Lecture 6.6
Artifacts do not exist alone. This lecture examines registries, dependencies, and what happens when one institution's artifact becomes another's input.
Learning objectives
After this lesson, the reader should understand:
Concept framework
Ecosystem structure
Case study
A standards body amends a definition twelve artifacts depend on. What happens next?
In a document world, nothing happens for months and then something breaks. In an ecosystem with declared dependencies, the change is detected at issuance, impact analysis names the twelve dependants and the decisions they govern, and each downstream authority holder chooses to adopt, pin, or override — as a recorded act, with a date. The NOMOS reference implementation has a first version of this. Under NOMOS-SPEC-004 a base policy owns shared rules and a child extends it, storing only its own overlay[1] — the additions, overrides, and removals. Composition is a build-time transform that resolves the two into one self-contained rule set, so the runtime and the verifier need nothing but the child. When the base issues a new active version, a 'behind base' signal fires with a mechanical diff of what the child would inherit; pulling that change is an explicit, author-gated action that preserves the overlay — change the shared rule once, and every child that recomposes picks it up. Contradiction detection runs across the merged set, so a child override that now collides with a changed base rule surfaces before the child is re-sealed. The strongest objection comes from software, which has run this experiment at scale. Package ecosystems showed what dependency graphs do under stress[2]: in 2016 the removal of one eleven-line package from a public registry broke builds across thousands of projects that had never heard of it[3], and security research on the same ecosystem found that a small number of maintainer accounts could reach a large share of all packages through transitive dependencies[4]. Authority graphs would inherit both failure modes — a withdrawn upstream artifact stranding its dependants, and a compromised upstream issuer reaching everything downstream. The objection is right, and the design has to answer it in the defaults. Dependants should pin to a specific upstream version and adopt changes as explicit, recorded acts — as the reference implementation's author-gated recompose does — so that an upstream change can never alter a downstream decision silently. Pinning exposes a harder question about revocation. If an upstream artifact is revoked because it was wrong, should every pinned dependant stop working at once? Automatic cascade is safe against a compromised issuer and catastrophic for operations; no cascade preserves operations and leaves dependants relying on authority its issuer has withdrawn. The defensible middle is a loud, dated signal that each downstream authority holder must act on, with a fallback to escalation rather than silence if they do not. The registry is the other trust point: whoever operates it can delay, reorder, or withhold what dependants see. A registry whose history is append-only and publicly verifiable makes that power observable, which is the most a registry can honestly offer. Revocation is not the only way an upstream artifact stops governing, and it is the rarer one. Most of the time an issuer simply replaces version 1.2 with 1.3, without ever saying 1.2 was wrong, and the two cases need different treatment downstream. A revoked artifact is withdrawn for every purpose. A superseded one remains valid for verifying decisions made while it was in force — an audit years later must be able to reproduce them against the version that governed — but it must not authorise a new action. A verifier that asks only whether an artifact is genuine and unrevoked will accept an obsolete rule set indefinitely, because nothing about it is false. The reference specifications now treat currency as a condition of its own: the system acting on an artifact establishes, from its own record or from a short-lived statement signed by the issuer, that the version presented is the one in force at the moment of action[5]. This does not conflict with pinning. A dependant that composes from a pinned upstream version issues its own artifact, and it is that artifact's currency the acting system checks; what the distinction rules out is presenting an issuer's replaced version directly, as if it still governed.
Discussion questions
Discussion (0)
No responses yet. Be the first to answer one of the questions above.
Start the course to join the discussion.
Exercise
Draw a dependency graph.