TL API Specification Suite: The "Ternary Logic" (TL) Framework

Before diving into the specification files, we recommend reading I_Read_API_Documents_So_You_Don’t_Have_To.md — a companion narrative that restores the constitutional thread inside schema constraints and ABI function signatures. Engineers, auditors, and policymakers who encounter a 14-file API specification suite can easily lose that thread. This companion piece restores it.

You can also listen to the full AI-generated deep-research interview: Preventing Financial Collapse With Ternary Hardware

The TL API is not a conventional REST interface. It is the software expression of a constitutional enforcement architecture: a sovereign governance coprocessor that operates in parallel with a binary inference engine and holds absolute authority over whether any proposed action crosses the threshold into execution.

The binary system proposes. The ternary system decides. The Permission Token is the only key that opens the actuation gate. Without a cryptographically valid token issued by the Audit Lane, no proposed State +1 action may execute. This is the No Log = No Action (NL=NA) iron law, enforced simultaneously at the schema layer, the API contract layer, the on-chain ABI layer, and the EIP-712 signing layer. There is no software path around it in a conforming implementation.

The Epistemic Hold (State 0) is the most constitutionally significant state in the framework. It is not a null. It is not an error. It is not a timeout. It is a first-class governance state of mandatory hesitation that holds execution pending verified completion of legitimate process. It cannot be argued away. It can only be resolved by a human reviewer or a Tri-Cameral custodian quorum with a terminal state of +1 or -1. State 0 is constitutionally invalid as a resolution target.

"Pause when truth is uncertain" → State 0 (Epistemic Hold) "Refuse when harm is clear" → State -1 (Refuse) "Proceed where truth is" → State +1 (Proceed)

The entire API is organized around two structurally distinct lanes, each with its own security scheme, latency envelope, and constitutional function.

Inference Lane: The binary inference engine submits proposed decision vectors via POST /decisions and receives a TLResult. A TLResult returning State +1 from the Inference Lane does not authorize actuation. The Inference Lane cannot issue Permission Tokens. Security scheme: TLGovernanceJWT. This separation is enforced at the schema level by the StateEnvelope if/then constraint in tl_schema.json.

Audit Lane: The ternary governance layer receives the complete TGLF record via POST /audit-logs, performs its own independent evaluation, and - only when the audit lane confirms log completion and Merkle anchoring - issues a Permission Token. The token carries laneOrigin: const "AUDIT_LANE". Security schemes: HSMSignedJWT and NLNAAuditToken. No token, no execution. No log, no token.

NL=NA is enforced at five independent layers. Bypassing one layer does not bypass the others.

TL_Ledger_Core.sol and ITL_Validator.sol are the on-chain enforcement layer. Even if a Permission Token were constructed that passed all off-chain schema validations, its registration on-chain would fail unless the authorizing TGLF record is already anchored in a previously committed Merkle root. The NLNAViolation custom error is the final constitutional backstop.

Every object in this specification carries a currentState field drawn from exactly three values: +1, 0, -1. These are signed integers, not enumerations of convenience. The StateEnvelope schema enforces the constitutional consequence of each value through if/then constraints: State +1 requires a permissionToken; States 0 and -1 prohibit one.

Every governance decision generates a Ternary Governance Log Format (TGLF) record. The discriminator on currentState routes to one of three forensic log variants. TGLF_StateP1 carries the Permission Token, the Goukassian Principle Block, and the Merkle anchoring proof. TGLF_State0 carries the uncertainty quantification, the deliberation matrix, and the Epistemic Hold escalation record. TGLF_StateNeg1 carries the license violation record, the threat vector analysis, and the chain of custody. Every variant requires committedAt before the Audit Lane releases any authorization. The log precedes the action. Always.

State-mutating operations require TriCameralApproval. The Technical Council (9 members) holds proposal rights. The Stewardship Custodians (11 members) hold binding veto authority - vetoExercised: true blocks constitutionally. The Smart Contract Treasury executes automatically with no admin key and no human override path. Emergency overrides are logged before execution. forcedState enum is limited to [-1, 0]. Forced +1 is constitutionally blocked and will revert UnauthorizedOverride.

POST /emergency/override is the break-glass surface. Three override types: BREAK_GLASS_SHUTDOWN, KILL_SWITCH, FORCED_STATE_TRANSITION. NL=NA applies without exception. The audit log is written before the state change fires. This ordering is constitutional.

The canonical, machine-parseable API contract. Defines all 40 endpoints across 12 path groups, 5 security schemes, request and response schemas, 2 webhook callbacks, and the dual-lane architectural separation. Import directly into Swagger UI, Postman, or any OpenAPI-compliant code generator.

The canonical schema bundle for all data types in the framework. 22 schemas, all enforcing unevaluatedProperties: false. Contains StateEnvelope, PermissionToken, all three TGLF variants, GoukassianPrincipleBlock, EscrowRecord, SignatureBlock, LanternStatus, AuditProof, TriCameralApproval, EKRRecord, SuccessionDeclaration, TLProblemDetail, and all primitives. The if/then constraint on StateEnvelope is the schema-level enforcement of NL=NA.

Application Binary Interface definitions for TL_Ledger_Core.sol and ITL_Validator.sol. Covers anchorMerkleRoot, registerPermissionToken, verifyPermissionToken, verifyMerkleInclusion, activateEpistemicHoldSystemWide, resolveEpistemicHoldSystemWide, executeEmergencyOverride, revokePermissionToken, mandate verification functions, and all custom errors. No Solidity source code. The on-chain layer is the final arbiter of token validity.

Get Lev Goukassian’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

EIP-712 domain separator and typed data schema definitions for GovernanceTraceLog, PermissionToken, EmergencyOverride, and GoukassianSignatureAttestation. Enables off-chain structured data signing with on-chain verifiability. Binds signatures to a specific contract, chain, and monograph version, preventing cross-domain and cross-version replay attacks. canonicalArtifactNameHashes records keccak256 pre-images for all three Goukassian Principle artifact names.

The canonical prose companion to tl_openapi.yaml and tl_schema.json. 14 sections covering the Goukassian Vow as foundational architecture, the Dual-Lane system, NL=NA five-layer enforcement, Epistemic Hold operationalization, the Goukassian Principle artifacts as API resources, all Eight Pillars mapped to API paths, the Regulatory Nexus (Basel III, FATF, IOSCO, GDPR, Paris Agreement), Domain Evaluation endpoints, the complete auditor verification workflow, DITL hardware interface, EKR and GDPR cryptographic erasure, error taxonomy, and trace propagation. Read this before reading the machine-readable files.

Maps every OpenAPI path and every JSON Schema definition to its Monograph section, TL Pillar, Regulatory Nexus, Implementation Status (SHIPPING / BETA / FUTURE), and Pillar Interactions. Includes NL=NA five-layer checklist, Epistemic Hold integrity checkpoints, Goukassian Principle artifact name audit, implementation gap summary, and dangling reference audit. Sufficient for auditor verification without reading implementation code.

Explicit catalog of six features that are constitutionally desirable but not yet shipping due to named Section X constraints: real-time per-trade blockchain anchoring (throughput asymmetry), Post-Quantum Cryptography signature migration (SLH-DSA-SHAKE-128s and ML-KEM-1024, pending HSM readiness), full DITL/MT hardware deployment (pending TSMC N2 production silicon), sub-300ms cross-jurisdiction custodian quorum (network physics), full GDPR Article 17 native compliance (Erasure Paradox: three residual sub-gaps), and real-time cross-border Basel III monitoring at global volume. Every FUTURE feature has a defined SHIPPING mitigation already present in the specification.

Full AI-generated deep-research interview covering the relationship between ternary hardware, financial collapse prevention, and the TL governance architecture.

I — Epistemic Hold

EpistemicHold

POST /decisions, GET/PATCH /epistemic-hold/escalations/*, POST /gateway/lane-assignment

SHIPPING

VI — Sustainable Capital Allocation

SustainableCapitalAllocationMandate

POST /evaluate/policy, POST /evaluate/supply-chain, GET /audit/compliance/attestation

SHIPPING

VIII — Anchors

GET /audit/verifications/merkle/{root}, GET /audit/verifications/inclusion/{logId}, POST /regulator/evidence-export

SHIPPING (per-trade real-time anchoring: FUTURE)

This specification operationalizes international financial and AI governance standards through machine-verifiable enforcement rather than policy declaration:

• Basel III: LCR >= 1.0, NSFR >= 1.0, capital adequacy, counterparty exposure, stress testing — enforced at POST /evaluate/trade, GET /regulator/basel-iii/attestation, and RegulatoryContext.baselIii schema fields.
• FATF: Recommendations 6 (targeted financial sanctions), 10, 11 (record keeping), 20 (SAR), 29 (financial intelligence) — enforced at POST /evaluate/trade, POST /regulator/fatf/compliance-export, and RegulatoryFlags.fatfFlags schema fields.
• IOSCO: Principles 34–38 (market integrity: layering, spoofing, wash trading, cross-market manipulation) — enforced at POST /evaluate/trade, GET /regulator/iosco/principle-mapping, and RegulatoryFlags.ioscoFlags schema fields.
• GDPR Article 17: The Erasure Paradox is mitigated through cryptographic erasure via HKDF-SHA3–256 key hierarchy (EKR workflow). Three residual sub-gaps documented in Future-Blocked_Appendix.md.
• Paris Agreement: Carbon footprint verification, green bond eligibility, ESG scoring — enforced at POST /evaluate/policy, POST /evaluate/supply-chain, and RegulatoryContext.parisAgreement schema fields.

This specification is anchored to the TL framework’s constitutional enforcement chain. The PermissionToken.laneOrigin: const "AUDIT_LANE" constraint means no token can claim to originate from the Inference Lane. The unevaluatedProperties: false constraint throughout tl_schema.json means no undeclared field can introduce ambiguity into the enforcement logic. The on-chain NLNAViolation custom error means the blockchain layer reverts any token registration attempt that lacks a previously anchored log.

This work is licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0).

Originally published at https://github.com.