Substrate observation

What it is

A state-claim is any assertion about what is true right now: a route exists, a payment settled, a category is consented. Under substrate observation, no claim travels without the observation it was derived from. Each one names where it came from: a code read, a log entry, an endpoint response, a file timestamp. A reader can then re-derive it. A claim that carries no such source is not authoritative; it stays an unverified inference until someone observes the substrate again.

The practical shape is a claim paired with its origin, like the two below. The point is not the syntax; it is that the source is always carried, never assumed.

"verify_identity is live"          [observed: code read at the route handler]
"this rate limit is 60/min"        [observed: config value in the running service]
"this category is not consented"   [observed: live consent check returned 403]

The authority order is fixed: running code, a database, or a live endpoint outranks a generated artefact, which outranks a hand-maintained document. A document may be cited only after it has been reconciled against the executing source it claims to describe, and it can never be the primary reference for a value the system actually executes.

No canonical narrative

Many systems try to keep concurrent actors in step by electing a single source that everyone trusts: one service holds the authoritative story, and every other component reads from it. ~alter does not. When several agents act at once, naming any one of them the canonical winner is exactly the failure mode to avoid. It lets the actors quietly converge on a shared story that has drifted from reality.

Instead, each observer reads the substrates it cares about and merges what it sees for itself. There is no reconcile step that picks a winner from conflicting observations; a contradiction is a signal to go and observe again, not to defer to whichever source spoke last. For an integrator this means a query result is a reading taken at a moment, not a verdict handed down. A stale reading is corrected by re-reading the substrate, not by appealing to a cached answer.

Inferred, not declared

The same instinct runs through how ~alter treats identity itself. Identity on the rails is inferred from what a person does, not taken from what they declare about themselves. A self-asserted claim is a description; the activity that produced it is the substrate. The identity surface you read over MCP is built from observed signal, and every trait it carries records how it was derived, so a reader can weigh it rather than take it on faith.

No language model reads you. The inference is classical and auditable: observed signals map to recorded traits through fixed, published logic, not a generative model’s judgement. The agents that query your identity bring their own model; the reading itself uses none. If a generative model ever sits in the path that decides who you are, the protocol is broken, assume so until you can verify otherwise.

For an integrator this closes the loop. The same rule that says “observe the substrate, do not trust the narrative” for system state is the rule that says “read what a person did, do not take their word for it” for identity. Provenance travels with both; neither has a canonical narrator. The consent model decides what inferred identity you are allowed to read, and the x402 layer ensures the person earns when you read it.