@lapxo/bound

Keep who said what. Name what is still missing.

Bound folds signed statements, observations and requirements into a place you can inspect. Every declaration keeps its origin. Incompatible declarations stay visible; missing evidence stays missing. Rendering a page does not pay a requirement.

See it

In an existing place with admitted declarations and valid public receipts:

npx @lapxo/bound@0.2.8 fold --check

Captured from the verified checkout:

PASS     closed · 1 places · 1836 ms

A check validates the current bytes against retained receipts. It does not run the external readers again. Changed inputs reopen the readings that depend on them; absent or altered selected outputs cannot pass as closed.

The installed reference example also captures two independently admitted fixture places and refuses an altered carrier in each:

README sensor · REQUIRED · altered carrier refused
README editorial · REQUIRED · altered carrier refused

Quick start

npm install @lapxo/bound@0.2.8

A place is a folder with TARGET.bound: its declarations, selected readers and renderers, and the rules under which changes can be admitted. Start inside such a place; installation alone does not create authority or a closed place.

npx bound fold                 # read declared inputs and render selected views
npx bound fold --check         # validate retained evidence against current bytes
npx bound fold --as lines      # inspect one selected view

To change a place, prepare a proposal, sign with a key already covered by the place, admit the signed lot, then fold and inspect the result. Signing and admission do not themselves pay a requirement. The usage guide covers keys, coverage, proposals, exact withdrawals and release policy.

What the fold keeps

• Declarations and origins. Who supports each statement remains available for explanation and exact withdrawal; a later value does not silently erase a conflict.
• Requirements and evidence. A reader supplies observations for its domain. Bound applies the admitted forms and constraints; it does not invent missing evidence.
• Views and receipts. Selected views have declared inputs. Unchanged regions can retain valid receipts; a receipt records a reading in its context.
• Refusals. Machine-readable codes name the failed condition and its next step. Human diagnostics are not parsed as authority.

A digest identifies content; it grants neither authority nor network permission. A receipt does not prove that a source is true or independent. Two signing keys are not evidence of two independent people.

Embed the engine

The CLI and applications use the same implementation. The pure engine projects already admitted object records in effective order:

import { objectFold } from '@lapxo/bound/engine';
import { inspectAuthenticatedReference } from '@lapxo/bound/reference';

export async function openAndProject(reference, trust) {
  const opened = await inspectAuthenticatedReference(reference, trust);
  return objectFold(opened.records, trust.objects);
}

Your host supplies the independently accepted trust context, selected form, policy, bounded content and cryptographic ports. The carrier cannot choose them. objectFold itself does not fetch content, verify signatures, choose authority, commit acts or write storage.

For native effects, /host provides a persistent host with explicitly bound signers and a pinned instrument. Host document requests refuse by name rather than returning an unrelated successful view. Digest-pinned redirects check the receiver's network policy before each connection; integrity never grants access. See host transport and refusals and receiver policy.

Public entry points

Import	Responsibility
/engine	Pure projection of already admitted records.
/reference	Inspect an authenticated carrier against accepted host context.
/reference/native	Export and open signed carriers from an admitted place.
/host	Native host, view identities and text, probes, authority preflight.
/physical-lines	Physical lines under declared selectors, with a reading witness.
/profiles	Digest-pinned composition and exact release categories.
/package/native	Content identity of a verified installed inventory.
/closure/native	Verify and deliver a declared module closure.
/wasm	Optional WASM adapter for object projection.
/refusals, /standing-contract	Machine-readable interpretation contracts.
/conformance, /determinism, /parity	Published acceptance contracts and neutral vectors.

A view identity can be requested with its text without running a fold. Its cost includes checking current input bytes; it is not constant in place size. Probes persist no counter or marker; the consumer owns its count. Authority cards are preflight results, and an eventual act still checks current authority.

The optional WASM adapter covers object projection, not admission, native effects or the whole CLI. Independent physical-machine verification remains pending.

Read further

Usage · Host ports · Standing · Refusals · Authority preflight · View identities · Probes · Physical lines · Profiles · Installed identity · Neutral parity.

Built on Topos for wire and interpretation contracts, and Obligations for constraint algebra. Domain readers supply their own observations; Bound is not a source of truth.

The underlying object is described in Ochoa, N. (2026), Two-Sided Constraints on a Valued Lattice, DOI 10.5281/zenodo.21858428.

MIT.