signatio (named mandatum until 2026-09-24) was built as ontoref's authority: custody of the key, verification of a person's signature, and authorization of who may do what, around the act of signing. Its contract lived in ontoref (code/ontology/schemas/authority.ncl) — the wire protocol together with ontoref's client side and the vocabulary of ontoref's Work Orders — and the core hardcoded that vocabulary: HUMAN_ONLY and the other actions, the Act enum, the Cedar actions, the scope rules of VerifySignature.
Measured 2026-09-23: nothing let a project install it, connect to it or prove the connection, and a second consumer could only use it by editing its core, because the core spoke ontoref's Work Orders. Measured 2026-09-24: what signatio does is how ontoref's domain `gov` exercises governance — governed-delivery, one of gov's modes, asks it to Authorize and Record every stage — and ontoref's ADR-122 (revised that day) withdraws the domain `authority` the protocol was first provided as: the capability is gov's, and its implementation is a requirement gov declares, optional.
SIGNATIO IS THE SIGNING CAPABILITY GOV EXERCISES. ontoref gives a governed project the domain `gov`; signatio is the implementation gov declares for signing — the requirement `signatio`, required = false (ontoref ADR-122). A project uses it by choice: it installs the pack and declares the provider in its own config (`signauthz.provider.root_cmd = "signatio-boot root"`); nothing installs it for the project, and no project's protocol requires it. Without it, only the stages that move a Work Order with a policy are refused, saying why.
THE PROTOCOL IS SIGNATIO'S. The wire contract is signatio's, entry `code/schemas/protocol.ncl`, shipped in the pack root that `signatio-boot root` prints. Consumers import it from the provider they declare, at resolution time; none copies it, and there is no domain through which it is discovered. What each consumer keeps is its client side: for ontoref, its client config, its pins and the cut rules, its declared registration and its network oracle.
A GENERIC CORE AND A PROFILE PER CONSUMER. The core states what holds for every consumer: a Person is the only subject that may do an act the consumer declares human; a person's signature over bytes is verified once and attested with the roles held among those asked; a signed statement has one canonical form; a role may be reserved; every answer, entry and notice is signed in its own domain. What an action, an act, a statement or a scope key IS comes from the consumer's PROFILE — { actions, human_only, acts, op_of_act, statement contract, reserved roles, scope keys } — which the consumer declares and registers with the authority; the core applies it as a contract. ontoref publishes the profile `ontoref-work-orders`. signatio's core names no consumer's vocabulary.
THREE MECHANISMS AROUND THE SIGN, EACH ITS OWN CRATE. Custody: signatio-custody and signatio-signer, the only process that loads the key, on a local socket, for one allowed uid. Verify: signatio-verify, public-key-only, linking no library able to sign. Attest: signatio-attest, the core — a person's signature verified once, the attestation issued, every answer sealed in its domain, the chain kept. Authorization — policies, grants, human-only acts, tokens — is evaluated by the service, signatiod, which holds no key.
A CONNECTION THAT CAN BE IMPLEMENTED AND VERIFIED. signatio declares the interface a project or service implements to use it (`code/schemas/connection.ncl`): what installing it takes, what an installed signatio hands over (endpoint, CA, the authority's public key and its id and scheme, an administrator's client — its proof as a command or a path, never the secret, and root_cmd), and what a consumer declares (its profile, its registration with the out-of-band channel, its clients, where it pins keys). A reference consumer written with standard tools only (`code/examples/consumer/`) implements it, and a verifier checks a consumer's declaration against the contract and against the running authority.
AN OPTIONAL PACK WITH ITS OWN LAUNCHER. signatio ships as a pack: its binaries, its schemas (the pack root) and a launcher, signatio-boot, that owns its units — layout, user services, status, removal — as ontoref's daemon has one (ontoref ADR-118).
SIGNATIO IS NOT GOVERNED BY ITSELF. A Work Order that declares a ratification policy runs its stages on an authority and is refused while the authority is down. For signatio's own Work Orders that is circular: a broken signatio would block the very order that repairs it. So signatio's governance level is OFFLINE (ontoref's OfflineLevel: `code/.governance/authority/offline.ncl`, authority 'None) and registered with no authority: its Work Orders carry only the minimal policy an offline level admits — one 'Mandatory party holding the veto, under 'Consent — ratified by the principal's detached signature against `code/.governance/witness.pub`, verifiable offline. Should that level ever move to ratification through an authority, it will be another instance, never the one the order changes.
The authority's wire contract is signatio's, at code/schemas/protocol.ncl
signatio's core and service name no consumer's actions or acts outside their tests
The connection interface and its reference consumer exist in signatio
signatio's pack manifest provides no domain
signatio's governance level is offline (authority 'None) and registered with no authority
A domain `authority` in ontoref, provided by signatio and discovered through its manifest
Rejected: The capability is gov's exercise, not a domain beside gov; the name collides with the AUTHORITY side every domain relation has; and discovery needed a rule for two providers that disagree (ontoref ADR-122, revised).
Keep the protocol in ontoref and let other consumers import ontoref's contract
Rejected: The contract belongs to whoever answers it: signatio would check what it emits against a copy it does not own, and ontoref's Work Order vocabulary would stay the only one the core speaks.
Move the whole of authority.ncl, Work Order vocabulary included, to signatio
Rejected: The vocabulary is ontoref's; moving it would make signatio's core ontoref-shaped and force a second consumer to edit it.
Copy the protocol into each consumer
Rejected: A copy is a fork with no upstream; it answers from a stale contract without anyone noticing.
Govern signatio's own Work Orders by signatio
Rejected: Circular: an outage or a defect of signatio would refuse the stages of the order that fixes it.
An installer inside ontoref's install
Rejected: ontoref keeps custody and signing outside it and imposes no mechanism (its ADR-122); an installer there would bind ontoref to one producer and make the optional capability a default.