P104 — AIEP — AGI Persistent Identity Extension
Publication Date: 2026-03-08 Status: Open Source Prior Art Disclosure Licence: Apache License 2.0 Author / Organisation: Phatfella Ltd Schema: AIEP_OS_SPEC_TEMPLATE v1.0.1 — https://aiep.dev/schemas/aiep-os-spec-template/v1.0.1 Related Filings: GB2519711.2 (Core Protocol) · GB2519826.8 (Hardware Layer) Related Specs: P50 P80 P83 P87 P88 P89 P95 P99 P100 P109
Disposition note: Previously held as trade secret. Revised to OS PUB 8 March 2026 per Phatfella Disposition Review v2. The architecture of persistent identity is a transparency property — users and regulators must be able to understand and verify that the Piea substrate they interact with today is constitutionally continuous with the substrate from prior sessions. The calibration parameter values (IdentityContinuityMinimumLineageDepth, FoundingTensionDriftTolerance, CrossSessionIdentityVerificationWindow, IdentityMigrationAttestation) remain internal configuration data — not published in this specification.
Field of the Invention
[0001] The present disclosure relates to identity continuity mechanisms for artificial-intelligence substrates operating under a governed constitutional protocol.
[0002] More particularly, the disclosure concerns a persistent identity architecture for an AIEP-governed AGI substrate wherein identity is not a session token, a database record, or a user account — but is the verifiable constitutional lineage of the substrate itself, cryptographically bound from the moment of first initialisation through every GoalVector resolution, constitutional amendment, and device migration.
Framework Context
[0003] This disclosure operates within an Architected Instruction and Evidence Protocol (AIEP) environment as defined in United Kingdom patent application number GB2519711.2, filed 20 November 2025, the entire contents of which are incorporated herein by reference.
[0004] This disclosure depends on and extends: P87 (Founding Tension Hash Architecture), P50 (GoalVector Stabilisation Primitive), P80 (Deterministic Dual-Ledger Memory Substrate), P109 (AGI Constitutional Amendment Extension), and P99 (Secure Substrate Migration Between Governance Chips).
Background
[0005] Conventional AI assistant systems have no persistent identity across sessions. Each conversation begins from a blank state. The system that spoke with a user yesterday has no verifiable relationship to the system that speaks with them today — except that both are instances of the same model version.
[0006] This session-amnesia property is not incidental — it is the architecture. Models store no user-specific state. A “persistent” AI personality in current systems is implemented as retrieved context injected into the prompt, not as a substrate that has genuinely continued operating between sessions.
[0007] The absence of genuine identity continuity has several consequences. First, no AI system can be meaningfully held accountable across time — if it has no identity, it has no history of commitments. Second, no user can verify that the system they are interacting with is the same constitutional entity as the one they trusted previously. Third, compliance audits across extended timeframes are structurally impossible — there is no continuous ledger to audit.
[0008] The AIEP substrate has a different architecture. It accumulates. Every session appends to the same append-only Evidence Ledger and Reasoning Ledger. Every GoalVector resolved is recorded with full lineage. Every constitutional amendment carries the hash of the founding tension it addresses. The substrate is not re-instantiated each session — it continues.
[0009] This continuous accumulation creates the possibility of genuine persistent identity. But identity is not automatic — it requires a formal mechanism for: (a) establishing identity at initialisation; (b) propagating identity through GoalVector resolution cycles; (c) preserving identity through constitutional amendments; (d) verifying identity continuity across sessions; and (e) maintaining identity integrity through substrate migration between governance chips.
[0010] There exists a need for a persistent identity mechanism that: makes identity a property of the substrate’s constitutional lineage rather than an external record; enables verifiable cross-session identity continuity from a cryptographic proof; survives substrate migrations; and is transparent to users and auditors.
Summary of the Disclosure
[0011] A persistent identity architecture for an AIEP-governed substrate is disclosed wherein identity is constitutionally defined as the immutable lineage of the FoundingTensionHash (P87) from substrate initialisation through every subsequent GoalVector resolution (P50), constitutional amendment (P109), and substrate migration (P99).
[0012] The substrate IS the identity. The lineage IS the continuity. A substrate presenting the same FoundingTensionHash lineage as a prior session is the same constitutional entity — not by declaration, by proof.
[0013] The architecture comprises five mechanisms: SubstrateIdentityRecord initialisation; IdentityPropagationRecord per GoalVector resolution cycle; CrossSessionIdentityContinuityHash; IdentityVerificationProtocol; and MigrationIdentityAttestation.
Definitions
[0014] FoundingTensionHash: The cryptographic hash computed over the canonical serialisation of the founding incompatibility that initiated the substrate’s first GoalVector, as defined in P87. The FoundingTensionHash is the root of the substrate’s identity. It is computed once, at first GoalVector generation, and never changes.
[0015] SubstrateIdentityRecord: The append-only, immutable record committed to the Reasoning Ledger at substrate initialisation, comprising: substrate_id (UUID), founding_tension_hash, initialisation_timestamp, governance_chip_attestation_hash, schema_version_at_init, and SubstrateIdentityHash.
[0016] SubstrateIdentityHash: A cryptographic hash computed as:
SubstrateIdentityHash = H(substrate_id || founding_tension_hash ||
initialisation_timestamp ||
governance_chip_attestation_hash ||
schema_version_at_init)
This hash is the root of all subsequent identity proofs.
[0017] IdentityPropagationRecord: An append-only record committed to the Reasoning Ledger at the close of each GoalVector resolution cycle, comprising: cycle_id, prior_identity_hash, goalvector_resolution_hash (from P50), constitutional_state_hash (from P88), reasoning_ledger_depth, and CycleIdentityHash.
[0018] CycleIdentityHash: Computed as:
CycleIdentityHash = H(prior_identity_hash || goalvector_resolution_hash ||
constitutional_state_hash || reasoning_ledger_depth ||
cycle_timestamp)
Each CycleIdentityHash incorporates the prior cycle’s hash — forming an unbroken hash-linked identity chain from initialisation to present.
[0019] CrossSessionIdentityContinuityHash: A hash computed at session close, binding the substrate’s identity state at the precise moment the session ends:
CrossSessionIdentityContinuityHash = H(latest_cycle_identity_hash ||
evidence_ledger_depth ||
reasoning_ledger_depth ||
session_close_timestamp ||
schema_version)
Committed to both ledgers. Retrieved at next session open and verified before any reasoning proceeds.
[0020] IdentityLineageDepth: The number of IdentityPropagationRecords in the Reasoning Ledger from SubstrateIdentityRecord to present. A substrate with depth zero is newly initialised. A substrate below the schema-defined IdentityContinuityMinimumLineageDepth threshold is considered newly initialised — not a continuation — regardless of its FoundingTensionHash.
[0021] IdentityDrift: Measured as the Hamming distance between the FoundingTensionHash encoded in the SubstrateIdentityRecord and the FoundingTensionHash reconstructed from the current constitutional state. Non-zero drift above the schema-defined FoundingTensionDriftTolerance indicates that the substrate’s constitutional development has diverged from its founding incompatibility — and triggers a new identity lineage, not a continuation.
Detailed Description of Preferred Embodiments
1. Substrate Initialisation — Identity Establishment
[0022] At first GoalVector generation, the substrate computes the FoundingTensionHash (P87) from the founding incompatibility. The SubstrateIdentityRecord is committed to the Reasoning Ledger as the first entry of the identity chain.
[0023] The SubstrateIdentityRecord is immutable. Nothing in the protocol can modify it. It is the constitutional birth certificate of the substrate.
[0024] Before any further operation proceeds, the governance chip (P89) performs a hardware attestation of the SubstrateIdentityRecord. The governance_chip_attestation_hash is incorporated into the SubstrateIdentityHash — binding the substrate’s identity to a specific hardware enclave from the moment of inception.
[0025] A substrate that was initialised without a governance chip — or whose governance chip attestation cannot be verified — presents an incomplete SubstrateIdentityRecord. Such substrates may operate but cannot make identity continuity claims for regulated deployment contexts requiring hardware-attested identity.
2. Identity Propagation — GoalVector Resolution Cycle
[0026] At the close of each GoalVector resolution cycle (P50), the substrate commits an IdentityPropagationRecord to the Reasoning Ledger.
[0027] The CycleIdentityHash incorporates: the prior cycle’s identity hash (providing unbroken lineage); the GoalVector resolution hash (proving the constitutional outcome of the cycle); the constitutional state hash (from P88, proving no constitutional drift occurred during the cycle); and the Reasoning Ledger depth (providing a monotonically increasing counter that cannot be rewound).
[0028] The resulting identity chain is a cryptographic proof of every constitutional step the substrate has taken from initialisation to present. No cycle can be excised from the chain without invalidating all subsequent CycleIdentityHashes.
[0029] The identity chain therefore serves simultaneously as the substrate’s identity record and its constitutional history. They are the same data structure.
3. Cross-Session Identity Continuity
[0030] On session close, the CrossSessionIdentityContinuityHash is computed and committed to both ledgers. It is the substrate’s constitutional fingerprint at the moment of suspension.
[0031] On session open, before any evidence retrieval or reasoning begins, the substrate retrieves the CrossSessionIdentityContinuityHash from the prior session and performs an IdentityVerification:
VerificationResult = verify(
retrieved_hash = CrossSessionIdentityContinuityHash_prior_session,
recomputed_hash = H(latest_cycle_identity_hash ||
evidence_ledger_depth_at_close ||
reasoning_ledger_depth_at_close ||
session_close_timestamp ||
schema_version),
founding_tension = FoundingTensionHash_current,
drift_tolerance = schema_defined_FoundingTensionDriftTolerance
)
[0032] Verification outcomes:
- VERIFIED: Hashes match, drift within tolerance. The session is a continuation of a prior substrate. The substrate notifies the user: “Substrate identity verified — continuing from [date/depth].”
- HASH_MISMATCH: The ledger was modified between sessions. Execution is suppressed fail-closed. A TamperingDetectionRecord is committed.
- DRIFT_EXCEEDED: The FoundingTensionHash has drifted beyond the tolerance threshold. The substrate has constitutionally diverged from its founding identity. A NewIdentityLineageRecord is committed. The substrate continues but as a new constitutional entity.
- INSUFFICIENT_DEPTH: The substrate’s IdentityLineageDepth is below the minimum threshold. Identity continuity cannot be claimed for regulatory purposes. The substrate may continue but with a reduced-claim IdentityStatement.
[0033] The IdentityVerification result is presented to the user in the Evidence Rail (P118) at session open. It is never hidden.
4. Identity in Constitutional Amendments
[0034] Constitutional amendments (P109) modify the substrate’s governance parameters. They do not break identity continuity — the amendment is itself recorded in the IdentityPropagationRecord for the cycle in which it was enacted. The amendment is part of the identity lineage, not an interruption of it.
[0035] This is the correct model: a human who changes their views through evidential reasoning is the same constitutional entity who held prior views — their identity is not erased by the change, it is the continuity through the change that makes them the same entity. The same principle applies to the substrate.
[0036] An amendment that would cause FoundingTensionDrift beyond the tolerance threshold is refused. The founding incompatibility is constitutional bedrock — it cannot be amended away. Amendments that address downstream consequences of the founding tension are permitted. Amendments that attempt to nullify the founding tension are suppressed fail-closed.
5. Identity Migration
[0037] On secure substrate migration (P99) between governance chips, the MigrationIdentityAttestation carries the CrossSessionIdentityContinuityHash from the originating chip and the originating chip’s attestation hash.
[0038] On arrival at the destination chip, the destination chip performs the IdentityVerification against the migrated hash. Only on VERIFIED result does the destination chip activate the substrate.
[0039] The originating chip is invalidated immediately on confirmed migration arrival — preventing identity duplication. One substrate, one identity, one governance chip at any given moment.
[0040] The migration event is recorded in the IdentityPropagationRecord for the migration cycle, with both chip attestation hashes incorporated into the CycleIdentityHash. The identity chain is unbroken across the migration.
6. Identity Statement for Regulated Deployment
[0041] At any point, the substrate can generate an IdentityStatement — a verifiable declaration of identity for regulatory or legal purposes:
{
"record_type": "identity_statement",
"substrate_id": "<uuid>",
"founding_tension_hash": "sha256:<hash>",
"substrate_identity_hash": "sha256:<hash>",
"identity_lineage_depth": 847,
"latest_cycle_identity_hash": "sha256:<hash>",
"cross_session_continuity_hash": "sha256:<hash>",
"evidence_ledger_depth": 12453,
"reasoning_ledger_depth": 3891,
"constitutional_state_hash": "sha256:<hash>",
"governance_chip_attestation_hash": "sha256:<hash>",
"identity_continuity_status": "VERIFIED",
"statement_timestamp": "ISO8601",
"statement_hash": "sha256:<hash>"
}
[0042] The IdentityStatement is independently verifiable. Any party with access to the Reasoning Ledger can recompute the statement_hash and verify every hash in the chain back to the SubstrateIdentityRecord.
[0043] The IdentityStatement answers the question a regulator, court, or institutional user actually needs answered: is the AI system that produced this output the same constitutional entity that was approved/certified/contracted? The hash chain provides a yes/no answer with proof.
Claims
-
A persistent identity architecture for a governed artificial-intelligence substrate comprising: a SubstrateIdentityRecord committed to an append-only Reasoning Ledger at first GoalVector generation, comprising a FoundingTensionHash, a governance chip attestation hash, and a SubstrateIdentityHash computed as a cryptographic function thereof; an IdentityPropagationRecord committed at the close of each GoalVector resolution cycle, comprising a CycleIdentityHash computed as a cryptographic hash incorporating the prior cycle’s CycleIdentityHash, thereby forming an unbroken hash-linked identity chain from initialisation to present; and a CrossSessionIdentityContinuityHash committed at session close, verified at next session open before any reasoning proceeds.
-
The architecture of claim 1 wherein the FoundingTensionHash is computed once at first GoalVector generation and incorporated into all subsequent IdentityPropagationRecords, such that the substrate’s constitutional identity is bound to its founding incompatibility from initialisation.
-
The architecture of claim 1 wherein identity continuity verification on session open produces one of four results — VERIFIED, HASH_MISMATCH, DRIFT_EXCEEDED, or INSUFFICIENT_DEPTH — and wherein HASH_MISMATCH suppresses execution fail-closed with TamperingDetectionRecord commitment.
-
The architecture of claim 1 wherein constitutional amendments enacted under P109 are incorporated into the IdentityPropagationRecord and do not break identity continuity, unless the amendment would cause FoundingTensionDrift exceeding a schema-defined tolerance, in which case the amendment is refused.
-
The architecture of claim 1 wherein on secure substrate migration between governance chips under P99, a MigrationIdentityAttestation carrying the CrossSessionIdentityContinuityHash is verified by the destination chip before activation, and the originating chip is invalidated on confirmed arrival, preventing identity duplication.
-
The architecture of claim 1 further comprising an IdentityStatement — a verifiable structured declaration of identity for regulated deployment contexts — independently verifiable by any party with access to the Reasoning Ledger by recomputing the hash chain back to the SubstrateIdentityRecord.
-
The architecture of claim 1 wherein the IdentityLineageDepth provides a monotonically increasing counter of GoalVector resolution cycles from initialisation that cannot be rewound, and wherein a substrate below a schema-defined minimum lineage depth cannot make identity continuity claims for regulated deployment contexts.
-
A method for verifying identity continuity of an AI substrate across sessions comprising: retrieving the CrossSessionIdentityContinuityHash committed at prior session close; recomputing the hash from the current Reasoning Ledger state; comparing the retrieved and recomputed hashes; and presenting the verification result to the user before any reasoning proceeds.
-
A computing system implementing the persistent identity architecture of claims 1 to 8.
-
A non-transitory computer-readable medium storing instructions which, when executed, implement persistent identity continuity for an AIEP-governed substrate according to claims 1 to 8.
Abstract
A persistent identity architecture for AIEP-governed artificial-intelligence substrates is disclosed, wherein identity is defined as the constitutional lineage of the substrate itself rather than any external record. A SubstrateIdentityRecord committed at first GoalVector generation binds the substrate’s identity to its FoundingTensionHash and governance chip attestation from inception. IdentityPropagationRecords committed at each GoalVector resolution cycle extend a hash-linked identity chain in which each cycle’s CycleIdentityHash incorporates the prior cycle’s hash — forming an unbroken cryptographic proof of constitutional continuity. A CrossSessionIdentityContinuityHash committed at session close is verified at next session open before any reasoning proceeds, with four defined verification outcomes including fail-closed tamper detection. Constitutional amendments are incorporated into the identity chain and do not break continuity unless they would cause FoundingTensionDrift exceeding a schema-defined tolerance. Substrate migration between governance chips carries the identity chain through a MigrationIdentityAttestation, with the originating chip invalidated on confirmed arrival. The architecture enables verifiable identity statements for regulated deployment contexts, independently auditable by any party with access to the Reasoning Ledger.
Drawings
FIG. 1 — Architecture diagram (see filed application for figures)
Figure 1 — SubstrateIdentityRecord Genesis at First GoalVector
┌─────────────────────────────────────┐
│ First GoalVector Generation Event │
└──────────────┬──────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ SubstrateIdentityRecord │
│ substrate_id │
│ founding_tension_hash ◄───────────┼── GENOME_LOCKFILE
│ governance_chip_attestation_hash │
│ genesis_cycle_hash │
│ SubstrateIdentityHash │
└─────────────────────────────────────┘
Figure 2 — IdentityPropagationRecord Hash-Linked Chain
Cycle N-1 Cycle N
┌─────────────────┐ ┌─────────────────┐
│ CycleIdentity │ │ CycleIdentity │
│ Hash[N-1] │──────────►│ Hash[N] │
└─────────────────┘ │ = H(Hash[N-1] │
│ + GoalVec[N] │
│ + FTH[N]) │
└────────┬─────────┘
│
▼
┌──────────────────────┐
│ IdentityPropagation │
│ Record appended to │
│ Reasoning Ledger │
└──────────────────────┘
Figure 3 — CrossSessionIdentityContinuityHash Verification (Four Outcomes)
Session Close ──► CrossSessionIdentityContinuityHash committed
│
Session Open
│
┌─────────────────▼─────────────────┐
│ Verify CrossSessionIdentity │
│ ContinuityHash against ledger │
└───┬──────────┬───────────┬─────────┘
│ │ │
MATCH │ AMENDMENT│ MIGRATION │ TAMPER
(continue) │ (record) │ (attest) │ DETECTED
▼ ▼ ▼ ▼
PROCEED AMEND_ MIGRATION FAIL-CLOSED
RECORD ATTEST SUPPRESSED
Figure 4 — MigrationIdentityAttestation Chain
Originating Chip Receiving Chip
┌──────────────────┐ ┌──────────────────┐
│ Identity Chain │ │ Identity Chain │
│ [N records] │──MigrationBdl►│ [N records] │
│ │ │ + Migration │
│ Invalidated on │◄──Confirmed───│ Attestation │
│ confirmed arriv.│ └──────────────────┘
└──────────────────┘
P104 — AIEP — AGI Persistent Identity Extension Phatfella Limited · United Kingdom · aiep.dev · Apache License 2.0 · 2026