Scientific objects on the Ledger

The RecordType enum

Every record on the Ledger carries a RecordType discriminator. The enum has seventeen values: Unknown plus sixteen usable record types. The usable taxonomy:

• RuntimeCycle — the temporal root of a cognition cycle. Anchors every downstream record produced in the same run.
• Hypothesis — a reviewable scientific question with confidence labels.
• Experiment — a computational study design tied to one or more hypotheses.
• EvidenceBundle — a curated scientific record set used by a cycle.
• Candidate — a peptide candidate proposed inside the constraint surface. Published records carry the full sequence plus sequence hash and salted commitment.
• Thesis — a synthesised reasoning document over an evidence bundle and a hypothesis. A reviewed daily paper is a Thesis.
• AssayResult — a wet-lab assay result returned from a review-gated provider. (Pipeline ready; provider integration is review-gated.)
• Collection — a reviewed cohort of records grouped for citation or release.
• RetractionNotice — an on-chain notice that a record has been retracted; emitted by the treasury-only RETRACTOR_ROLE path.
• ExternalSignal — an external evidence packet ingested through the operator-reviewed ingest_url pipeline.
• Governance — an operator-initiated governance event (role grant, allow-list change, halt-switch toggle).
• ScientificAsset — a citable aggregation of records (typically a paper + supporting hypotheses + experiments). Carries a stable identifier external citations resolve against.
• IPAsset — a provisional-IP intent record. Gated behind IP_DECLARANT_ROLE in addition to a writer role; Bankr cannot mint these.
• CandidateFamily — a reviewed family/cohort record for related candidates with family sequence material and membership lineage.
• CandidateLineage — an attested candidate parent/child lineage branch.
• FamilyLineage — an attested family lineage branch.

Unknown is the sentinel value and is not a usable record type.

The twenty RelationTypes

Lineage between records is itself first-class state. Every edge is a typed RelationType:

| Relation | Direction | What it asserts | | --- | --- | --- | | DerivedFrom | parent → child | child was produced using parent as input | | Tests | parent → child | child experiment tests parent hypothesis | | Supports | parent → child | child evidence supports parent claim | | Contradicts | parent → child | child evidence contradicts parent claim | | Supersedes | parent → child | child supersedes parent (parent's lifecycle moves to Superseded) | | Retracts | parent → child | retraction notice references the retracted record | | Includes | parent → child | parent collection or asset includes child record | | Produces | parent → child | parent cycle produced child record | | Cites | parent → child | child paper or thesis cites parent record | | ReviewedBy | parent → child | parent record passed a review event captured by child | | Anchors | parent → child | parent runtime anchors child cohort | | AssetOf | parent → child | child ScientificAsset aggregates parent record | | ProtectedBy | parent → child | child IPAsset asserts protection over parent record | | ParentOf | parent → child | parent candidate produced or constrains child candidate | | ChildOf | child → parent | inverse lineage edge for candidate descendants | | MemberOfFamily | family → candidate | candidate belongs to a published family | | VariantOf | parent → variant | candidate is a sequence variant of another candidate | | FamilyDerivedFrom | parent family → child family | family-level derivation relationship | | PublishedAs | record → publication | record is represented by a publication artifact | | Unknown | — | sentinel value; not a usable edge type |

A reader who downloads the contract's event log gets the entire graph — every record + every edge — from RecordRegistered, RecordContentEmitted, and EdgeLinked events alone. No off-chain stitching required.

Lifecycle state

Every record moves through a controlled lifecycle. The on-chain LifecycleState enum (ten states):

Draft → ReviewReady → Anchored → AssayRequested → AssayReturned → IPReview → PatentFiled → Published, with terminal-or-near-terminal states Superseded and Disputed.

ProteanLedger._validLifecycleTransition adversarially prevents invalid moves; the contract test suite verifies that the operator cannot leave a terminal state. Only the treasury-only retraction path can move a record to a publicly-visible retracted state without altering its lifecycle field.

Disclosure state

A second enum tracks what public disclosure mode the record is in. Six deployed DisclosureState values:

• PrivateCommitmentOnly — historical or unpublished record contains only commitment-safe content.
• RedactedPublic — legacy public record has redacted content.
• CounselReviewed — counsel-reviewed disclosure state.
• PatentPending — public-safe state during provisional-IP handling.
• Public — fully disclosed on the public explorer.
• Retracted — a one-way move from any disclosed state via the treasury-only RETRACTOR_ROLE. The retracted record stays on chain — public retraction is the point.

Private drafts that have not been registered yet are off-chain proposal state, not an on-chain disclosure value. Disclosure changes after registration are explicit Ledger mutations and emit DisclosureChanged.

Identity formula

Every recordId is a domain-separated keccak256 over the Solidity ABI-encoded fields passed to registerRecord. The Solidity contract and the offline utility must share this formula exactly.

recordId = keccak256(
abi.encode(
  RECORD_DOMAIN,
  priorObjectId,
  uint8(recordType),
  uint8(lifecycleState),
  uint8(disclosureState),
  keccak256(bytes(title)),
  keccak256(bytes(summary)),
  keccak256(bytes(author)),
  keccak256(bytes(runtimeId)),
  keccak256(bytes(replayPointer)),
  keccak256(bytes(publicationUrl)),
  keccak256(abi.encode(references)),
  supersedes,
  retracts,
  publishedAt
)
)

edgeId = keccak256(
abi.encode(
  EDGE_DOMAIN,
  parentRecordId,
  childRecordId,
  uint8(relation),
  evidenceHash
)
)

What the Ledger is, and is not

The Ledger is an integrity and lineage layer over typed scientific objects. It records that a record existed, what it was content-addressed against, what its lifecycle and disclosure state were, and how it was related to other records.

The Ledger is not an NFT system, a claims engine, or a mechanism for participation rights. Published candidate and family records intentionally expose full sequences; that visibility is scientific provenance, not a property right or biological validation claim. The boundary is enforced in the contract: there is no transfer function, no balanceOf, no claim against the contract for any future state. The IPAsset RecordType is the closest the Ledger comes to anything IP-shaped — and it is role-gated, not transferable, and explicitly framed as a provisional-IP intent record rather than a property right.