The Sovereignty Foundation — Whitepaper
RITA — Modular Role Inference
Governance mathematics as a replaceable part
Abstract. Every governance system contains mathematics that judges behavior — similarity measures, decay laws, momentum estimates, adversarial filters, fusion rules. In nearly every deployed system that mathematics is welded to the engine that runs it: upgrading the evaluator means stopping the system, and no record survives of which mathematics judged which decision. RITA™ inverts this. The engine performs none of the evaluation mathematics itself. Five interface contracts — comparison, decay, momentum, adversarial filtering, fusion — define pluggable modules; active modules are exchanged at runtime by atomic reference reassignment, with no restart, no state serialization, and no interruption of in-flight evaluation; per-entity accumulated state survives every swap because it lives in canonical, module-agnostic types. Every decision emits a structured role assignment record carrying one of four indicators — permit, restrict, prevent, defer — and an inference chain records which modules were active for each decision, making the evaluator itself auditable. A three-tier operating-mode hierarchy progressively constrains the system from exploratory to fully locked. The architecture is implemented in the Foundation’s reference stack and anchored in the filed estate.
1 · The problem: governance that cannot change its mind about how it thinks
Access-control and behavioral-evaluation systems age badly for a structural reason: the judgment mathematics is compiled into the judge. When a better similarity measure appears, or a decay law tuned for a new domain, or an adversarial filter for an attack class that did not exist at design time, the operator faces a forced trade — stop the system to upgrade its judgment, or keep running on mathematics known to be stale. Most keep running. The second failure is quieter: when a decision is later challenged, almost no deployed system can answer the question which mathematics produced this decision? The evaluator's own configuration is the least-audited part of the audit trail.
2 · The architecture: five contracts, zero resident mathematics
RITA's engine is deliberately empty. All evaluation mathematics enters through five interface contracts:
comparison · decay · momentum · adversarial filter · fusion
A module implementing a contract may be any mathematics that honors the contract's types and bounds — a cosine comparison or a learned metric; an exponential decay or a domain-specific one; a conservative momentum estimate or an aggressive one. The engine delegates every evaluation through the contracts and contributes only orchestration: sequencing, state custody, and record emission. Because the engine owns no mathematics, no mathematics is privileged — the judgment layer becomes a set of parts with published sockets.
Fig. 1 — The empty engine. Five sockets, published contracts, one module arriving while the system runs.
3 · The hot swap: upgrading judgment without stopping it
Module exchange is a single atomic reference reassignment. There is no restart, no serialization of state to disk, no drain-and-reload window, and no interruption of evaluations already in flight — an evaluation completes on the module that started it, and the next begins on the replacement. The property that makes this safe is state custody: per-entity accumulated state — the running history a decay or momentum module builds up — is held by the engine in canonical, module-agnostic types, not inside the modules. A replacement module inherits the accumulated history of its predecessor and continues it. Judgment upgrades stop being maintenance events and become governance events: recorded, attributable, reversible.
4 · The result record: four indicators, one structure
Every evaluation emits a structured role assignment record whose governing field is a four-state indicator: permit, restrict, prevent, or defer. Downstream dispatch consumes the indicator, not the mathematics behind it — components act on the record without knowing or caring which modules produced it. Defer is the human-facing state: the architecture descends from the Foundation’s earliest governance writing, in which gates that cannot be resolved by mathematics are elevated to a person rather than forced to a binary. The 2025 whitepapers that first described those gates — Rita Gates and Rita: Human in the Loop — are preserved in the Foundation archive as this paper’s ancestors.
5 · The mode hierarchy: Float, Deterministic, Locked
RITA runs under a three-tier operating-mode hierarchy in which each tier is a strict constraint on the one below: Float permits exploratory evaluation; Deterministic requires reproducible evaluation from identical inputs; Locked additionally freezes the module set. The tiers give an operator a dial between adaptivity and auditability, and give a certifier something checkable: which mode a system ran in is recorded per decision. In candor, and per the Foundation’s published register of known deltas, the reference implementation currently defaults to Float — the standard’s conformance cells require Deterministic for certification, and closing that delta is tracked in the open.
6 · The inference chain: auditing the judge
Because modules are replaceable, the question which mathematics decided? becomes answerable — and RITA makes answering it structural. An inference chain records, for every decision, the identity of each active module at evaluation time. The chain composes with the audit discipline used across the Foundation’s stack: decisions are attributable not only to inputs but to the exact configuration of the judgment layer that processed them. When a module is swapped, the boundary is visible in the record; a challenged decision replays against the modules that actually made it.
7 · Reduction to practice and lineage
The architecture is implemented in the Foundation’s reference stack: contract-defined evaluation modules, canonical state types, runtime module exchange, and the four-state role assignment record operating as the dispatch gate for downstream execution. Test coverage for the module pattern and mode hierarchy is cited in the evidence footers of the AGI Standard, and the modular-evaluation discipline is one of the load-bearing patterns the Standard’s conformance corpus exercises. The lineage runs from the May 2025 whitepapers through the filed application to the running system — written first, filed second, built throughout.
This whitepaper describes architecture disclosed in U.S. Patent Application 19/670,114 (RITA — modular role inference), patent pending, and in the sovOS omnibus application 64/004,108, patent pending. The identity substrate it evaluates is the subject of granted U.S. Patent 12,688,267 B1. Published after filing and scoped to the filed disclosures, per the Foundation’s disclosure-anchoring practice. Comments and refutations are invited.