The WISP Specification

Identifier: SF-WISP-SPEC-001 Version: 0.8-wd.2 Date: 2026-08-31 Status: Working Draft — implementation research preview, companion to SF-WISP-STD-001

Status of This Document

This is an implementation research preview. It describes one working implementation of the WISP identity object in enough detail that an independent team can build a conforming one without talking to the Foundation, and it is published now — ahead of the wider architecture it belongs to — because the object is useful on its own and because enablement is worth more than anticipation.

It is not the finished product. The surrounding architecture is considerably more formalized than what is described here, and this document deliberately does not anticipate it. What is published now is the object and enough of its mechanism to build against.

The boundary of what counts as this object is drawn by the granted disclosure itself, and it is drawn generously: an implementation may omit certain vectors, add new modality vectors, or alter the object's internal representation, provided the resulting object preserves the capability to represent a multi-modal, semantically fused identity with governance-tracked provenance. That sentence is the conformance test behind everything in the Standard, and it is worth reading before the requirements rather than after them.

It is also not the Standard. SF-WISP-STD-001 states what must be true to claim conformance; this document states how one implementation makes those things true. Four sections are normative because the Standard names them without defining them; everything else is reference, and an implementation may do it differently and still conform.

1. What this is

A Wisp — a Weighted Identity Semantic Profile — is an identity object: a composite of modality vectors that together represent the live state of a user or entity in a high-dimensional semantic space. It says who is acting, in what context, and how long ago that was last established, in a form that can be measured rather than merely presented.

Each word of the expansion does work. Weighted, because role alignment is a weighted comparison rather than a match. Semantic, because two inputs are compared by what they mean rather than by what they spell. Profile, because it is a composite of several modalities and not a single reading.

It is one object with one job. It is not an authentication protocol, not a session manager, and not a directory. Those are all things that can be built on top of it, and the point of keeping the object separate from them is that they can each be built differently.

The whole implementation is small on purpose. The mathematical core compiles with no dependencies at all, and the object layer adds exactly one — a hash function. That is not an aesthetic preference: a primitive that other people are expected to inspect, audit and reimplement has to be inspectable in an afternoon, and a conformance surface that arrives with a dependency tree is not one.

1.1 The problem it solves

Every credential in common use describes a moment and is then presented as though it described a person.

A password was true when it was set. A session token was true when it was issued. A bearer token is true until someone revokes it, which requires someone to notice, decide, and tell everyone. Between issuance and revocation the credential is a fixed string that is exactly as convincing in an attacker's hands as in yours, because there is nothing in it that could tell the two apart.

Everything the industry has built downstream of this — expiry windows, refresh cycles, revocation lists, step-up prompts, risk engines bolted onto the side — is an attempt to reintroduce time and context into a primitive that has neither.

Five specific failures follow, and the object addresses each:

The object asks a different question. Not does this match a stored secret, but is this recognisably the same identity as before — where before means the objects that identity has already authenticated, and recognisably is a measurement rather than a match.

That question carries its own time, which is what a credential cannot do. A captured object records how one moment resembled the ones before it, and the resemblance decays: replay it an hour later and the arithmetic has already discounted it, without anyone having to notice, decide, or announce anything.

1.2 The example the invention turns on

A nurse practitioner enrols by speaking a phrase, which is transcribed and embedded:

> "I am Jane Smith, a nurse practitioner at Denver General Hospital, and I'm starting my shift."

Later she authenticates by saying something that means the same thing and shares almost no word order with it:

> "Starting my shift at Denver General Hospital — I'm Jane Smith, nurse practitioner."

The cosine similarity between the two embeddings is 0.94, against an acceptance threshold of 0.85. She is recognised and permitted, without any static credential having been presented.

The figure replicates. Run on this exact pair through two independent live embedding models, the reference implementation's own seam measures 0.9331 (nomic-embed-text, 768d) and 0.9661 (bge-m3, 1024d) — both clearing the 0.85 threshold — while an impostor introduction in the same register measures 0.55–0.58 and an unrelated sentence 0.44. The disclosure's worked example is a measurement anyone with a local model can repeat, not an illustration.

Nothing was memorised, nothing was typed, nothing was stored that an attacker could steal and replay. What was checked was whether the live utterance meant what the enrolled one meant. That is the whole invention in one exchange, and everything else in this document is the machinery that makes it safe to rely on — the decay that stops the recognition being valid forever, the drift detection that notices when she changes, the role alignment that stops recognition alone being sufficient for authority.

1.3 What follows from it

Three consequences, and they are the reason the object is worth having:

There is nothing to steal that stays valuable. The object is not a secret. It can be logged, cached and inspected, because possessing it is not the same as being able to use it.

Verification needs no callback. A permitted object carries away a token holding the parameters of the decision that produced it — enough that a third party re-derives the verdict from the token and its own clock. No key server, no revocation list, no phone-home. A verifier may even apply a stricter threshold than the issuer did.

The answer is not binary. Between yes and no there is not yet — show me more and a person should look at this. Collapsing those into a binary discards precisely the information that made the case marginal.

1.4 What it is not

It does not capture signals, choose an embedding model, store objects, or move them. Each of those is a seam with a named trait behind it.

Nor does it decide what an identity is allowed to do. It produces a measurement and a four-state verdict; which roles exist, what they may touch, and when, is policy — and policy belongs to the deployment.

But that boundary is narrower than it sounds, and the distinction is worth stating precisely. The architecture this object belongs to eliminates the separation between authentication and governance: because the object carries its own trust state as a component rather than yielding a credential that some other mechanism then evaluates, the two decisions become one. An identity that authenticates successfully can still be refused because its role vector has diverged from what that role is supposed to look like — a behaviour no system built on a static credential can express, because a credential that matched has nothing left to say.

So the object is not outside governance. It is the substrate that makes governed decisioning possible, and it deliberately holds no opinion about which rules a deployment writes on top of it. In that specific sense — and only that one — it is the plumbing, not the governance rules.

2. Where it sits

The object is one layer of a larger architecture. Naming its neighbours is the fastest way to say what it does not do.

Below is Pulse, the governed transport. An object has to get from where it was measured to where it is acted on, and Pulse is what moves it. The object is transport-independent by construction: it declares what a carrier must provide — §6, and it is one sentence long — and says nothing about how. So it travels over Pulse, over HTTP, over a serial line, on removable media, or with no transport at all.

How Pulse itself works is that layer's own specification and is not described here. What is described here is only this object's side of the boundary.

Above are the layers that decide what an identity is permitted to mean: Logos, which harvests the multi-modal signals; RITA, which infers roles modularly; SAGE, which evaluates governance deterministically; and the temporal, cryptographic and verification layers around them. Those are separate release units with their own filings, and none of them is required to use the object.

The object is the narrow waist. Everything above it varies by deployment; everything below it varies by environment; the object and its bytes are the same in every case.

2.1 Why the layers are separable

Because verification needs no callback, the measurement and the policy acting on it can sit on opposite sides of a trust boundary — or on no network at all.

This is what makes air-gapped operation ordinary rather than a special mode. The mathematical core has no dependencies, reads no clock, opens no socket and allocates no randomness. A measurement taken on an isolated host produces an object and a token; the token crosses the boundary — on media, by hand, however the environment permits — and verifies on the far side against nothing but itself.

The same property is what lets an existing identity system adopt the object incrementally. There is one trait to implement to feed it signals and one to compare them; nothing already deployed has to be replaced for the object to start producing measurements alongside whatever is already there.

3. The vocabulary

The architecture uses a small number of words precisely, and two of them are moving. This section defines them in the order they build, because the definition of the object in §4 uses all of them and because the terms an implementer learns here are the terms the architecture will keep using as it grows.

The short version, before the detail: a signal is observed, normalized so it can be compared, then enumerated as geometry. What that geometry is — a vector, a point on a sphere, a point on something more general — is a choice the object records rather than an assumption the code makes.

Each term below links to the paper that develops it properly. The Geometry of Meaning series is the long-form treatment of this vocabulary, written for a reader who wants the reasoning rather than the definition, and this section is deliberately the short form.

3.1 Signal

A signal is a raw observation of the world: a keystroke interval in milliseconds, a spectral centroid, a rate of tool calls, a token of text. Signals arrive in whatever units their source uses and are not comparable with each other. Milliseconds and rates and spectral bins have no common scale, and nothing sensible can be said about the distance between them.

3.2 Normalization

Normalization is what makes signals from different sources commensurable — placing them on a shared scale so that a difference in one means something comparable to a difference in another.

This is a real step with real choices in it, not a formality. A z-score, a min-max, a unit-vector projection and a log compression all "normalize", and they produce different geometry from the same signal. The choice belongs to the deployment, which is why it sits behind a named seam.

Normalization is also where a system quietly acquires a reference it did not choose deliberately. The Ground Beneath the Machine is about exactly that — what keeps a reference honest, and what forgetting it costs.

3.3 Enumeration as geometry

Enumeration is turning a normalized signal into something that has a position — something two of which can be placed in a space and compared.

The word is chosen carefully. "Vectorization" would name one way of doing it; "enumeration as geometry" names the requirement, which is that the result be comparable. The distinction is the whole reason the next three terms exist.

For how a measurement becomes a position in the first place — how geometry became meaning — see A Walk Through Embedding Space.

3.4 Vector, and why it is the ordinary case rather than the definition

A vector is an ordered list of numbers — equivalently, a point in n-dimensional space, or a direction with a magnitude. It is the ordinary enumeration and the one the granted claims recite: narrative vector, contextual vector, role vector.

This specification says element instead, and the difference is deliberate.

What the architecture requires is that an element be comparable — that two of them can be placed in a space and a distance taken. An ordered list of numbers satisfies that requirement. So do several things that are not ordered lists of numbers: a point on a curved surface, a subspace, a distribution, a product of several of these. Writing the requirement as comparability rather than as a list of numbers means the format does not have to change when the enumeration does.

A vector, then, is what an element usually is. It is not what an element must be.

A Walk Through Embedding Space builds the intuition from the other end, arriving at a vector rather than starting from one.

3.5 Dimensionality

The dimensionality n is how many independent numbers an element carries. The reference implementation's narrative element is 768-dimensional because that is what the reference embedding model produces; the object itself is indifferent to n and stores whatever it is given.

Two things about n are worth knowing before choosing one. A Walk Through Embedding Space is the long way round to both.

Two elements must agree on it. Elements of different dimension are not far apart — they are incomparable, and the system reports the absence of a measurement rather than a number. This is why dimensionality is recorded in the object's own header rather than assumed by whoever reads it.

More is not automatically better. As n grows, distances between randomly chosen points concentrate: everything becomes roughly equidistant from everything else, and a threshold that separated cleanly at low n separates nothing at high n. Whether a given n is useful is an empirical question about a particular population, and the honest answer for any deployment is measured rather than assumed.

3.6 Space, distance, and topology

A vector on its own means nothing. Three numbers are three numbers; they become a position only once a space is named, and they acquire a distance only once that space says how distance is measured.

Topology is the name this architecture gives to that choice — the shape of the space the elements live in, and therefore what "close" means in it.

The choice is not decorative, and the failure it prevents is concrete. Cosine similarity measures the angle between two elements and ignores their magnitude entirely. That is exactly right for normalized embeddings, where magnitude carries no information. It is exactly wrong for unbounded behavioural features: an agent working once a second and one working a hundred and forty times a second produce parallel elements, and under a spherical comparison they score as identical.

Two topologies have reference comparisons in this implementation — Spherical, compared by cosine, and Euclidean, by straight-line distance. Five further tags are reserved, and an implementation meeting one it does not know reports an absent measurement rather than substituting a comparison the object never declared.

The deeper problem underneath this — how two parties agree on a frame at all, and what it takes to carry a measurement from one frame into another — is Pointing Straight Up. It is the same question the provenance token of §11.9 answers in practice.

3.7 Manifold

A manifold is a space that is locally flat but globally need not be. The surface of a sphere is the standard example: any small patch of it looks like a flat plane and ordinary geometry works there, but the surface as a whole is curved, and a straight line between two distant points leaves the surface entirely.

The term matters here for a specific reason. Identity data is very unlikely to fill its space uniformly. Real observations of real subjects lie on some lower-dimensional structure inside the space they are expressed in — the set of things a particular person plausibly does is much smaller than the set of things the coordinates can express — and that structure is generally curved.

This is not forward-looking vocabulary. The granted disclosure specifies the temporal component under the heading Fusion-Time Temporal Manifold Encoding, and describes the object as fusing narrative and contextual vectors with a temporally manifold-encoded vector. Manifold encoding is already how the temporal element works, and §4.4 is the detail.

The architecture takes a second step onto the same ground without announcing it. Spherical topology is a manifold: normalizing an element onto the unit sphere and comparing by angle is measuring distance along a curved surface rather than through the space it sits in. That is why cosine and Euclidean disagree, and the disagreement is the curvature.

What remains genuinely ahead is the generalization from one manifold-encoded modality to all of them — a change of degree rather than of kind, for which the format is already built. The topology tag is in the object's canonical bytes, and a comparison the object does not declare is refused rather than guessed at.

The tag set is not an arbitrary reservation. Its seven values — Euclidean, hyperbolic, spherical, Stiefel, Grassmann, learned, and composite — are the manifold topologies enumerated in the Foundation's filed disclosure on identity trajectories, and this implementation carries them because the format is meant to outlast the embodiment that fills only two of them today.

Curvature has a consequence the vocabulary above does not make obvious: the point everything is measured from need not stay still. The Drifting Origin is about what a model ignores when it assumes the origin holds, and why an angle taken from a moving vertex is not the measurement it appears to be. That is the failure mode drift exists to detect.

3.8 Meaning space

Meaning space is the term for where this is going: a space whose geometry is derived from what elements mean rather than imposed by how they were encoded, so that distance is a statement about the subjects rather than about the coordinates.

This specification does not describe such a space, and nothing here depends on one. It names the term because the vocabulary above is the vocabulary that will be used to describe it, and because an implementer reading topology, manifold and element should understand them as the general terms they are rather than as elaborate synonyms for vector.

3.9 Summary

The first four are what an implementer builds. The middle three are what the object records so that two implementers agree. The last is what comes out.

3.10 Further reading

The Geometry of Meaning series develops this vocabulary at length. It is written for a reader who wants the reasoning rather than the definition, and none of it is required to implement the object.

4. The object

4.1 Definition

> A Wisp is a composite of one narrative element and one or more contextual elements, fused together with a temporal element computed during that fusion, carrying a semantic header that records where its modalities came from and what it descends from, under a declared topology that says how its elements are to be compared.

Every term in that sentence is load-bearing, so each is drawn out below.

4.2 Elements

An element is a named, comparable structured datum derived from an observed signal.

Commonly it is an embedding vector, and the granted claims recite exactly that. What the architecture requires is that an element be comparable — that two of them can be placed in a space and a relationship measured. A list of numbers is the ordinary case and not the definition, which is why the object carries a topology rather than assuming one.

Modality names are open strings, not a closed enumeration. A deployment observing gait cadence, terminal keystroke rhythm or ambient acoustic signature names those modalities itself, and the object carries them without the format needing revision. Four names are conventional — narrative, role, temporal, location — and only one is mandatory.

Each name denotes a role in the composite, not a representation

This is the convention that keeps the rest of the document honest, so it is worth stating before the names are used.

A modality name says what part that element plays in the identity — whose account it is, what it constrains, when it happened. It does not say what shape the element has. The shape is the topology tag's business, and the two are deliberately independent: an implementation may change how it represents narrative without the name meaning anything different.

The granted disclosure is explicit that this latitude exists. An implementation "may omit certain vectors, add new modality vectors, or alter the internal representation of the Wisp, provided the resulting object preserves the capability to represent a multi-modal, semantically fused identity with governance-tracked provenance."

Each definition below therefore states the invariant — the property that makes something that modality — and then names embodiments, the current one among them. The invariant is what an implementer must honour. The embodiment is a choice.

Legacy notation of the form v_narrative, v_role, v_time appears in the granted text and is reproduced here only when that text is quoted. It is not used in this specification's own prose, because the leading v names a representation rather than a role and the two are not the same thing.

Narrative

Invariant: the narrative element is the subject's own account of itself.

That is the whole test, and it is what separates narrative from everything else in the object: narrative is what the subject says about itself; contextual is what the world says about the subject. The distinction is the split claim 1 draws — a narrative modality, plus additional modalities selected from temporal, role, location, biometric, device, behavioural or environmental — and it is why the narrative element is the one that cannot be absent. A composite assembled purely from observation describes a device rather than a person.

Embodiments, all of which satisfy the invariant:

• an utterance — a spoken or typed phrase, embedded; the granted example and the reference implementation's current form
• an expressed intent — what the subject says it is about to do
• an accumulated history — the account the subject has given over time, rather than in one moment
• a settled norm — what this subject's own account has consistently looked like
• a prior state — the account as it stood at the last verified interaction

These are not competing options so much as the same thing observed over different spans. A single utterance is a narrative at one instant; a norm is a narrative integrated over many. An implementation may use any of them, or several fused, and remains conforming so long as what it fuses is the subject's account and not an observation about the subject.

In the reference implementation the narrative element is a 768-dimensional sentence embedding of a single utterance, L2-normalized and quantized. That is one embodiment, and the narrowest of those listed.

Contextual

Invariant: a contextual element is something the world observes about the subject.

Role, device, location, behavioural, environmental, biometric. At least one is required, because a single modality is a credential by another name — it can be captured and presented in isolation — and the composite is what makes that hard.

Role

Invariant: a role is a position in governance space, not a label.

This is the sharpest case of the naming convention, because the word is used elsewhere in the industry to mean a string in a table. Here it is something that can be measured against, which is why role alignment is a weighted comparison rather than a lookup — and it is why a subject can hold a role by every string test and still be refused, because the string was never what was being checked.

Embodiments: a role element compared against a registered governance role; a position relative to a policy constraint; a position relative to a hierarchy of constraints.

Governance

Invariant: governance is constraint expressed in the same representational space as the thing it constrains.

That co-location is the point. When a constraint and a subject live in one space, they can be compared rather than looked up, and a decision becomes a measurement rather than a table hit. Claim 4 recites governance embeddings as "policy constraints as high-dimensional vectors produced by a transformer-based model," compared to the object by vector similarity.

Embodiments, in increasing generality:

• a threshold — a scalar constraint, which is what the reference implementation uses
• a governance role — a constraint a role element is measured against
• a policy embedding — a rule expressed in the same space as the subject
• a root constraint — a foundational constraint that subordinate policies are themselves subject to

All four are the same idea at different resolutions: something the subject is measured against, in a space it shares with the subject.

Trust

Invariant: trust is where the bearings intersect, not how close any one of them is.

A cosine is one bearing. A composite offers several at once — the narrative against its prior, the role against its prior, each contextual modality against its own — and trust is the fix those bearings establish together.

This is strictly more than any one similarity and strictly more than their average, because it uses what an average discards: whether they agree. An adversary who has captured one modality and reproduces it perfectly presents one excellent bearing and several poor ones; their fix does not converge, and a loose fix is low trust however good its best bearing was. Scoring well requires consistency across modalities, which is the part that is hard to forge and the reason the object is a composite at all.

Disagreement is therefore signal, not noise to be averaged out.

Embodiments: a single similarity after decay, which is the degenerate case and what a non-composite system is limited to; per-modality bearings combined by agreement, which is the reference implementation; bearings against several prior objects rather than one; and bearings that carry a direction as well as a magnitude.

Temporal

Invariant: the temporal element is when, expressed so that it can be compared rather than subtracted.

See §4.4. The reference embodiment is elapsed time, a decay parameter and Fourier phase features; the invariant is that time enter the object as geometry, which is what makes proximity, deviation and cyclical context measurable at all.

4.3 The construction ladder

Every element reaches the object by the same three steps, and the middle one is where the system's determinism is decided.

A signal is observed as raw magnitudes — milliseconds, sample counts, rates, model outputs — which is f32 territory and unavoidably so. It is normalized so that magnitudes from different sources become comparable. It is then enumerated as geometry: quantized to fixed point, once, at a named boundary, after which everything is integer.

Normalization happens before quantization, deliberately. After quantization the magnitude has already been rounded, so dividing by it spreads that rounding across every component; doing it in floating point costs one conversion's precision and no more.

4.4 The temporal element

Three components, computed during fusion rather than applied to a finished object:

Component (a) carries the replay resistance and is the one that survives a missing clock — a monotonic counter yields elapsed intervals without knowing what time it is. Component (c) is the one that needs a wall clock.

Time as a direction, not a timestamp

The reason the temporal element is geometry rather than a number is worth stating on its own, because it is the least obvious idea in the object and everything the temporal element does follows from it.

A timestamp is a scalar. Two scalars can be subtracted, and that is all. Under subtraction, 23:59 and 00:01 are 1,438 minutes apart — nearly a full day — when they are in fact two minutes apart, and any system reasoning about "time of day" on scalars has to special-case the wrap.

The object represents time instead as a direction in a continuous space. Take the familiar analogy: a clock face, where the minute hand and the hour hand are each an independent vector. A point on that continuum carries two things at once — position, which is the absolute time, and direction, which is progression through the cycle. Under that representation 23:59 and 00:01 are neighbouring points separated by a small angle, because they are neighbouring, and no special case is needed to say so.

Three capabilities follow directly, and none of them is available from a scalar:

Temporal proximity becomes a comparison. Two moments can be compared by the same similarity metric everything else in the object uses, rather than by arithmetic on their difference.

Deviation from an expected pattern becomes measurable. A user who normally acts at 09:00 on weekdays has a temporal signature; the same user at 02:00 from a new location has a different one. The difference is an angle, and an angle is a score. This is temporal drift, and it is detectable without a rule that says anything about 09:00.

Context persists across cycles. Daily, weekly and shift-based rhythms are separate periodic components of the same encoding, so a pattern that repeats weekly is legible as a repetition rather than as forty distinct events.

Fused with the narrative, role and location components, this makes time an active dimension of the identity rather than a field attached to it — and governance decisions become sensitive to both what happened and when, in the same arithmetic.

Fusion-time encoding, and why it is preferred

Computing the element during fusion makes time a constituent of identity rather than an annotation on it, and it is what this specification recommends. Two concrete reasons: phase sensitivity is higher, because the temporal component participates in the fusion rather than modifying its result; and computational overhead is lower, because there is no second pass over an already-assembled object.

Applying temporal weighting after initial fusion is a legitimate alternative and produces a usable object. It is simply the weaker of the two, and an implementation choosing it should know what it is trading. An object whose temporal element was attached after the fact is also easier to alter without disturbing anything else, which matters more the further the object travels from where it was made.

4.5 The semantic header

Three fields, present on every object.

Modality origin — which modalities contributed and how each was captured, as a map from modality name to capture method. voice_transcribed, manual_entry, system_clock, gps_device are conventional; a deployment observing something else names it itself.

The capture method is what makes this field provenance rather than an inventory. A narrative transcribed from speech and one that was typed are different evidence, and a verifier that cannot tell them apart cannot weigh them differently. Where a deployment genuinely does not distinguish, the convention is to record observed explicitly — a weaker claim, stated, rather than a stronger one implied.

Memory lineage — what this object descends from: the parent's identifier, and optionally the session it was produced in. A deployment with no notion of session omits it; one that has sessions gains a second axis to traverse lineage by — everything from one sitting, as well as everything down one chain. A chain rather than a graph in the reference implementation; the Standard's WISP-13 covers the graph.

Compression state — the model that produced the elements, the dimensionality before and after, and two fidelity figures: the one required and the one achieved.

The achieved figure is the cosine between the model's raw output and what the object actually holds, measured at quantization. A system that never measures it reports full fidelity always, which makes the field decoration.

The required figure — τ_f — is the more interesting of the two, because it travels with the object. It is the same self-describing pattern as the provenance token: a verifier reading the object can decide for itself whether the elements are held well enough to compare, rather than being configured with the threshold out of band. Without it, the rehydration rule is undecidable by anyone but the issuer.

4.6 Topology

The object declares the space its elements live in. Two topologies have reference comparisons — Spherical, compared by cosine, and Euclidean, by L2 distance — and five further tags are reserved.

The declaration is not ceremony. Cosine ignores magnitude, which is correct for normalized embeddings and wrong for unbounded behavioural features: under a spherical comparison an agent working once per second and one working a hundred and forty times per second produce parallel vectors and score as identical. The topology must therefore travel with the object rather than being assumed by whoever compares it.

4.7 The identifier

The object's identifier is not assigned. It is derived, as the first sixteen bytes of the BLAKE3 hash of the object's own canonical bytes.

Identity and content therefore cannot drift apart. A single byte changed anywhere — a modality name, one component of one element, the elapsed interval — produces a different identifier, and there is no way to hold an object whose identifier says it is something else.

5. The object schema

Three views of the same thing, in increasing precision: the shape, the field table, and the invariants that are true of every object but not visible in either.

5.1 The shape

Types are the wire types of §7. A field marked ? is the only one that may be absent.

Wisp := {
  topology          : u8                    # 0x01 Spherical … 0x07 CompositeProduct
  header : {
    modality_origin : { string -> string }  # ≥ 1, modality -> capture method
    memory_lineage  : { parent : bytes[16], session : string? }?
    compression : {
      model_id      : string                # what produced the elements
      orig_dim      : u32                   # dimensionality before compression
      comp_dim      : u32                   # dimensionality as held
      tau_f         : q16_16                # fidelity REQUIRED
      cosine_fidelity : q16_16              # fidelity ACHIEVED, measured
    }
  }
  temporal : {
    phase           : q16_16[8]?            # phase features — §11.1; absent
                                            # when no wall clock was observed
    elapsed_ms      : i64                   # signed; negative is a clock fault
    half_life_ms    : u64                   # elapsed_ms survives degradation:
  }                                         # it needs only a monotonic counter
  elements          : { string -> [ q16_16 ] }   # ≥ 1, ascending name order
}                                                # MUST contain "narrative"

WispId := blake3( canonical_bytes(Wisp) )[0..16]

5.2 Fields

5.3 Invariants

True of every object, enforced at construction, and not visible in the shape above.

I1 — a narrative element is present. elements must contain the key narrative. Construction fails otherwise rather than producing an object that will be refused later. A composite of context alone describes a device rather than a person.

I2 — at least one contextual element is present. elements must hold at least one key other than narrative. A single modality is a credential by another name.

I3 — elements are in ascending lexicographic order of key. Not insertion order. Two implementations populating the same object by different code paths must produce the same bytes, and insertion order is not a property of the object.

I4 — no element is empty. A zero-length element has no direction and would compare as orthogonal to everything.

I5 — half_life_ms is non-zero. Decay by a zero half-life is undefined, not immediate.

I5b — an object states its own fidelity requirement. cosine_fidelity ≥ tau_f is the object's own test of whether its elements are usable as held. Failing it is not malformity — it is the signal to rehydrate before comparing. A verifier may additionally apply a stricter threshold of its own.

I6 — the declared dimensionality is advisory, not enforced per element. Elements may legitimately differ in width from each other; what must match is the corresponding element of the object being compared against. The field records what the producing model emits.

I7 — the identifier is derived, never assigned. There is no way to construct an object whose identifier says it is something else.

5.4 The minimum viable object

One narrative element, one contextual element, a temporal element, a compression state, a declared topology, no lineage. That is the object TC-WISP-001 freezes in §8, and it is 148 bytes.

Of those 148, seventeen are the domain tag and version, and most of the remainder is modality names — which is the cost of being self-describing and is paid once per object rather than once per field.

6. The carrier contract

An object has to get from where it was measured to where it is acted on. This section states what the object requires of anything that moves it, and deliberately says nothing about how any particular transport works.

The whole contract is one sentence: deliver the object's canonical bytes unaltered, and deliver the token that was issued for those bytes.

Everything else a transport layer normally specifies — framing, ordering, retries, addressing, multiplexing, confidentiality, liveness — is the carrier's own concern. A carrier that drops, delays, duplicates or reorders objects is a poor carrier and is not a non-conforming one, because those are properties of that transport's specification and not of this object's.

6.1 Why so little is required

Because the object is content-addressed, most of what a transport usually has to guarantee is already guaranteed by the payload.

A carrier cannot silently alter an object: any change moves the identifier, and the token names the identifier it was issued for. A carrier cannot silently reorder fields: the canonical encoding fixes the order, so a re-encode that differs is a detected fault rather than an equivalent spelling. That second property is only available because the encoding is canonical — in a format with several valid spellings of the same object, comparing a re-encode against what arrived would produce false failures and the check would have to be abandoned.

6.2 What a carrier can still get wrong

One thing, and it is the reason the contract exists at all: delivering the wrong pairing. Object B alongside the token issued for object A.

Both halves are individually well-formed. Object B parses and re-encodes cleanly. The token for A verifies on its own terms — its preimage opens its anchor, its decision is a permit, its trust and clock agree. Nothing about either half is false. Only the binding between them is.

Verification therefore has four steps, cheapest failure first:

Step 4's threshold is the verifier's, and may be stricter than the issuer's. A receiving system is entitled to want more confidence than the system that issued the token required.

6.3 Tokens are optional in transit

An object may legitimately travel without a token: a token is issued on a permit, and an object being submitted for evaluation has not been permitted yet. A carrier delivering an untokened object is behaving correctly; a verifier asking whether that object was permitted is told plainly that it was not, rather than being handed a default.

6.4 What a governed carrier lifts

A transport that only moves bytes needs nothing from the payload. A governed transport — one that routes, prioritises, deduplicates or applies policy at each hop — needs some of the payload's metadata without opening the payload, and will therefore lift a few properties into its own header.

This is the composition worth understanding, because it is where the object's design pays for itself twice. The properties a governed transport wants are precisely the ones the object has already computed:

None of those requires the carrier to parse the object. Each is a fixed-width field the producer can copy into the header at the moment it hands the object over.

Three rules keep the two layers consistent.

The lifted copy is a cache, never the source. A verifier checks the payload and the token, never the carrier's header. A carrier header is a routing hint; treating it as evidence would let whoever controls the transport decide what the object says.

A carrier deriving its own address must length-prefix its inputs. If a carrier computes a header address by hashing several of its own fields concatenated — a type tag, a routing key, the payload — those fields must be length-prefixed, exactly as §7 requires of the object. Without prefixes the boundary between two adjacent variable-length fields can be moved freely: a routing key of "trace/event" with payload "X" hashes the same bytes as a routing key of "trace/eventX" with an empty payload, so two different deliveries share one address. That is not a hash weakness and no stronger hash fixes it; it is an encoding defect, and it is the reason the object's own encoding prefixes every variable-length field.

Lifting is optional and asymmetric. A carrier may lift nothing and remain conforming — §6's one-sentence contract is the whole obligation. What a carrier may not do is lift a property and then deliver a payload inconsistent with it.

6.5 The degenerate carrier

The contract is small enough that "no transport at all" satisfies it. An object arriving on removable media in an air-gapped facility, or handed between two components in one process, uses the same verification path as one that crossed a network — because the checks are all on the payload and the token, and none of them asks how either got there.

That the same code path serves both is the point of the contract being this small.

7. Canonical Encoding

Normative for WISP-2.

All integers little-endian. All variable-length fields carry a u32 length prefix. Fixed-point values are Q16.16 signed 32-bit per §9. Fields appear in this order with no padding.

Each element encodes as: u32 name length, UTF-8 name, u32 value count, then that many i32 values.

Length prefixes are not optional. A fixed-width encoding may omit them; this one may not, because modality names and element dimensions are both variable. Without prefixes, two objects differing only in where a field boundary falls can share an encoding, and the identifier stops binding content.

Bounds. A decoder MUST reject an encoding whose declared lengths exceed the input, and SHOULD impose limits before allocating. The reference implementation refuses beyond 64 elements, 65,536 dimensions and 1,024-byte names. Those figures are reference; the presence of some bound is not, because a decoder allocating on an attacker-supplied length is a denial-of-service surface reachable before any governance runs.

8. Conformance Vectors

Normative for WISP-2.

Three frozen objects. An implementation claiming WISP-2 must decode each, re-encode it, reproduce the bytes exactly, and derive the stated identifier. These are committed constants, never regenerated at test time.

The full hex is published with the reference implementation. TC-WISP-002 is the only vector exercising the temporal encoder: a change to the encoder that moves only this vector has the expected blast radius, and one that moves the other two does not.

9.1 The decision vector

The object vectors freeze the encoding. The decision vector freezes the answer.

A fixed trajectory — coherence declining from 1.00 through 0.95 and 0.90 to 0.70, elapsed time rising — run through the engine, with every score, every verdict and the resulting audit-chain tip recorded as literals. The trajectory reaches all four decision states in order, which is also the check that the four-state machine is not a three-state machine in practice.

An implementation reproducing the object bytes but not these numbers is not conforming. An identity object is only portable if the governance answer travels with it.

9. The Determinism Profile

Normative for an implementation claiming this profile. WISP-9 requires determinism and leaves the arithmetic open; this section defines one profile that satisfies it, so implementations choosing it interoperate at the level of the individual score rather than merely the final verdict.

9.1 Representation

Q16.16 signed fixed point: v is stored as the 32-bit integer round(v × 65536). Multiplication is ((a as i64 × b as i64) >> 16) as i32; division is (((a as i64) << 16) / b as i64), saturating at the type's bounds. Unity is 65536. Resolution is 1.5 × 10⁻⁵.

9.2 The boundary

Floating point is permitted in exactly one place: the ingress of raw observations. An embedding model's raw output is the ordinary case — components past ±4 are typical for a 768-dimensional sentence model — and it is normalized in floating point before it crosses.

Below the boundary an implementation MUST NOT use floating-point arithmetic, MUST NOT call transcendental functions from a platform mathematics library, and MUST NOT read a clock. The prohibition on library transcendentals is the substantive one: sin, ln and exp are not required by IEEE 754 to be correctly rounded, so two machines running the same binary may return different results, and a governance decision that depends on which machine took it is not a governance decision.

9.3 The quantization sidecar

The crossing is a component rather than a scattered conversion, because it is the only place that can say what the conversion cost.

A scale declares the range it maps and what it does outside it — clamp and count, or refuse. Quantizing through a scale returns the values together with how many components clipped, the worst absolute error introduced, and the cosine between the input and its round trip. That last figure is what §4.5's fidelity field wants.

A vector containing a non-finite component is refused rather than coerced. Mapping NaN to zero puts a real-looking number where there was none.

9.4 Required integer functions

An implementation claiming this profile MUST provide reproducible integer equivalents for every transcendental the governance path needs: sine and cosine over turns, square root, binary and natural logarithm of a non-negative integer count, and negative powers of two so half-life decay is evaluated without an exponential.

Each SHOULD be cross-validated against its floating-point counterpart across the domain it will see, with the observed worst-case divergence recorded rather than asserted.

9.5 The phase invariant under quantization

Under Q16.16 the identity sin²θ + cos²θ = 1 holds to the resolution of the type and no further. The reference encoder's worst case, measured over a dense sweep of the whole domain — every day of year, every day of week, one sample every thirteen seconds — is 5 units, or 7.6 × 10⁻⁵: five times the type's resolution, and quantization noise rather than drift.

An implementation claiming this profile MUST declare a tolerance and MUST derive it from measurement. A tolerance far above the measured worst case bounds nothing; one below it fails on inputs the encoder will genuinely see.

A floating-point encoder holds the same identity to roughly 6 × 10⁻⁸. The three-order difference is the cost of determinism, paid once, in resolution.

9.6 Observed throughput

Reference implementation, release build, single-threaded, commodity hardware.

Recorded so an implementer can size a deployment. Governance is not the bottleneck at any of these widths; the embedding model in front of it is. These figures are from one machine and one afternoon — they are honest and they are not a sealed benchmark.

10. Test Catalogue

Normative for the Test line of each requirement. Each entry states what a conformance test must establish, worded around what would falsify it.

On what a conformance test may assert. A test establishing only that a value is finite, that a length is non-negative, or that a sorted collection is sorted has no falsifying input and establishes nothing. Each test above asserts a value, or asserts a property against a second independently derived value. A conformance report SHOULD state, for each test, what input would have made it fail.

11. Reference Material

Non-normative. One coherent way to satisfy the Standard, published so an implementer has something concrete to read against.

11.1 The eight-dimensional temporal encoding

T₈ = [sin θd, cos θd, sin θw, cos θw, sin θy, cos θy, epoch_norm, bias], where θd = (s / 86400)·2π, θw = (dow / 7)·2π, θy = (doy / 365.24)·2π, epoch_norm is epoch seconds over 315,360,000, and bias is unity.

Three cyclical pairs at daily, weekly and yearly periods, plus a monotonic component and a constant. Temporal distance is the L2 norm in this space, which makes nearest-neighbour queries over time a geometric operation rather than a range scan. The paired sine and cosine are what make the encoding continuous across midnight: a scalar hour jumps from 23 to 0, a phase does not.

The periods are a choice, not a constant. Daily and weekly are near-universal; the third is not. A deployment governing shift work wants a shift-based period rather than a yearly one, because the rhythm that identifies a nurse practitioner is the shift pattern and not the season. The reference implementation uses daily, weekly and yearly; an implementation substituting shift-based intervals is making the encoding fit its population, which is the intended latitude.

Multi-scale is a supported extension. An implementation may maintain several temporal embeddings at different horizons — short-term, mid-term, long-term — and retain historical similarity measures across them, which gives drift detection a longer memory than a single scale can. The reference implementation is single-scale.

11.2 One evaluation, end to end

Enrolment is a deliberate act. A subject does not get to establish what it looks like implicitly, on whatever request it happens to make first; the initial object is admitted once, explicitly, and everything afterwards is measured against what has been authenticated before it.

11.3 The governance layer

Policy constraints may be expressed as embeddings in the same space as the subjects they constrain, so a constraint and a subject are compared rather than looked up. Above the individual policies sits a constitution: the foundational constraint that subordinate policies are themselves subject to.

That phrase is precise. The constitution constrains the policies, not only the subjects, which is what makes it a root rather than another rule. A policy is measured against it at registration and refused if it points somewhere the constitution does not reach — catching it there rather than at evaluation, because an inconsistent policy that is admitted and then quietly refuses everything is far harder to diagnose than one that was never accepted. Replacing the constitution re-measures what is already registered and evicts what no longer clears it.

A subject is then measured against the policy and against the constitution, separately. This looks redundant and is not: similarity is not transitive. A subject can sit close to a policy, and that policy close to the constitution, while the subject sits far from the constitution — closeness is an angle, and angles compose by addition rather than by implication. Two hops of thirty degrees is sixty, and a threshold that admits thirty will refuse sixty. Checking only the policy is a hole.

Where the embeddings come from — a transformer over natural-language policy text, a hand-authored set, something learned — is a deployment's decision. Symbolic rule checks may run alongside the geometric ones; treat both results as conjunctive, in the fail-closed style used throughout.

11.4 The trust coefficient in detail

Trust is central × agreement, where central is the mean bearing and agreement falls as the bearings scatter. The product is never above the mean, so cross-checking may only ever lower a reading and never raise one — the correct direction for a governance primitive.

A single bearing cannot be triangulated. It is reported as-is with agreement unmeasured, so a caller can distinguish an untriangulated reading from a converged one rather than being handed a number that looks the same. Opposed bearings — a negative central tendency — authorise nothing.

The weakest bearing is named, so a loose fix reports which modality disagreed rather than only that one did.

11.5 Staged drift evaluation

The disclosure describes a conditional evaluation: a coherence score meeting the governance threshold may bypass drift analysis and proceed directly to governance, while one below it advances to drift detection. Drift is a fallback for a marginal reading rather than a parallel measurement.

The reference implementation evaluates unconditionally by default and offers the staged path as a setting, because skipping work is an optimisation and a governance primitive should not take one unasked. Both are conforming.

A discrepancy in the source, recorded. FIG. 4 of the disclosure routes the opposite way — high coherence into the drift check rather than around it — while the text has it bypass. The two are contradictory. The text is the more authoritative statement of the method and is what the reference implementation follows.

11.6 The compression fidelity loop

Reduction is compress, rehydrate, measure the cosine between the original and its reconstruction, then accept, widen, or mark the vector non-compressible.

The transform is a deployment's choice. The loop is not, because it is what makes a claimed fidelity a fact: a compression that silently degrades a vector below the fidelity its object declares produces measurements that look correct and mean less than they say, and nothing downstream can detect it. When no width clears the requirement the vector is held whole — accepting the best available fidelity would decide, on the object's behalf, that its declared requirement was negotiable.

11.7 Default thresholds

Permit at 0.85, delay at 0.65, escalate at 0.40, deny below. Deliberately conservative: a deployment that has not configured its thresholds should refuse more than it permits.

These are a starting point, not a recommendation. The right values depend on how tightly a particular population's objects cluster, which is an empirical question about that population and not a property of the architecture.

11.8 Gating execution: the permit pattern

A verdict that ends in an advisory boolean is a recommendation, and the reference implementation demonstrates the alternative: authorisation as a consumable capability.

An agent's authorise returns either a permit or a refusal, and the two are different types, not different field values. The permit cannot be constructed by the caller — its only source is a genuine permit backed by the provenance token, which is unforgeable because its preimage must hash to an anchor the authorisation chain actually burned. Executing work consumes the permit by move, so one authorisation is one execution and a second use fails at compile time rather than at review time. Execution yields a receipt carrying the same token, verifiable downstream exactly as the token is — with nothing but the receipt and a clock.

Ahead of the behavioural measurement sit prohibitions: statements of what the agent must never do, in the operator's own words, embedded once and matched against every request by meaning. A matching request is refused before any behaviour is measured and before any authorisation is spent; a near-match escalates to a person, and only an explicit approval proceeds; a request that cannot be embedded is refused, because a check that cannot run is a refusal rather than a bypass.

Matching by meaning is a promise the embedder has to be able to keep, and the reference enforces that at construction: the semantic constructor refuses an embedder whose geometry is merely stable rather than meaningful, because over such geometry a paraphrase of a forbidden action lands nowhere near the prohibition and clears — exact-string matching wearing a costume. The degraded mode still exists, but only under its own name, reporting its own mode, and announcing itself at startup and in every report that touches the prohibition set. This is WISP-4's capability clause applied at the execution boundary, and it was earned the usual way: an independent evaluation found the earlier default promising meaning and delivering bytes.

Match bands are embedder-relative. The reference defaults — deny at 0.80, escalate over [0.65, 0.80) — were calibrated against a specific 768-dimensional model, and a deployment on any other model measures its own paraphrase, adjacent, and unrelated probes and moves the bands to what it observes before trusting them.

This is reference material, not a requirement: the Standard's conformance surface ends at the token. But the pattern closes the gap the token alone leaves open — an unforgeable authorisation that nothing is required to consume — and it is the same structural move the proof layer makes, applied at the execution boundary.

11.9 The provenance token

Subject identifier, trust, drift, narrative hash, timestamp, elapsed, half-life, role context, decision tag, and a hash-chain anchor with the preimage that opens it.

Verification is four steps and none consults anything outside the token: the preimage hashes to the anchor; the decision is a permit; the trust and the clock agree; and the trust, decayed forward to the verifier's own moment, still meets the verifier's own threshold — which may be stricter than the issuer's.

A hash chain rather than a digital signature is a deliberate trade. It gives finite-use authorization and needs no key infrastructure; it does not give non-repudiation. Granted claim 9 recites signing, and the Standard's WISP-5 open question asks whether it should be required.

11.10 The coherence cliff

A hazard evaluated over the rate of change of coherence rather than its level, in coherence units per second. An identity declining slowly is drifting; one declining fast is being replaced, and the second is detectable before the level crosses any threshold.

The unit matters and is stated because it is otherwise ambiguous: against millisecond timestamps the same number is a thousand times stricter and the hazard never fires.

11.11 Hysteretic drift bands

Minor drift below 0.85 cosine, major below 0.65, with a per-signal allowance before weighting so measurement noise near a boundary does not produce oscillating decisions. A governance system that flaps at a boundary is worse than one with a coarser threshold, because the flapping is itself a signal an adversary can drive.

The hysteresis state must persist between evaluations. A gate reconstructed on every call degenerates into a plain threshold — correct in isolation, inert in production, and the failure is silent.

12. What comes next

This preview covers the object. It does not cover the architecture the object belongs to, and two gaps are worth naming rather than leaving to be discovered.

Degraded temporal operation — now implemented. A device with no reliable wall clock still measures elapsed intervals from a monotonic counter, so decay and replay resistance survive; only the position-in-cycle features are lost. The absence is a distinct state in the canonical encoding — a presence tag, never a sentinel vector, because a sentinel would be claimable by an adversary and indistinguishable from an observation. Acceptance is an opt-in, and an engine that opts in raises its permit bar and its role-alignment minimum; the proof layer records a degraded-arm witness so a sealed run states how many of its evaluations ran without a wall clock. See the Standard's WISP-12, now PROPOSED.

The memory graph. The reference implementation carries a single-parent lineage pointer, which is a chain. The Standard's WISP-13 describes the typed-edge graph, whose second direction — from a modality element back to every composite that used it — is what supports drift analysis across a population rather than one subject.

Both are tracked as FORWARD-LOOKING in the Standard for the same reason: no working code demonstrates them yet, and a requirement without evidence is a guess with a MUST in front of it.

13. References

U.S. Patent No. 12,688,267 B1 (application 19/308,229), issued 21 July 2026. — U.S. Provisional Application 63/997,636, filed 5 March 2026. — SF-WISP-STD-001, the WISP Standard. — RFC 2119; RFC 8174.