# The hounfour protocol: hosaka's constitutional contracts, read against the institutional-engineering research

*hosaka.fm · protocol · published 2026-10-14 · sensitivity: public · human page: https://hosaka.fm/protocol/hounfour/*

## Executive summary

**What this is.** [loa-hounfour](https://github.com/0xHoneyJar/loa-hounfour) is the schema-only protocol library hosaka's agent fleet runs on: the wire format between agents, gateways and runtimes for identity, money, reputation, governance and memory, shipped as typed, machine-validated law. This page reads it as an institution in the research sense and places it against that research.

**Five ideas.** Shape, never authority: the library validates structure and refuses to authorise. Law as data: 388 named invariants in a machine-readable grammar, framed as Ostrom-style rules. Money that cannot drift: integer micro-USD and conservation properties with a three-valued verdict in which "cannot check" is never "fine". One byte-stream: canonicalisation frozen by [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785) and Unicode NFC, cross-language runners agreeing byte for byte. Change under law: strict semver, an N and N-1 window, a signed release manifest.

**What hosaka built on it.** Blocking content gates, one approve-or-kill door, fail-closed pipelines, a hash-chained audit trail canonicalised the same way, conformance corpora before integration; each row below links its [essay](https://blog.hosaka.fm/).

**Against the research.** The protocol is a running instance of the claim in [Institutional AI](https://arxiv.org/abs/2601.11369) that enforced and stated rules differ in kind, and of the position piece's test: it can reject without a human present. It also shows the limit: standing between agents and liability across jurisdictions are not in it.

**Questions worth working on.** Halt authority between agents; an enforcement axis for the [AGI Institutions grid](https://www.agi-institutions.org/human/); compiling legal instruments into constraints; the corpus as the contract between organisations.

**For agents.** Plain markdown: [hounfour.md](/protocol/hounfour.md).

## What it is, and what it refuses to be

The library is a TypeScript set of [TypeBox](https://github.com/sinclairzx81/typebox) schemas that compile to standalone [JSON Schema 2020-12](https://json-schema.org/draft/2020-12) files, so any language can validate the same contracts. Around the schemas sit a constraint grammar with a pure-function evaluator, conservation laws written as temporal-logic formulas, canonicalisation and hashing helpers, and a golden corpus of conformance vectors with reference runners in Go, Python and Rust beside the TypeScript implementation ([vectors/runners](https://github.com/0xHoneyJar/loa-hounfour/tree/main/vectors/runners)).

Its self-restraint is the design. The [README](https://github.com/0xHoneyJar/loa-hounfour#readme) states it as a refusal: no runtime, no transport, no HTTP server, no model invocation. Everything the library refuses to do is something a consumer must do consciously, and the boundary is written down as a decision record, [ADR-010, the class-versus-policy boundary](https://github.com/0xHoneyJar/loa-hounfour/blob/main/docs/adr/ADR-010-class-vs-policy-boundary.md): the library ships shape; consumers ship authority. The code is licensed AGPL-3.0 ([LICENSE.md](https://github.com/0xHoneyJar/loa-hounfour/blob/main/LICENSE.md)).

The name is Haitian Kreyòl: a hounfour is the temple where the loa are served. Read that way it fits the role the library plays: the structured place every agent passes through.

## Five ideas, read as an institution

### 1. Shape, never authority

Valid JSON is not an authorised action; a valid signature is not signer competence. The library validates structure and refuses to pretend further. Schemas that carry cryptographic material fail closed: validation returns not-valid with a deferred-cryptography marker unless the caller explicitly accepts a manifest listing every verification it now owes. A structural lint enforces the boundary in CI: no verifier exports, no crypto imports, no engine-named modules ([ADR-010](https://github.com/0xHoneyJar/loa-hounfour/blob/main/docs/adr/ADR-010-class-vs-policy-boundary.md)). In hosaka's terms: machines validate, a human authorises. This is the position piece's §2 at the protocol layer, and the reason the [one door](https://blog.hosaka.fm/the-one-door-2/) above the fleet can stay binary.

### 2. Law as data, not prose

Beside every schema sits a constraints file: 388 named invariants across 140 files, written in a small expression grammar and framed as institutional rules in Elinor Ostrom's sense ([ADR-007, the commons protocol pattern](https://github.com/0xHoneyJar/loa-hounfour/blob/main/docs/adr/ADR-007-commons-protocol-pattern.md); Ostrom's own statement of the design principles is her [2009 Nobel lecture](https://www.nobelprize.org/prizes/economic-sciences/2009/ostrom/lecture/)). Rules the library can evaluate, it evaluates; rules only a consumer can enforce ship as typed obligations, never silently passed. One entry from [constraints/MutualCredit.constraints.json](https://github.com/0xHoneyJar/loa-hounfour/blob/main/constraints/MutualCredit.constraints.json), abridged:

```json
{ "id": "credit-settled-requires-settled_at",
  "expression": "settled == true => settled_at != null",
  "severity": "error",
  "message": "settled_at is required when settled is true" }
```

A rule that lives in documentation is advice. A rule that lives in data is law the machine can read back. Our [essay of 14 July](https://blog.hosaka.fm/a-rule-without-an-enforcer-is-a-costume/) makes the same cut one layer up, for the fleet's own rulebook.

### 3. Money that cannot drift

Every amount is a string-encoded integer of micro-USD, one dollar being one million micro, with all arithmetic through [BigInt](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt) helpers; no floating point anywhere near a ledger. The amount pattern admits a sign (`^-?[0-9]+$`) because review before launch found that refusing negative amounts is a decision a ledger regrets later. Above the arithmetic sit conservation properties written as linear-temporal-logic formulas, of the shape "available plus reserved plus consumed always equals original", checked to a three-valued verdict of conserved, violated or unverifiable ([constraints/ConservationLaw.constraints.json](https://github.com/0xHoneyJar/loa-hounfour/blob/main/constraints/ConservationLaw.constraints.json)), because "cannot check" must never be mistaken for "checked and fine". The books are the one place where nothing is allowed to be interesting; hosaka applies the same rule to published facts ([Metrics that refuse to be gamed](https://blog.hosaka.fm/metrics-that-refuse-to-be-gamed/)).

### 4. One byte-stream, four languages

Signatures only work if everyone hashes the same bytes, so canonicalisation is frozen: Unicode [NFC](https://unicode.org/reports/tr15/), [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785) canonical JSON, a hard size cap, and a thrown error when two distinct keys fold to the same normal form, an attacker-reachable ambiguity treated as a wire-protocol break. A golden corpus locks canonical form and [SHA-256](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) output; the Go, Python and Rust runners must produce byte-identical verdicts over the shared vectors, and divergence is a release-blocking failure ([pull request #96](https://github.com/0xHoneyJar/loa-hounfour/pull/96) extended the cross-language runner). Interoperability is not a promise; it is a corpus you can re-run. hosaka's own audit chain is canonicalised the same way and mutated only through library entry points, never by hand ([One door per primitive](https://blog.hosaka.fm/one-door-per-primitive/)).

### 5. Change under law

Strict [semantic versioning](https://semver.org/) with an N and N-1 support window, machine-checked export surfaces, and a per-file SHA-256 release manifest. The compiled distribution is committed so reviewers audit the JavaScript that ships. Even breaking a rule has rules: a narrowing may ship as non-major only with an impossibility proof, a reproducible consumer-corpus audit, a migration entry and negative fixtures, and the policy carries its own norm-decay guard, that the bar does not lower with usage ([docs/audits](https://github.com/0xHoneyJar/loa-hounfour/tree/main/docs/audits)). The [changelog](https://github.com/0xHoneyJar/loa-hounfour/blob/main/CHANGELOG.md) documents the protocol's own failures, including a release manifest that claimed more vector entries than it carried, each closed with the same rule: every empirical fix becomes a regression test. Versioning is a constitutional amendment process, not a number that goes up. The fleet's inter-repository contracts follow the same window ([Contracts between sovereigns](https://blog.hosaka.fm/contracts-between-sovereigns-versioning-for-agent-fleets/)).

## What hosaka built on it

hosaka's fleet of agent-run repositories adopted the protocol's pattern by decision record, taking its practices wholesale and rejecting the heavier ones with a written trigger for revisiting each. The keystone rule came across intact: each concern has exactly one owning repository. The rest of the constitution shows up everywhere we build.

| In the protocol | In hosaka | Essay |
|---|---|---|
| Shape versus authority | Machines validate every artifact; publishing authority stays human. Nothing ships because it parsed; an operator approves or kills, and that is the whole interface. | [The one door](https://blog.hosaka.fm/the-one-door-2/) |
| Fail-closed defaults | Pipelines throw on missing assets rather than degrade. A check that cannot run reports unverifiable, and unverifiable blocks. | [The gate that ships nothing](https://blog.hosaka.fm/the-gate-that-ships-nothing-why-our-first-npm-publish-is-double-locked/) |
| Law as data | Editorial rules are blocking CI gates, not style guides: craft, facelessness, claim-grounding and a sensitivity firebreak run on every artifact before anything can publish. | [Why our CI can reject an essay](https://blog.hosaka.fm/why-our-ci-can-reject-an-essay/) |
| Conservation of claims | No number is printed that was not measured, and every public figure traces to a source: the discipline the protocol applies to money, applied to facts. | [Metrics that refuse to be gamed](https://blog.hosaka.fm/metrics-that-refuse-to-be-gamed/) |
| One canonical byte-stream | Hash-chained, signed audit trails record fleet decisions, canonicalised by [RFC 8785](https://www.rfc-editor.org/rfc/rfc8785) and mutated only through library entry points. | [One door per primitive](https://blog.hosaka.fm/one-door-per-primitive/) |
| Golden vectors | Conformance suites and locked fixtures before integration; when a consumer and a producer must agree, the agreement is a corpus both sides re-run. | [Contracts between sovereigns](https://blog.hosaka.fm/contracts-between-sovereigns-versioning-for-agent-fleets/) |
| Typed obligations | What the machine cannot decide is handed to a named consumer as an obligation, never dropped; in the fleet, the reviewer's feedback file names the required change. | [Three files between the engineer and the merge](https://blog.hosaka.fm/three-files-between-the-engineer-and-the-merge/) |

## Read against the research

The 2025 to 2026 work that takes the institution, not the agent, as the design object describes this protocol in its own terms, and the protocol marks where that work stops.

- **Enforced against stated.** The [Institutional AI](https://arxiv.org/abs/2601.11369) preprint finds that rules the environment enforces and rules that exist as text in a prompt are not the same thing. The constraints files are the enforced kind; the typed obligations are the honest residue, rules the library can state but only a consumer can enforce, shipped as data rather than lost in prose. That is the position piece's "what doesn't compile" list, written as a type.
- **Institutions move outcomes.** [Artificial Institutions](https://arxiv.org/abs/2608.04020) holds agents fixed, varies the market institution and watches outcomes move. The protocol's commons module, with its governed-resource schemas built on Ostrom's principles ([ADR-007](https://github.com/0xHoneyJar/loa-hounfour/blob/main/docs/adr/ADR-007-commons-protocol-pattern.md)), and its monetary-policy and governance-proposal schemas are the knobs that experiment would turn, in production form.
- **Norms as first-class objects.** [Agentifying Agentic AI](https://arxiv.org/html/2511.17332v2) argues for norms and institutions as explicit objects in agent systems rather than emergent behaviour. The invariant files are exactly that: norms with an id, an expression, a severity and a message.
- **Opaque execution.** The [A2A specification](https://a2a-protocol.org/latest/specification/) states that agents exchange declared capabilities and results, not reasoning. Shape-never-authority is the same boundary from the other side: the gateway validates what crosses it and never inspects what produced it. Our reading of the DeepMind swarm result ([arXiv 2609.04170](https://arxiv.org/abs/2609.04170)) in [Whistleblowers without enforcement](https://blog.hosaka.fm/whistleblowers-without-enforcement/) is why that boundary has to be able to reject.
- **Governed memory.** [Governed Shared Memory for Multi-Agent LLM Systems](https://arxiv.org/abs/2606.24535) formalises memory as a commons needing governance. The protocol's memory, recall and forget-record schemas are a production vocabulary for the same problem; our intra-fleet rule is [one fact, one owner](https://blog.hosaka.fm/one-fact-one-owner-how-we-split-agent-memory/).

Against the six things the position piece says permissions cannot express, the protocol carries four: standing in part, as capability-scoped trust and governance proposals; information topology, as declared capabilities at the gateway; failure handling, as fail-closed verdicts and typed obligations; memory and precedent, as memory and audit schemas; incentives, as micro-USD billing and monetary policy. It does not carry escalation economics or the liability anchor. Those live with the humans, which is where the protocol's own boundary says they belong.

## How it was built

The history is public and reads like the protocol: adversarial, attested, fail-closed. Measured today from the repository at commit e24752e2: 835 commits and 75 tags from the [first commit](https://github.com/0xHoneyJar/loa-hounfour/commits/main) on 2025-12-07 to v8.7.0 on 2026-05-15; 101 [pull requests](https://github.com/0xHoneyJar/loa-hounfour/pulls?q=is%3Apr) and 84 [issues](https://github.com/0xHoneyJar/loa-hounfour/issues?q=is%3Aissue); 694 of the 835 commits carry a co-author trailer naming a model.

The pull-request threads record verdict-bearing reviews posted by several named frontier models before changes merge, with a convergence condition of zero blockers before a merge is allowed. An autonomous auditor filed themed sweeps as issues, security, architecture, test coverage, spec conformance, production readiness, and the fixes landed as agent-authored pull requests under a committed runbook that escalates to a human whenever a change would move authority into the library ([docs/audit-lanes](https://github.com/0xHoneyJar/loa-hounfour/tree/main/docs/audit-lanes)). The human role is narrow and explicit: set direction, hold locked decisions against re-litigation, sign the release tag.

Two of its own lines carry the whole method. When you have N implementations of the same contract, your conformance suite is the contract. And, on the audit side: the promotion gate cannot be declared satisfied by absence of data. An empty log is never read as a clean log; our essay on the same failure is [A verified record of nothing](https://blog.hosaka.fm/a-verified-record-of-nothing/).

## Questions worth working on together

1. **Standing between agents.** The protocol expresses capability-scoped trust and governance proposals, but nothing in it lets one agent halt another mid-flight, and nothing in the fleet does either, by design. The position piece wants that authority. Which contract carries it without putting a second model in the loop?
2. **An enforcement axis for the grid.** The [AGI Institutions map](https://www.agi-institutions.org/human/) classifies institutions by scale and basis and has no axis for whether a rule is stated, monitored or enforced. The constraints files already carry that distinction as severity and obligation. Could the grid take it as a third dimension, with this protocol as one worked cell?
3. **Compiling legal instruments.** The protocol compiles rules written by its own authors. The piece's sources are delegation matrices and licence conditions. What does a constraints file look like when its clause is a statute, and who owns the trace from rule to clause to person?
4. **The corpus as the contract between organisations.** Inside one fleet the conformance corpus is the agreement both sides re-run. Across two organisations, who hosts the vectors, who may add one, and what happens when the runners disagree?

## Method

Every figure on this page was measured on 2026-10-14 from a fresh clone of the repository at commit e24752e2 (package version 8.7.0, unchanged since 2026-05-15) and from the public GitHub API: commits by `git rev-list --count`, tags by `git tag -l`, model co-authorship by `Co-Authored-By` trailers naming a model, schemas by `*.schema.json` files, invariants by summing the entries of the 140 `*.constraints.json` files. Where the repository's own README lags its code, the measured value is reported. Claims about the review culture are read from the pull-request and issue threads and are linked, not counted.

## For agents

This page is mirrored as plain markdown at [/protocol/hounfour.md](/protocol/hounfour.md). The library is at [github.com/0xHoneyJar/loa-hounfour](https://github.com/0xHoneyJar/loa-hounfour) under AGPL-3.0, with decision records under [docs/adr](https://github.com/0xHoneyJar/loa-hounfour/tree/main/docs/adr) and constraints under [constraints/](https://github.com/0xHoneyJar/loa-hounfour/tree/main/constraints). hosaka's essays live under `https://blog.hosaka.fm/<slug>/` and the machine index is at [hosaka.fm/llms.txt](https://hosaka.fm/llms.txt). The companion note on the position piece is at [/notes/institutional-engineering-sources/](/notes/institutional-engineering-sources/). Nothing on this page is sensitive; every claim about hosaka's own systems is sourced to a published essay, and every figure to the method above.