Example

Carry a boundary without carrying its history

See a declared boundary travel to three fake services as a minimal payload, one applied exactly, one refused as too broad, and one unconfirmed.

Protection that travels is a promise about a service the person may never see again. The chapter’s mechanism is to report the journey honestly, stage by stage, and never to let a service’s limitation enlarge the instruction.

Run it

git clone https://github.com/ernanhughes/project-language.git
cd project-language
git checkout 329660f679a5a87831f91fe1430c20ac9360dda8
npm ci
npm run example:personal -- ch26

The services are fakes. The example is cumulative and the model is a scripted stand-in.

Expected outcome

Three services, three different outcomes, and six stages reported separately each time:

...
Chapter 26: the boundary travels without its history, and each service reports six separate stages
  apply video-service: FAITHFUL (fit exact)
    declared:yes carried:yes received:yes supported:yes enforced:yes verified:not_attempted
  apply news-service: REFORMULATE (fit broader_only)
    declared:yes carried:yes received:yes supported:no enforced:not_attempted verified:not_attempted
    This service cannot apply the requested boundary: hide-all-research would also hide other material (research). A different rule for this service would be a new decision with its own scope; the original was not widened.
  apply offline-service: UNCONFIRMED
    declared:yes carried:unknown received:not_attempted supported:not_attempted enforced:not_attempted verified:not_attempted

Verification is its own act, and nothing earlier implies it:

...
verify video-service: yes — setting read back and checked (verification vr_36ca2dacad4bd7ba8d7b29fbefaf7929); content matching not independently checked

And revocation travels the same path as creation:

...
  revoke video-service: REVOKED_APPLIED
    declared:yes carried:yes received:yes supported:yes enforced:yes verified:not_attempted

The stages, and the minimal payload

Six stages, and they are not the same claim. The boundary travels as a minimal payload: the rule, its limits and the authority reference — no observations, no inferences, no history.

export const STAGES = ["declared", "carried", "received", "supported", "enforced", "verified"] as const;
export type Stage = (typeof STAGES)[number];
export type StageState = "yes" | "no" | "unknown" | "not_attempted";
/** The minimum a destination needs: the rule, its limits and the authority reference. No observations, inferences or history. */
export function minimalPayload(b: PortableBoundary): BoundaryPayload {
  return { boundary_id: b.id, version: b.version, authority_ref: b.authority_ref!, effect: b.effect, preserve: [...b.preserve], override: b.override, end: b.end, persistence: b.persistence };
}

A control that would hide more than was asked is never chosen:

/**
 * Which of the service's controls, if any, implements the requested boundary faithfully? A control that also hides search,
 * or another category, EXCEEDS the instruction and is never chosen. A control that covers only some of the requested surfaces is
 * a faithful partial application, provided it supports the override, the end conditions and the learning limit.
 */
export function fitControl(b: PortableBoundary, controls: readonly ServiceControl[]): Fit {
  const want = new Set(b.effect.surfaces);
  const needsSearch = b.preserve.includes("search");
  let broader: string | null = null; let best: Fit | null = null;
  for (const c of controls) {
    if (c.hides.category !== b.effect.category || (needsSearch && c.hides.includes_search)) { broader = `${c.id} would also hide ${c.hides.category !== b.effect.category ? `other material (${c.hides.category})` : "search results"}`; continue; }

Mechanism and limitations

Documented: the six stages, the minimal payload and the “never exceed the instruction” rule are in core/personal/src/portable.ts.

Observed: the run above. The video service applied the boundary exactly and then passed a readback check; the news service could only offer a broader control, so the boundary was not applied there and the original was not widened; the offline service was unreachable and the result was UNCONFIRMED rather than a pass. Revocation used the same path.

Not shown. Only fake services exist here, and a setting read back is not proof of future behaviour. “Declared, carried, received, supported, enforced and verified” are six different claims, and the run shows that the code keeps them apart — it does not show that any real service honours a boundary. A boundary’s removal at each service is a separate act from the boundary’s expiry. Physical erasure is not possible: the durable backend retracts and keeps a tombstone.

Canonical source and the portable boundary module .

Understand this example

Copy this prompt into your AI tool. No code runs here.

Apply this example

Copy this prompt into your AI tool. No code runs here.