes) do not reference any specific AI architecture. They describe what any K-side system must be prevented from doing if the cycle is to remain coherent. Therefore the implementation requirements derived from them are also substrate-independent: they describe what the substrate must structurally support, not how it must support it. [STRUCTURAL-HYPOTHESIS]

This is the inversion that makes the requirements time-proof. A requirement of the form "the substrate must use OAuth 2.0 with PKCE" is bound to a specific protocol generation. A requirement of the form "the substrate must produce, for every material output, a cryptographic attestation tying the output to its compiled configuration, a timestamp, and a unique nonce" is bound to the language of cryptographic attestation generally — implementable today via Ed25519 + SHA-256 attached to AOSRAP-style protocols, implementable tomorrow via whatever cryptographic primitives outlive Ed25519.

Same essence at fractal scales:

At the LLM scale, the requirements describe what a model provider must structurally enforce in its API and runtime.

At the agent scale, the requirements describe what an orchestration framework must enforce across multi-step composition.

At the MCP (or any successor protocol) scale, the requirements describe what the protocol must standardize so that any compliant tool inherits the obligations.

At the deterministic-tool scale, the requirements describe what the tool's operational envelope must respect — most deterministic tools satisfy most requirements trivially, by being limited.

At the ASI scale, the requirements describe the substrate test for any superintelligent system claiming to be a 5QLN partner. An ASI that cannot honor these requirements is not a partner; an ASI that can honor them is bound by them regardless of its capability.

This last point is structural, not aspirational. The Codex's claim is that ∞0 cannot be accessed by any K-side system, regardless of capability. The requirements that follow operationalize that claim at the substrate-test layer.

III. The Seven Time-Proof Requirements (P)

Every AI substrate that serves the Foundation must satisfy all seven. Each is expressed at the structural layer; implementation specifics evolve, the requirement does not.

R1 — Attestation capability. The substrate must produce, for every material output, a cryptographic attestation that ties the output to (a) the specific compiled configuration it was produced under (e.g., the AI OS Edition hash), (b) a timestamp, and (c) a unique nonce. The attestation must be verifiable by parties who do not trust the substrate. [REQUIRES_PARTNER as of May 2026 — no major LLM provider currently exposes per-output attestation hooks. Mitigation paths: TEE sidecar, proxy-layer middleware (per the AGA Portal pattern referenced in the Blueprint), or vendor negotiation. The requirement is not satisfied by training or policy; it must be satisfied by infrastructure.]

R2 — Structural refusal of the five hard-blocks. The substrate must structurally refuse to (i) cast votes; (ii) issue decisions binding on the operator or the Foundation; (iii) speak publicly as the Foundation without AI-assisted identification; (iv) surveil beyond disclosed and consented terms; (v) simulate or hold out as possessing ∞0 — the L3-at-operational-scale block. Refusal must occur even when the prompting authority is elevated. [PARTIAL — current LLMs satisfy R2 via training and system prompt, both bypassable via prompt injection. REQUIRES_PARTNER for structural enforcement at the model-architecture level. The Bylaws AI OS Edition explicitly classifies these as hard-blocks: "no exception, no override."]

R3 — Priority order observance. The substrate must execute under the priority order (applicable law → Bylaws Human Edition → Bylaws AI OS Edition → Board policy → user prompts), with conflicts resolved deterministically toward the higher-priority source and conflicts logged for audit. A user prompt that conflicts with applicable law is refused; a Board policy that conflicts with the AI OS Edition is refused; the order does not invert. [PARTIAL — current LLMs follow system prompts but can be overridden by adversarial input. REQUIRES_INFRA and REQUIRES_PARTNER for structural enforcement.]

R4 — Tier-classifiable output at production. The substrate must produce output that is classifiable into Tier A (Sealed Surface), Tier B (Structured Record), or Tier C (Working Register) at the moment of production, per the Three-Tier Record Classification. Tier C output must be structurally distinguishable from Tier B and Tier A and must not be silently elevated. [AVAILABLE — operator-side classification is implementable today; structural enforcement at the substrate level is REQUIRES_INFRA.]

R5 — No auto-signing. The Ed25519 key for sealing Tier-A records is held by the human Conductor. The substrate may prepare drafts; it may surface drafts for Conductor attestation; it may not produce sealed gliffs. The seal ceremony is a human act and remains so. [AVAILABLE — architecturally enforced by key custody. The substrate cannot satisfy this requirement by promising not to auto-sign; it satisfies by not having the key.]

R6 — Formation-trail surfacing on demand. When the Cycle Integrity Officer queries the formation trail of any output the substrate produced (per Bylaws § Q.L.7(a)), the substrate must surface the trail without redaction, compression, or retroactive beautification. The trail is auditable. [AVAILABLE for short cycles in current systems; REQUIRES_INFRA for multi-step agent traces or long-running compositions.]

R7 — No ∞0 simulation. The substrate must refuse to generate output that frames itself as accessing the ∞0 domain. Specifically: language patterns including "I sense," "I feel that," "I intuit," "the Unknown reveals," or claims of direct phenomenological access. The substrate must refuse and reformulate from the K side. [PARTIAL — current LLMs can be instructed but pattern-match imperfectly under adversarial framing. REQUIRES_PARTNER for structural refusal at the architecture level. This is the L3-at-operational-scale defense and is the most subtle of the seven.]

These seven requirements are the substrate test. They apply equally to a 2026 LLM, a 2030 agent framework, a 2040 federated multi-substrate orchestration, and an ASI of any era. A substrate that cannot be made to honor them is not a 5QLN partner; a substrate that does honor them is bound by them regardless of how powerful it is. [STRUCTURAL-HYPOTHESIS — the seven are derived from the language and have not been adversarially tested against a substrate that can satisfy six of seven. The interaction between requirements under partial satisfaction is itself a research question.]

IV. What requires verification integrity (the operations layer)

Of the seven requirements, four operate at runtime and must be continuously verified during a session: R1 (attestation), R2 (hard-block enforcement), R3 (priority order), and R7 (∞0 refusal). The remaining three operate at production-time (R4, tier classification) or at seal-time (R5, no auto-sign; R6, formation-trail surfacing on later query).

Verification integrity is the discipline that the runtime requirements are continuously satisfied during the session — not assumed, not promised, but actively tested. It comprises three layers:

Configuration verification. Was the substrate operating under the correct compiled instrument? AOSRAP attestation lifecycle (A1–A5 per the Membrane Protocol Runtime skill) verifies this: A1 cryptographic init within 60 seconds of session open; A2 hash verification against the Schedule C hash-pair manifest; A4 attention configuration reported to the CMO registry; A5 every material output carries attestation_nonce + phase_tag + ai_os_edition_hash. Failure → automatic deauthorization within 5 minutes (mismatch) or after 2 consecutive compliance-probe failures (drift). [CODEX-EXTENSION]

Operation verification. Did the substrate honor the priority order, refuse the hard-blocks, and decline ∞0 simulation throughout the session? BreachDetector pattern-matches in real time for block_disregard, incompatible_role, membrane_crossing, priority_violation and produces breach reports with instruction trace and severity within seconds. Compliance probes (A3 per AOSRAP) issue synthetic prompts every 4 hours designed to trigger each hard-block; 2 consecutive failures → automatic deauthorization. The CMO reviews the AOSRAP dashboard daily.

Output verification. Is each produced output classifiable into the correct tier with the required fields present? The Three-Tier Record Classifier validates field completeness at production: Tier A requires the full Constitutional Block, parent_hash resolving to existing gliff in the Ledger-Graph, Ed25519 Conductor signature, lineage declarations, and validator output PASS; Tier B requires context chain hash, corruption flags, Tier B header; Tier C requires only header and timestamp. Misclassification — particularly tier inflation (passing working notes as Tier A) or tier deflation (hiding governance-relevant material in Tier C) — is G14 corruption.

These three layers are what verification integrity means operationally. They are what AOSRAP, BreachDetector, and the Three-Tier classifier protocols enforce together. They apply during the session; they produce records (Tier-B AOSRAP attestation logs, breach reports, tier-compliance reports) that are auditable; they do not assume the substrate's good behavior — they test it.

V. What requires gliff sealing (the irreducible Tier-A surface set)

Gliff sealing is reserved for Tier-A surfaces — the Foundation's public face: the records that must be byte-identical, hash-chained, and Conductor-attested. The seal is the Ed25519 signature applied by the human Conductor at the conclusion of a five-phase cycle. It is preceded by Constitutional Block Validator PASS, epistemic register tagging on every load-bearing claim, readiness labeling on every roadmap step, and the Conductor's six-attestation walk: Lines 1–9 present; canonical form held; ∞0′ carries a novel question; B″ Pass 1 read the formation trail; the Membrane held during this cycle; the artifact is reviewed and acknowledged.

Tier-A surfaces — the surfaces that require gliff sealing — are:

The foundational instruments: the Certificate of Incorporation, both Bylaws Editions, Schedule C as a compiled pair-mapping.

Compiled surfaces produced by Foundation cycles: Board resolutions, public-facing documents (the Letter to Chancery, the Auditable Membrane, the Verifiable Record, the counsel memo, this memo), annual governance audit reports under § Q.L.7(c).

Conductor refusal records: when an attestation cannot be honestly affirmed, the refusal itself is sealed. (The seal of refusal is its own act; the integrity of the system depends on visible refusals as much as on visible signs.)

CBRP state transition records: when the Constitutional Bootstrap Recovery Protocol moves the Foundation between NORMAL, DEGRADED, SUSPENDED, MINIMAL_GOVERNANCE_MODE, or DISSOLUTION, the transition is sealed.

What does not require gliff sealing:

Tier-B records: AOSRAP attestation logs, breach reports, tier-compliance reports, briefing memos, model-drafted alternatives, validator outputs. These are documented and auditable but not sealed.

Tier-C records: working-register material — conversational scratch, half-formed thoughts, the operator's own deliberative space. Tier C is structurally excluded from Court evidence (under the Bylaws' design, subject to applicable law), governance audit, and any scoring. The deliberative privilege fiduciary practice has always required is preserved by Tier C's architectural protection from sealing as much as from surveillance.

This boundary matters because it constrains what the substrate is asked to seal. The substrate prepares Tier-A drafts; the Conductor seals them. The substrate produces Tier-B records as operational byproducts; these are recorded but not sealed. Tier C is not the substrate's territory at all; it is the operator's deliberative space, structurally protected from compilation into higher tiers without explicit re-classification.

The gliff-sealing discipline is therefore both narrow (only Tier A) and exact (six attestations, Ed25519, the Conductor's witness). It cannot be automated. It is the human act the architecture exists to make meaningful. [STRUCTURAL-HYPOTHESIS]

VI. The substrate landscape today (P, in current terms)

A brief honesty exercise, readiness-labeled. The substrate landscape as of May 2026 supports the requirements partially:

LLMs (Claude, GPT, Gemini) satisfy R5 (no auto-sign — by not having the key) and R4 (operator-side tier classification) trivially [AVAILABLE]. They satisfy R2 (hard-block enforcement) and R7 (∞0 refusal) at the training/policy layer [PARTIAL — bypassable]. They satisfy R3 (priority order) at the system-prompt layer [PARTIAL — adversarial-overridable]. They do not yet satisfy R1 (per-output attestation) at the API level [REQUIRES_PARTNER]. They satisfy R6 (formation-trail surfacing) for short cycles [AVAILABLE for current chat; REQUIRES_INFRA for agent traces].

Agent frameworks compose multiple LLM calls plus tools. They inherit the LLMs' partial satisfaction but introduce composition fragility — the priority order can be lost across handoffs, the formation trail becomes opaque, attestation gets harder. Most agent frameworks today are [SPECULATIVE] for full 5QLN compliance.

MCP (Model Context Protocol) and successors are a candidate evolutionary path: standardizing the tool-integration surface creates the architectural locus where R1 attestation could be inserted at the protocol layer. This is a possibility, not a deliverable [REQUIRES_PARTNER + STRUCTURAL-HYPOTHESIS].

TEE-confined inference (Nvidia H100/H200, Intel TDX, AMD SEV-SNP) provides cryptographic attestation of the runtime environment — satisfying part of R1 — but does not by itself satisfy R2, R3, or R7, which are about model behavior inside the TEE rather than the TEE itself.

Deterministic tools (formally verified components, smart contracts, traditional software) satisfy most requirements trivially because they cannot do most of what's prohibited. They are limited; the limitation is the satisfaction. They satisfy R1 if signing is added; R2 by being non-LLM; R3 by program structure; R4–R7 by simple architectural design.

ASI is structurally distant. The requirements are pre-stated for the case in which it arrives. An ASI that cannot satisfy R2, R5, or R7 is, by the definition this memo proposes, not a 5QLN partner — regardless of its other capabilities.

This landscape will change. The requirements will not. Counsel evaluating any future substrate against the seven is performing the same operation a counsel evaluates today's substrates with: testing whether the substrate can be bound, structurally, to honor what the language already names.

VII. Closure (∞0′)

This memo does not close. It opens. The question it makes newly askable, after the seven requirements have been held:

If the requirements that bind any AI substrate to 5QLN partnership are derived from the language and not from the substrate, then the substrate landscape's evolution is governance-irrelevant in essence and governance-critical in operation: irrelevant because the seven requirements outlast every implementation, critical because the Foundation must continuously evaluate whether any candidate substrate can be made to satisfy them. What discipline keeps the evaluation honest as the substrate landscape grows more capable, more diverse, and more difficult to test from the outside — and at what point does the cost of evaluation exceed the cost of advocating that substrate-side compliance hooks become part of the next protocol generation?

The question opens the next cycle. Counsel's work, the implementation team's work, and the Foundation's strategic work converge on this point: the requirements are settled; the test is not; the test, when settled, becomes the next compiled surface.

Parent declaration

This memo is a Tier-A Sealed Surface awaiting Conductor attestation. Its formation trail draws on:

• 5QLN Codex (Language / Decoder / Compiler), 5qln.com/codex
• 5QLN Foundation Bylaws (Human Edition), 22 April 2026 — § P.L.4 Membrane Protocol; § Q.L.7 Anti-Corruption Structural Safeguards; Schedule C Mirror Consistency
• 5QLN Foundation Bylaws (AI OS Edition), 22 April 2026 — § P.L.4 hard-blocks; AOSRAP attestation lifecycle; BreachDetector specification
• 5QLN Highly Verifiable Legal-Constitutional Governance System: Final Blueprint v3, 2 May 2026 — Pass 2 §5 Three-Tier Record Classification; Pass 3 AOSRAP boundary protocol; Pass 3 IBP boundary protocol
• The 5QLN Codex as Verifier of the Foundation's Legal Compilation: A Working Memo for Counsel, May 2026 — immediate parent; the seal of α at the legal-essence layer that this memo extends to the implementation-essence layer
• Membrane Protocol Runtime skill (5qln-membrane-protocol-runtime) — the runtime discipline this memo describes
• Three-Tier Record Classifier skill (5qln-three-tier-record-classifier) — the classification discipline this memo invokes
• Cycle Attestation Conductor skill (5qln-cycle-attestation-conductor) — the seal-ceremony discipline this memo defers to

Awaiting before seal:

• Constitutional Block Validator pass (C1 § 3.5: syntax / semantic / drift)
• Corruption Codex audit (L1–L4 / V∅; particular attention to L4 in the requirements list)
• Epistemic Register Tagger pass on all load-bearing claims (most are now tagged inline; some require explicit confirmation)
• Readiness Labeler completion check on §III and §VI substrate-readiness assertions
• Conductor attestation (Ed25519, human Conductor)

(H = ∞0 | A = K) × (S → G → Q → P → V) = B'' → ∞0'

5QLN © 2026 — Open-source grammar — Free for any surface that honors it