Why NSIGII is the carrier U‑POWER needs — and why a right you can't transmit intact isn't a right yet

The Capabilities of a Linkable‑Then File Format

Why NSIGII is the carrier U‑POWER needs — and why a right you can't transmit intact isn't a right yet
A right that cannot be represented, transmitted, verified and attributed intact cannot yet function as a machine-verifiable entitlement.
Nnamdi Michael Okpala (Uche) — OBINexus Computing

---

I spent this week finishing the integration of three repositories into one layered file format. It's called NSIGII, and its design principle has an ugly acronym I'm going to defend anyway: LTF — Linkable Then Format.

Most binaries link at compile time. ELF bakes the meaning in before the file exists on disk. LTF does the opposite: the file exists first, carries its own address and its own proof, and gets linked — resolved, verified, bound to a responsible party — before anything is allowed to act on it. Link‑before‑execute as a constitutional step, not an optimisation.

That sounds abstract until you have something that actually depends on it. I do. It's called U‑POWER, and this post is about why the two fit together like a key in a lock.

The problem U‑POWER hands you

U‑POWER — Umbrella, Papa, Oscar, Whiskey, Echo, Romeo — is our constitutional‑computing framework for human rights. Its claim, stated without metaphor, is that every legal entitlement is a computable power relation. Not a flat list of documents. The power to act within a system.

The maths is deliberately small: 5 senses × 5 senses × 5 senses × 5 senses = 5⁴ = 625. Five domains of what you can act on (Existence, Communication, Autonomy, Sustenance, Environment), five legislative dimensions, five sub‑rights (Access, Enforcement, Remedy, Non‑Discrimination, Participation), five implementation layers (Primary Duty → Procedural Safeguard → Enforcement Mechanism → Redress Pathway → Monitoring). Every entitlement a person holds gets a deterministic address in that space:

D1.CR.AC.1  →  Existence · Civil Rights · Access · Primary Duty
            →  Human Rights Act 1998 Art.2 (Right to Life)

And it's a bijection. The reference calculator (upow.c) has upow_encode and upow_decode as exact inverses — four indices in, one integer 1–625 out, and back again with a verification line at the end that proves the round trip. There is no ambiguity about which right you mean.

That's a beautiful specification. But a specification on a PDF is inert. The moment a real person needs D4.AC.1 — food, at this address, now — the address has to travel: over a bad network, on a borrowed phone, through a caseworker's inbox, into a tribunal bundle. And it has to arrive as the same thing it was when it left, provably, without anyone having to trust the sender or run anything.

That transport problem is the whole reason NSIGII exists. The U‑POWER document says so itself — it lists "NSIGII Protocol" as the protocol layer, sitting under the runtime and above the law. My job this week was to make that layer real and honest.

Three layers, three guarantees

NSIGII is not one format. It's three, and they never merge. Each first byte tells you which one you're holding:

NSIGII01        → CORE_V1                generic byte container   (transport)
NSIGII\0 + 0x07 → CONSTITUTIONAL_WRAPPER verification envelope    (proof)
NSIGII\0\0      → LEGACY_CODEC_STREAM    application media/state  (interpretation)
anything else   → UNKNOWN                inert bytes

Map those onto what a rights claim actually needs and the fit is exact.

1. The claim survives — CORE_V1

The C core does one thing: frame arbitrary bytes with a header, length‑prefixed chunks, and an IEEE CRC‑32 footer. Its single invariant, tested against empty input, 257 bytes, 200 000 bytes, and a deliberately corrupted checksum:

decode(encode(bytes)) == bytes    — for every finite byte sequence,
                                     including empty data and embedded NULs

If a byte flips in transit, the CRC fails and the decode stops. It does not hand you a plausible‑looking wrong answer. It is allocation‑free, streams through read/write callbacks, reads in twenty lines of Python, and compiles to WebAssembly so a browser does the exact same decode as the CLI with no re‑implementation.

This is upow_encode / upow_decode given a wire. The address D1.CR.AC.1 that a person's advocate writes is the address a duty‑holder receives — or the artifact refuses itself out loud. A right you can't transmit intact is not a right yet; it's an intention.

2. The claim proves itself — the constitutional wrapper

Around any payload you can put a verification envelope: a SHA‑256 of the payload, three independent "trident" channel readings (TRANSMIT → RECEIVE → VERIFY), a consensus verdict, and an ENDNSIGII terminator a third party can scan for to confirm the file was written in full.

verify recomputes every hash and requires 3/3 agreement. extract is refused below a YES. I proved this both ways this week: wrap a 20 MB screen recording, verify 3/3, extract → the MP4 comes back byte‑identical; flip one byte inside the payload → verification drops to NO and the bytes are never released.

That is U‑POWER's Enforcement and Remedy sub‑rights made mechanical. A caseworker, a tribunal, or an automated duty‑holder can check a claim without trusting whoever sent it and without executing anything. The receipt is the evidence that the claim was made, intact, and received. verify before trust or interpretation is the invariant, and it never bent across eight phases of this build.

3. The claim stays data — dispatch

The browser viewer and the CLI classify by the first eight bytes, then act:

CORE_V1  → decode via the C/WASM core, then re-dispatch the result (bounded to 4 hops)
WRAPPER  → verify 3/3, then extract, then re-dispatch
LEGACY   → hand to the renderer it was built for
UNKNOWN  → show metadata, offer a download — never decode, never render, never run

run and view are verification‑only. "EXECUTE" in the RWX/trident model is a verification stage — the third channel reaching consensus — not "run the extracted program". A .nsigii artifact is data. A malicious one is inert data.

This matters more for a rights channel than for anything else, because the people it serves are, by definition, the people least able to absorb an attack delivered through it. The format cannot be turned into a weapon against its own beneficiary. That's not a nice‑to‑have; it's the second of the three Nevers below.

Why this is U‑POWER's shape

U‑POWER has a rule it calls the No‑Cross‑Reference Principle: each of the 625 articles is self‑contained. No article may depend on another for its interpretation or enforcement, because inter‑article dependency is exactly how rights get nullified in practice — you assert one, and the other side points at a conflicting one.

NSIGII enforces the identical discipline at the byte level:

container mechanics ≠ constitutional verification ≠ application interpretation

The transport layer knows nothing about verification. The verification layer knows nothing about what the payload means. The renderer never touches the container. Each layer is a single computable unit that does its job and refuses to reach into the next one. Break one and you have not broken the others.

And the addressing composes cleanly. A U‑POWER article is four small integers. Serialise a claim that references D1.CR.AC.1, put it in a CORE_V1 container, wrap that in a constitutional envelope, and you have an artifact that:

1. round‑trips byte‑exact, or fails loudly (CRC‑32),
2. proves its own integrity to any third party (3/3 trident),
3. is inert until a system that understands U‑POWER interprets it (dispatch),
4. can be linked with other claims into a resolved topology (nsigii link → SIGNAL / NOSIGNAL / NOISE).

The disability variant's 9^625 address space doesn't strain this at all. It's bytes. CORE_V1 does not care how large the number is.

The three Nevers, as engineering invariants

The NSIGII spec binds three invariants to three addressing modes. They were the acceptance criteria for every phase of this integration:

mode	Never	what it meant in code
here and now	never a toy	it ships working, or it doesn't ship — the codec bug that made the video path lie got fixed, not hidden
there and then	never a weapon	no path executes an extracted payload; UNKNOWN stays inert; the browser verifier releases bytes only to the next dispatch hop, never to a runtime
where and whenever	never a problem	bounded recursion (depth 4), cycle detection, malformed input rejected cleanly, working trees clean after every test run

A claim entered under where and whenever is unbound in place and time — a standing claim. The format has to keep holding it long after the moment it was made. Streaming, allocation‑free, no index required, twenty lines of Python: the artifact keeps working on the device the person actually has, years later, offline.

Receipts

Because the repo is public and I'd rather you check than believe me:

• Byte‑exact transport. raw.dat → C pack → nsigii wrap → nsigii extract -r → cmp → identical. The full nesting chain — CONSTITUTIONAL_WRAPPER → CORE_V1 → UNKNOWN — resolved in the CLI and in a headless browser, nothing executed.
• Verification gates release. Tamper one payload byte → verify = NO, extract throws, the browser shows a receipt and renders nothing.
• One decoder, two runtimes. The browser decodes CORE_V1 through the C core compiled to WASM — not a hand‑written JS parser. A constitutionally‑wrapped, CORE_V1‑packed interactive donut verified 3/3 in‑tab, extracted, decoded, and rendered identical to the original.
• Linking. nsigii link over a set of artifacts → Topology Resolution: SIGNAL. A queue of claims becomes a resolved graph where every node carries its own proof.
• CI, off my machine. The cross‑repo matrix (raw‑byte round trips, corruption detection, empty and NUL‑containing payloads, the real 1.3 MB fixture) is green on GitHub's runners, not just locally.

What it does not do yet

The container carries a SHA‑256. That proves the bytes haven't changed since someone wrote them. It does not prove who, or when. Signing is the next layer, and for a rights protocol it's the one that matters most — a claim you can't attribute is a claim a duty‑holder can dispute. That's being built. I'm telling you it's missing so you don't assume it's there.

Close

U‑POWER's closing line is: your right to the power is not a metaphor — it is a specification.

A specification is only as real as its carrier. If the entitlement can't move from the page to the duty‑holder intact, provable, and inert until understood, then "you have a right to X" stays a sentence.

The Linkable‑Then file format is what turns the sentence into a delivered artifact. It links before it acts. It survives the network. It proves itself to a stranger. It never runs. And it holds the claim for as long as the claim stands — here and now, there and then, where and whenever.

When systems fail, build your own. This is one of the pieces.

---

Code: github.com/obinexusmk2/nsigii · obinexus/nsigii_project · obinexus/nsigii_viewer
Framework: U‑POWER — Your Rights to the Power, OBINexus Constitutional Computing
Contact: obinexus.org