Public Structure, Continuation Identity,
and IS-from-WAS Verification

This paper defines Alethegraphy, a class of systems in which trust and identity arise from public generative structure and historical continuation constraints, rather than from secrecy, entropy, or one-way cryptographic primitives. The primary primitives are:

1. Alethigraphs: deterministic public universes whose structure is intended to be traversed.
2. Alethion: a continuation-based identity primitive defined by the persistence of a private traversal dynamic across time and across Alethigraphs.

Alethegraphy implements an IS-from-WAS ontology: verification is the inference of what must have been true historically for an observed artifact to exist as claimed. Under this ontology, many conventional cryptographic questions (preimage resistance, indistinguishability, key compromise collapse) are either irrelevant or apply only to surrounding transport layers, not to the primitive itself.

Security in Alethion systems is formalized as continuation safety: an adversary may generate plausible local artifacts, but cannot hijack an established identity frontier; at most they can create dead-end forks that fail to extend the accepted continuation. The paper provides a threat model, formal definitions, and deployment guidance, including availability considerations (e.g., onboarding cost control) distinct from authenticity safety.

Modern trust systems typically reduce identity to possession of a secret:

• private keys (signatures),
• shared secrets (MACs),
• randomness-derived nonces and challenges,
• one-way hashes as commitment anchors.

These primitives are powerful, but they impose a specific ontology:

• Identity is stored (as a key, a hash, or a record).
• Truth is hidden (verification depends on secrets or trapdoors).
• Compromise collapses identity (secret leakage is catastrophic).
• Artifacts are opaque (verification is detached from provenance structure).

Alethegraphy proposes a different ontology:

Truth can be public and still binding—if binding arises from history and continuation rather than secrecy.

In Alethegraphy, the artifact is not a proof of possession of a secret. It is evidence of persistent interaction with an irreducible public structure.

2.1 Definition

Alethegraphy is the study and engineering of systems where validity, identity, and authenticity arise from:

• public structure (no hidden verification inputs),
• generative history (structure is “scarred” by its construction),
• constraint satisfaction (verification is structural),
• continuation (identity is a trajectory, not an object).

---

2.2 IS-from-WAS

Traditional systems ask:

“Given this input, did it produce this output?”

Alethegraphy asks:

“Given this observed structure, what must have been the case for it to exist as claimed?”

This is IS-from-WAS: the current artifact is interpreted as an implication of prior state and allowable dynamics.

---

2.3 What Alethegraphy Is Not

Alethegraphy is not:

• encryption,
• anonymity by itself,
• cryptography pretending not to be cryptography,
• “security through obscurity.”

Alethegraphy is:

• public,
• structural,
• history-bound,
• continuation-verified.

3.1 Formal Object

An Alethigraph \(A\) is defined by:

• a traversal domain \(D_A\) (e.g., grid, manifold, graph, torus),
• a deterministic evaluation function:

and a neighborhood relation \( \mathcal{N}_A(p) \subset D_A \) defining admissible moves.

Alethigraphs are intended to be:

• publicly reproducible,
• structurally rich (nontrivial gradients and irregularities),
• traversal-supporting (local information exists),
• resistant to simplification (construction leaves “scars”).

Key point: An Alethigraph is not a message. It is a public environment.

4.1 Informal Definition

An Alethion is a continuation identity primitive:

An Alethion is the equivalence class of all trails that remain mutually consistent under a private traversal dynamic across time (and optionally across Alethigraphs).

Alethion is not:

• an identifier string,
• a key,
• a signature,
• a stored secret.

Alethion identity exists only as:

• the ability to keep producing valid continuations from an accepted frontier,
• under deterministic rules bound to public structure.

---

4.2 Private Traversal Dynamic

Let \( \tau \) be a deterministic selector family with a private parameter \(K\) (not published):

Properties:

• deterministic,
• path-dependent,
• universe-bound,
• uses local revealed structure (neighborhood values),
• avoids cryptographic primitives (not required for the ontology).

A trail is a sequence \( (p_0, p_1, \dots, p_L) \) such that:

• \( p_{i+1} \in \mathcal{N}_A(p_i) \)
• \( p_{i+1} \) is chosen by \( \tau \) using local structure.

An Alethion Part is a projection:

Where:

• \(A_{id}\): Alethigraph identity,
• \(\Pi\): public projection metadata (protocol, purpose, challenge tag, sample count, neighborhood id),
• \(S\): steps (positions),
• \(V\): revealed values along steps,
• \(c_{prev}\): previous continuity frontier.

Each Part is weak in isolation by design. Its security does not come from “being unforgeable as a single object,” but from being extendable only by the same traversal dynamic.

6.1 Online Verification

A verifier maintains per-identity (or per-track) state:

• an expected continuity frontier \(F_t\),
• a bounded set of traversal-parameter candidates consistent so far (or an equivalent constraint representation).

A proposed Part is acceptable if:

1. It starts at the current frontier.
2. Its steps are legal neighborhood moves.
3. Its revealed values match the public Alethigraph exactly.
4. There exists at least one traversal parameter \(K\) consistent with the Part and all previously accepted Parts.

---

6.2 Frontier-Based Safety

An adversary cannot overwrite an identity frontier without producing a valid continuation consistent with the constrained traversal dynamic.

This does not require delayed accumulation to prevent hijack. Accumulation increases confidence, but continuation provides immediate protection against takeover.

---

6.3 Fork Semantics

If an adversary submits an artifact that is locally plausible but does not extend the accepted frontier, it is a fork:

• forks may exist,
• forks do not merge automatically,
• forks do not overwrite the accepted identity,
• forks are dead ends relative to the verifier’s frontier.

Forking is not identity theft; it is noise.

7.1 Security Goal (Continuation Safety)

Alethegraphy does not claim “nobody can generate a plausible Part.” It claims:

Continuation Safety:
Given a verifier that has accepted a frontier \(F_t\) and maintained constraints \(C_t\), an adversary without the private traversal dynamic cannot produce a Part \(P\) that both:

• extends \(F_t\), and
• remains consistent with \(C_t\),

except with probability bounded by the residual ambiguity remaining in \(C_t\).

You can fake a receipt. You can’t fake the next receipt—not after the system has begun constraining the traversal dynamic.

---

7.2 Why “It Looks Insecure” at First

A reviewer trained on cryptographic systems will notice:

• “the traversal parameter is small / enumerable,”
• “verification can brute force candidates,”
• “the universe is public.”

And conclude “it’s broken.”

That conclusion assumes a cryptographic framing:

• the object must be unforgeable in isolation,
• security must be key-based,
• public verifiability implies one-shot authenticity.

Alethion rejects that framing. In Alethion:

• a single Part is intentionally weak,
• identity is defined by continuation, not by a static proof,
• the “secret” is not a signing key but a persistent traversal dynamic,
• the verifier’s state is part of the primitive.

This is not a weakness—it is the defining design choice.

---

7.3 Adversary Capabilities

Assume an attacker can:

• know the entire Alethigraph,
• observe prior Parts,
• submit arbitrary Parts,
• compute freely (no reliance on computational hardness assumptions),
• attempt to enumerate traversal parameters.

Even under these assumptions, they face a core barrier:

They must produce an extending Part consistent with the already constrained traversal dynamics.

As accepted Parts accumulate, the consistent-parameter set shrinks rapidly (often to one or a small bounded set). At that point, forging a continuation becomes equivalent to guessing the remaining ambiguity.

A common objection: “If the traversal parameter space is finite, an attacker can brute force it.”

Response: brute forcing the parameter space is not the same as hijacking identity, because:

1. The verifier does not accept “any valid Part.” It accepts only Parts that extend the established frontier and remain consistent with the constraint state.
2. Enumeration only yields bounded admissibility regions. Even if an attacker finds candidate parameters consistent with a Part, those candidates are immediately pruned by subsequent continuation constraints.
3. Identity is relational and stateful. The “secure object” is not the Part alone; it is the pair:
   \[ (\text{verifier frontier}, \text{constraint state}) \]
   plus the ability to keep extending it.
4. Forks do not override. Enumeration may let an attacker create alternative plausible branches, but the verifier’s accepted branch remains safe.

Thus, the security claim is not “hard to compute,” but “hard to continue once constrained.”

A practical Alethion verifier typically enforces:

• strict matching of:
  • protocol id, purpose, universe id,
  • neighborhood relation id,
  • challenge tag derived from public context,
• step legality (neighborhood moves),
• value correctness (public universe evaluation),
• frontier continuation (Part begins at expected continuity),
• candidate survival narrowing:
  • track maintains a set of traversal parameters still compatible,
  • new Parts filter survivors,
  • expected continuity advances to last step.

This can be implemented without ever storing the traversal parameter itself—only the constraint state.

Alethion distinguishes:

• safety (immediate continuation constraint), from
• confidence (accumulated constraint reducing ambiguity).

A verifier can set policies like:

• accept immediately but treat as low-confidence until \(n\) Parts,
• require \(k\)-of-\(n\) Parts across multiple Alethigraphs for stronger assurance,
• increase samples per Part as risk increases.

Confidence is tunable without changing the ontology.

11.1 Weak Alethigraphs

If the public universe has:

• low variation,
• regular cycles,
• easily predictable neighborhoods,

then different traversal parameters may remain consistent too long. This reduces confidence growth. Mitigation: design Alethigraphs that are structurally rich and “scarred.”

---

11.2 Trivial Selectors

If the selector ignores structure or is nearly deterministic independent of \(K\), then constraint narrowing fails. Mitigation: selectors must be path-dependent and structure-responsive.

---

11.3 Availability vs Authenticity

Aletheion continuation safety is an authenticity property. Separately, onboarding and constraint maintenance have availability costs.

Systems must include:

• admission control for new tracks,
• rate limiting,
• caching,
• bounded memory eviction strategies,
• economic or procedural friction where needed.

These are deployment concerns, not semantic failures.

Alethegraphy supports:

• persistent pseudonyms without stored identifiers,
• anti-spoofing for agent continuity,
• device/instance continuity across resets using public universes,
• “world anchoring” systems where structure provides binding.

It does not inherently provide:

• secrecy,
• confidentiality,
• anonymity (though it can be combined with anonymity systems).

Paradigm	What is stored	Binding source	Failure mode
Cryptography	secret keys	entropy + hardness	key compromise collapses identity
Biometrics	measurements	physical invariants	sensor spoofing / template theft
Alethegraphy	public structure + frontier constraints	continuation through history	weak universes/selectors reduce confidence, not immediate hijack safety

Alethion must not be evaluated as:

• a signature scheme,
• a cryptographic commitment,
• a one-shot authentication token.

Alethion must be evaluated as:

• a continuation identity primitive,
• a constraint-accumulating trajectory system,
• a public-structure trust model.

The correct question is not:

“Can an attacker produce a plausible artifact?”

but:

“Can an attacker extend the accepted frontier consistently over time?”

Alethegraphy replaces secrecy-based binding with history-based binding.

Alethion replaces static identity objects with relational continuation.

The system is secure in the sense it actually claims:

Identity cannot be hijacked once a verifier has established a frontier; adversaries can at most create dead forks.

Truth is public. Identity is relational. History is binding.

Alethigraphs MUST:

1. be deterministic,
2. be publicly reproducible,
3. be structurally rich (nontrivial neighborhoods),
4. support traversal domains and neighborhood relations,
5. resist simplification (scar-producing generation).

---

Selectors MUST:

1. be deterministic,
2. be keyed by a private parameter,
3. be universe-bound,
4. be path-dependent,
5. use public local structure,
6. avoid reliance on cryptographic randomness (not required).