C³社会デザインセンター

Search this site

Search pages, Verify ID...

日本語
← Japanese authority specification (current source)

Two-Rail Kernel · Translation review candidate

Two-Rail Kernel

v0.1 · Public Kernel Draft

Make public claims verifiable while protecting private information.

Two-Rail is an evidence discipline for separating records that should be publicly verifiable from records that must remain private. When an organization or AI agent makes a public claim, its supporting material contains both information that may be disclosed and information that must be protected. Two-Rail separates them into two rails and preserves a state in which the claim can be verified using the public rail alone.

The public side preserves verifiability; the private side preserves protection. Only accepted values bridge the two.

Position of this page

Two-Rail Kernel is the minimum evidence-separation discipline for making public claims verifiable while protecting private information (Public Kernel Draft v0.1).

Two-Rail Kernel is a field-independent minimum kernel for separating records that should be public from records that must remain private. An implementation is called Two-Rail conformant when it satisfies four requirements: prohibition of cross-rail writing, accepted public claims, a verifiable public surface, and an accountability interface. v0.1 is a Public Kernel Draft; it does not claim third-party certification, complete signature deployment, or an RF Pledge in force.

Definition

What the Two-Rail Kernel defines

  1. 01Which records belong on the public rail
  2. 02Which records remain on the private rail
  3. 03How a public claim can be made verifiable without crossing the rails

Canonical citation

Two-Rail defines which records belong on the public rail, which records must remain on the private rail, and how a public claim can be verified without cross-rail leakage.

Two-Rail is a separation discipline for creating a verifiable public surface. Existing signatures, registries, selective disclosure, and zero-knowledge proofs may be used as implementation mechanisms where appropriate.

Normative requirements

The four core requirements

An implementation that satisfies all four requirements is called Two-Rail conformant.

TR-1

Cross-Rail Write Prohibition

Source records, funds, and logs on the public and private rails must not be transferred between the rails. The public rail may contain only declared public status, summaries, verification references, hashes, timestamps, and version information. Personal information, trade secrets, costs, contract terms, internal logs, private keys, and unpublished evidence remain on the private rail.

TR-2

Verified Public Claim

A public claim on the public rail is limited to accepted values, states, summaries, and evidence references. Source records from the private rail are not disclosed directly. The existence of corresponding evidence on the private rail may be indicated only to the extent that indication is permitted for disclosure.

May be public

  • status
  • version
  • published_at
  • content_hash
  • evidence_reference
  • verification_route

Must not be public

  • ×Personal information
  • ×Original contracts
  • ×Cost details
  • ×Internal decision logs
  • ×api_key / secret
  • ×Unpublished evidence
TR-3

Verifiable Public Surface

The public rail has a public surface that a third party can check independently. The initial minimum public surface contains the following fields.

{
  "rail": "public",
  "status": "ready",
  "kernel_version": "0.1",
  "published_at": "YYYY-MM-DDTHH:mm:ss+09:00",
  "content_hash": "sha256:...",
  "private_records_exposed": false
}

Signatures, JWS, decision_hash, and third-party audit evidence are added when the implementation is ready. The initial version does not indicate that they have been fully deployed.

TR-4

Accountability Interface

A claim on the public rail is accompanied by an interface for checking evidence, recalculating results, and raising a dispute.

  • Which version the claim is based on
  • When the public surface was updated
  • Whether the hash matches
  • How much supporting evidence can be checked without disclosing private information
  • Where to raise an issue when there is an error or an obsolete-version reference

The interface does not require complete disclosure of private information. It requires a verifiable response path for a claim that has been made public.

Non-claims

What this document does not claim

  • ×That it has received third-party certification
  • ×That it is an official public certification
  • ×That a patent has been granted
  • ×That every signature mechanism has been fully deployed
  • ×The truth of private information
  • ×Authority to make policy or allocation decisions
  • ×A new cryptographic primitive

Two-Rail is not a guarantee of truth. It is a separation discipline for creating a verifiable public surface.

Status

Current status

Document
Two-Rail Kernel v0.1
Status
Public Kernel Draft
Third-party certification
None
Third-party audit
None
Signature coverage
Partial / planned
Patent
Application pending
RF Pledge
In preparation (not in force)

RF Pledge

Patent pledge for conformant implementations (in preparation)

A royalty-free, defensive patent pledge (RF Pledge) for implementations conforming to the Two-Rail Kernel is in preparation. After expert review, it will be published as a separate document with its signature date, effective date, and stable URL.

Publication of this Kernel document does not put the RF Pledge into force.

Frequently asked questions

What is the Two-Rail Kernel?

It is the field-independent minimum kernel for separating records that should be public from records that must remain private. An implementation is called Two-Rail conformant when it satisfies four requirements: prohibition of cross-rail writing, accepted public claims, a verifiable public surface, and an accountability interface.

What is the difference between the public rail and the private rail?

The public rail may contain only declared public status, summaries, verification references, hashes, timestamps, and version information. Personal information, trade secrets, costs, contract terms, internal logs, private keys, and unpublished evidence remain on the private rail and are not transferred between rails.

Does this mean third-party certification or production operation?

No. This document is Public Kernel Draft v0.1. There is no third-party certification or third-party audit, and signature coverage is partial or planned. It does not claim complete signature deployment or any specific social outcome.

Is the RF Pledge (patent pledge) in force?

No. The RF Pledge is in preparation and is not in force. After expert review, it will be published separately with a signature date, effective date, and stable URL. Publication of this Kernel document does not put the RF Pledge into force.

Evidence links

Time layer and governance identity

Document lineage ID: C3-SPEC-TR-KERNEL-01

Version: 0.1

Status: Public Kernel Draft

Source semantic revision: sr-0.1.0

The lineage ID is not a Registry snapshot Verify ID. This English review candidate has no Registry binding and does not issue or inherit a C3-REF value.