Lawful Substrates: A Constitutional Eighth Strategy for Computational Worlds

A substrate should not be defined by the nouns visible in its demonstration.

A document is not a substrate law. Neither is a spreadsheet, database, canvas, notebook, object image, browser DOM, application model, or runtime. Each may be an excellent computational medium. Each may embody a coherent substrate for a domain. None is general merely because many things can be encoded inside it.

The deeper question is constitutional:

What remains invariant when computational worlds acquire new subjects, tools, domains, owners, implementations, and peers?

This article proposes a law- and relation-centric answer. A lawful substrate is an underlying computational constitution whose laws govern identity, typed relations, authority, admission, transition, observation, isolation, effects, lineage, finite closure, extension, and federation. Domain systems elaborate their operations into that constitution. They do not rewrite it. Concrete implementations realize the constitution. They do not become its universal ontology.

Here, lawful means admitted under an explicit computational constitution. It does not mean merely compliant with external legislation, centrally administered, or globally owned. Governance is the mediation of commitment by stated law and authority; federation preserves multiple such authorities.

Documents, direct manipulation, liveness, persistence, and malleability are central research achievements and design goals. A constitutional account places them at the level of experience and realization, then asks the additional question: under what laws can unlike realizations remain comparable, extensible, auditable, and federable?

The proposed category adds a law- and relation-centered strategy to seven overlapping historical strategies. Its organizing center is unity by invariant law rather than unity by one privileged representation.

A converging research program

Substrate research draws together a long lineage of attempts to treat the complete computational environment as a coherent design object.

Engelbart treated computing as an environment for augmenting individual and collective intellect (Engelbart, 1962). Nelson sought structures adequate to information that is complex, changing, and indeterminate (Nelson, 1965). Kay and Goldberg described a personal dynamic medium broad enough to combine communication, memory, simulation, and authoring (Kay and Goldberg, 1977). Smalltalk made a live, inspectable object world into both programming environment and medium (Kay, 1993). Persistent programming later attacked the artificial boundary between short-lived computation and durable data (Atkinson et al., 1983; Atkinson and Morrison, 1995).

Across these lineages, the whole computational environment was already the design object. Their ideas subsequently continued through programming languages, operating systems, databases, distributed systems, security, hypermedia, provenance, and human-computer interaction, each of which developed a tractable part of the larger problem.

The contemporary Software Substrates program brings these strands into direct conversation. Jakubovic, Edwards, and Petricek (2023) argue that programming systems lack a common structure comparable to the theories used to compare programming languages. Their technical-dimensions framework seeks to make programming systems cumulative research rather than a succession of incomparable personal visions. The first dedicated Software Substrates workshop in 2025 collected sharply different vision statements, and the 2026 workshop retained “substrate” as an umbrella over interactive authoring, computational media, malleable systems, local-first work, integration domains, and other traditions (Software Substrates, 2025; Software Substrates, 2026).

The proceedings identify the present research opportunity. The universal review of the 2025 contributions observes that working systems are valuable tests of feasibility, yet packaging ideas inside different demo systems makes abstract comparison difficult (Software Substrates, 2025). The 2026 call describes a spectrum running from accounts broad enough to find substrate-like qualities in nearly any runtime to visions that expect a successful substrate to converge on a canonical structure (Software Substrates, 2026).

The task is to develop a vocabulary strong enough to compare complete computational worlds without prematurely selecting one realization as universal.

Current substrate foundations

Current substrate research contributes essential design principles for complete computational environments.

Edwards (2025) defines a substrate through a complete and self-sufficient programming system, persistent code and data, direct manipulation, live programming, continuity between use and programming, and conceptual unity. The compact slogan is a “WYSIWYG document, DB, & PL in one.” This is a strong realization strategy. It attacks impedance mismatches directly and places the user inside a coherent computational world rather than outside a stack of opaque services.

Klokmose (2025) develops another powerful lineage from instrumental interaction and Webstrates. Its principles reject a hard technical boundary between tools and data, demand manipulation across devices and users, use transclusion for composition, seek modification during use, permit semantically distinct substrate layers, and make edit and interaction history first-class. Webstrates operationalizes much of this by turning the browser DOM into collaboratively editable, persistent computational media (Klokmose et al., 2015). A decade of work around that platform has also documented the trade between general principle and the pragmatics of building real systems (Borowski et al., 2022).

Mackay and Beaudouin-Lafon (2025) distinguish information substrates from interaction substrates and study how interaction can gain power without forcing all complexity directly onto the user. Local-first software restores local primacy, ownership, offline operation, longevity, and collaboration (Kleppmann et al., 2019). CRDTs provide mathematically defined convergence for classes of replicated data (Shapiro et al., 2011). These are substantial parts of any serious future substrate.

The constitutional proposal complements these lines of work by supplying a level at which their agreements and disagreements can be stated without requiring any one artifact model to become universal.

The distinction is:

A document/database/programming-language synthesis may be an exceptionally good substrate. It answers the realization question by selecting an integrated medium. A constitutional kernel answers the generality question by stating the laws under which integrated media can differ without losing meaning.

Seven historical strategies and a constitutional eighth

The following classification is a comparative map of what each lineage tends to make primary. Real systems frequently cross categories.

The eighth strategy incorporates the first seven as possible realizations, domain substrates, or imported law families. Their favored nouns become explicit domain commitments rather than implicit universal ontology.

The organizing principle is:

Unity without ontological flattening.

A file need not become a process. A process need not become a theorem. A theorem need not become a document. A document need not become a database row. They may remain distinct subjects while sharing laws of identity, relation, admission, consequence, evidence, extension, and federation.

A substrate constitution

Let the invariant kernel be:

K := <Subj, Id, Eq, Rel, Auth, Admit, Step,
      Obs, Iso, Emit, Lin, Close, Ext, Fed>

The components are law families:

• Subj governs the formation and admission of subject kinds without enumerating every domain noun or requiring one universal data structure.
• Id and Eq govern identity, equality, succession, aliasing, and distinction.
• Rel governs how relation kinds are formed and admitted, including endpoint conditions, direction, authority, and consequence; overlays supply domain meanings.
• Auth identifies who or what may propose, attest, admit, delegate, or revoke.
• Admit governs entry into the committed world.
• Step governs lawful state transition and refusal.
• Obs, Iso, and Emit govern captured inputs, isolation assumptions, visible outputs, ambient influence, and external effects.
• Lin governs causal lineage rather than merely chronological logging.
• Close requires the dependency and execution closure of a transition to be finite and admitted before commitment.
• Ext governs overlays, capabilities, succession, and promotion without silent root mutation.
• Fed governs exchange among independently governed worlds.

A domain overlay O, a local policy P, and an admitted finite capability closure A specialize but do not replace K. “Owner” denotes the local locus of authority, which may be a person, group, institution, or formally constituted process. For current state s, proposal q, and captured boundary c, the core judgment is:

decide_(K,O,P,A) : S × Q × C
                 -> Admit(S × R × E)
                  + Reject(S × F × E)

R is a result, F is a first lawful failure, and E is an evidence object whose required contents and adequacy are themselves fixed by the active law. The sum is disjoint. The judgment has no silent third outcome.

Let X_(K,O,P,A) be the declared boundary request space. If a concrete boundary accepts bytes, decoding and malformed-input rejection belong inside this space or in an immediately preceding total judgment. Admission is an outcome, never a precondition. The minimal totality and determinism obligation is:

for every boundary request x, there exists exactly one y
such that decide_(K,O,P,A)(x) = y.

In notation:

∀x ∈ X_(K,O,P,A). ∃! y. decide_(K,O,P,A)(x) = y

A rejection preserves the committed state. It may produce evidence explaining refusal, but it does not smuggle in a partial successor:

decide(s,q,c) = Reject(s,f,e)

An admission identifies the successor, result, and evidence together:

decide(s,q,c) = Admit(s',r,e)

This makes enforcement part of the denotation of the law. “Persistent,” “malleable,” “open,” “local,” “secure,” and “observable” are not sufficient as values. A law needs a scope, a satisfaction condition, a violation condition, a deciding authority, an enforcement point, a total outcome, and evidence adequate to audit the decision.

Conservative narrowing under extension

Within a fixed observable alphabet Σ, additional law narrows behavior:

Beh_(i+1) ⊆ Beh_i

An extension may introduce new subject kinds or operations, so its behavior lives over an expanded alphabet. Let Comp(K) be the triples (O,P,A) lawfully composable with K; let ⊕ denote that governed composition, not arbitrary union; let Beh(X) be the observable behaviors admitted by X; let Σ_K be the root observable alphabet; and let π_(Σ_K) project an extended behavior onto that alphabet. The root-preservation obligation is:

∀(O,P,A) ∈ Comp(K).
  π_(Σ_K)(Beh(K ⊕ O ⊕ P ⊕ A)) ⊆ Beh(K)

For a purely conservative extension that adds vocabulary without restricting old behavior, the stronger equality holds:

π_(Σ_K)(Beh(K ⊕ O)) = Beh(K)

This distinction matters. A spreadsheet overlay may introduce cells, ranges, formulas, recalculation, and workbook-specific failures. A theorem overlay may introduce terms, goals, elaboration, proof objects, and kernel rejection. A build overlay may introduce artifacts, dependency edges, compilers, and link steps. Each expands the vocabulary. None may redefine root identity, invent unrecorded authority, conceal effects, escape closure, or erase lineage.

Owner-reserved freedom is itself part of the constitution. A law should classify each dimension as one of:

Explicit reservation distinguishes owner discretion from underspecification. Without it, one implementation may treat silence as freedom while another treats it as prohibition or obligation.

The law families

Identity before storage

Most software lets its storage mechanism answer identity questions by accident. A pathname, memory address, database key, URL, object pointer, row number, hash, or UI position becomes “the thing” because that is what the implementation happens to expose.

A lawful substrate separates at least:

• subject identity from representation;
• equality from byte identity;
• succession from mutation;
• aliases from identities;
• local names from global references;
• content identity from contextual identity;
• imported identity from locally admitted identity.

Content-addressed identifiers such as SWHIDs solve an important subset: stable reference to source-code artifacts by intrinsic structure (Software Heritage, 2021). They do not alone state whether two executions are the same act, whether a derived result is authorized, whether a foreign identifier is locally admitted, or whether a successor preserves the identity of its predecessor. Those are additional laws.

Typed relations before a universal container

A lawful substrate is relation-centric, but it is not committed to the relational model as the single representation of everything. It requires relations to have admitted kinds, endpoint conditions, direction, authority, and consequences.

The root may know that a relation is:

produced-by(result, execution)
used-input(execution, subject)
authorized-by(proposal, authority)
succeeds(new, old)
interprets(view, subject)
imports(local, foreign)

The domain may know that another relation is:

cell-depends-on(cell_7, cell_2)
theorem-uses-lemma(T, L)
document-transcludes(D1, D2)
object-instantiates-schema(x, S)

The first group can be constitutional. The second group remains domain law. Generality comes from preserving the distinction, not from encoding every domain noun as a generic node and then pretending the semantics survived.

Authority and admission before capability

The existence of a tool or operation does not authorize its use. The ability to parse a foreign claim does not require accepting it. The possession of a capability does not permit that capability to admit itself.

Security research has long separated mechanism from policy and emphasized complete mediation (Saltzer and Schroeder, 1975). Enforceable-policy work asks which policies a monitor can actually enforce (Schneider, 2000). Proof-carrying code makes acceptance conditional on checkable evidence (Necula, 1997). SPKI’s local authorization model demonstrates that useful trust need not begin with one universal naming sovereign (Ellison et al., 1999).

A substrate constitution should absorb the lesson directly:

Propose(x) ≠ Authorize(x) ≠ Admit(x) ≠ Execute(x)

and:

origin(proposal) cannot be the sole source of the authority
required to admit that proposal.

This is the non-self-admission rule. A capability may propose its successor. It cannot manufacture the root authority that makes the successor lawful.

Total transition and first refusal

Partial functions are often convenient inside an implementation. They are a poor external constitution. At the commitment boundary, every admitted request should yield exactly one admitted successor or one explicit rejection.

A first-failure order is not merely an error-message preference. It makes refusal deterministic and prevents implementations from exposing different partial interpretations of the same invalid proposal. Where several conditions fail, the law states which failure is authoritative.

This supports:

• reproducible conformance testing;
• stable audit evidence;
• cross-implementation comparison;
• denial without partial effects;
• reasoning about adversarial inputs;
• exact correspondence between abstract law and concrete behavior.

Observation, isolation, and effects

A transition cannot be explained by naming only its explicit arguments. External computation may observe environment variables, files, clocks, randomness, process state, network replies, inherited descriptors, locale, kernel behavior, hardware features, or previous mutable state. It may emit files, packets, subprocesses, UI changes, or other effects.

A lawful substrate therefore makes the observation boundary and effect boundary explicit. Isolation is not a slogan that “nothing else mattered.” It is evidence of what was excluded, admitted, or captured.

At minimum, evidence for an externally realized transition should bind:

proposal identity
law and overlay versions
authority and admission decision
exact tool identity
finite dependency/execution closure
captured observations and inputs
isolation conditions
termination and failures
outputs and emissions
committed successor state

A log stating that an event happened is weaker. A provenance graph stating that one entity was derived from another is stronger. A lineage-bearing execution record binds the exact admitted act to the exact causal and authority closure that made its result possible.

PROV-O gives a cross-domain vocabulary for entities, activities, agents, generation, use, attribution, and derivation (W3C, 2013). in-toto binds authorized supply-chain steps, materials, products, and attestations (Torres-Arias et al., 2019). A lawful substrate treats such evidence not as optional reporting attached after execution, but as part of the transition result itself.

Finite admitted closure

A computation whose operative closure is “whatever happens to be available” is not governed. The closure need not be small, and its internals need not be implemented in one language. It must be finite for the act being admitted, identifiable, and closed under the dependencies that can influence the result.

Formally, for an admitted execution a:

Close(a) is finite
and every member of Close(a) is admitted under the active law.

Libraries and abstractions can serve as governed compression. At the commitment boundary, their identities, versions, authorities, and causal contributions must be admitted rather than ambient.

Ungoverned abstraction is the failure. Governed abstraction is compression.

Conceptual unity is compatible with implementation heterogeneity. A realization may contain compilers, stores, processes, protocols, proof kernels, UI frameworks, and hardware layers. The constitutional requirement is no ungoverned semantic seams.

Lawful extension without root mutation

A substrate that cannot grow becomes a museum. A substrate whose extensions may silently redefine its law becomes an application platform with privileged plugins.

Lawful extension requires at least:

• explicit extension identity and version;
• declared new vocabulary and operations;
• proof, decision, or test evidence for root preservation;
• explicit migration or succession when old behavior is narrowed;
• no self-admission;
• revocation and rollback semantics;
• visible consequences for existing subjects and relations.

The root can permit new domains without knowing their nouns. It can permit new tools without granting those tools constitutional authority. Recursive growth is therefore possible without recursive surrender.

Four levels of substrate architecture

A constitutional account distinguishes four levels of commitment.

A document can be a lawful subject. A spreadsheet can be a domain substrate. A database can realize persistence and query. A browser DOM can be a pragmatic common medium. Each belongs at an explicit architectural level.

Putting a domain noun into the root immediately imports assumptions about granularity, identity, transactions, conflict resolution, presentation, ownership, synchronization, addressability, and what counts as an operation. Those assumptions may be excellent for the intended world. They cease to be general when they become invisible.

Generality depends on preserving both plurality and level distinctions. Unlike substrate realizations become comparable only when root law, domain law, concrete realization, and interface are stated separately.

Elaboration: rich domains, small constitutional judgments

The useful analogy is a language elaborator and a small trusted core. Rich surface operations are translated into a smaller judgment that the kernel can check. The kernel does not need every surface construct as a primitive.

A substrate operation follows the same shape:

rich domain operation
        ↓ domain elaboration
identified subjects + typed relations + proposed transition
+ authority + finite closure + captured boundary
        ↓ constitutional decision
admitted successor or evidenced rejection

Consider four unrelated operations.

Recalculate a spreadsheet. The overlay identifies formula subjects and dependency relations, elaborates recalculation into a derivation proposal, supplies the admitted evaluator and finite input closure, and declares the expected result kind. The root decides identity, authority, closure, observation, effects, and commitment. It does not need a universal Cell primitive.

Check a theorem. The overlay identifies terms, declarations, dependencies, and the proof-checking operation. The constitutional layer governs which checker and environment are admitted, what exact closure was used, and whether the accepted proof object may enter committed state. It does not decide the theorem’s mathematical meaning for the domain.

Produce a build artifact. The overlay supplies source and dependency relations, toolchain actions, and expected artifacts. The constitutional layer binds exact tool identities, observations, isolation, emissions, and lineage. It does not need Compiler to be a root subject kind.

Capture a scientific observation. The overlay owns the scientific schema, units, calibration rules, and domain validity. The constitutional layer governs authority, capture identity, observation boundaries, transformations, and evidentiary succession. It must not infer a scientific conclusion the domain has not authorized.

The root is general because it remains ignorant of domain semantics that it has no right to invent, while remaining strict about consequences that no domain may conceal.

Federation and semantic continuity

The field of distributed systems provides mature theories of event order, replication, convergence, consensus, failure, and serializability. Lamport’s causal ordering and state-machine reasoning made the absence of a single global time an explicit scientific problem in 1978 (Lamport, 1978). CRDTs formalize convergence for replicated data under specified conditions (Shapiro et al., 2011).

For lawful substrates, those mechanisms sit inside a broader federation problem:

How can a complete computational world preserve semantic continuity across independently governed machines, people, organizations, and law versions?

A federated lawful substrate carries the established distributed-systems questions into the constitutional domain:

Two laws follow.

First, intelligibility is not authority:

Understand_j(x) does not imply Authorize_j(x)

A world may decode a foreign subject, validate its evidence, and understand the law under which it was produced while still refusing to admit, execute, promote, or trust it.

Second, trust is not silently transitive:

Trust_i(j) and Trust_j(k) do not imply Trust_i(k)

Transitivity may be explicitly authorized by local policy, but it cannot be smuggled in as a property of connectivity.

A distributed substrate therefore includes more than synchronized documents or replicated state. Local-first systems restore the local copy as primary and show that collaboration can preserve data ownership (Kleppmann et al., 2019). A constitutional substrate generalizes the boundary: local authority remains local even when meanings and evidence are globally traversable.

Global intelligibility does not imply global authorization.

Formal and empirical obligations

A law-centered account separates what formal law can establish from what human experience must demonstrate.

A proof can show that an extension is conservative, a transition deterministic, a closure finite, or an authority check complete relative to a model. Empirical study determines whether a person can discover a capability, understand a consequence, comfortably manipulate a representation, or appropriate a tool during use.

Claims such as malleability, directness, conviviality, learnability, and human-scale coherence require empirical evaluation. Accordingly, current substrate work treats interaction as first-class (Edwards, 2025; Klokmose, 2025; Mackay and Beaudouin-Lafon, 2025). The constitutional category gives those systems a common formal floor alongside human-computer interaction research.

The division of labor is:

formal and executable law:
    what may happen, under whose authority, with what evidence

human-centered realization:
    what can be perceived, understood, discovered, and appropriated

domain law:
    what the operation means in the subject matter

A serious substrate science coordinates all three while preserving their distinct evidentiary roles.

What would make the category scientific

A position becomes a research program only when it can fail. The law- and relation-centric category should be judged by at least the following tests.

1. Domain independence

The same unchanged root law must govern several genuinely unrelated domains. Demonstrating three document variants is insufficient. A stronger experiment would combine, for example, a proof development, a build, a scientific capture, and a collaborative document without adding their nouns to the kernel.

Failure condition: the root must be edited whenever a new domain is introduced.

2. Conservative extension

An overlay or capability must either preserve existing root-observable behavior or declare an explicit restrictive succession. Projection onto the old vocabulary must satisfy the conservation equation.

Failure condition: an extension silently changes the meaning of existing identity, authority, transition, or evidence.

3. Total and ordered refusal

Every admitted input must yield one admitted successor or one explicit first failure, with no partial commitment and no implementation-dependent error race.

Failure condition: malformed or conflicting proposals produce ambient exceptions, partial effects, or different authoritative failures across conforming implementations.

4. Closure and causal evidence

An externally executed transition must identify a finite admitted closure and bind its inputs, observations, isolation assumptions, outputs, effects, and termination to the committed result.

Failure condition: the result depends on an unrecorded ambient resource, or the evidence cannot distinguish two causally different executions.

5. Independent realization

At least two materially different implementations must realize the same abstract law and agree on admitted observations. Otherwise the “law” may be only a description of one program.

Failure condition: correspondence requires importing hidden behavior from the reference implementation.

6. Federation without sovereignty collapse

Two independently governed worlds must exchange understandable claims while retaining local admission, local refusal, and explicit trust boundaries.

Failure condition: interoperability requires one global owner, one mutable service, or automatic transitive trust.

7. Non-self-admission

A capability may propose an extension but cannot create the authority by which that extension is admitted.

Failure condition: executing an untrusted extension is necessary to decide whether it was safe to admit.

8. Empirical validation of experience

Where a realization claims malleability, direct manipulation, understandability, or lower cognitive burden, those claims must be evaluated with people and tasks appropriate to the intended users.

Failure condition: a formal property is presented as evidence of a human outcome it does not entail.

Together, these tests make the category a refutable technical claim.

The case in one judgment

A lawful substrate can be summarized as:

K; O; P; A ⊢ <s,q,c>
    ⇓ Admit<s',r,e>
    + Reject<s,f,e>

subject to:

∀(O,P,A) ∈ Comp(K).
π_(Σ_K)(Beh(K ⊕ O ⊕ P ⊕ A)) ⊆ Beh(K)

The first line says every proposed consequence is totally decided under explicit root law, domain law, owner policy, admitted capability closure, current state, and captured boundary. The result is either a committed successor with evidence or an evidenced refusal that preserves committed state.

The second line says domains, owners, and capabilities may add vocabulary and narrow permission, but they may not exhibit root-observable behavior forbidden by the constitution.

Everything else follows:

• documents and databases may be worlds without becoming universal law;
• implementations may be heterogeneous without hiding semantic seams;
• capability may grow without self-authorization;
• provenance may become causal lineage rather than decorative metadata;
• distribution may preserve local authority rather than dissolve it;
• owners may retain explicit freedom without relying on underspecification;
• unlike domains may remain unlike while participating in one governed computational world.

The field has already recovered the ambition to treat complete computational environments as research objects. The next step is to distinguish the medium from its constitution.

Open authoring; governed commitment.

References

• Malcolm P. Atkinson and Ronald Morrison. 1995. “Orthogonally Persistent Object Systems.” The VLDB Journal 4:319–401. doi:10.1007/BF01231642.
• Malcolm P. Atkinson, Peter J. Bailey, Ken J. Chisholm, W. Paul Cockshott, and Ronald Morrison. 1983. “An Approach to Persistent Programming.” The Computer Journal 26(4):360–365. doi:10.1093/comjnl/26.4.360.
• Marcel Borowski, Bjarke V. Fog, Carla F. Griggio, James R. Eagan, and Clemens N. Klokmose. 2022. “Between Principle and Pragmatism: Reflections on Prototyping Computational Media with Webstrates.” ACM Transactions on Computer-Human Interaction 30(4). doi:10.1145/3569895.
• Edgar F. Codd. 1970. “A Relational Model of Data for Large Shared Data Banks.” Communications of the ACM 13(6):377–387. doi:10.1145/362384.362685.
• Jonathan Edwards. 2025. “Substrate Vision Statement.” In Substrates 2025 Proceedings. PDF.
• Carl M. Ellison, Bill Frantz, Butler Lampson, Ron Rivest, Brian Thomas, and Tatu Ylonen. 1999. SPKI Certificate Theory. RFC 2693, Experimental. RFC Editor; doi:10.17487/RFC2693.
• Douglas C. Engelbart. 1962. Augmenting Human Intellect: A Conceptual Framework. SRI Summary Report AFOSR-3223. Primary text.
• Roy Thomas Fielding. 2000. Architectural Styles and the Design of Network-based Software Architectures. Ph.D. dissertation, University of California, Irvine. Official dissertation.
• David Gelernter. 1985. “Generative Communication in Linda.” ACM Transactions on Programming Languages and Systems 7(1):80–112. doi:10.1145/2363.2433.
• Joel Jakubovic, Jonathan Edwards, and Tomas Petricek. 2023. “Technical Dimensions of Programming Systems.” The Art, Science, and Engineering of Programming 7(3), Article 13. doi:10.22152/programming-journal.org/2023/7/13.
• Alan Kay and Adele Goldberg. 1977. “Personal Dynamic Media.” Computer 10(3):31–41. doi:10.1109/C-M.1977.217672.
• Alan C. Kay. 1993. “The Early History of Smalltalk.” ACM SIGPLAN Notices 28(3):69–95. doi:10.1145/155360.155364.
• Martin Kleppmann, Adam Wiggins, Peter van Hardenberg, and Mark McGranaghan. 2019. “Local-First Software: You Own Your Data, in Spite of the Cloud.” In Onward! 2019, 154–178. doi:10.1145/3359591.3359737.
• Clemens N. Klokmose, James R. Eagan, Siemen Baader, Wendy E. Mackay, and Michel Beaudouin-Lafon. 2015. “Webstrates: Shareable Dynamic Media.” In Proceedings of UIST ’15. doi:10.1145/2807442.2807446.
• Clemens Nylandsted Klokmose. 2025. “Substrates: From Webstrates and Beyond.” In Substrates 2025 Proceedings. PDF.
• Leslie Lamport. 1978. “Time, Clocks, and the Ordering of Events in a Distributed System.” Communications of the ACM 21(7):558–565. Author publication page; doi:10.1145/359545.359563.
• Wendy E. Mackay and Michel Beaudouin-Lafon. 2025. “Interaction Substrates: Combining Power and Simplicity in Interactive Systems.” In Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems, Article 687. doi:10.1145/3706598.3714006.
• George C. Necula. 1997. “Proof-Carrying Code.” In POPL ’97, 106–119. doi:10.1145/263699.263712.
• Theodor H. Nelson. 1965. “Complex Information Processing: A File Structure for the Complex, the Changing and the Indeterminate.” In Proceedings of the 20th ACM National Conference, 84–100. doi:10.1145/800197.806036.
• Jerome H. Saltzer and Michael D. Schroeder. 1975. “The Protection of Information in Computer Systems.” Proceedings of the IEEE 63(9):1278–1308. doi:10.1109/PROC.1975.9939.
• Jerome H. Saltzer, David P. Reed, and David D. Clark. 1984. “End-to-End Arguments in System Design.” ACM Transactions on Computer Systems 2(4):277–288. doi:10.1145/357401.357402.
• Fred B. Schneider. 2000. “Enforceable Security Policies.” ACM Transactions on Information and System Security 3(1):30–50. doi:10.1145/353323.353382.
• Marc Shapiro, Nuno Preguiça, Carlos Baquero, and Marek Zawirski. 2011. “Conflict-Free Replicated Data Types.” In Stabilization, Safety, and Security of Distributed Systems, LNCS 6976, 386–400. INRIA record; doi:10.1007/978-3-642-24550-3_29.
• Software Heritage. 2021–2026. “SoftWare Heritage Persistent IDentifiers (SWHIDs).” Official specification.
• Software Substrates. 2025. Substrates 2025 Proceedings. Initial workshop held June 3, 2025, at ‹Programming› 2025 in Prague. Proceedings.
• Software Substrates. 2026. “Substrates-26: Call for Contributions and Program.” ‹Programming› 2026. Official workshop page and proceedings.
• Santiago Torres-Arias, Hammad Afzali, Trishank Karthik Kuppusamy, Reza Curtmola, and Justin Cappos. 2019. “in-toto: Providing Farm-to-Table Guarantees for Bits and Bytes.” In 28th USENIX Security Symposium, 1393–1410. USENIX publication page.
• Timothy Lebo, Satya Sahoo, and Deborah McGuinness, editors. 2013. PROV-O: The PROV Ontology. W3C Recommendation, 30 April 2013. Specification.