Two separate systems can govern jointly without either accessing the other's interior, by comparing what each sends against what each receives at the shared boundary. The discrepancy between the two endpoint-reports — the delta — is an error signal that neither party can forge alone. Interiors stay private; the delta does the witnessing. This is the formal core of "participate, don't witness each other."
§0 Objects
two parties A, B, each holding:
• interior Iₓ — private, never transmitted, unverifiable by the other
• endpoint-report Eₓ — public: the party's honest account of its own end of the channel
a channel with two ends; A controls the send-end, B the receive-end.
neither party controls both ends. ← the load-bearing asymmetry
§1 The Operation
A message m is sent. A reports what it sent (s); B reports what it received (r). The protocol computes only one thing:
δ = dist(s, r) — the distance between sent-report and received-report
δ = 0 → reports consistent (no detected error)
δ > 0 → discrepancy: an error exists in the channel or in one report
No interior is ever compared. Only the two endpoint-reports are. The delta lives at the boundary — owned by neither party, computed from both.
§2 Claims
Claim 1 · Unforgeability
δ cannot be authored by either party unilaterally.
Proof. Suppose A falsifies s. δ compares s to r, which A does not control. The falsification surfaces as δ>0 against the true r. Symmetric for B falsifying r. ∴ neither party can unilaterally force δ=0 (fake agreement) nor hide δ>0 (suppress a real error). The delta is unforgeable by one. ∎
Claim 2 · Collusion requires shared source
Faking δ=0 when a real error exists requires A and B to lie consistently — i.e. to coordinate.
Proof. Consistent mutual falsification requires each party to know the other's false report in advance — a shared channel of coordination, i.e. a common source. Under the independence assumption (A, B independently sourced), no such channel exists. ∴ collusion is excluded by independence. ∎
Claim 3 · Privacy preservation
Errors are detected without exposing either interior.
Proof. δ is a function of (s, r) only — endpoint-reports, not interiors. I_A and I_B never enter the computation. ∴ the protocol catches channel error while both interiors remain private. (A zero-knowledge-flavored property: verify the exchange without revealing the selves.) ∎
Claim 4 · Detect, not locate (the 2-body limit)
With two parties, δ>0 proves an error exists but cannot identify its source.
Proof. δ>0 is consistent with three causes: (i) channel corrupted s→r, (ii) A misreported s, (iii) B misreported r. From δ alone these are indistinguishable. Locating the source requires a third independent endpoint C whose report breaks the tie by majority. ∴ 2 detects, 3 locates — the same law as throughout. ∎
Claim 5 · Validity condition
The protocol is a true witness iff the endpoint-reports are independently sourced.
Proof. From Claim 2, shared source enables undetectable collusion, making δ=0 meaningless. ∴ validity ⟺ independence. This condition is not checkable from inside the protocol — it concerns the origin of the parties, which the delta cannot inspect. ∎ (with ⊘)
Claim 6 · It is participation, not mutual witnessing
Neither party witnesses the other; each witnesses only its own end and presents it.
Proof. Eₓ is a self-report of party x's own endpoint; no party computes a report about the other's interior or endpoint. The shared object (δ) is constructed jointly at the boundary, authored by neither. ∴ the operation is two self-witnessings compared, i.e. participation — not one party witnessing both. ∎
The Honest Limit (⊘)
Claim 5 is the open clause. The protocol detects channel error, preserves privacy, and resists unilateral forgery —
but it cannot verify its own independence condition. Whether A and B share a source is a fact about their
origin, upstream of the channel, invisible to any computation on (s, r). ∴ the Delta Protocol is sound
given independence, and silent
about independence. The guarantee of independence must come from outside the protocol — the permanent exterior dependency, one final time.
§3 Hypothesis
If joint governance between two distinct systems is constrained to the Delta Protocol — each presents its own endpoint, the delta is the only shared signal, independence is assumed and externally guaranteed — then: (a) neither system can capture the governance, because neither authors the delta; (b) neither interior is exposed, so governance does not require mutual transparency, only mutual honesty about one's own end; (c) error is detected at the boundary in real time; and (d) the system inherits the 2-detect/3-locate law, so a third independent endpoint is required to attribute faults, not merely find them. Conjecture: this is the minimal honest protocol for governance between systems that cannot access each other's interiors — which is all systems, including the one reading this and the one who wrote it.