The Learner Autonomaton

A Single Argument in Five Movements

This is a single argument across five movements. It is long because the structural claim — that cognitive infrastructure in higher education must be architectural rather than platform-mediated — is load-bearing across several layers. The first movement names the threat. The second specifies the architecture. The third describes a learner's life inside it. The fourth names the place this is being deliberately planted, what it asks of the institutions that adopt it, and how the standard maintains itself as an open commons. The fifth marks the boundaries of the spec. The anchors below jump to each.

The Thesis

A Learner Autonomaton is a structural answer to a structural problem.

The problem has a specific shape. A small number of centralized providers are converting human cognition into a platform business. Every interaction with their models trains them further. Every query routes through their infrastructure. Every inference produces telemetry they own and the user does not see. The business model requires that users not develop the local capability that would make the platform optional. The design requires that the platform continue to be the first place a thought goes, the only place certain operations can be performed, and the default place knowledge lives.

Cognitive platforming is the name for this arrangement when it becomes the normal substrate on which an entire society thinks.

This arrangement is being installed in universities right now. The currently fashionable form is “AI for education” — free or subsidized subscriptions to commercial chatbots, promoted as access, framed as equity. The actual operation is a recruitment pipeline for lifelong API dependency, installed at the moment when a young adult's cognitive habits are most plastic. The resulting graduate is a platform user, not a learner. Their most valuable years of cognitive development were spent producing training data for someone else's model, in exchange for answers to questions whose provenance they cannot inspect and whose storage they do not control.

The Grove Foundation writes architectural standards that make this outcome structurally impossible in places where the standards are adopted. The Learner Autonomaton is the standard for the educational case. It is released under Creative Commons Attribution 4.0 — not as a branding gesture, but because a published architectural standard is capture-proof in a way that a proprietary architecture never is. Once published, the spec cannot be withdrawn. It cannot be relicensed. It cannot be preempted by any commercial offering. It can only be built on.

A Learner Autonomaton is not a study aid. It is not an AI tutor. It is not a notes application with a chatbot stapled to it. It is a learner's lifelong cognitive scaffolding infrastructure — sovereign, portable, and the learner's alone. It interoperates with the governed compositions a learner moves through across a life: during college with institutional and peer nodes; after graduation with employer, specialty-federation, alumni-consultation, and civic nodes; throughout life with whatever compositions the learner chooses to engage. The architecture is the constant. The compositions are the life phases. The learner carries one sovereign system across all of them and selectively couples it to whatever is in front of them.

The dock is the learner's memory. The routing layer is the learner's attention. The compute landscape is the learner's environment, and it evolves continuously as the learner's life evolves. All three are portable. The learner owns the first two for life and traverses the third as their context changes. The first such environment, where the architecture is built and trained and where the learner's earliest sovereign cognitive work is grounded, is their university — the richest early-life composition the learner will inhabit, and the subject of this specification. The architecture itself extends well beyond it.

The core architectural reframe in this version of the spec, relative to earlier drafts: a Learner Autonomaton does not operate alone, and the educational environment it operates inside is itself a composition of sovereign nodes rather than a platform that hosts the learner. A university running this architecture is a composition of pipeline-compatible sovereign autonomatons — students, faculty, departments, advisors, libraries, writing centers, peer cohorts — each running the same five-stage invariant, each owning their own dock and telemetry, each composing with neighbors through declarative interfaces. The learner's sovereign system interoperates with this composition during the university years and continues interoperating — with employer, specialty-federation, alumni-consultation, and civic compositions — for the rest of the learner's life. The university composition is the richest early-life environment the system will engage; it is the first of many.

And beneath both the platform critique and the composition reframe sits the deepest architectural claim of the specification, the one the rest of the document builds toward:

A cognitive platform extracts the identical artifact — patterns of user judgment — and routes it outward, refining the vendor. The autonomaton pulls the identical artifact inward, refining the learner. The two architectures do the same thing with the same structural object. The architecture is what decides who benefits, and the downstream consequence is what decides where a human life's attention gets spent: on re-litigating what has already been settled, or on reaching for what has not.

Policy responses to cognitive platforming — ethics pledges, terms of service, voluntary safety commitments — cannot reach this distinction. Software does not respond to promises; it executes architecture. If governance is not a structural property of the code, it is not governance — it is a request. The specification that follows is a description of the architecture that does what policy cannot.

This specification is not a thought experiment. The architecture it describes was shaped, over the year preceding publication, by sustained contact with the realities of compliance-heavy regional industries: pharmaceutical manufacturing, regulated banking, insurance underwriting, agricultural-technology operations. These industries cannot afford the YOLO-and-litigate posture that defines Silicon Valley product cycles. They have spent decades pricing the cost of opaque automation in lives, regulatory penalties, defaults, and failed harvests. The structural commitments named in the sections that follow — the inviolable five-stage pipeline, the Red-zone permission absence at the operating-system level, the architectural enforcement of provenance — are not abstractions. They are the design conventions a serious operator in those industries would arrive at independently after enough time spent with the problem. The architecture passed its first stress tests in those rooms. Section 17 specifies why this terroir matters: not as marketing frame, but as design input.

This document describes what a Learner Autonomaton is, how it composes with other autonomatons to form a cognitive ecosystem at institutional scale, what it memorializes for the learner who uses it, what it produces at graduation, what it asks of the institutions that adopt it, what regional conditions made the design possible, and how the standard itself is maintained as an open commons. It is a vision requirements document, not an implementation plan. It is written to be inspectable by a university president, a foundation executive, and a business school dean in a single sitting, because the argument at each of those three addresses is the same argument viewed from a different corner.

The Cognitive Platforming Hazard

Before specifying what a Learner Autonomaton does, this section names precisely what it is defending against. The hazard is not AI. The hazard is a particular commercial architecture for AI delivery.

A cognitive platform exhibits eight architectural properties, all of which arise from the same business-model pressure and all of which compound against the user over time:

These eight properties are not incidental. They are load-bearing for the platform's economics. A cognitive platform cannot choose to operate without them and still satisfy its investors. The result is that every student who spends four undergraduate years immersed in a cognitive platform graduates having unwittingly participated in a structural rearrangement of their own thinking — one whose persistence depends on the platform's continued willingness to host them.

The Learner Autonomaton exists because this arrangement must be refused, not through policy, but through an architecture that makes the eight platform properties structurally impossible. The architecture is specified in the sections that follow.

What the Current Models Get Wrong

Two failing models dominate educational cognition in 2026, and the Learner Autonomaton rejects both.

The first failure: the AI-first model

A student downloads a commercial chatbot, asks it questions for four years, and graduates with a chat history they cannot take with them, a cognition shaped by whatever a commercial vendor trained on, and a dependency that deepens every term. The vendor is the default. The vendor is the substrate. The vendor is the only place cognition happens. Epistemology concentrates at the API endpoint, and the student's own university becomes a setting for the learning rather than a substrate of it. The transcript the student leaves with is orthogonal to the cognition they actually developed. This is cognitive platforming at human scale, and it is the scaled-up version of exactly what the Grove thesis exists to reverse.

The second failure: the traditional credentialing model

A student completes courses, accumulates credit hours, passes assessments designed by an institution, and receives a transcript. The transcript is a record of institutional judgment about the student. It is not a record of the student's demonstrated cognition. An employer reading “STAT 301 — B+” learns what the institution decided about this student in one fifteen-week window. They learn nothing about how this student thinks, what they validated, what they rejected, what they can still apply six years later. The credential is a derivative artifact of institutional process. It goes stale the moment the institution's reputation shifts or the student's career deviates from what the transcript anticipates.

Neither model survives the lifetime arc a learner actually inhabits. The AI vendor will change. The transcript will go stale. Both are disposable.

The Learner Autonomaton is built from a different premise: the durable artifact of a life well-thought is the cognitive architecture itself — a sovereign, portable, auditable, learner-owned system whose provenance chain is inspectable, whose compute substrate is swappable, and whose growth is continuous. The university's job is to be the first and best environment for building that architecture. The architecture is what the learner leaves with.

The Autonomaton Invariants

Before describing what the Learner Autonomaton adds, this section names what is unchanged. These are the architectural non-negotiables of any Autonomaton, inherited whole from GRV-001. A Learner Autonomaton is one instantiation of the Autonomaton pattern. It is not a new pattern. Variance is permitted in configuration and landscape. Compliance is required in pipeline, files, zones, and human approval.

The five-stage pipeline

Telemetry → Recognition → Compilation → Approval → Execution. Every cognitive operation traverses all five stages, in order, every time. No bypasses. No parallel paths. No runtime fallback cascades. One operator input equals one pipeline traversal. At any given moment, a pattern resolves to exactly one execution path.

flowchart LR
  S1["1. Telemetry"] --> S2["2. Recognition"]
  S2 --> S3["3. Compilation"]
  S3 --> S4["4. Approval"]
  S4 --> S5["5. Execution"]
  S4 -.rewrites.-> CFG[("routing.config")]
  CFG -.settled patterns route direct.-> S5
  S5 -.memorialized judgment.-> S1

Two properties make the pipeline compound rather than bottleneck. First, Stage 4 approval does two things at once: it authorizes the immediate execution and it rewrites the routing config so that the next invocation of that same pattern no longer requires the same deliberation. The human approval is amortized across every subsequent use of the pattern. Second, Stage 5 execution produces telemetry that re-enters Stage 1, carrying forward the memorialized judgment rendered at approval — the loop is closed. Because every node in a composition (§5) runs this same loop at its own scale, the approval load distributes across the topology rather than stacking at one gate: a department's zones.schema (§10.6) auto-co-signs pre-declared criteria without a per-mutation human halt; a teacher's Stage 4 governs aggregate pedagogical observation, not individual student work. No single gate carries the system.

The three files

routing.config declares what the system knows how to handle and where. zones.schema declares where human approval is required. telemetry.jsonl records everything that ever happened. The sovereign state of the system lives in three inspectable files the learner owns.

The zone model

Green zone is autonomous. Yellow zone requires the learner's review before acting. Red zone is the learner's alone — the system surfaces context but never composes or submits. The code governing Red actions lacks the permissions to execute them. Not will not. Cannot. Red-zone boundaries are declarative and structurally enforced: the pipeline halts at Red, surfaces full context, and requires synchronous human resolution. The system is physically incapable of crossing a Red boundary on its own.

Stage 4 is always human

The system never approves its own actions. The learner is the sovereignty gate. The Ratchet proposes config mutations. The learner approves them. The system executes what was approved. No runtime promotion. No runtime demotion. Trajectory is approved mutation, never fallback. Stage 4 is also the capture mechanism specified in §9 — the single gate through which all memorialization flows. When an approved mutation would invoke another node's authority — a tier demotion that claims departmental grounding in the credential view, for example — co-sign evaluation under the protocol in §10.6 runs alongside Stage 4. The learner's approval is sufficient for sovereign memorialization; institutional provenance claims require the cited node's declarative authorization in addition.

Config over code

If a non-technical learner — or a non-technical teacher, department chair, or librarian operating their own autonomaton — cannot change the system's behavior by editing a declarative file, the architecture has failed. Behavior lives in config.

Digital Jidoka

When the system cannot confidently classify an intent or cannot safely execute an action, it halts and surfaces its state. Silent failures do not exist. Fallbacks that obscure diagnostic context are forbidden. The system is permitted to propose fixes; it is not permitted to bypass the pipeline.

Composability

The execution output of one Autonomaton feeds directly into the telemetry input of the next. No adapter code. Two autonomatons that have never been coordinated compose correctly, because they share a pipeline shape, not a codebase. This is the property on which the composition thesis in §5 rests.

These invariants are inviolable. They are the same whether the Autonomaton in question is a student's learning node, a compliance system in a pharmaceutical company, a teacher's cohort-observation tool, or a library's institutional retrieval service.

These invariants enable diversity rather than constraining it. Within the invariant pipeline and the three files, every dimension of how an Autonomaton is built is open: storage format, retrieval mechanism, model orchestration, attestation tooling, market integration, user interface, the substrate's own internal organization. Many Autonomatons will exist. Many approaches to local context capture, to ratchet mechanics, to attestation routing, to federation participation will be built in parallel. The Foundation does not specify which approaches; it specifies what makes them all Autonomatons. Conformance enables interoperability without requiring uniformity, which is the precondition for the substrate value to compound across an ecosystem rather than calcify inside a single implementation. This is an invitation, not a constraint. The Foundation specifies what makes an Autonomaton; what an Autonomaton can be — across product surface, domain specialization, ecosystem role — is properly the work of builders and the markets that form around them.

That the same set of invariants accommodates each of these without modification is itself a design verification — the architecture was pressure-tested across them in parallel, not designed for one and adapted to the others. The mechanisms by which the Foundation maintains compliance against these invariants in an openly published standard are specified in §20.

The Composition Thesis

The central architectural insight of this version of the spec, and the correction to earlier drafts that treated the Learner Autonomaton as a solitary instrument:

The learner's sovereign system participates in this topology during the university years as it will later participate in employer, specialty-federation, and civic topologies — one role inside one composition, with the same architectural shape carrying the learner across every subsequent composition the learner enters. The institution's architecture is the composition. Nothing about the learning experience requires a central platform, a central orchestrator, or a central authority mediating between nodes. What it requires is that every node run the same invariant pipeline and expose the same composition interfaces.

This is not a theoretical property. It follows directly from the Autonomaton composability guarantee. The execution output of one Autonomaton is already structured telemetry. The telemetry input of another Autonomaton already expects structured telemetry. When two autonomatons share a pipeline shape, they compose by default.

The consequence for institutional design is substantial. A university that adopts the Autonomaton pattern is not standing up one product for students and a separate product for faculty and a third separate product for advising. It is populating its institutional life with sovereign nodes that speak the same pipeline language. A student's node can consult a department's node because the consultation is just pipeline-to-pipeline composition. A teacher's node can observe cohort patterns across student telemetry — within the consent boundaries those students have specified in their own zone schemas — because the telemetry is structured and the zone schemas are inspectable.

The four-year learning experience, under this architecture, is not a series of interactions with an AI tool. It is four years of operating as a sovereign cognitive node inside a rich federation of other sovereign cognitive nodes. That experience is itself a credential: the graduate carries out of the institution not only a learned vocabulary of cognitive work, but a learned vocabulary of how to operate inside cognitive ecosystems. The latter turns out to be the more valuable asset, because it is the skill that generalizes to every professional environment the graduate will subsequently inhabit.

The rest of this specification operates on this premise. Every later section — the node taxonomy, the compute landscape, the memorialization mechanism, the credential output, the institutional preconditions, the regional terroir that shaped the design, the Foundation's stewardship of the open standard — is an implication of the composition thesis. What is true for the university topology is true for any composition of pipeline-compatible nodes; the learning case is one application of a property the atomic unit carries everywhere it is deployed.

The Node Taxonomy

A university running the Autonomaton pattern exposes, over time, a taxonomy of sovereign nodes that together constitute the institutional cognitive substrate. This section specifies the principal node types, each of which runs the same invariant pipeline and composes with the others via the interfaces specified in §10.

This taxonomy is not exhaustive and is not normative for every institution. A research university may populate all seven types; a community college may populate three; a specialized graduate program may add node types not listed here. The spec is not prescriptive about which nodes exist. It is prescriptive about what properties any node must have to participate in the composition.

The Compute Landscape

Having specified the node taxonomy, this section specifies the compute landscape against which each node's router operates. The landscape is the substrate; the nodes are the residents. The two are distinct, and conflating them is a common error in platform-first thinking.

A second distinction matters at least as much. The landscape names the tiers at which inference can run; the substrate that compounds for the learner is something different. The substrate is the learner's owned context — the dock, the routing config, the zone schema, the provenance arc — and it accumulates with the learner regardless of which tier serves which pattern at which moment. The routing layer is how the substrate is built and consulted. The substrate itself is what stays: the durable artifact of the learner's accumulated judgment, indifferent to which compute the next pattern resolves against. The tier diagram below describes the routing layer. The substrate is what the routing layer serves.

A compute landscape is a set of tiers that a node's router can point at. Each tier is characterized by three properties: what it costs, what trust boundary it sits inside, and what kind of work it handles well. The number of tiers is user-defined — a learner's configuration might declare three, five, seven, or more, depending on what the institution exposes and what the learner adds. What matters is the shape of the landscape, not the count.

A reasonably equipped landscape for a university learner might include:

Tier 5 · Commercial apex compute

The most capable frontier reasoning models. Outside the institution's trust boundary. Expensive. Useful when no other tier has sufficient capability for a task. For a mature learner, this tier serves a small minority of work.

Tier 4 · Commercial mid-tier compute

Strong general-purpose models, commercial APIs, outside institutional trust boundary but cheaper than apex. A transitional tier — useful while institutional capacity is still developing, and increasingly displaced as institutional models mature.

Tier 3 · Institutional compute — the tier the ecosystem ignores

Every major research university already runs GPUs at scale and already owns a corpus most commercial models will never see: library holdings, course materials, faculty research, institutional archives, dissertations. Institutional compute is what happens when a university runs open-weight models on its own hardware, grounded via retrieval against its own corpus. It is cheap for the institution — marginal value from depreciating assets. It is private to the learner — data stays inside the institutional trust boundary covered by the same agreements as tuition. It is faithful to the institution's pedagogy — a learner studying at Purdue gets grounding from the corpus that Purdue's faculty produced. The retrieval-augmented capability required here is trivial; Grove's own Atlas has been operating an analogous pattern for months. What is missing is not capability. It is institutional will to expose the interface.

Crucially, “institutional compute” is not a single tier of raw inference. It is the layer where the node taxonomy lives. When a student node consults institutional compute, it is often (implicitly) consulting a department node, a library node, a writing center node, or some combination, each of which is itself an autonomaton. The institutional tier is therefore not homogeneous — it is a composition of sovereign specialist nodes that collectively constitute the institution's cognitive surface.

Tier 2 · Peer / federated compute

Pooled compute shared across a peer federation. A thesis cohort may jointly run a shared institutional-tier model against their pooled literature. A research group may share inference against their collaboratively curated corpus.

Tier 1 · Local compute

A small model on the learner's own machine. Augmented with retrieval against the learner's personal dock. Handles lookups, first drafts, routine synthesis. Private, offline, owned.

Tier 0 · Sovereign deterministic compute

Cached. No inference. The learner's own validated knowledge served from disk at filesystem latency. Cost: zero. Provenance: the learner's own prior pipeline traversals.

These are illustrative tiers. A working institution might configure three; a heavily resourced one might configure seven. A K–12 deployment would configure differently from a graduate program. The landscape is a property of the configuration, not the architecture. What the architecture requires is only that the landscape be declared, that each cognitive pattern resolve to exactly one tier at any given moment, and that movement between tiers happen through approved mutation rather than runtime fallback.

That last property is the one most easily missed and most architecturally consequential. A Learner Autonomaton does not cascade down the landscape at invocation time. The router resolves each pattern deterministically to its current tier assignment. The Ratchet's job is not to catch failures at runtime; it is to propose better tier assignments over time, which the learner approves at Stage 4.

The distinction matters because sovereignty lives in that distinction. A fallback cascade is a system that leaks work outward under pressure. An approved-mutation architecture is a system that pulls work inward through learning.

Data Residency Invariant. The tier numbering is an architectural property, not a descriptive label. Telemetry originates at Tier 0 — the learner's own disk — and moves outward only through Stage-4 approved mutations. Never through runtime fallback. Never through implicit inference. Never through the platform's convenience. A cognitive pattern's tier assignment is, in effect, a declaration of which trust boundaries the learner has consented to cross for that pattern. Lower tier numbers mean stronger sovereignty; the Ratchet's structural direction is always toward lower numbers. The consent is inspectable in the routing config, revocable in the zone schema, and enforced at every pipeline traversal that crosses a boundary.

The Ratchet as Learning Trajectory

The Ratchet is the Autonomaton's mechanism for proposing improvements. In the Learner version, its operation is unchanged — but what it is measuring has a specific name. It is measuring learning.

What the Ratchet is actually doing, beneath the routing-tier movement that the trajectory below illustrates, is migrating validated context inward. Each approved mutation captures a piece of the learner's judgment about what is settled, about what is grounded, about what no longer needs to be re-deliberated, and writes it into the substrate the learner owns. The compute-tier change that follows is downstream of the substrate change, not the other way around. A pattern resolving from institutional tier to sovereign tier is a shorthand for the validated context for this pattern now lives in the learner's own substrate, accessible at filesystem latency, no longer requiring institutional consultation to invoke. The tier movement is the legible evidence; the substrate accumulation is what compounds.

Here is how a single concept moves across the landscape over a semester. Note that the trajectory involves multiple nodes, not just the student's own:

In September, a sophomore encounters regression assumptions for the first time. Her router has no prior mapping for the pattern. Recognition surfaces it as novel. The Flywheel proposes routing it to the statistics department autonomaton, which grounds the concept in Purdue's applied-statistics corpus and returns a structured explanation with full provenance. The student reviews. She approves integration into her dock.

By October, she has encountered the concept several more times — in coursework, in a problem set, in a conversation at the writing center where her capstone draft included a weak discussion of her model's assumptions. The writing center node has flagged the weak discussion; the department node has returned grounded treatment each time she consulted it. Her own dock has been revised by her twice. The Flywheel observes the pattern stabilizing and proposes a config mutation: promote regression_assumptions from department-grounded institutional compute to the challenge-verification stage. She approves. The system generates a Socratic challenge from her dock and her telemetry. She passes. The telemetry logs a challenge-verified event, and the challenge itself carries provenance back to the department node's canonical corpus.

By December, the Flywheel proposes a further mutation: demote regression_assumptions to sovereign compute, with institution-attested provenance carried forward. The pipeline evaluates the department autonomaton's zones.schema against the proposed mutation (§10.6). The pattern's three challenge-verified events, grounded in the canonical corpus, fall squarely inside the department's green-zone auto-co-sign criteria; co-sign issues deterministically without any faculty halt. She approves at Stage 4. The pattern now resolves to a cached answer from her own dock, served at filesystem latency, costing nothing, leaving no trace outside her own machine — and the telemetry entry and the credential view both record purdue-stat-dept-autonomaton as the validating node at institution-attested tier, with the department's co-sign authority version hashed into provenance. When her peer cohort (a statistics study group) asks her to explain homoscedasticity before the final, she does it from her own voice, using her own vocabulary, grounded in provenance she can point to if asked.

Nothing in this trajectory was a runtime fallback. Every tier transition was a proposed config mutation, approved at Stage 4 and — where institutional provenance was claimed — co-signed under the evaluating institution's declared authority (§10.6), then deterministically applied. The telemetry preserves the full arc, including the provenance of every consultation with every institutional node along the way and the co-sign authority version that stood behind each institution-attested event.

That arc is what learning looks like when it is grounded in structure rather than grade. In September the concept required institutional compute from the department node. In December the concept is the learner's own sovereign property, though its provenance still traces back to the institutional grounding. The trajectory is the credential signal. The Ratchet is the mechanism. The sovereignty is the outcome. The institutional grounding — the fact that the learning traces back to Purdue's statistics department and not to a commercial vendor — is what makes the sovereign credential evaluable.

A well-configured senior's router, after four years of this process, resolves the majority of her cognitive work at the lowest tiers — local and sovereign. Institutional and peer compute handle most of what remains. Commercial tiers serve the rare frontier cases. This distribution is not a cost optimization. It is a map of what she has learned, with every learned concept traceable back to the specific institutional substrate that grounded its validation.

The distribution is also something more consequential than a record. Each concept that has ratcheted to sovereign tier is a concept the learner no longer has to actively reason through to use. Her cognitive bandwidth, over four years, has migrated upward: away from the foundational, toward the frontier. Where a freshman spends her active attention re-grounding every statistical assumption she encounters, a senior spends it interrogating the edge cases her validated framework does not yet resolve. The Ratchet is not primarily a cost-reduction mechanism. It is the mechanism by which the learner's attention is freed to do the work that has not yet been done. The next section specifies why.

Memorialized Judgment: Why the Ratchet is a Cognitive Elevator

Every architectural property specified above — the five-stage pipeline, the three files, the zone model, the Ratchet, the composition interfaces — exists to support a single claim that has not yet been stated directly:

This is not a side benefit of the design. It is the design. Each of the previous sections describes a mechanism; this section describes what the mechanisms are for.

9.1 The Inversion

A centralized cognitive platform also records human judgment. Every query, every iteration, every accepted answer is captured, structured, and retained. The platform's business case is built on that capture. Patterns of authorized judgment — what the user classified as correct, what they rejected, what they refined, how they weighted competing framings — are the training data for the platform's next model and the competitive intelligence for its product roadmap. The user is, paradoxically, paying a recurring fee to fund the automation of their own judgment.

The Learner Autonomaton captures the identical artifact. The structural form is the same: authorized patterns, approved classifications, refined routing decisions, validated groundings. What is different is where the capture lands and what it does once captured.

In the centralized architecture, the capture flows outward. It refines the vendor. It trains the vendor's next product. It compounds the vendor's asset. The user's own capability, meanwhile, atrophies — because every time the user's judgment is externalized to the platform, the incentive to internalize it weakens. The platform becomes smarter. The user becomes more dependent.

In the autonomaton architecture, the capture flows inward. It refines the learner's routing config. It rewrites the learner's own tables of what they have settled. It compounds the learner's asset. The learner's capability, correspondingly, does not atrophy — it elevates, because memorialized judgment is no longer judgment that needs to be re-performed.

The two architectures do the same thing with the same structural artifact. The architectures decide who benefits.

9.2 What Gets Memorialized

Five categories of judgment are captured and persisted across every approval at Stage 4:

Routing decisions. When the Ratchet proposes that regression_assumptions move from institutional compute to sovereign, and the learner approves, the approval is memorialized. The learner has declared: this pattern is settled; I no longer need to re-ground it against the department canon. That declaration becomes the config. The config is the record of settled judgment.

Zone classifications. When the learner approves moving a pattern from Yellow (supervised) to Green (autonomous), the approval is memorialized. The learner has declared: this kind of work no longer requires my review. The zone schema is the record of what the learner has delegated.

Grounding patterns. When the learner validates that a particular kind of question should be grounded against the library node rather than the department node — or against both, weighted in a specific way — the validation is memorialized. The routing config records the resolution.

Consent scopes. When the learner approves sharing cohort-level telemetry with a specific teacher node, the approval is memorialized. The consent schema records what has been agreed to, with whom, and under what scope.

Exploration decisions. When the learner approves marking a pursuit as a dead end, a parked investigation, or a reconsidered approach, the decision is memorialized with its reasoning. The learner has declared: I have settled that this approach does not work, for these specific inspectable reasons — or this line of inquiry is not productive for me right now; parked. Negative knowledge is captured with the same structural status as positive knowledge. The level of detail retained — full reasoning trail, compressed summary, flagged-only — is a configuration decision made by the learner or by the domain they operate in, not by the architecture. The architecture's job is to preserve the option. Whether to exercise it is the learner's.

These five categories cover the full surface of what the system does. Every interaction traces back to one or more of them. The sovereign state of the system is, in aggregate, a crystallized record of the learner's judgment across their learning arc — including the judgments they rendered against pursuing particular paths, which turn out to be load-bearing assets in their own right (§15).

9.3 The Single Capture Mechanism

All five memorialization types pass through the same gate: Stage 4 approval. The system proposes; the human decides; the decision is recorded. There is no other capture path. There is no silent inference of preference from behavioral patterns alone. There is no implicit consent. The Ratchet may propose a mutation based on observed patterns, but the mutation does not become memorialized until the human approves it explicitly.

This is why Stage 4 is non-negotiable. Stage 4 is not a governance checkbox. It is the capture mechanism. Remove Stage 4, and the architecture no longer memorializes anything; it merely observes. Memorialization requires consent. Consent requires a human gate. The human gate is Stage 4.

The same property explains why Red zone is structurally enforced rather than merely advised. Red actions are, by definition, judgments the system must never memorialize on the learner's behalf. An authorship declaration, an academic integrity assertion, a goal commitment — these are the judgments that constitute the learner's own identity as a thinking being, and the architecture refuses, at the permission-system level, to memorialize any of them without explicit synchronous human act. The system cannot click submit for the learner. The system cannot set the learner's goals. The system cannot assert integrity on the learner's behalf. Not will not. Cannot.

9.4 What Memorialization Produces

A pattern that has been memorialized does not need to be re-decided. This is the mechanical fact. The consequential fact is what the un-re-decided pattern does to the learner's attention.

Consider a sophomore's first encounter with regression assumptions in September. The concept is novel. Every aspect of it requires active attention — what the terms mean, why the assumptions matter, when they are violated, what violation implies. The learner's cognitive bandwidth for that week is substantially occupied by this one concept.

By December, regression assumptions have ratcheted to sovereign tier. The learner's approval of that mutation is the act of declaring the concept settled. The system resolves the pattern locally, cost zero, no cloud call, no re-grounding. When the learner encounters regression assumptions again in her statistics capstone, her attention is not reconsumed by the basics. It is available for what comes next — the specific adversarial case she is now examining, the novel question about how her data might violate one of the assumptions in a way her textbook did not anticipate.

Multiply this across every concept the learner memorializes across four years. The cumulative effect is that the learner's active attention is continuously migrating upward — away from what has been settled, toward what has not. The frontier of her cognition keeps moving because the settled territory keeps expanding beneath it.

This is what expertise actually is. A chess master does not think about basic captures; those are memorialized. A senior clinician recognizes a rare presentation in seconds because the common presentations are memorialized. A working mathematician does not re-derive standard results; those are memorialized. What distinguishes the expert from the novice is not that the expert knows more concepts — it is that the expert's attention is free to work on the frontier because everything behind the frontier has been structurally settled.

The Learner Autonomaton is a machine for installing this property in a human being, over the course of four undergraduate years, with full provenance and inspectable telemetry. It is, in the most literal architectural sense, a cognitive elevator: it does for a learner's own judgment what decades of deliberate practice do for a master's, using the same structural principle (memorialize the settled; free attention for the unsettled), implemented in a pattern the learner can inspect, own, and carry.

9.5 The Compounding Property

Memorialization compounds across years. A freshman memorializes perhaps a few dozen patterns per term. A senior, by contrast, encounters far fewer genuinely novel concepts at the foundational level — not because the material is easier, but because the senior's accumulated cognition, recorded in the routing config, already resolves the foundations sovereignly. The senior's attention is therefore available for questions at the frontier of the field rather than questions at the frontier of the textbook.

This is the architectural mechanism behind what educators call “increasing returns on accumulated learning.” The phenomenon is real; the mechanism has previously been invisible. The autonomaton makes it visible and accelerates it. Every pattern memorialized is a pattern whose cognitive cost goes to zero, freeing bandwidth for the next pattern up. A well-used autonomaton, operated across four years, produces a graduate whose cognitive frontier has risen measurably in every domain the learner has engaged with — and the rise is inspectable, because the routing config is the record.

9.6 The Self-Authoring Property

The autonomaton is called a self-authoring system for this reason. It authors itself through the human's approved history. The learner does not directly edit the routing config and the zone schema. The learner approves mutations, one at a time, at Stage 4, across four years of use. Each approval is a memorialization. The aggregated memorializations crystallize into a sovereign cognitive substrate that is the learner's alone — durable, owned, irreplicable, accumulated through their own judgment rendered against their own demonstrated mastery. The config and the schema are the inspectable surfaces of that substrate; the substrate is what the learner authors.

This is why config-over-code is the correct separation. Code is what implementers write. Config is what learners author through their own approved history. A learner who has operated their autonomaton for four years has, without ever writing a line of code, authored a highly specific cognitive architecture that is exactly fitted to their own thinking, because every fitting decision was made by them, at their own pace, against their own demonstrated mastery. The architecture fits because the architecture is the accumulated record of their fit.

One further clarification follows from the co-sign protocol specified in §10.6: the learner's authoring of the substrate is sovereign, but claims the substrate makes about external nodes' authority operate inside a separate envelope. A tier mutation the learner approves at Stage 4 always commits to the learner's own cognition. Whether that mutation can claim a department's, library's, or teacher's provenance in the credential view is determined by that node's own declarative authority. Self-authoring is total for the learner's own cognitive substrate; it is bounded by the federation's declared envelope where the substrate makes claims that reach beyond the learner's own node.

9.7 The Reversibility Property

A final architectural property worth naming before this section closes, because it is the principle that decides several design choices that would otherwise seem over-determined: preservation is cheap; loss is permanent.

The architecture memorializes, by default, everything that passes through Stage 4 approval — positive judgments and negative judgments alike. It does not attempt to decide in advance which memorializations will turn out to be valuable. It does not compress dead ends into summaries before the learner or the market has had a chance to discover what is useful in them. It does not prune what appears trivial today on the bet that it will remain trivial tomorrow. The sovereign substrate holds the full record. The learner configures compression, exposure, and query patterns against that substrate as they choose, and can adjust those configurations as their understanding of what matters evolves.

This is a deliberate asymmetry, and it is not subtle. A system that defaults to preservation can always compress, expose selectively, or archive later. A system that defaults to discard cannot recover what it threw away. Unwinding a centralized dependency is another matter altogether — and unwinding a premature architectural decision about what to keep is a specific case of that broader structural problem. The moment the provenance substrate starts deleting what it cannot justify keeping, the option to later discover the value of the deleted material is gone. The cost of preservation is storage, which is cheap and getting cheaper. The cost of loss is optionality, which cannot be restored.

The consequence for institutional and individual adoption is that running the architecture correctly, today, is almost entirely future-proofing. Storage is negligible overhead. Structured append-only telemetry across four undergraduate years and sixty career years after occupies a trivial fraction of consumer-grade storage. The learner, their institution, and the federations they participate in retain the option to discover value in the preserved record because the record was preserved. This is sovereignty over the provenance substrate, and it is the foundation on which the economic property in §15 depends.

9.8 Why This Is the Point

Every other property of the architecture — sovereignty, portability, composability, cryptographic provenance, federation — is in service of this one mechanism. Sovereignty matters because memorialized judgment must not be extractable by a third party. Portability matters because memorialized judgment must travel with the learner for life. Composability matters because memorialization in one node must be inspectable and consultable by other nodes without losing integrity. Provenance matters because memorialized judgment without a chain to its validation is just opinion. Federation matters because a learner's memorialized expertise must be monetizable and participatable in broader economies.

None of these properties, individually, is the point. The point is memorialization-as-elevation. The point is that human attention, over the course of a human lifetime, should keep rising into the unsettled — and the architecture that makes this possible is one that captures authorized judgment at the moment it is rendered, memorializes it permanently, and refuses ever to re-demand it from the human who has already rendered it.

Policy cannot do this. Policy can ask a platform to please not re-extract the user's judgment each time. Architecture does it. Architecture makes the re-extraction structurally impossible and the elevation structurally automatic.

9.9 The Verification Property

Every section before this one has described a mechanism that operates when a learner's work passes through the pipeline. A reader arriving here reasonably asks the question the educational-AI discourse has been unable to answer: what stops a student from routing around the pipeline entirely — ChatGPT in a browser, answers pasted into a submission, no telemetry generated, no arc touched?

Nothing stops this. The architecture does not attempt to. And it does not need to, because preventing external tool use is not the property the architecture claims to deliver. The property it claims is narrower, structurally stronger, and sufficient:

These are logically different properties. Only the first is required for the architecture to do what it claims. A competency claim in a credential view is backed by verification events in the arc, or it is not. Inspection looks for the presence of backing, not the absence of tools. An unbacked claim fails inspection regardless of how the learner arrived at the unbacked state. This is the property that lets the architecture refuse to operate as surveillance over the learner's life while still operating as substantiation for the claims the learner chooses to make.

Every pipeline event that could substantiate a competency claim carries an attestation tier — a telemetry field declaring the standing under which the event was verified. The spec does not invent the tier. It surfaces a property that already exists in every serious evaluation context — proctored exams, oral defenses, board certifications, lab practicals are all high-attestation events by pre-architectural convention — and makes it inspectable at the credential boundary. Three tiers are standard for a learner operating inside an institutional composition:

Self-attested. The learner administered the verification event to themselves and scored it against their own dock. A student generates a Socratic challenge from her prior reasoning, answers it, judges her own answer. The event is real; the arc records it; the attestation tier is self. This is meaningful for the learner's own sovereign memorialization — the mechanism by which a pattern ratchets to sovereign tier for the learner's own use. It is not meaningful to an audience requiring external standing, and the credential view does not pretend otherwise.

Autonomaton-attested. The pipeline administered the challenge — generating the adversarial question from dock and telemetry, evaluating the response against criteria declared in the learner's zone schema — with no external node's participation. Jidoka enforces non-silent failure; the learner's Stage 4 approved the resulting classification. Medium attestation. Credible to audiences who trust the pipeline invariants but not to audiences who require external-party verification.

Institution-attested. An institutional node administered the challenge event and co-signed its resolution through its own zones.schema. A proctored examination; a capstone defense evaluated by a department's faculty node; a lab practical administered under the department's declared protocols. The institution's standing stands behind the attestation. The composition protocol specified in §10.6 governs the shape of the co-sign; the resulting telemetry entry is cryptographically traceable to the institution's validation authority at the moment of attestation.

An attestation tier is not a grade. It is a declaration of who stood behind the verification event. The credential view (§14) surfaces the attestation tier for every competency claim the learner chooses to expose, and downstream consumers set their own thresholds against it.

From this single primitive, the questions that have dominated educational-AI discourse resolve structurally rather than through policy.

A student can use ChatGPT on their own laptop and the pipeline never knows. Correct. The arc is silent about what the learner does outside it. But the arc is not a detection surface; it is a substantiation surface. If the student later claims the underlying competency in a credential view, inspection queries the arc for verification events backing the claim. No verification events, no backing. The claim fails inspection. The architecture did not need to detect the external tool to expose the unbacked claim; the unbacked claim exposes itself the moment a receiver requires backing.

A student can launder external output through the pipeline to fake the shape of learning. Also correct, and less consequential than it sounds. Autonomaton-attested events can be performed against pre-polished inputs and the telemetry will show a plausible traversal. But institution-attested events cannot be substituted, because the institution administers them. A receiver requiring institution-attested backing is structurally immune to input-laundering — the attestation happened on institutional premises, under institutional procedure, co-signed under institutional authority. The architecture does not claim that autonomaton-attestation is fraud-proof. It claims that institution-attestation is administration-anchored, and that the distinction between the two is visible in the credential view.

A student can self-grade into any credential they like. Only if the receiver accepts self-attestation. Some receivers will — a weekend-project claim from a hobbyist learner carries trivial stakes and self-attestation suffices. Others will not — a clinical licensing body will require institution-attested events exclusively. Between those poles sits a market, and the market stratifies on attestation tier rather than on credential gatekeeping. Self-attestation is not devalued; it is placed at the credibility level appropriate to self-administration. The architecture makes the level visible and lets the market sort.

A student's entire private exploration is surveilled by this architecture. The opposite is the case. The learner's sovereign config, dock, and arc are the learner's alone; the only audiences who see any portion of the arc are audiences the learner consents to expose to, scoped per audience and revocable at any time under the consent interface in §10.3. A learner can ratchet any pattern to sovereign tier, memorialize any judgment, pursue any inquiry that interests them, and never expose a single entry to anyone. Private exploration is the default. Exposure is a deliberate act, scoped by the learner, at the moment the learner chooses. The architecture protects privacy by refusing to disclose what the learner has not chosen to share, and protects claim integrity by requiring backing for anything they do choose to share.

The same property that makes the autonomaton useful for the learner — memorialized judgment flows inward and compounds — makes it legible to the institutions, employers, and federations who receive the learner's credential views. Verification is visible. Attestation is classed. Co-sign is traceable. What the learner knows, by whose standing, and under what conditions is inspectable at the resolution the receiving audience requires. Below that surface, the learner's life is private, sovereign, and their own. This is what it looks like when a structural property replaces a surveillance promise.

Composition Interfaces

The claim that autonomatons compose without adapter code requires a specification of the interfaces that make this true. This section specifies the five composition interfaces — telemetry, retrieval, consent, provenance, and endorsement — that every Autonomaton in a learning composition must implement.

10.1 The Telemetry Interface (inbound)

Every Autonomaton exposes a telemetry-ingestion interface that accepts structured events from any other pipeline-compatible Autonomaton. Events are JSON-Lines; their schema is the canonical Autonomaton telemetry schema (intent, source node, consent scope, provenance chain, pipeline stage outputs, timestamp, integrity hash). A node consuming telemetry from another node does not need to know anything about the source node's internal implementation. It only needs to know the shared schema.

10.2 The Retrieval Interface (outbound, grounded)

Every Autonomaton that exposes knowledge — a department node, a library node, a writing center node, a peer node — exposes a retrieval interface that accepts a structured query and returns a grounded response with full provenance. The response includes: the retrieved content, the sources consulted, the tier at which retrieval was resolved, the consent scope under which the retrieval is valid, and an integrity hash that allows the receiving node to verify the response was not tampered with in transit.

10.3 The Consent Schema (governance)

Every Autonomaton declares, in its zones.schema, the consent scopes under which it participates in compositions. A learner's node declares which categories of telemetry may flow to which other nodes (e.g., “aggregate cohort signals may flow to the teacher node for this course; individual telemetry may not”). A department node declares who is permitted to consult its canonical corpus and for what purposes. These consent scopes are inspectable and revocable by the node's owner at any time. Revocation is immediate and propagates through the composition.

10.4 The Provenance Chain (integrity)

Every response passed between Autonomatons carries a provenance chain — a cryptographically hashed record of which nodes the claim has traversed, under what consent, and through what pipeline stages. A student's final paper, at the moment of submission, carries a provenance chain showing every department node consulted, every library source grounded, every writing center suggestion integrated, every peer contribution acknowledged. The chain is inspectable by the student, by the institution, and by any downstream consumer (employer, graduate program, licensing body) the student chooses to share it with.

10.5 Composition Patterns

Four composition patterns are standard in a learning environment:

Chain composition. Node A's execution output becomes Node B's telemetry input. A library node retrieves; the result feeds directly into a student node's compilation stage. No adapter. No intermediate layer.

Parallel composition. Multiple nodes consulted simultaneously on the same query, with the student integrating at Stage 4. A capstone student consults the economics department autonomaton, the history department autonomaton, and the library autonomaton on the same question; three structured responses return in parallel; the student's approval stage is the synthesis.

Aggregation composition. Multiple nodes feed aggregate (not individual) telemetry to a supervisory node. Consenting student nodes feed cohort-scope telemetry to a teacher node; the teacher node sees patterns, never individuals.

Federation composition. A set of peer nodes share a bounded telemetry and retrieval space for a defined purpose and duration. A thesis cohort federates their literature-review docks for six months; at dissolution, each student's individual dock retains its own contributions and the cohort space sunsets.

These patterns are not exotic. They are the natural consequence of the shared pipeline shape. A university's institutional computing team does not need to write adapters between nodes; the composability is structural.

10.6 The Co-Sign Protocol

The four interfaces specified in §10.1 through §10.4 describe how autonomatons exchange telemetry, retrieval, consent, and provenance. This subsection specifies a fifth: how they exchange endorsement — the protocol by which a node declares what classifications it is willing to lend its standing to when another node invokes its name. This is the mechanism that makes institution-attestation (§9.9) operational without introducing a new architectural construct.

The protocol introduces no new file. The composition thesis in §5 holds that every node runs the same invariant pipeline and maintains the same three files. The zones.schema of a learner's node classifies submission actions, data-sharing acts, and tier mutations. The zones.schema of an institutional node classifies the same primitive categories applied to a different input surface — including co-sign requests arriving from learner nodes whose credentials will reference the institution's name. The zone model applies directly, and what v0.9 left implicit becomes explicit: every node's zones.schema governs an input class of co-sign requests from other nodes, and the Green/Yellow/Red semantics apply as specified.

A department autonomaton receiving a co-sign request for a student's tier mutation evaluates it against its own zones.schema:

Green. The request meets pre-declared criteria. Co-sign is automatic. The department's faculty-governance body has, through whatever deliberative mechanism the department uses, already approved the class of co-signs this request falls into. The pipeline resolves without human halt at the institutional node. This is the scalable form of “the department endorses this kind of competency attestation under these specific conditions” — declared once, evaluated deterministically at every subsequent request.

Yellow. The request falls outside the declared auto-co-sign criteria but inside the department's scope. The pipeline halts at the institutional node; the department's governance body reviews; co-sign is issued or declined through the department's existing deliberative process. This is the institutional counterpart to Stage 4 human review at the learner's node — the department's equivalent of “a human at this node must approve before endorsement is lent.” Exposed as a zone-classified event rather than buried in per-mutation ad hoc review.

Red. The request is outside the department's scope entirely — a co-sign claim the department has no authority over. Refused structurally. The department's zones.schema lacks the classification that would permit co-sign; the pipeline is incapable of producing one. Not will not. Cannot. A biology department autonomaton asked to co-sign a literary-analysis competency has no zone under which that request resolves.

A department's zones.schema governing co-sign might read like the illustration below. The specific criteria are for illustration; the declarative form is what matters, and is chosen to be readable by the same faculty-governance body that will approve it.

# zones.schema — Purdue applied-statistics department autonomaton
# Co-sign classifications. Human-readable; approved once by faculty governance.
# Evaluated deterministically at every incoming co-sign request.

cosign:
  # Auto-co-sign — green zone
  regression_assumptions:
    scope: canonical_corpus
    zone: green
    requires:
      attestation_tier: institution
      challenge_events: 3
      provenance_sources_must_include: purdue-stat-dept-corpus
    delegates_to:
      - stat-301-teacher-node     # in-course authority, fall/spring only
      - stat-302-teacher-node

  model_selection:
    scope: canonical_corpus
    zone: green
    requires:
      attestation_tier: institution
      challenge_events: 2
      provenance_sources_must_include: purdue-stat-dept-corpus

  # Governance review — yellow zone
  novel_statistical_methods:
    scope: frontier_of_field
    zone: yellow
    review_body: department_curriculum_committee
    note: "methods not yet in canonical corpus require committee review"

  # Refused structurally — red zone
  literary_interpretation:
    scope: out_of_domain
    zone: red
    note: "outside the department's scope; no co-sign issued under any conditions"

Three properties of this form are worth naming.

Institutional sovereignty. The department owns its co-sign criteria. No other node dictates what the department is willing to endorse. A learner's Ratchet may propose any tier mutation, and the learner's Stage 4 may approve it for their own sovereign use — but whether the mutation can claim departmental provenance is determined entirely by the department's own zones.schema. Sovereignty at every node, including the institutional ones.

Delegation chains. A department may delegate in-course authority to teacher nodes within declared scope. The teacher's zones.schema declares what it is willing to co-sign within the department's grant. A TA's zones.schema declares within the teacher's grant. Each level can only delegate what was delegated to it. At co-sign time, the pipeline evaluates the delegation chain and hashes into provenance which node actually co-signed under what delegated authority. Structurally the same pattern as certificate authority chains in TLS — a well-understood primitive applied to a new domain.

The envelope is visible. When a learner's tier mutation cannot be co-signed — because the pattern falls outside the institution's declared envelope, because no institutional node has the authority, or because the learner is exploring in a direction no institution yet endorses — the mutation still commits at the learner's discretion through Stage 4. What changes is the credential view: the competency resolves at sovereign tier, but with attestation tier self or autonomaton, with no institutional validating node recorded. The learner retains the knowledge; the credential honestly reports the absence of institutional backing. Self-trained sovereign competency is first-class, and the credential makes its backing condition explicit rather than obscure.

The protocol above is specified for the learner-institution composition because that is this specification's domain. A generalized version of the protocol — how any autonomaton node formats zones-schema entries to govern co-sign behavior with any other node — is the natural subject of a future Grove composition-semantics standard. GRV-003 is forward-compatible with that generalization by construction: the zone-classification primitive, the delegation pattern, and the declarative format specified here are domain-invariant, and can be absorbed into a broader specification without reinterpretation of the learner-institution case.

With this, the four properties specified in §10.1 through §10.4 — telemetry, retrieval, consent, provenance — are joined by a fifth: endorsement. Together they constitute the full set of interfaces by which autonomatons compose in a learning environment. Every other mechanism specified in this document is built from some combination of these five.

Learning as a Cognitive Process

Earlier drafts of this specification borrowed routing intents from the enterprise Autonomaton — research, draft, analyze, synthesize, problem-solve. This was a pattern-matching error. Those are knowledge-work verbs in a student costume. They describe what a developer does with a codebase, not what a learner does with knowledge.

A Learner Autonomaton organizes its router around the five stages of learning as a cognitive process:

Acquisition

The learner is encountering new material for the first time. The dock does not yet contain it. The goal is exposure and initial comprehension. Acquisition typically routes to the institutional tier — department nodes, library nodes — because grounding matters most when a concept is being installed.

Synthesis

The learner is connecting new material to what they already know. The dock contains related entries. The goal is integration — producing a synthesis the learner then reviews. Synthesis may route to institutional tiers for verification and to local tiers for draft production.

Verification

The learner is stress-testing what they believe they understand. They ask the system to challenge them. The system draws on the dock and telemetry to generate adversarial questions calibrated to the learner's actual history. Pass the challenge, and the knowledge gains a challenge-verified marker. Fail, and the gap becomes visible.

Integration

The learner is compacting knowledge. Raw entries synthesize into summaries. Summaries crystallize into principles. Full provenance moves to telemetry archive. The living dock becomes tighter, more applicable, more portable. Integration is where the dock matures.

Application

The learner is producing work from the dock — a capstone draft, a research synthesis, a policy analysis, a presentation. The dock serves as primary substrate. Submissions remain Red zone.

A snapshot of a junior-year learner's routing config might look like this — simplified for clarity, with the understanding that each pattern resolves to exactly one tier in this snapshot, and that tier assignments evolve over time through approved Ratchet mutations:

# routing.config — snapshot, fall semester junior year
# Each cognitive pattern resolves deterministically to one tier.
# Tier assignments evolve via Ratchet-proposed, learner-approved mutations.
# Mutations happen at Stage 4 approval time, not at runtime.

regression_assumptions:
  stage: verification
  tier: sovereign            # demoted from institutional in December
  zone: green                # challenge-verified twice
  handler: dock_retrieval
  provenance: purdue-stat-dept-autonomaton

policy_framework_analysis:
  stage: synthesis
  tier: institutional        # current resident tier
  zone: yellow
  handler: department_grounded
  source_node: purdue-policy-dept-autonomaton

capstone_thesis_development:
  stage: application
  tier: commercial_mid       # outside institutional capability for now
  zone: yellow
  handler: commercial_api
  fallback: none             # no runtime fallback — Ratchet only

literature_review:
  stage: acquisition
  tier: institutional
  zone: yellow
  handler: library_grounded
  source_node: purdue-library-autonomaton

peer_study_group_discussion:
  stage: synthesis
  tier: peer_federation
  zone: yellow
  handler: cohort_shared
  source_node: stat-301-study-cohort
  consent_scope: cohort-aggregate-only

No tier_preference arrays. No fallback cascade. Each pattern names exactly one tier and (where relevant) exactly one source node. When the Flywheel observes that policy_framework_analysis has been running cleanly for a semester with no corrections, it will propose promoting the pattern to verification, then demoting it toward sovereign as the learner demonstrates mastery. The learner approves each mutation. The config evolves. The cognition compounds.

Notice that this config is not an artifact the learner wrote. It is a record of the learner's memorialized judgment across three years of approved mutations. The config is the learner's cognitive biography, expressed in executable form.

The Dock: The Learner's Owned Cognitive Substrate

The dock is the learner's accumulated context substrate. It is what the learner has settled, validated, and made permanently theirs — the locus where their cognitive value compounds, owned outright. Institutional consultation is one input the substrate accumulates from. Personal exploration is another. Peer cohort contribution is a third. The substrate carries them all without reducing to any one of them, and the act of accumulation is what makes the substrate generative across the rest of a learner's life.

Clark and Chalmers argued that cognitive artifacts reliably coupled to a person are part of that person's mind. The Learner Autonomaton's dock is the strongest version of this claim yet built.

The dock is not a notes app. Every entry in the dock passed through five stages of governance. It is not what the student wrote down; it is what the student validated. A raw excerpt from a Purdue faculty paper, surfaced through the library autonomaton and added to the dock, carries provenance: this entered my knowledge on this date, through this pipeline, from this source in the library's institutional corpus, validated by my review. A synthesis connecting three concepts from different courses lives alongside the telemetry showing how the student built it and which department autonomatons grounded each input.

The right image for the dock is a loom that has shaped itself to the weaver's hands. The learner arrives at the institution with an empty dock — a custom-built physical loom that has not yet been threaded. Over four years, every approved pattern, every validated entry, every memorialized judgment becomes part of the loom's own structure. The dock is not a record of what the learner has seen. It is a record of what the learner has settled — crystallized judgment, inspectable, portable, permanently the learner's.

What distinguishes the dock from any other notes system is not the folder structure. It is the provenance chain linking every entry to the pipeline traversals that produced it, the source material that grounded it, the node that validated it, and the tier that resolved it. The dock is the learner's cognitive substrate — accumulated through institutional grounding, personal exploration, and peer composition — owned by the learner and carried for life. A senior's knowledge base contains principles crystallized from thousands of validated interactions with department autonomatons, library autonomatons, writing center autonomatons, peer cohorts, and the learner's own teacher nodes. Compacted, portable, inspectable, and irreducibly the learner's, grounded in the institutional substrate that produced it but not reducible to it.

Compaction over time is not data loss. It is learning. The freshman's forty pages of cell biology lecture notes distill, over terms, into a two-page crystallization of what the student actually retained and can apply. The archaeological record of how that crystallization happened lives in telemetry. The living knowledge lives in the dock. Both travel with the learner forever.

Goals: Aspiration with Provenance

Goals are Red zone. The system surfaces progress, proposes refinement, and asks useful questions — but the system cannot modify aspirations. Those are the learner's alone. Neither the advisor autonomaton, nor any department autonomaton, nor any peer cohort can write to the learner's goals file. They can observe (with consent) and they can surface context. They cannot author.

What a transcript never captures is what the student was trying to accomplish. The telemetry trail of a student pursuing a goal — the pivoting and re-pivoting, the informational interviews, the honest assessment of what they actually enjoyed, the consultation with the advisor autonomaton, the moment when the trajectory stabilized — is a credential signal no institution can generate. Employers will tell you, when pressed, that the most valuable thing they look for is self-directed reasoning under uncertainty. There is no current credential that demonstrates it. The goals file, paired with the telemetry showing its pursuit, is the first one.

The Credential of Value, Architecturally

This is the section that responds to what Lumina Foundation has spent a decade defining.

The Credentials of Value framework — articulated across the institutional work of Lumina Foundation president and CEO Jamie Merisotis — argues that the durable signal of learning should be demonstrated capability, not institutional process. The framework is correct. It is also architecturally unbacked. Nothing in the current educational infrastructure produces artifacts that satisfy the framework's requirements. Badges fall short. Competency statements are assertions without provenance. Even the most rigorous skills-based credentials are institutional judgments dressed up in new language.

A credential of value, to be real, requires three properties the current infrastructure cannot deliver:

It must be sovereign. The learner must own it. No institution can revoke it; no vendor can hold it hostage.

It must be grounded. Every claim must trace to a validation event with inspectable provenance — when it was validated, against what corpus, through what process, mediated by which institutional node.

It must be continuous. It must extend naturally from the university experience into professional life, growing rather than going stale.

The simplest way to see the difference from what we have today: a traditional transcript is a piece of paper from a driving school saying the student took the class and got a B+. A sovereign credential is a dash cam. It shows the learner parallel-parking in fourteen different conditions, merging onto a crowded highway, handling a skid on black ice. The employer reviewing a dash cam is not trusting the driving school's assessment. They are inspecting verifiable evidence of what the driver can actually do.

That is the architectural difference between an institutional judgment about a student and a structural record of the student's own memorialized judgment. A transcript reports what the institution decided. A sovereign credential reports what the learner settled, with full provenance of how and against what.

A practical clarification before the illustrative sketch that follows: the credential is not a separate artifact sitting beside the learner's provenance arc. The credential is a view into the arc — a formatted projection generated on demand, composed from the parts of the arc the learner chooses to expose to a particular audience. A learner can expose a lightweight view to a potential employer, a richer view to a graduate program, a different scoped view to a specialty federation they are joining. Each view traces back to the same underlying arc and can be independently verified by the receiving party through the provenance-chain integrity specified in §10.4. The credential is the interface. The arc is the asset.

The Learner Autonomaton produces the sovereign credential as a structural property of how it works. A credential output — generated at the learner's discretion, read-only, and shareable — might look like the illustrative sketch below. The specific distributions are for illustration; the shape of the artifact is what matters.

┌─ LEARNER CREDENTIAL (illustrative) ───────────────────────────────┐
│                                                            │
│  Active since: September 2026                               │
│                                                            │
│  COGNITIVE PROVENANCE                                       │
│  ───────────────────────────                                  │
│  This cognition was trained primarily on institutional      │
│  compute, grounded in Purdue's corpus (stat dept, policy    │
│  dept, bioethics dept, library), with a meaningful          │
│  fraction of recurring patterns demoted to sovereign        │
│  local operation over four years of use.                    │
│                                                            │
│  Full tier-by-tier distribution inspectable via telemetry.  │
│                                                            │
│  CHALLENGE-VERIFIED COMPETENCIES                            │
│  ───────────────────────────                                  │
│  • Statistical modeling — regression, ANOVA, model        │
│    selection                                                │
│    Grounded in: Purdue applied-statistics corpus            │
│    Validating node: purdue-stat-dept-autonomaton            │
│    Attestation: institution (proctored · 3 challenges)     │
│    Challenge record: inspectable via telemetry              │
│                                                            │
│  • Policy analysis — regulatory framework evaluation      │
│    Grounded in: Purdue policy & bioethics corpus            │
│    Validating nodes: policy-dept, bioethics-dept            │
│    Attestation: institution (capstone defense co-sign)      │
│    Challenge record: inspectable via telemetry              │
│                                                            │
│  • Research synthesis — literature review methodology     │
│    Grounded in: cross-domain institutional sources          │
│    Validating node: purdue-library-autonomaton              │
│    Attestation: institution (librarian co-sign)             │
│                                                            │
│  • Rust async runtime internals (self-directed study)    │
│    Grounded in: self-selected open-source corpus            │
│    Validating node: none — self-trained sovereign           │
│    Attestation: autonomaton (pipeline-administered)         │
│    Challenge record: inspectable via telemetry              │
│                                                            │
│  COMPOSITION FLUENCY                                        │
│  ───────────────────────────                                  │
│  Evidence of federation literacy: participated in           │
│  three peer cohorts across four years (thesis cohort,       │
│  applied-stats study group, extracurricular research        │
│  team). Demonstrated consented telemetry aggregation        │
│  and provenance-preserving contribution.                    │
│                                                            │
│  GOALS PURSUED (learner-disclosed)                          │
│  ───────────────────────────                                  │
│  Completed, active, and parked goals shown here, each       │
│  linked to the telemetry trail of its pursuit.              │
│                                                            │
│  PROVENANCE                                                 │
│  ───────────────────────────                                  │
│  Every competency links to its validation chain.            │
│  Every validation links to its source node and tier.        │
│  Every claim can be inspected back to its evidence.         │
│                                                            │
│  This credential was generated by the learner's             │
│  sovereign node. No institution issued it.                  │
│  The learner owns this artifact.                            │
└──────────────────────────────────────────────────────────┐

Notice what this credential does that nothing current can. It does not say “this student took a statistics course.” It says, in effect: this student's statistical fluency was validated through institution-attested challenge events, grounded in Purdue's applied-statistics corpus via the department autonomaton, and currently resolves at sovereign tier from the student's own dock. A self-directed competency — no institutional co-sign, autonomaton-attested only — appears in the same view beside the institution-attested ones rather than being hidden or excluded. The architecture reports the backing condition of every claim rather than collapsing all claims onto a single axis of legitimacy; the receiver sets their own threshold against what is transparently declared.

An employer reading this learns something a transcript cannot convey — not what the institution judged, but what the learner actually internalized, traced through the compute landscape and the institutional node composition that grounded the internalization. The credential's value is higher the more institutional the underlying grounding is, because institutional provenance tells an employer that this cognition was shaped by a faculty and corpus they can evaluate, not by a commercial vendor they cannot audit.

Notice also the “Composition Fluency” section. Four years of operating inside an institutional autonomaton composition produces a specific, evaluable capability: the ability to work inside a federated knowledge environment, with consent management, provenance preservation, and non-centralized coordination. This capability is increasingly valuable in enterprise environments that are themselves becoming federated. It is a credential of its own, producible only in a context where the learner spent real time inside a real composition.

The Federated Expertise Economy and the Provenance Arc as Asset

The tradable object in the federated expertise economy is not the conclusion. It is the arc that produced the conclusion.

What the sovereign credential makes possible, once it is held by enough graduates, is an economy that does not presently exist: a federated market for validated expertise whose economic primitives are cryptographically provable cognitive capability.

The architecture of this market is a structural implication of everything above. A graduate leaving a university with a sovereign node carries a validated, inspectable, federation-ready cognitive capability — and, crucially, the provenance arc that produced it. The next subsection specifies what is actually traded.

15.1 The Provenance Arc as Asset

A conclusion can be copied. A conclusion, stripped of provenance, is indistinguishable from every other claim in a market full of claims. A conclusion without the arc that produced it is opinion. But the arc — the inspectable record of how a specific learner came to hold a specific validated competency, the sources they grounded against, the challenges they passed, the neighboring hypotheses they explored and rejected — is irreplicable. No one else produced this arc. No one else can reconstruct it after the fact. The arc is the learner's unique asset.

Two architectural properties make the arc tradable in a way no prior credential has been:

Full-life provenance is the default, queried as needed. The learner does not curate arcs for release. They expose a queryable surface over their full provenance, under the consent schema they control, and federation participants query into it on the terms the learner sets. A specialty federation interested in a learner's validated regression work queries the arc scoped to regression. A different federation interested in the same learner's policy-analysis arc queries that scope. Neither receives anything the learner has not consented to expose. The market determines which arcs have value through the pattern of queries. What turns out not to matter fades from query traffic but is not discarded — because yesterday's trivia is tomorrow's signal, and the architecture cannot know in advance which is which. How societies and markets choose to use this queryable surface will be worked out through debate and experimentation; the architecture's commitment is to preserve the surface, not to dictate its use.

Dead ends are first-class provenance. A confirmed non-path — “I pursued this approach, here is the reasoning trail, here is why I reached the conclusion that it does not work” — is a structurally valuable asset. The eleventh researcher in a specialty federation saves months by consulting the ten preceding researchers' recorded dead ends before starting. The job-market participant evaluating two candidates with equivalent validated competencies gains signal from seeing whose exploration range was wider. A mature specialty federation uses recorded dead ends as routinely as it uses confirmed findings, because negative knowledge is often more decision-relevant than positive knowledge. The learner, or the domain configuration they operate under, sets the compression at which dead ends are retained — fully detailed for high-stakes domains, summarized for routine ones, flagged-only for trivial ones. Compression is configuration, not architecture.

The provenance arc has a structure worth naming. Two strands, intertwined: the path of confirmed knowledge and the path of confirmed dead ends. Neither strand alone describes how the learner's judgment was formed; the pairing does. Read only the confirmed knowledge and you learn what the learner believes; read only the dead ends and you learn what they rejected; read both together and you learn how they came to discriminate. This is a double helix of cognitive provenance — the code, in the most literal sense, that describes how a mind was built.

The arc, not the conclusion, is the asset. The federated expertise economy is the market that forms when arcs become sovereign, queryable, and interpretable at scale.

15.2 Properties of the Market

From the arc-as-asset frame, three market properties follow immediately:

Validated expertise becomes monetizable. Because the provenance is cryptographically verifiable, the contributors to a specialty federation can be priced and paid. A graduate whose validated regression competence improves a specialty composition receives an ongoing share of its economic output. This is not a gig arrangement. It is not a royalty scheme. It is a new asset class — inheritable cognitive capability, owned by the person who earned it, earning on their behalf.

Middle-career capability stops depreciating. In the current economy, professional capability depreciates the moment it stops being actively monetized. A sabbatical, a parental leave, a career shift all erode the asset. In a federated expertise economy, validated capability remains in circulation — participating in specialty compositions, earning on its provenance — even when the individual is not actively selling their time.

Specialty economies form where they previously could not sustain. A rural community college with exceptional teaching in a narrow field can credential graduates whose validated expertise federates upward into the broader economy regardless of local labor-market conditions. The geography of credential value stops being the geography of employers.

This is the Act III picture, but collapsed in time. The federation does not wait for a civilizational build-out. It emerges from the aggregation of sovereign arcs as they enter the labor market, which begins the moment institutions adopt the architecture. Act I (individual sovereignty) and Act II (federation) are not sequential in time; they are simultaneous in deployment, because enterprise adoption of the Autonomaton pattern (already visible at trillion-dollar scale in the pharmaceutical industry, as §17 specifies) is already building the federation into which the first cohort of sovereign graduates will arrive.

This is also the section where the Credentials of Value framework stops being aspirational and becomes underspecified. The question is not whether 75 percent of adults can hold credentials of value by 2040. The question is whether the arcs they hold are sovereign enough to participate in an economy that compounds rather than depreciates.

The Lifecycle: Four Years at an Institution, Sixty Years Beyond

The critical property: the architecture persists; the landscape it points at evolves. The senior graduating from Purdue points her router at Purdue's GPUs, Purdue's department autonomatons, Purdue's library node. The twenty-seven-year-old data scientist points the same architecture at her employer's internal autonomatons and her specialty federation participation. The forty-year-old consultant points it at a local stack, a curated set of trusted specialty federations, and a small set of external commercial models. The seventy-year-old retiree points it at her own machine, running models that were frontier a decade ago, with a dock that is half a century deep and a specialty federation presence that has been compounding for forty years.

The dock grows. The telemetry accumulates. The provenance arc lengthens. The routing config evolves with the landscape. The architecture never changes.

An alumni benefit emerges that no university currently offers: continued access to institutional autonomaton compositions after graduation, as a terms-of-degree persistent entitlement. An alumna twenty years out, consulting her sovereign dock on a question whose provenance traces to Purdue's statistics department, can still ping the (now much-evolved) Purdue statistics department autonomaton for updated canonical treatment. The institutional relationship does not end at graduation. It becomes a lifelong consultation relationship, with the learner's node as the point of continuity.

What the Institution Becomes: The Regional Imperative

The Learner Autonomaton reframes what a research university is for in the AI era. The current framing — we teach, then we certify, then we release — was built for a world where institutional knowledge was the scarce resource. That world is ending. General-purpose models now have broader recall than any single institution. The scarce resource, going forward, is grounded cognition — reasoning connected to an auditable epistemological substrate, validated through trusted process, composed with other validated nodes, and owned by the learner who did the work.

A university that operates a full autonomaton composition becomes a custodian of cognitive infrastructure. The value proposition shifts:

From: “Come here for four years and we will teach you.” To: “Come here and we will outfit your cognitive architecture for life, using our compute, our corpus, our faculty, our libraries, our advising, and our peer-cohort infrastructure as the substrate your node consumes, composes with, and internalizes. You will graduate with a sovereign cognitive system whose provenance chain traces to us, and your alumni relationship with this institution will be a lifelong consultation partnership rather than a fundraising transaction.”

The existing endowment becomes a differentiator in new ways. The university's GPUs, which today produce research output, also produce trained cognition that walks out the door with every graduate. The library, which today circulates books, is now one of the most widely consulted nodes in the composition and the source of most institutional-grounded provenance. The faculty, whose working papers today sit in institutional repositories, are now operators of teacher autonomatons and contributors to department autonomaton canons. The writing center, whose value today is hard to measure, is now a specialist node whose consultation patterns are visible in every graduate's composition-fluency credential.

None of this requires new endowment. It requires institutional will to expose the right interfaces over existing infrastructure. The marginal cost of operating a departmental autonomaton, over a department's existing pedagogical operations, is trivial. The marginal cost of a library autonomaton, over a library's existing retrieval operations, is trivial. The marginal value of the graduates who leave with cognition trained on this composition is categorical.

The second-order effect is what changes a university's position in higher education. First-mover advantage here is not a ranking bump. It is a categorical shift. The first research university to build this infrastructure defines what “university” means in the post-AI era — and every other institution spends the next decade building toward the new definition. The reputation compounds with alumni. Graduates will keep consulting the institution's composition long after graduation, because their node's routing config already points at it, because the trust boundary is already established, and because the epistemology their cognition learned to speak is the institution's.

17.1 Terroir as design input

Cognitive infrastructure of this kind is shaped by the place it is grown in. The architecture in this specification did not emerge from a Silicon Valley vacuum and get applied to regulated industries afterward. It emerged from sustained contact with regulated industries — particularly the compliance-heavy regional economy of central Indiana — and was pressure-tested against their requirements before it was generalized to the educational case. The terroir is not coloring. It is design input.

Indianapolis is the geographic locus of this terroir. Eli Lilly and Company, headquartered six miles from Lumina Foundation's offices, became in November 2025 the first pharmaceutical firm in history to reach a $1 trillion market capitalization — and the technology press covering the milestone described it not as a pharma achievement but as the arrival of the AI-native enterprise. Lilly's TuneLab platform federates drug-discovery research across biotech partners without any party surrendering raw data sovereignty. Lilly's Equipment Connectivity Platform unifies manufacturing telemetry across sites using edge compute and standardized namespaces while keeping operational details inside each plant's trust boundary. These are, structurally, enterprise-scale instances of the same architectural pattern this specification names. They were not built from this specification. They were built independently, by an Apple-lineage CIO (Diogo Rau) and the first Chief AI Officer in any major pharmaceutical company (Thomas Fuchs), arriving at the same architectural conclusions because the constraints of the pharmaceutical industry permit no other answer. That parallel arrival is itself the strongest possible validation: serious architects, given serious constraints, converge on the same design.

17.2 The Purdue–Lilly pipeline: 150 years of institutional fact

The Purdue–Lilly relationship that makes Indianapolis the natural soil for the educational case is not a recent partnership. It is a 150-year institutional fact.

Eli Lilly began his pharmacy apprenticeship in 1854 at the Good Samaritan Drugstore in Lafayette, Indiana — the same town where Purdue would open its doors twenty years later. In 1886, Lilly hired the company's first chemist: Ernest Eberhardt, the top graduate of Purdue's then-new School of Pharmacy. From that hire forward, Purdue has been Lilly's principal talent pipeline. The current CEO of Eli Lilly and Company, David Ricks, holds a 1990 BS in industrial management from Purdue. The two institutions operate the Eli Lilly and Company–Purdue University Research Alliance Center jointly, with more than fifty researchers and sixty graduate students working in active collaboration. Lilly has committed $250M+ to expand the partnership and operates the Lilly Scholars at Purdue program for incoming undergraduates with pharmaceutical-industry interest. The pipeline is structural, continuous, and economically load-bearing for both institutions.

A learner who graduates from Purdue with a sovereign cognitive credential carrying inspectable institutional provenance — grounded in the corpus produced by Purdue faculty, validated through department autonomatons trained on the institution's pedagogical canon — enters a regional labor market in which the largest employer's chief technologist is the same lineage of engineer who built the architecture the credential reflects. The credential is legible to the labor market because the labor market is structurally legible to the credential. This is not the case in most regions. It is the case in central Indiana because of a 150-year institutional pattern that no other region replicates.

17.3 The compliance-heavy regional economy as design input

The terroir extends beyond pharma. Anthem and a deep ecosystem of regional carriers anchor a substantial insurance underwriting sector. Old National Bank, OneAmerica, and a regional financial services base operate under similar compliance pressures. Corteva Agriscience, Beck's Hybrids, and an extensive agricultural-technology base operate under the regulatory and biological constraints that define modern agtech. Cummins operates one of the most engineering-rigorous manufacturing operations in the world from Columbus, Indiana.

None of these industries can afford opaque automation. All of them have been pricing the cost of unauthorized model behavior for decades — in regulatory penalties, in defaults, in failed harvests, in failed clinical trials, in product recalls. They have pre-existing intuitions about sovereignty, audit trails, and circuit breakers that coastal tech firms are only beginning to develop the vocabulary for. Architecture-first thinking about AI is, structurally, a Midwestern instinct, sharpened by industries that have always required it.

The Learner Autonomaton inherits this instinct — and exports it, at the moment of graduation, to every employer in every region the graduate subsequently enters. The architecture is the seed. The regional economy is the soil. The 150-year Purdue–Lilly pipeline (and its analogues across pharma, insurance, banking, agriculture, and engineering) is the demonstration that the seed will take root here in a way it could not take root anywhere else first.

17.4 Why Purdue is the obvious first mover

Three structural conditions make Purdue the natural institutional first mover for this architecture, regardless of any specific personal relationship.

Academic alignment. Purdue's president, Mung Chiang, is a former Princeton information-systems and network-economics scholar whose published academic work maps almost directly onto the architectural problems this specification addresses. The match between presidential research expertise and institutional first-mover opportunity is unusually clean.

Institutional bridge to the credential framework. Purdue's business school dean, Jim Bullard — former president of the Federal Reserve Bank of St. Louis — is simultaneously a special advisor to the Purdue president and, as of March 2026, a newly elected member of the Lumina Foundation Board of Directors. The institutional pathway by which a Purdue pilot of this architecture becomes a Lumina-scale national initiative is therefore not a chasm to be crossed but a hallway already standing. Austan Goolsbee, President of the Federal Reserve Bank of Chicago, sits on the same Lumina board, bringing the monetary-economics expertise of a region whose central bank has spent decades analyzing labor markets and regional economic development.

Geography that makes the credential immediately economically meaningful. A Purdue graduate carrying a sovereign credential into the Indiana labor market lands in a region whose largest employers — Lilly, Anthem, Corteva, Cummins, OneAmerica, Beck's — are exactly the institutions already building Autonomaton-pattern-compatible architectures at scale. The credential will be read natively by those employers because the architecture is shared. The Purdue graduate does not need to wait for national-scale recognition of sovereign credentials before the credential becomes economically meaningful. It is meaningful the day it is issued, in the regional economy that issued it.

These three conditions — academic alignment at the president, institutional bridge to the funding coalition, regional labor market structurally legible to the credential — do not assemble themselves at most institutions. They assemble at Purdue. The first-mover question is not whether Purdue should pilot the architecture. It is whether the institution that is structurally positioned to do so will recognize the convergence in time to act on it.

What Goal 2040 Requires, Architecturally

The Credentials of Value framework, articulated by Lumina Foundation president and CEO Jamie Merisotis across more than a decade of strategic work and synthesized in Human Work in the Age of Smart Machines (2020), is the philosophical inspiration for this specification. The framework articulates four claims:

1. Credentials should signal demonstrated capability, not institutional process.
2. Credentials should be meaningful to employers who did not design the curriculum.
3. Credentials should be portable across institutions and career transitions.
4. Credentials should grow with the learner, not go stale at graduation.

Each of these claims is a policy statement. Each is also, in its current form, a promise the current infrastructure cannot keep. A transcript cannot signal demonstrated capability — it signals institutional judgment. A badge cannot be meaningful across institutions — it means what the issuing institution says it means. A microcredential cannot be portable in any useful sense — it lives in whichever platform granted it. A stackable credential does not grow — it accumulates.

The Learner Autonomaton is what each of those four claims looks like once they are given an architecture instead of a policy:

Demonstrated capability, grounded in telemetry chains that show how the capability was validated, against what sources, through what challenges, mediated by which institutional nodes. Inspectable.

Employer-meaningful, because the provenance chain names the substrate — an employer evaluating an institutional credential is evaluating that institution's corpus, faculty, and node composition, all of which they can audit.

Portable, because the whole thing is three files and a dock the learner owns. No institution holds it. No platform gatekeeps it.

Growing, because the architecture persists after graduation and accumulates new provenance across employer compute, specialty federations, civic compute, and sovereign local compute for the rest of the learner's working life — while retaining a consultation relationship with the institutional composition that originally grounded it.

A fifth claim, not in the original framework but implied by its logic, also falls out of the architecture: credentials should be monetizable by the person who earned them, not only by the person who employs them. §15 specifies how. This is the piece the original framework could not anticipate because the architecture that makes it possible — the provenance arc as a sovereign, queryable asset — had not yet been specified.

HumanityAI is the natural institutional home for the work of bringing this architecture to scale. The $500M consortium, co-chaired by Omidyar Network, has been searching for structural options to match its policy ambitions. The Learner Autonomaton is one such option. The Grove Foundation will publish the pattern under CC BY 4.0 regardless of institutional participation. The strategic question for Lumina, for HumanityAI, and for the foundations whose mandates intersect this architecture is whether they want to be the institutional coalition that makes the pattern real at scale, or whether they want to observe a pattern reaching scale through other vectors.

The board-level connective tissue is already present. Jim Bullard — newly elected to Lumina's board, special advisor to Purdue's president, and dean of Purdue's Daniels School — sits in precisely the institutional position where the argument of this specification can travel from a Purdue pilot to a Lumina-scale coalition without crossing an organizational chasm. Austan Goolsbee, on the same Lumina board, brings monetary-economics expertise that maps cleanly onto the Ratchet-as-structural-argument frame. The architecture, the pilot institution, and the funding coalition are already in the same room. They are not yet in the same conversation. This document exists to make that conversation structurally obvious.

Institutional Preconditions

A Learner Autonomaton composition does not ask much of institutions, but what it asks is non-negotiable. This is the list of structural preconditions required for the architecture to operate at an institution, stated as requirements rather than tasks.

Institutions must expose an institutional compute tier. At minimum: authenticated interfaces through which learner nodes can consult institutional models grounded in the institution's corpus. Open-weight models on institutional GPUs are sufficient; the technical capability has been demonstrated repeatedly. The institutional requirement is not capability. It is will — the decision that the institution's compute and corpus are part of the learner's cognitive substrate.

Institutions must populate the node composition. Teacher nodes, department nodes, library nodes, advisor nodes, and at least one specialist node (writing center, research consultation, or equivalent) are the minimum viable institutional composition. A composition with fewer than five node types does not exhibit the full composability benefits. Institutions may add more; they should not deploy with fewer.

Institutions must respect the learner's sovereignty. Telemetry belongs to the learner. The dock belongs to the learner. The routing config belongs to the learner. The provenance arc belongs to the learner. Institutions may offer default configurations; they must not mandate them. Institutions may observe aggregate patterns; they must not inspect individual learner telemetry or arc content without explicit consent declared in the learner's zone schema. The institution is the first best environment for the learner's cognitive development. It is not the owner of the learner's cognition.

Institutions must operate consent transparently. Every composition interaction that crosses a node boundary must carry an inspectable consent scope. A student consulting the biology department autonomaton sees what consent scope applies; a teacher consuming aggregate cohort telemetry sees the scope under which the aggregation is permitted; a library node returning a retrieval sees the scope of the query. Consent is not a policy document; it is a structural property of every pipeline traversal that crosses a node boundary.

Institutions must publish declarative validation authorities. Every institutional node — department, teacher, TA, library, specialist — whose provenance may appear in learner credentials must publish, under its own zones.schema, the classifications it is willing to co-sign and the conditions it requires. The co-sign protocol specified in §10.6 operates on these declarations deterministically. Without published validation authorities, the institution's name can appear in credentials no institutional body has actually endorsed, and the credential loses the structural backing that distinguishes it from institutional-judgment-via-policy.

Institutions must produce credentials compatible with sovereign provenance. This does not require institutions to issue the Learner Autonomaton's credential — the learner issues that themselves. It requires institutions to accept that the learner's sovereign credential is a legitimate artifact, and to build transcripts and certifications that do not conflict with or obscure it.

Institutions must offer alumni composition access. Graduates retain consultation access to the institutional composition after graduation, at a defined service level, as a terms-of-degree entitlement. This is what makes the lifecycle story (§16) real. Without it, the institutional grounding that made the undergraduate cognition valuable begins to go stale the moment the learner leaves campus.

Foundations must coordinate recognition. For the Credentials of Value framework to operate in this architecture, foundations — Lumina, HumanityAI, and peer institutions — must establish interoperability standards for how employers, graduate programs, and civic institutions recognize sovereign credentials and query sovereign arcs. This is coordination work, not funding work. The architecture does not require a grant. It requires a recognition framework.

The architecture must remain open. The Grove Foundation publishes the Learner Autonomaton specification under CC BY 4.0 as part of the Grove standards series. No institution can fork it into a proprietary variant and call it compliant. Compliance is tested against the published invariants. Variance is permitted in configuration, landscape, and node-taxonomy population. Compliance is required in pipeline, files, zones, human approval, composition interfaces, and provenance integrity. The mechanisms by which compliance is maintained against an openly published standard — certification mark, conformance registry, federation-protocol metadata, federation-behavior pricing — are specified in §20.

These are preconditions, not tasks. They describe what the world has to look like for this architecture to do what it claims. The world does not currently look like this. The work of the Grove Foundation, of Purdue if it chooses, and of Lumina if it chooses, is to make the world look like this.

The Foundation's Structural Role

A specification published under CC BY 4.0 has the capture-resistance property identified in §1 — it cannot be withdrawn, relicensed, or preempted. It also has a vulnerability that every open standard inherits from its open-ness: anyone can fork it. A vendor can publish a proprietary product that claims “Autonomaton-compatible” branding, omits the Red zone enforcement, keeps the marketing language, and gradually shifts the operating semantics of the standard into proprietary extensions. Microsoft executed this pattern against Java, Netscape, and several other open systems. The defense pattern is institutional, layered, and forty years old.

The Grove Foundation's role in maintaining this specification is the defense, in four layers — three institutional, one architectural.

The certification mark

“Autonomaton” is filed as a certification mark with the U.S. Patent and Trademark Office (Class 9 for downloadable conformant implementations; Class 42 for certification and standards-development services). A certification mark differs from a conventional trademark in that its function is to attest conformance to a published standard rather than to identify a single producer. Use of the mark without successful conformance testing creates legal standing for the Foundation to compel removal. This is the structural mechanism that protects Energy Star, USDA Organic, and UL Listed.

The conformance registry

The Foundation publishes which implementations have passed conformance testing against the architectural invariants specified in §4 — the five-stage pipeline traversal, the three-file structure, the zone enforcement (including Red-zone permission absence at the operating-system level, not merely at the application level), the human-approval gate at Stage 4, and the composition interfaces specified in §10. Implementations that have passed are listed; implementations that claim compliance without passing are publicly flagged as non-conformant. In markets that treat reputation as currency — higher education, healthcare, financial services, regulated manufacturing — public flagging carries direct economic cost.

The federation-protocol layer

This is the architectural defense, and it is the one most distinctive to this specification. Every response passed between Autonomatons via the composition interfaces (§10) carries a cryptographically hashed provenance chain. That chain records not only which nodes the claim has traversed and under what consent, but also each traversed node's conformance status at the moment of traversal and — for competency attestations that will appear in credentials — the validating node's co-sign authority version at the moment the attestation was issued. A receiving node can inspect the chain and filter for conformance at the protocol level. A learner's node can be configured to refuse responses originating from non-conformant nodes. A federation can specify, in its consent schema, that participation requires conformance. The architecture itself becomes the enforcement mechanism, without any party in the federation having to take voluntary action — non-conformance is simply not interoperable at the technical layer with parties that have configured their nodes to require it.

The federation-behavior layer

Above the protocol layer sits a behavioral one that the Foundation does not have to manage. A learner choosing which employer to share their sovereign credential with will rationally prefer an employer whose autonomaton is itself conformant — because handing provenance to a non-conformant architecture is handing one's pattern history to a system specifically designed without the protections that make such handing safe. A school deciding which institutional autonomatons to interoperate with will prefer the conformant ones, because non-conformance often signals the presence of cohort-telemetry mining or zone-enforcement absence. The expert market specified in §15 will price provenance from conformant nodes higher than provenance from non-conformant claimants, because conformant provenance is what makes a specialty federation trustworthy in the first place. The federation, in aggregate, prices the difference between conformance and non-conformance through differential trust — and the Foundation does not have to manage any of this, because every party in the federation has structural incentive to prefer conformance.

These four layers do not stop gaming. They create asymmetric cost: gaming is structurally permitted under the open license, but every layer makes gaming progressively more expensive and progressively less consequential. The Foundation declares conformance through the certification mark and the registry. The protocol layer makes conformance a queryable property of every interaction. The federation-behavior layer prices the difference. Together they constitute the quality register the architecture requires to function — reputation of reputation, made structural.

A clarification worth naming explicitly, because it changes the political economy of standards adoption: the Foundation does not need enforcement authority over every implementation to maintain the meaning of the standard. It needs only to operate the certification mark and the registry honestly, and to maintain the protocol-layer conformance metadata in the published specification. The federation does the rest. This is the same property that allows the Internet Engineering Task Force to maintain the meaning of TCP/IP without policing every router — the protocol's behavior is self-enforcing, because a non-conformant router cannot exchange traffic with conformant ones without breaking the exchange. The Autonomaton specification inherits this property by design.

The practical consequence for institutions considering adoption: the open license is not a risk to the standard's meaning; it is the precondition for the standard's defensibility. Were the specification proprietary, its meaning would depend entirely on the goodwill and continued solvency of its publisher. As an open standard with the four layers above, its meaning depends on a distributed network of incentives that is structurally more durable than any single institution. This is the property that makes the Learner Autonomaton, alone among the architectures currently competing for the educational-cognition substrate, capable of being adopted by serious institutions without committing them to a vendor relationship that might outlive their interest in maintaining it.

Out of Scope

This spec deliberately does not address a number of questions. They are worth naming so that the reader does not mistake silence for omission.

Implementation details. Specific stack choices, programming languages, deployment topologies, database schemas. These belong in reference implementation documentation, not in the vision requirements specification.

Vendor selection. Which open-weight models to deploy on institutional compute, which retrieval index to use, which client-side runtime for learner nodes. These are deployment decisions, made by each institution according to its own capabilities and constraints.

Pilot program structure. Cohort size, semester sequencing, evaluation methodology, budget. These belong in a pilot operations document produced jointly by the deploying institution and the Grove Foundation, not in the architectural specification.

Conformance testing details. The test suites, certification process, fee structures, and re-certification cadence that operationalize the certification mark and conformance registry described in §20 are maintained as separate Grove Foundation operational documents, not in the vision requirements specification.

Regulatory treatment of sovereign credentials and arcs. How sovereign credentials and queryable provenance arcs interact with FERPA, with institutional accreditation, with regulated-profession licensing bodies, with data-protection regimes in other jurisdictions. These are policy questions that require coordinated work with foundations, regulators, and accrediting agencies.

Economic structure of specialty federations. Pricing mechanisms for provenance arc access, payment flows, federation governance structures, dispute resolution, determination of what compression levels produce durable market value for different kinds of knowledge. These are design problems for the federations themselves, to be worked out through debate and experimentation once the architecture is adopted. The architecture's commitment is to preserve the substrate, not to prescribe the market that forms on it.

K–12 adaptation. This spec is written for post-secondary deployment. The invariants apply to younger learners, but the node taxonomy and the consent-scope defaults require substantial rethinking for contexts where learners are minors.

Non-university institutional contexts. The architecture applies to corporate learning, professional development, public library educational programs, and many other contexts. This spec is scoped to the post-secondary university case because that is where the first-mover leverage is highest. Adaptation to other contexts is future work.

Relationship to existing commercial products. This spec is not a competitive analysis. Commercial products that implement the Autonomaton pattern and the composition interfaces specified here are welcomed. Commercial products that refuse to implement the pattern and continue to platform cognition are the structural problem this spec exists to counter.

Closing

The argument here is smaller than it sounds and larger than it seems.

It is smaller because it does not require any institution to abandon what it already does. Universities keep teaching. Foundations keep funding. Faculty keep writing. Libraries keep collecting. Writing centers keep coaching. Advisors keep advising. GPUs keep spinning. Everything currently valuable remains valuable. The Learner Autonomaton is a routing layer over existing endowment, composed into an institutional node topology that is already latent in how the institution already operates.

It is larger because the routing layer changes what the endowment means. Compute, corpus, faculty output, library holdings, writing-center expertise, advising practice, peer-cohort life — all of it becomes a substrate for sovereign cognition that leaves campus in every graduate, composes with the world they enter, memorializes the judgment the graduate renders across a lifetime, and grows for the rest of that life. The transcript becomes vestigial. The credential becomes portable. The institution becomes a custodian rather than a gatekeeper. The alumni relationship becomes a lifelong cognitive partnership. The learner becomes the owner of the artifact that records what they actually learned and what they decided was not worth pursuing, and their sovereign capability becomes monetizable as a participant in a new economic primitive that does not require them to rent their cognition from a vendor for the rest of their working life.

Under this architecture, credentials of value are not a target. They are a byproduct of how the system already works. A learner who operates a sovereign node for four years inside an institutional composition emerges with a validated, federation-ready cognitive capability whose provenance is inspectable and whose continued growth is structurally guaranteed. The learner did not receive a credential; the architecture is the credential. Goal 2040 becomes achievable not because a policy coalition willed it into being, but because the mechanism that produces credentials of value has been installed in a hundred institutions and ten million graduates are already carrying them forward.

The design principle is not complicated. It is the same principle that produced the electrical building code, the TCP/IP stack, and every other piece of infrastructure that outlasted the commercial interests that initially opposed it: put the control where the value is produced, not where the vendor is incorporated. The value of a learner's cognition is produced inside the learner, inside the institution that substrates them, inside the federation of peer nodes they participate in, and inside the specialty compositions they will enter after graduation. The architecture should put control in each of those places and at every boundary between them. The Foundation's role, specified in §20, is to ensure that the standard those boundaries enforce remains the standard the architecture published — not because the Foundation has the authority to compel it, but because the standard is structured so that the federation enforces it through its own incentives.

Where the value is produced, in the case of this architecture, is also where the architecture itself is being deliberately planted: in central Indiana, where 150 years of institutional pipeline between Purdue University and Eli Lilly and Company have created the most architecturally literate regional labor market in the country, and where the compliance-heavy industries that already think structurally about automation are simultaneously the regional employers most likely to read a sovereign credential the day it is issued. Architectures of this kind do not scale by being announced. They scale by taking root in the soil where their constraints are best understood, and propagating outward from there. The seed is the architecture. The soil is the regional terroir specified in §17. The federation specified in §15 is what compounds when sovereign credentials enter that labor market and propagate outward — to every other region, every other industry, every other graduate.

Design is philosophy expressed through constraint. The constraints of the Learner Autonomaton — five stages, three files, three zones, one human at every approval gate, one pattern resolving to one tier at any given moment, one composition interface shared across every participating node, one capture mechanism through which all memorialization flows, one commitment to preserve the record so that its future value may be discovered, one quality register through which the standard maintains its meaning, one terroir in which the architecture was pressure-tested before it was generalized — express a philosophy the current educational infrastructure does not yet have language for: the durable artifact of a life well-thought is the cognition itself; the institution's job is to be the first and best composition that cognition grows in; the architecture's job is to memorialize the judgment the learner renders — confirmed paths and confirmed non-paths alike — so the learner's attention can keep rising; the federation of graduates' sovereign arcs is the economy that this rising attention compounds into; the Foundation's job is to keep the standard honest while the federation keeps it valuable; and the place the seed is being planted is the place that grew the design.

The substrate-not-routing inversion stated at §1 is the design insight that produced the architecture in this specification — and the design insight that anticipates where Grove's next standards will go. Every property in §1 through §21 follows from it. Every later domain that composes against GRV-001 — clinical, civic, scientific, professional — will demonstrate the same property at a different scale. The educational case is one application. Many will follow, by design.

The architecture is ready. The composition is specifiable. The institutional hallway — Purdue to Lumina, Lumina to HumanityAI, HumanityAI to Omidyar — is already standing. The terroir is already in place. The specification is published. The invitation is open.

Jim Calhoun · Founder, The Grove Foundation · the-grove.ai