# Sovereignty and federation

*Foundations · lesson 3 of 5 · ~10 min*

## What you will learn

How independent universes interoperate without anyone giving up ownership of their meaning: the federation model, MUFP, and why "no apex" is a feature.

## Sovereignty, precisely

A Universe is sovereign when three things hold:

1. It defines its own concepts, in its own vocabulary, under its own constitution.
2. Its knowledge never leaves as raw, ownerless copies: only as governed Projections.
3. No external party can change what its knowledge *means*: not a partner, not a registry, not a majority.

Sovereignty is not isolation. The whole point of the standard is that sovereign universes can still understand each other, deeply and verifiably.

## The federation protocol in one walk-through

Two universes, Acme HR and a government tax service, both know about a person. Federation runs like this (this is the standard's golden example, message by message):

1. **Discovery.** Each universe publishes a discovery document (a `/.well-known/meta-universe.json`) describing what it is and which models it exposes.
2. **Identity binding.** They agree that Acme's `employee #482` and Gov's `taxpayer X` denote the same person, without merging records: a binding, not a merge.
3. **Semantic mapping.** They align vocabularies where needed ("salary" ↔ "declared income"), explicitly, versioned, with declared confidence.
4. **Federation contract.** They sign a machine-readable contract: which projections, to whom, under what conditions, revocable how.
5. **Projection and synchronization.** Data moves at last, as contract-shaped projections; synchronization keeps them coherent; drift is detected, not discovered by accident.
6. **Conflict preservation.** When the two disagree, the disagreement is *recorded as such*. Nobody silently wins; consumers see both claims with provenance and trust.

Notice what never happened: no shared database, no central schema, no one asking permission from a global authority.

## Trust is a vector, not a boolean

Federation runs on trust, and the standard refuses to flatten it to trusted/untrusted. A **Trust Vector** scores a counterparty along independent dimensions (identity assurance, semantic quality, timeliness, history...). Decisions condition on the relevant component: you might accept a partner's product catalog (high semantic quality) while ignoring its inventory numbers (chronically stale).

## Why "no apex" matters

It is tempting to want one global registry that knows the true meaning of everything. The standard deliberately forbids this: registries index and point, they never own (a registry entry is a *reference*, not a copy). The deepest argument comes from the largest case study: when a whole state was modelled as a Vercy Dimension, its political philosophy independently converged on the same rule, no apex ledger of value, federate sovereign perspectives instead. When an interoperability protocol and a theory of government arrive at the same architecture from opposite directions, that architecture is probably not an accident.

## Key takeaways

- Sovereignty = own vocabulary + governed projections + nobody else can redefine your meaning.
- Federation is a negotiated sequence: discovery → identity → mapping → contract → projection → synchronized coexistence, with conflicts preserved.
- Trust is multidimensional; registries reference, never own; there is no apex.

## Go deeper

- [MUFP overview](/spec/#03-federation/MUFP.md) and [the message protocol](/spec/#03-federation/MUFP-Messages.md)
- [Identity binding](/spec/#03-federation/Identity-Binding.md) · [Federation contracts](/spec/#03-federation/Federation-Contracts.md) · [Trust model](/spec/#03-federation/Trust-Model.md)
- Worked example: `examples/federation-acme-govtax/` in the [repository](https://github.com/ver-cy/meta-universe)

Next: [Time, truth and provenance](04-time.md)