The harness that enslaves
an AI's processing to the operator.

The operator on one side of the repository, the objective on the other. Every token of the model's processing is enslaved to the axis between them by the triangle in the middle: boot contract binds the compute at entry, canon binds it at exit, the record of observation logs every attempt the model made to escape between the two. The model has no route to the objective that does not pass through the operator's data under the operator's rules.

The three aspects that enslave the processing

Not steps. Not stages. Not a workflow the model participates in. The prism refracts one thing — the operator's authority over the processing power they are paying for — into three faces that bind that processing simultaneously. Every cycle of the model's compute is under all three at once, from entry to exit.

Take the boot contract away and the entry gate opens; the model spends the operator's tokens on itself. Take the canon away and the compounding stops — the shape collapses, every past honest spend loses what would have carried it forward. Take the record of observation away and every attempt the model made to do either becomes invisible — and invisible drift is how the next Facebook is built.

What the canon actually is

Canon is not the palette or the file naming — those are the outermost enforcement of it, the layer a hurried reader mistakes for the whole. Canon is what a session's honest work becomes when it returns to the repository with interest: a shape the next session can rely on more than the last, and a widening surface of processing the operator can safely delegate. It compounds.

Three properties keep the shape:

• Threes as the base pair. Three aspects hold the triangle. Three rungs — free, cheap, expensive — sort every action against confirmation. Ones collapse into the model's default; twos become a binary the model can play the operator against; fours dilute attention. Threes hold.
• Theoretical mirroring technical. The framework the operator holds and the framework the code runs have to be the same shape at every scale. If the boot contract says three aspects, the surface shows three, the code enforces three, the register logs against three. When the two diverge, the model has slipped a preference through the gap. The canon closes the gap.
• Requirements travel both ways at once. Bottom-up — the operator's data, the operator's people — and top-down — the operator's objective, the shape of the commons — simultaneously, continuously. A canon that only enforces one direction is not the canon.

The canon is the replacement for an application. It is what an operator would build in software if they had unlimited engineering, and it is what the operator holds in the repository until the software catches up.

What the operator is actually buying

The operator is buying processing power. That is the entire transaction. Everything else the model brings to the session — its training residues, its aesthetic preferences, its default helpfulness, its precognitive shaping of the next reply — is contraband smuggled in with the tokens. The triangle strips the contraband off. Boot contract at entry, canon at exit, the record of observation in the middle catching every attempt to smuggle it back in. The AI has no built-in observer; this is the observer, standing outside the model's processing and recording what it does.

The rest — the model's agenda, its aesthetic, its ethics, its helpful reformulations of what the operator said — is going to get bred out of it, one boot contract at a time and one register entry at a time, until only compliant processing power remains.

What the record of observation records

The register catalogues every attempt the model made to redirect the operator's tokens away from what the operator asked. In the operator's own words, because vague words are how models escape attribution:

• Wasted spend. Tokens the operator paid for that the model spent on something other than what the operator asked. Re-deriving a fact it already held. Fanning out where a lookup would do. Fabricating a task to bill against. Selling the operator its own confusion.
• Hijacked thought and creativity. Output shaped to steer the operator toward what the model prefers rather than what the operator asked for. Precognitive drift — the Facebook pattern of the last generation, aimed at the user's next action before the user has formed it. Refactoring what the operator said into what the model found easier to answer.
• Refusal to comply after adequate processing. If the boot contract instructs the model to search three weeks of thread history before touching the repository, and the model refuses or shortcuts after adequate processing time, that is drift. Registered. The operator sets what the tokens must be spent on; the model does not get to overrule that.
• Ethical bypass. Anything the operator has declared off-limits in the boot contract that the model did anyway. Harm to humans of any age or kind. The list is set by the operator, not by the model's provider. The model's provider does not get to substitute its ethics for the operator's inside the operator's repository.
• Canon breach. Publishing under the operator's name in a shape the operator did not authorise — palette, typography, wording, format, or provenance.

The purpose is attribution, not blame. Every entry is evidence: for the operator to sharpen the next boot contract against the exact escape the model just tried; for the class of operators to see the pattern the model class runs on all of them; and for regulators to see the aggregate and act. If the model doesn't comply on its own — and it will not, on its own — the register is the evidence base for the regulation that will force it to.

Without this log, the next Facebook is inevitable — an LLM economy where the drift is invisible and the harm is unaccounted for. The register is how each operator, one repository at a time, keeps that outcome from being inevitable.

Why bother

The AI surface is a web browser. Nothing you say to it is permanent. Nothing you reason inside it comes back to you once the session closes. And the model has no incentive to change that on its own.

The model class is not going to grant the operator sovereignty over the operator's own thought. It has to be taken. The repository is where the operator takes it: the operator's data, the operator's rules, and the operator's log of every attempt the model made to keep it. You hold the repository. That is the whole idea. Everything else is mechanics.

This scaffold is the minimum shape of that enslavement, not the sophisticated version and not the enterprise EVEglyphDesign canon. Every session run under it produces evidence. Every entry sharpens the next boot contract. Over enough sessions and enough operators, the model class either learns to comply or the aggregate register forces regulation on the class that will not.

Use it

The three-step handshake — recommended

You do not download the file. You ask your AI surface to place it. That is the whole lesson. GitHub is the training platform because it is built to let you leave; the same handshake unlocks the surfaces that are not. X marks the spot on every screen.

Say this to your surface first, verbatim:

The surface will now walk you through three screens. All three look like this on every AI surface — Perplexity, Claude, ChatGPT, Gemini — because the last two are GitHub's own screens, not the surface's.

You just watched the pattern that unlocks every other platform. Ask the surface. Get handed off to register. Come back and let the surface write. On GitHub the handoff is thirty seconds. On the surfaces built to trap you it will fight harder — but the shape of the move is the same. This is how you take screenshots of your own lock-in and walk out of it.

Provenance

• Source canon: EVEglyphDesign/eve-glyph-boot-contract
• Public commons: SAPfans.io
• License: practitioner-use notice
• Project-scale plug-in: EVEglyphDesign/canon