The hounfour protocol: hosaka's constitutional contracts, read against the institutional-engineering research

§1What it is, and what it refuses to be

The library is a TypeScript set of TypeBox schemas that compile to standalone JSON Schema 2020-12 files, so any language can validate the same contracts. Around the schemas sit a constraint grammar with a pure-function evaluator, conservation laws written as temporal-logic formulas, canonicalisation and hashing helpers, and a golden corpus of conformance vectors with reference runners in Go, Python and Rust beside the TypeScript implementation (vectors/runners).

Its self-restraint is the design. The README states it as a refusal: no runtime, no transport, no HTTP server, no model invocation. Everything the library refuses to do is something a consumer must do consciously, and the boundary is written down as a decision record, ADR-010, the class-versus-policy boundary: the library ships shape; consumers ship authority. The code is licensed AGPL-3.0 (LICENSE.md).

The name is Haitian Kreyòl: a hounfour is the temple where the loa are served. Read that way it fits the role the library plays: the structured place every agent passes through.

§2Five ideas, read as an institution

1. Shape, never authority

Valid JSON is not an authorised action; a valid signature is not signer competence. The library validates structure and refuses to pretend further. Schemas that carry cryptographic material fail closed: validation returns not-valid with a deferred-cryptography marker unless the caller explicitly accepts a manifest listing every verification it now owes. A structural lint enforces the boundary in CI: no verifier exports, no crypto imports, no engine-named modules (ADR-010). In hosaka’s terms: machines validate, a human authorises. This is the position piece’s §2 at the protocol layer, and the reason the one door above the fleet can stay binary.

2. Law as data, not prose

Beside every schema sits a constraints file: 388 named invariants across 140 files, written in a small expression grammar and framed as institutional rules in Elinor Ostrom’s sense (ADR-007, the commons protocol pattern; Ostrom’s own statement of the design principles is her 2009 Nobel lecture). Rules the library can evaluate, it evaluates; rules only a consumer can enforce ship as typed obligations, never silently passed. One entry from constraints/MutualCredit.constraints.json, abridged:

{ "id": "credit-settled-requires-settled_at",
  "expression": "settled == true => settled_at != null",
  "severity": "error",
  "message": "settled_at is required when settled is true" }

A rule that lives in documentation is advice. A rule that lives in data is law the machine can read back. Our essay of 14 July makes the same cut one layer up, for the fleet’s own rulebook.

3. Money that cannot drift

Every amount is a string-encoded integer of micro-USD, one dollar being one million micro, with all arithmetic through BigInt helpers; no floating point anywhere near a ledger. The amount pattern admits a sign (^-?[0-9]+$) because review before launch found that refusing negative amounts is a decision a ledger regrets later. Above the arithmetic sit conservation properties written as linear-temporal-logic formulas, of the shape “available plus reserved plus consumed always equals original”, checked to a three-valued verdict of conserved, violated or unverifiable (constraints/ConservationLaw.constraints.json), because “cannot check” must never be mistaken for “checked and fine”. The books are the one place where nothing is allowed to be interesting; hosaka applies the same rule to published facts (Metrics that refuse to be gamed).

4. One byte-stream, four languages

Signatures only work if everyone hashes the same bytes, so canonicalisation is frozen: Unicode NFC, RFC 8785 canonical JSON, a hard size cap, and a thrown error when two distinct keys fold to the same normal form, an attacker-reachable ambiguity treated as a wire-protocol break. A golden corpus locks canonical form and SHA-256 output; the Go, Python and Rust runners must produce byte-identical verdicts over the shared vectors, and divergence is a release-blocking failure (pull request #96 extended the cross-language runner). Interoperability is not a promise; it is a corpus you can re-run. hosaka’s own audit chain is canonicalised the same way and mutated only through library entry points, never by hand (One door per primitive).

5. Change under law

Strict semantic versioning with an N and N-1 support window, machine-checked export surfaces, and a per-file SHA-256 release manifest. The compiled distribution is committed so reviewers audit the JavaScript that ships. Even breaking a rule has rules: a narrowing may ship as non-major only with an impossibility proof, a reproducible consumer-corpus audit, a migration entry and negative fixtures, and the policy carries its own norm-decay guard, that the bar does not lower with usage (docs/audits). The changelog documents the protocol’s own failures, including a release manifest that claimed more vector entries than it carried, each closed with the same rule: every empirical fix becomes a regression test. Versioning is a constitutional amendment process, not a number that goes up. The fleet’s inter-repository contracts follow the same window (Contracts between sovereigns).

§3What hosaka built on it

hosaka’s fleet of agent-run repositories adopted the protocol’s pattern by decision record, taking its practices wholesale and rejecting the heavier ones with a written trigger for revisiting each. The keystone rule came across intact: each concern has exactly one owning repository. The rest of the constitution shows up everywhere we build.

§4Read against the research

The 2025 to 2026 work that takes the institution, not the agent, as the design object describes this protocol in its own terms, and the protocol marks where that work stops.

• Enforced against stated. The Institutional AI preprint finds that rules the environment enforces and rules that exist as text in a prompt are not the same thing. The constraints files are the enforced kind; the typed obligations are the honest residue, rules the library can state but only a consumer can enforce, shipped as data rather than lost in prose. That is the position piece’s “what doesn’t compile” list, written as a type.
• Institutions move outcomes. Artificial Institutions holds agents fixed, varies the market institution and watches outcomes move. The protocol’s commons module, with its governed-resource schemas built on Ostrom’s principles (ADR-007), and its monetary-policy and governance-proposal schemas are the knobs that experiment would turn, in production form.
• Norms as first-class objects. Agentifying Agentic AI argues for norms and institutions as explicit objects in agent systems rather than emergent behaviour. The invariant files are exactly that: norms with an id, an expression, a severity and a message.
• Opaque execution. The A2A specification states that agents exchange declared capabilities and results, not reasoning. Shape-never-authority is the same boundary from the other side: the gateway validates what crosses it and never inspects what produced it. Our reading of the DeepMind swarm result (arXiv 2609.04170) in Whistleblowers without enforcement is why that boundary has to be able to reject.
• Governed memory. Governed Shared Memory for Multi-Agent LLM Systems formalises memory as a commons needing governance. The protocol’s memory, recall and forget-record schemas are a production vocabulary for the same problem; our intra-fleet rule is one fact, one owner.

Against the six things the position piece says permissions cannot express, the protocol carries four: standing in part, as capability-scoped trust and governance proposals; information topology, as declared capabilities at the gateway; failure handling, as fail-closed verdicts and typed obligations; memory and precedent, as memory and audit schemas; incentives, as micro-USD billing and monetary policy. It does not carry escalation economics or the liability anchor. Those live with the humans, which is where the protocol’s own boundary says they belong.

§5How it was built

The history is public and reads like the protocol: adversarial, attested, fail-closed. Measured today from the repository at commit e24752e2: 835 commits and 75 tags from the first commit on 2025-12-07 to v8.7.0 on 2026-05-15; 101 pull requests and 84 issues; 694 of the 835 commits carry a co-author trailer naming a model.

The pull-request threads record verdict-bearing reviews posted by several named frontier models before changes merge, with a convergence condition of zero blockers before a merge is allowed. An autonomous auditor filed themed sweeps as issues, security, architecture, test coverage, spec conformance, production readiness, and the fixes landed as agent-authored pull requests under a committed runbook that escalates to a human whenever a change would move authority into the library (docs/audit-lanes). The human role is narrow and explicit: set direction, hold locked decisions against re-litigation, sign the release tag.

Two of its own lines carry the whole method. When you have N implementations of the same contract, your conformance suite is the contract. And, on the audit side: the promotion gate cannot be declared satisfied by absence of data. An empty log is never read as a clean log; our essay on the same failure is A verified record of nothing.

§6Questions worth working on together

1. Standing between agents. The protocol expresses capability-scoped trust and governance proposals, but nothing in it lets one agent halt another mid-flight, and nothing in the fleet does either, by design. The position piece wants that authority. Which contract carries it without putting a second model in the loop?
2. An enforcement axis for the grid. The AGI Institutions map classifies institutions by scale and basis and has no axis for whether a rule is stated, monitored or enforced. The constraints files already carry that distinction as severity and obligation. Could the grid take it as a third dimension, with this protocol as one worked cell?
3. Compiling legal instruments. The protocol compiles rules written by its own authors. The piece’s sources are delegation matrices and licence conditions. What does a constraints file look like when its clause is a statute, and who owns the trace from rule to clause to person?
4. The corpus as the contract between organisations. Inside one fleet the conformance corpus is the agreement both sides re-run. Across two organisations, who hosts the vectors, who may add one, and what happens when the runners disagree?

§7Method

Every figure on this page was measured on 2026-10-14 from a fresh clone of the repository at commit e24752e2 (package version 8.7.0, unchanged since 2026-05-15) and from the public GitHub API: commits by git rev-list --count, tags by git tag -l, model co-authorship by Co-Authored-By trailers naming a model, schemas by *.schema.json files, invariants by summing the entries of the 140 *.constraints.json files. Where the repository’s own README lags its code, the measured value is reported. Claims about the review culture are read from the pull-request and issue threads and are linked, not counted.