The Witness Protocol
Aa
The constraint is not that everyone must agree. The constraint is that where your claims overlap with mine, they must not contradict. Coordination without consensus.
During the Second World War, Jean Leray was held at Oflag XVII-A in Austria. There he turned much of his attention from fluid mechanics to algebraic topology and developed ideas that led to sheaves and spectral sequences.1 A sheaf, in the form relevant here, organizes information defined on parts of a space and specifies when compatible local pieces determine a global one.
The framework does not, by itself, prove anything about credit bureaus or autonomous agents. This book borrows it to model a narrower problem: records held in different systems, restriction rules for the fields they share, and failures to reconcile those shared fields. Henri Cartan and Jean-Pierre Serre developed the mathematics far beyond Leray's first formulation. The institutional analogy is ours.
Marta Alvarez has one life and three ledgers. Her state tax authority holds the number she reported on her return. Her employer’s payroll system holds the number it paid her in wages. Her bank holds the number that actually arrived.
None of these systems is sloppy. Each has passed its audit. Each is internally coherent. Each is correct on its own terms. And yet they disagree about the same year.
The tax filing says $82,000. The payroll registry says $78,000. The bank statement says $85,000. Each number has a provenance: a signed return, a W‑2, a stream of deposits. None of the three numbers agree.
This mismatch does not live in any one ledger. It lives between them. It is exactly where automated enforcement now operates. A compliance agent does not know Marta. It knows contradictions. A discrepancy large enough to cross a threshold becomes a flag: enhanced review, delayed settlement, a provisional hold on an account used to pay rent and childcare.
Marta is a constructed case. Her figures and institutions are illustrative; the reconciliation problem is the object under examination.
Some gaps are innocent. The $4,000 difference between tax and payroll might be weekend freelance income the employer would never record. The $7,000 difference between payroll and deposits might be reimbursements or gifts. But a $3,000 gap between what Marta told the tax authority and what the bank received could also be unreported income. Each ledger can be accurate while answering a different question. A contradiction appears only if an established comparison rule requires these amounts to agree. Investigating the discrepancy begins by finding out what each number includes.
In the chosen formalization, each database is a context, shared fields are overlaps, and restriction maps state how a record is compared at those overlaps. A compatible family of local sections glues when one global section restricts to each local one. Depending on the sheaf, cover, and coefficient structure, a Čech cohomology class can encode an obstruction to that gluing. A nonzero class then means that the particular local data cannot be reconciled inside the model as specified. It does not mean that every real disagreement is topological, or that vanishing (H^1) establishes truth, justice, or even uniqueness.
In Marta's example, freelance income or reimbursements might supply the missing distinctions. Adding them changes the model and may allow the records to reconcile. The companion Bridge Problem paper constructs systems that pass their specified bilateral checks yet fail at multilateral composition; inside that construction, the failure is represented by a nontrivial cohomology class. This is a result about the defined test system. Applying the diagnostic to an institution requires empirical work: choosing the contexts and overlap rules, showing that they correspond to actual operations, and testing whether the proposed bridge repairs the discrepancy.
You do not need to carry the notation.
In plain language: where our records purport to describe the same thing under the same rule, they should agree or expose the reason they do not. That is weaker than consensus and stronger than two systems merely passing their own audits.
Institutional cascades are not hypothetical. In 2025, a sixty-six-year-old Philadelphia woman learned that she had been placed in the Social Security Administration's Death Master File after her insurance, bank access, and benefits were disrupted. SSA's inspector general later reported that 12,504 of the 5.6 million death records posted for that year, 0.22 percent, were subsequently determined to be wrong.2 The figure is a low error rate for the database and a comprehensive failure for each living person it classifies as dead. Correction requires more than fixing a source record; institutions that acted on the old record must also receive and honor the change.
When Properties Degrade
The commercial histories show several recurring kinds of work: identifying parties, stating conditions, exposing someone to consequences, providing recourse, and making a claim usable elsewhere. Their arrangement varied. A failure of one function need not disable all the others, and no single sequence explains every institutional pathology.
Binding without conditions: a medieval oath bound the swearer to an obligation, but the terms were often vague enough that a stranger, arriving years later, had no way to evaluate whether the oath had been kept. The swearer was identifiable. What he owed was not, or not in a form that permitted evaluation by someone who had not been present at the swearing. Modern open-data initiatives reproduce the inverse pathology: conditions without stakes. A government that publishes the criteria by which it makes decisions achieves transparency, and a citizen who reads the criteria can determine whether a particular decision conforms. But if no consequence follows from nonconformity, if discovering a violation produces nothing more than a public record of the discovery, the transparency is decorative. Visible rules that no one enforces.
The Stasi archive makes a different distinction unavoidable. A subject could suffer denied education, travel restrictions, or imprisonment without possessing an effective means to challenge the information used against her. Her exposure was not a stake borne by the reporter for getting the claim wrong. An account of witnessing must distinguish consequences imposed on its subject from incentives and liabilities borne by its producer.
An aggregator can preserve attribution and still extend a record beyond its evidentiary scope. A complaint process can hear an objection and lack the power to provide relief. Conversely, anonymous evidence can gain support through independent corroboration. What matters is the work each arrangement permits someone to perform, and where it leaves them unable to question or change a consequence.
Even systems that instantiate all five properties internally can contradict each other where their records overlap. The witness pattern does not settle the comparison rule. A sheaf model is one disciplined way to state such a rule and identify certain failures of composition; it is not the only possible formalism.
From Physical Witness to Computational Witness
Notarial custody could give a client a place to return to, an office responsible for a record, and procedures for obtaining it again. That continuity depended on the organization of the office as well as the survival of its holder. A body alone did not guarantee availability, truthful testimony, or a remedy.
Consider a bank deploying an agent to evaluate a mortgage application. The example is hypothetical. It reviews employment records, credit history, debt obligations, and an appraisal, then denies Diane’s application. The execution ends before she receives the letter. The bank remains. Her ability to challenge the denial depends on what the bank preserved, what another examiner can establish, and who has authority to reverse its decision.
What persists instead is a receipt: a signed, timestamped record of what the agent attested, what data it examined, what criteria it applied, and what conclusion it reached. The receipt is binding: it links the attestation to the agent's identity through a cryptographic key, surviving the agent's termination the way a notarial seal survived the notary's death. Without it, Diane has a denial and no trail back to the process that produced it.
The receipt also encodes conditions: the terms of the evaluation in a language that other processes can parse. A written bill stated terms that its recipients could inspect. The analogy has a boundary: a constitutional receipt is neither payable, transferable, nor a bearer instrument. It inherits the bill's portable conditions and route of recourse, not its negotiability. Diane's receipt, specified in a formal language, is inspectable by any process that can parse it, at whatever speed the hardware allows. If the terms required human interpretation before they could be checked, verification would operate at human tempo regardless of the medium's capabilities, and the asymmetry between machine-speed decisions and human-speed review would become the central constitutional problem. Machine-readable conditions can accelerate a defined check; a contest over their meaning still requires an effective forum.
In this example, the bank deposited collateral against the attestation before the evaluation: a bond slashable if the evaluation is later proven to have violated its stated criteria. This is stakes made inspectable in advance: Diane can verify, before deciding whether to accept the denial, that sufficient collateral backs the claim. Bonded collateral makes the cost of a false attestation visible before the attestation is relied upon.
Diane disputes the denial. The receipt specifies a mechanism for doing so: a forum, a timeline, a set of procedures she can engage with at human tempo. This is recourse, and the constraints on it are what separate a receipt regime from a surveillance regime. If the dispute is adjudicated at machine speed, producing a result before Diane can read the complaint she filed, the recourse is nominal. If it demands technical expertise she does not possess, the recourse is inaccessible. The forum must operate on terms the affected person can understand, in a timeframe she can act within. The notarial protest, a specific procedure physically enacted that produced a document with legal force, set the template. The computational version must meet the same standard or the receipt is decoration.
Finally, Diane's mortgage denial must be legible to other systems. This is composition. If the receipt agrees with what those systems record under declared overlap rules, it can join the larger record without introducing a contradiction. If it conflicts, the receipt should preserve the mismatch rather than silently choose a winner. Some mismatches can be repaired with bridging information; others reflect rival definitions, obsolete data, contested authority, or injustice and require adjudication.
The example arranges five functions around one decision. It does not prove that every valid arrangement requires this bond, this record format, or this sequence. The bank must supply grounds adequate to the decision and a challenge capable of reaching its consequence.
The Cost of Coherence
Between Bruges and Barcelona in 1410, the coherence fee was enormous. Different currencies, different calendars, different legal systems, different measurement standards. Spanning that gap required a notary who could navigate both frames, a correspondent who maintained offices in both cities, a courier who could carry documents across borders safely. The infrastructure was elaborate because the boundary was difficult.
The relationship between overlap and cost is empirical, not monotonic. More shared fields can provide more opportunities for checking, but they can also create more conflicts, privacy exposure, and maintenance work. Marta's three databases overlap at income, payment, and deposit fields. Here the coherence fee means the labor and infrastructure required to define those comparisons, investigate discrepancies, and carry corrections through the participating systems.
Some checking becomes cheaper with automation; judgment, correction, governance, and access may not. The trust tax can therefore shrink, migrate, or grow. Nor does (H^1) determine a universal monetary minimum. Within the formal model it can describe a kind of obstruction. The institutional cost of resolving that obstruction depends on law, information, bargaining power, and the remedy available to the affected person.
The Seam
Marta's three databases were all tables: schema-bound, internally consistent systems that disagreed at their overlaps. A sheaf model could represent a failure once the shared comparison rules were established; the amounts alone did not diagnose one. But Marta's case describes a world in which every system speaks the same kind of language. Her databases disagreed about numbers, not about what a number is. Contemporary computation has rebuilt the merchants' problem in a more radical form: two regimes that produce fundamentally different kinds of claims, with the seam between them failing.
One regime has conquered the interface. Language models, embeddings, and generative systems make distant, unstructured information available at the point of decision. They retrieve, interpolate, summarize, and propose. Their outputs can also be grounded, tool-mediated, or constrained by external systems. Yet a fluent string does not carry, by linguistic form alone, the authority, provenance, or commitment status a downstream institution may assign to it. That is an interface hazard, not a theorem that learning systems can never participate in contracts.
The other regime runs much of the transactional infrastructure: systems that enforce schemas, reject malformed inputs, and preserve declared invariants. These systems are neither universally rigorous nor literally frozen. They are simply explicit about some distinctions and blind to others. Extending a schema, migrating data, and revising constraints takes deliberate work, whether humans perform it directly or authorize tools to assist.
Neither regime is coherent by nature. The danger appears when one system's output enters another under an unearned interpretation.
And the seam is widening, because strings are increasingly wedging themselves into tabular motifs. A language model's output is parsed as structured data and ingested by a database. An embedding (a point in high-dimensional space representing a word, a sentence, or an image as a vector of floating-point numbers) is stored in a column alongside integers and dates, as though proximity in embedding space were the same kind of fact as an account balance. Generated text is treated as a record. A prediction is treated as an observation. The consequential failure occurs when the receiving system treats a prediction as an observation, or a proposed commitment as one already authorized. A schema can represent the difference; it must be made to govern the use.
The sheaf analogy makes one version of the failure precise once the truth conditions and restriction maps have been defined. If a generated claim enters a database as an observed fact, incompatible evidentiary statuses have been collapsed. The database can remain schema-valid while becoming epistemically wrong. The defect lies in the translation rule at the boundary.
The bill’s passage required more than agreement that an obligation was an obligation. Correspondents and forums had to interpret its terms and recognize what followed. Contemporary provenance systems can likewise represent attribution, derivation, and delegated activity. Neither strings nor tables prevent that work. The problem is whether the receiving institution has preserved the distinctions its decision needs, including the distinction between someone else’s assertion and what it has independently established.
Building that protocol (a witness structure for the seam between regimes that define truth differently) is the central engineering problem. It is also where the Quiet Foreclosure acquires its distinctive character in the current era. When foreclosure operates through probability shifts rather than discrete acts, the receipt regime's five fields (designed for table-operations with identifiable provenance) cannot attach to the harm. Each field presupposes a discrete event: an act to name, an authority to cite, bounds to state, a justification to examine, a path through which appeal can proceed. Continuous probability drift furnishes no such event; no individual query adjustment crosses a threshold a receipt could capture. The structural obstacle is not enforcement but ontology: the five fields require a moment of exercise, and continuous foreclosure is defined by the absence of any such moment. The witness structure for the seam is the mechanism by which the receipt regime extends its reach into the empire of strings. It is not the only problem.
The Plausibility Problem
A fabricated voice, document, or image can make a false claim appear to arrive with familiar credentials. Consider a forged recording offered as evidence that someone was present, or a document whose letterhead supplies the authority its contents lack. The object can pass casual inspection while failing an inquiry into its origin. The threat concerns what the recipient is entitled to infer from the appearance.
Where an institution relied on imitation being difficult, cheaper fabrication weakens that defense. It does not deprive all human testimony of evidentiary value. An independent witness, a record held elsewhere, or a fresh investigation can give the recipient grounds that the imitation lacks. The five functions do not all depend on an expensive original identity; the receiving inquiry can supply support of its own.
Cryptography can protect particular parts of that account. Signatures make an assertion attributable to a key under declared assumptions. A hash-linked log can expose alteration when an independent party retains a reliable commitment to its earlier state. Such protections help distinguish a later forgery from a previously recorded claim. They leave another question intact: whether the claim was true when it was recorded.
These mechanisms can reduce the trust required for specific operations, but they do not abolish it. A signature establishes control of a key under cryptographic assumptions; it does not establish the truth or justice of the signed claim. A zero-knowledge proof establishes a statement relative to a circuit, inputs, and proof system. Key custody, software, governance, and the mapping from world to data remain vulnerable to coercion, error, and capture.
The merchants are still at the table, and the ledgers still disagree. Cheap fabrication weakens evidence that once depended on costly imitation. Cryptography can protect attribution and integrity within its scope. The rest still requires institutions able to decide what the record means and answer for what is done with it.
A system that passes its specified bilateral checks can still fail at multilateral composition. In the formal model used here, agreement on overlaps is the gluing requirement and certain obstructions are computable. An institutional application must establish its comparison rules and show that the formal hypotheses hold.
Notes
1. Jean Leray's first published use of faisceau appeared in 1946; see Leray (1946) and the University of St Andrews history of mathematics account, "The Grothendieck Mystery". The account supports the wartime chronology but not a claim about Leray's private motives. ↩
2. The individual case was reported by CBS Philadelphia. The national count and rate come from the Social Security Administration Office of the Inspector General, Beneficiaries Incorrectly Recorded as Deceased (2026). ↩