The Intellectual Sovereignty Protocol.

1. A hash is not a title

A novel exists as an idea-bearing work, as an English text and a Portuguese translation, as a hardcover with an ISBN, as an EPUB file with a digest, and as the signed copy on a shelf. Exclusive English-language digital distribution in the United States for two years is a different object again. So is a license under those rights, a claim that a given person wrote the text, and a contractual share in future revenue. Library science has long separated several of these layers. Content-provenance standards bind signed assertions to media. Identifier standards give each level its own code.

Tokenized intellectual-property systems tend to collapse that structure into one object: one work, one token. The failures are familiar, even when they are not named. A hash anchored on a chain is advertised as proof of authorship. Transferring a token is presented as transferring copyright. A royalty interface is described as royalty enforcement. A valid signature is displayed as a verified person. A cosine similarity of 0.8 is reported as “80% plagiarized.” Each failure is a type error. A value of one kind is silently read as a value of another.

ISP is built on the opposite principle. It defines no blockchain, consensus protocol, validator network, or token. Existing chains are optional places to anchor a commitment or execute a representation. ISP records who asserted what, on which evidence, for which scope, and with what contestation status. It does not record what is true.

2. Keep the work, the file, and the right apart

The object model extends the Work–Expression–Manifestation–Item hierarchy used in library science, and adds the objects digital commerce actually moves.

• A Work is the logical creative object. Its identifier is random. It is never derived from a title or a file hash, so it stays stable when the file changes.
• An Expression is a realization in a language or form, such as a translation, an adaptation, or a musical arrangement.
• A Manifestation is an edition, a recording, or a rendered master.
• A Rendition is one exact digital file, identified by its digest.
• A Copy is one issued exemplar, physical or digital.
• An Ingredient is a component or source used inside another work.

Parties, role credentials, claims, rights, grants, signed contract manifests, attestations, and chain anchors are independent entities. External identifiers — ISBN, DOI, ISRC, ISWC, ISAN, ISNI, ORCID — are attached. They are not overwritten. Content-derived codes such as ISCC identify bytes. They do not replace the Work identifier.

Every record carries its schema version, subject, issuer, time, scope, payload hash, evidence, signature, status, jurisdiction, and privacy class. Records are canonicalized with one named method. Corrections append a new record that supersedes the old one. Nothing is edited in place.

Non-coercion

For two distinct ISP types, a conforming implementation may not accept a value of one type where the other is required, unless the specification defines an explicit conversion and the conversion records the evidence that justified it.

3. A graph of propositions, not of titles

A Rights Graph is a directed, labeled multigraph of typed objects. Each edge is a proposition: who asserted it, on what evidence, over what interval, in what jurisdiction, at what verification level, and with what dispute status. Two parties may assert incompatible authorship. Both edges remain, marked as contested. The graph is a register of claims. Absence of an edge is not evidence that the claim is false. Unknown is not the same as no conflict.

A right or a grant has a scope: a set of uses, territories, media, languages, and a time interval. Two scopes overlap when those cells intersect. Before any request can be authorized, someone must attest that named sources were searched and must list the encumbrances found. That closure attestation is itself signed, scoped, and challengeable. An encumbrance outside the searched sources remains a named residual risk. It is not hidden behind a promise of completeness.

Three-valued authorization

Authorization uses the strong Kleene connectives over true, false, and unknown. A request names a work, a seller, a territory, a medium, a language, a time, and a number of copies. For each grant the seller presents, the decision asks whether the grantor’s authority was verified, whether the grant covers the request, whether the grant is revoked, and, for an exclusive grant, whether capacity is reserved. A missing field is unknown. The result is the disjunction of those grants, conjoined with the absence of a known conflict.

An indeterminate result lists the unresolved atoms, so a person knows which evidence to collect. Deny means the presented evidence does not authorize. It does not mean that no authorization exists anywhere.

The authorization function is monotone in information. Resolving an unknown atom never reverses an allow or a deny. Only an indeterminate decision can change. A closed-world rule that treats an unknown revocation as “not revoked,” or a missing territory as “all territories,” is not monotone. Later evidence can turn its allow into a violation. Models may propose candidate clauses for a person to confirm. They may not set any atom to true.

4. One exclusive right, one reservation

An exclusive grant consumes capacity. The cells of its scope become unavailable to every other grantee. If exclusivity lives inside a bridged token, a chain reorganization or a replayed message can leave two live copies of the same exclusive right. ISP puts capacity in a reservation ledger keyed by the canonical work identifier. Chain representations are derived views. A token moving does not release the right. Release is an explicit act, and it must reach every destination before the hold-down expires.

The safety claim has three assumptions. The reservation ledger for a work is linearizable, so check-and-insert is atomic. A destination issues at most one representation per nonce and accepts only proofs signed by that ledger. Release reaches every destination within a known bound, and the hold-down is at least that long. Under those assumptions, two live exclusive representations held by different grantees never cover the same cell.

If two coordinators accept reservations during a partition, safety fails. That is the familiar limit on combining consistency and availability. ISP marks the affected grants pending reconciliation and stops issuing new exclusive grants, rather than inventing availability. Non-exclusive grants need no reservation. A minimum deployment is one anchoring chain plus signed off-chain license attestations, not a two-chain bridge.

Assurance of identity is not assurance of rights

• A0. A display name only.
• A1. Control of a key or passkey. Not a civil identity.
• A2. An independent credential for a role or a legal identity in a defined context.
• A3. A documentary chain of title and mandate, checked for the exact right and jurisdiction, with an expiry.

A high identity level does not establish a rights claim. Identity and rights are checked by different oracle families. A delegation names the principal, the delegate, the permitted actions, the assets, the territories, the maximum exposure, the expiry, and the revocation endpoint. Preparing an offer is not the same act as signing an exclusive license.

5. An attestation is not a verdict

The CRO (Cross-Reference Oracle) is a federated attestation service. For each request it accepts a bounded question, with a stated purpose and a lawful basis for the corpus it may search. It gathers authorized evidence, applies a method suited to the question, and issues a signed report that discloses uncertainty, coverage, and conflicts. The report can be contested and corrected.

The oracle may not block a creation declaration, force a creator to add suggested references, publish an unreviewed plagiarism flag, unmask a pseudonym by stylometry without consent and authority, or train on restricted material. Language models may help search, extract, and explain. They do not authenticate a source, prove authorship, assess enforceability, or rule on infringement.

Evaluation moves through five tiers, and a report must not collapse them into one score. Tier 0 checks bytes, signatures, and content bindings. Tier 1 checks that sources and credentials were authentic at the time of the event. Tier 2 retrieves candidates. Tier 3 is statistical or semantic inference. Tier 4 is independent human review, required for an adverse or high-stakes finding.

Assurance is a vector, not a badge. The dimensions are integrity, issuer, independence, legal review, model, and finality. Combining two claims keeps the weaker value on each dimension. A verified file hash cannot be drawn as a checkmark that says the physical painting is authentic. Three operators who share a model, a corpus, or an index are not three independent findings. A high-stakes quorum is counted by independent components, not by headcount.

A similarity score is a ranking signal. It is not a probability of copying unless it has been calibrated for that question on representative data. Style, genre, and topic are down-weighted as evidence of copying. A composition and a sound recording are different objects. So are the pixels of a painting and the physical painting. A “no match” means “not found in this authorized corpus, at this index version.” It does not mean the work is original.

6. What the reference model did

The authorization rule and the reservation algorithm were implemented in about two hundred lines of dependency-free Python and checked by randomized testing. These experiments test the specification’s logic. They are not measurements of a deployed network. The baseline rates depend on the chosen parameters.

Authorization under missing evidence

Each instance draws a fully specified ground truth, then hides fields independently with probability p. The closed-world baseline reads unknown authority as valid, unknown revocation and conflict as absent, and an unknown scope field as unrestricted. Forty thousand instances were run at each level of p, two hundred thousand in total.

ISP produced no reversals, and therefore no false allow, at any level of missing evidence. The price of that safety is abstention. As evidence thins, more decisions become indeterminate and go to a person. That trade-off is the intended one for exclusive and monetized grants. The operational value of the rule depends on complete evidence — closure attestations and checked mandates — not on the decision procedure alone.

Exclusivity across two chains

Five hundred randomized schedules of four hundred steps compared five configurations. Sellers issued exclusive grant intents over a twenty-four-cell scope, on one chain or the other, with relay delay, replay, reorganization of a source-chain lock, and ordinary releases.

While the assumptions hold, there are no violations. Shortening the hold-down produces rare, brief doubles at the moment of release, which is the race the hold-down exists to prevent. Partitioned coordinators are as unsafe as no coordination. Cross-chain exclusivity reduces to one linearizable reservation point per work and a bounded release hold-down. Bridge engineering does not substitute for either.

7. What this paper does not claim

The retrieval hypotheses for the oracle are falsifiable and have not been run. The preregistered agenda compares multi-evidence, localized retrieval with exact-hash-only and model-only similarity, and it asks whether a multi-dimensional assurance display reduces false trust compared with a single badge. Targets in that agenda are proposals to test. They are not achieved results.

ISP states its guarantees narrowly. Integrity holds when the digest and signature suite verifies. A timestamp is an observation time, not proof that a work was created first. A signature means a named signer made a statement, not that the statement is true. License evidence can be checked. It is not thereby complete. A chain transfer proves chain settlement, not that fiat money arrived. A custody record can be attested, and the physical object can still be swapped.

The components are research proposals. They are not ratified standards. Nothing in the paper is legal advice. No hash, token, or attestation creates copyright, priority, trademark rights, or legal originality.