AURiX WHITEPAPER: Scope Compositor ================================================================================ Title: Compositing Without Judgment: How the Scope Instrument Renders Trust State Without Breaking Invariant Author: AURiX Protocol | April 2026 ================================================================================ ABSTRACT The Scope instrument faces a critical design challenge: producing a meaningful visual signal that represents the structural state of a page without imposing interpretation or judgment. The original AURiX traffic-light cursor (Y-Lens) encountered a fundamental problem—the page almost always appeared green because browsers filter the most obviously dangerous content before it reaches the browser layer. This white paper describes how Scope solves this through composition: reading state outputs from multiple instruments (Gauge, Trace, Ledger), applying a deterministic, formally declared composition rule, and rendering the most constrained state as a single visual signal. The result maintains invariant compliance while producing meaningful, actionable visual feedback. INTRODUCTION The core problem is deceptively simple: how do you make invisible mechanisms visible without becoming an interpreter? A user visiting a typical website encounters dozens of active mechanisms. Some are benign: form validation, layout adjustments, resource loading optimization. Some are concerning: scroll locks, redirect chains, overlay obstruction, interaction interception, focus traps. Most exist on a spectrum where the mechanism itself is observable but its intent is ambiguous. A redirect might be legitimate navigation or a tracking redirect. A scroll lock might improve mobile usability or prevent the user from escaping an overlay. The original AURiX traffic-light cursor attempted to solve this by categorizing pages into green (safe/stable), yellow (uncertain), and red (unsafe/halt). But this required judgment. Worse, in practice, almost every page appeared green because: - Most egregiously harmful mechanisms are filtered by browsers or blocked by the network layer before reaching the page. - Genuinely harmful mechanisms (redirects to malware sites, drive-by downloads) are rare in normal browsing. - Mechanisms that are concerning but not filtered are technically normal: redirects, overlays, script execution. The result was an instrument that lacked signal. It cried wolf never, making the yellow and red states meaningless. A user would lose trust in the tool because it never revealed anything. Scope solves this through a different approach: not by categorizing content as safe or unsafe, but by rendering the most constrained structural state as a single visual signal. The tool becomes useful because it surfaces real constraints that the user can observe and decide upon. THE SOLUTION: COMPOSITION, NOT INTERPRETATION Scope is a compositor, not a detector. Scope does not independently determine if a page is safe, unsafe, suspicious, or trustworthy. Scope reads the state outputs of all other active instruments (Gauge, Trace, Ledger, and optionally others) and applies a mechanical composition rule. The composition rule is formally declared and deterministic: 1. Collect the current state output from each active instrument. 2. Translate each output into a state representation: Stable, Uncertain, or Fracture. 3. Apply worst-state-wins logic: If all instruments report Stable, render Green. If any instrument reports Uncertain, render Yellow. If any instrument reports Fracture, render Red. 4. Render the result as a visual signal: green circle (Stable), yellow hollow circle (Uncertain), red triangle (Fracture). This is not interpretation because: - The composition rule is explicitly declared in the protocol specification. It is not hidden. The user can read exactly how the signal is produced. - The rule is deterministic. Two independent implementations of the same rule, given identical instrument outputs, produce identical results. There is no randomness, no judgment call, no edge case interpretation. - The cursor does not add meaning. It passes through the most constrained state that any instrument detected. Like a thermometer triggering an alarm at a declared threshold, the rule is mechanical. - The mapping from state to color is fixed. The protocol specifies: Stable=green, Uncertain=yellow, Fracture=red. No variation, no learning, no context-dependent adjustment. The user decides what to do with the signal. The cursor is not a recommendation. It is a reflection of constraint. STATE DEFINITIONS AND INSTRUMENT MAPPING Each instrument outputs a state that maps into the three-level system: Stable: The instrument observes behavior that is consistent, predictable, and non-contradictory. No signals conflict. Change is expected and ordered. The system behaves according to declared structure. Uncertain: The instrument detects contradictions, drift, or inconsistency. Behavior is not chaotic, but it is not fully aligned with declared structure. Signals conflict or are missing. The system is not broken, but it is not fully transparent. Fracture: The instrument detects an invariant violation. Observable mechanisms contradict declared mechanisms. Origins are ambiguous. Silent transformations are detected. The system cannot be structurally attested. The page fails to meet the minimal conditions for transparent interaction. Gauge maps as follows: - Gauge/Stable: No focus traps detected, scrolling is responsive, overlays are optional, interaction events fire as expected, layout is stable, DOM changes are ordered. - Gauge/Uncertain: Some interaction is intercepted, overlays are present but optional, layout shifts occur but resolve, some focus management is active. - Gauge/Fracture: Scroll is locked regardless of user input, focus is trapped with no escape, interaction is fundamentally intercepted or impossible, layout is chaotic and non-deterministic. Trace maps as follows: - Trace/Stable: Navigation follows expected patterns, redirects are transparent (declared in advance or part of standard navigation), cross-origin transitions are expected, no redirect loops detected. - Trace/Uncertain: Redirect chains exist but are complete and visible, some cross-origin transitions are present, navigation timing is variable, history manipulation is detected but is declared. - Trace/Fracture: Redirect loops are detected, cross-origin transitions contradict origin declarations, navigation targets are hidden, referrer information is being spoofed or redacted without declaration. Ledger maps as follows: - Ledger/Stable: DOM changes are ordered and expected, scripts execute in declared order, resources load as declared, storage changes are associated with declared actions. - Ledger/Uncertain: DOM changes include unexpected elements, some script execution is dynamic, resource loading order varies, storage changes occur from multiple sources. - Ledger/Fracture: DOM mutations are unattributed, scripts execute in contradictory order, resource loading violates declared dependencies, storage changes are undeclared. Scope maps as follows: - Scope/Stable: Initial surface is clean, no major obstructions, declared forms and inputs are accessible, initial redirects are transparent. - Scope/Uncertain: Initial overlays are present, initial form structure is complex, initial navigation transitions exist. - Scope/Fracture: Initial surface is obstructed, declared metadata contradicts observed structure, initial redirect is opaque. Worst-state-wins logic is applied: If Gauge=Uncertain, Trace=Stable, Ledger=Stable, Scope=Stable, the final output is Yellow (Uncertain). If Gauge=Stable, Trace=Fracture, Ledger=Stable, Scope=Stable, the final output is Red (Fracture). If Gauge=Stable, Trace=Stable, Ledger=Uncertain, Scope=Uncertain, the final output is Yellow (Uncertain). The rule is transparent: the user can check which instrument caused the yellow or red by reading the detailed instrument reports. THE SEMANTICS OF COLOR AND SHAPE The visual signal is rendered using both color and shape to maximize accessibility: Green = Stable. Rendered as a filled green circle. The circle conveys wholeness and integrity. Yellow = Uncertain. Rendered as a hollow yellow circle. The hollow conveys that the interior is not fully present, that something is ambiguous. Red = Fracture. Rendered as a red triangle. The triangle is geometrically distinct from the circle, signaling a change in category. The pointed shape suggests a warning flag, a boundary marker. Shape encoding ensures that the signal is readable by people with color vision differences. A user with deuteranopia (red-green color blindness) sees green circle, yellow hollow circle, red triangle—three distinct geometric and color combinations, all readable. A user with achromatopsia (complete color blindness) sees three distinct shapes. The shapes are simple: circle, circle, triangle. They are learned quickly and recognized at a glance. Color is used for fast recognition (color name activates association), shape for reliable distinction (shape is processed differently in vision than color). The filled green circle conveys completeness and stability through its filled interior. The hollow yellow circle conveys ambiguity through the absence of fill. The red triangle conveys a distinct category through geometric change. FROM INDIVIDUAL SIGNALS TO COMPOSITE STATE A single page might have dozens or hundreds of active signals. How does the compositor avoid becoming a judgment filter? The answer is layering. The visual cursor (green, yellow, red) is only the visible output. Behind it, all detailed signals remain available: - Gauge reports 50 active signals: scroll lock=true, overlay=2 elements, focus trap=none, DOM mutation rate=high, etc. - Trace reports 5 signals: initial redirect from google.com to target domain, no loops, all origins declared. - Ledger reports 30 signals: DOM mutation timestamps, script execution order, storage writes. - Scope reports 8 signals: initial state clean, no obstructions, form structure normal, initial load transparent. The compositor reads these and produces: Yellow. The user can see Yellow and decide to investigate. They can read the Gauge report and see which signals triggered the Uncertain state. They can read the Trace and Ledger reports and verify or dispute the classification. They have access to all the underlying data. The Yellow is not a judgment; it is a summary of constraint. This is the key insight: the visual cursor is not the message. The cursor is an entry point. The message is the complete signal data, which the user can inspect and understand. WHY REDS CAN NOW APPEAR The original traffic-light cursor rarely produced reds because "malicious" is a judgment, not an observation. But with the compositor approach, reds emerge from actual constraint: Scenario 1: Scroll Lock + Redirect Chain + Cross-Origin Form - Gauge detects scroll is locked and cannot be restored (Fracture) - Trace detects a redirect chain with ambiguous origins (Uncertain) - Ledger detects form submission to a different domain than the page origin (Uncertain) - Scope detects initial obstruction (Uncertain) Worst-state-wins produces Red. The red does not mean "malicious." It means "the system failed structural attestation. Scrolling is locked and cannot be escaped, and navigation targets are unclear." The user looks at the detailed reports, sees that they cannot scroll away and the form goes somewhere unexpected, and decides what to do. The user makes the judgment. The instrument made the observation. Scenario 2: Redirect Loop - Trace detects: user clicks link on example.com, redirects to redirect.example.com, which redirects back to example.com, which redirects to redirect.example.com. - Ledger detects: each redirect adds a timestamp but the URL pattern repeats. - Gauge detects: page never fully loads, stuck in loading state. Worst-state-wins produces Red. The red does not mean "attacking you." It means "the system is in an unresolvable state. Navigation is looping, and the page cannot complete loading." Again, the user sees the data and decides. PERFORMANCE CONSIDERATIONS: TIERED GAUGE DETECTION The Scope compositor reads outputs from Gauge, which must operate efficiently. Gauge tiering enables this: Tier 0: Minimal expensive operations. Tier 0 runs on every page and checks only the most critical and cheap signals: Is scrolling locked? Are major overlays present? Is focus trapped with no accessible exit? These checks run in <5ms and use cached DOM queries. Tier 1: Broader sampling on interaction. When the user interacts (clicks, types, scrolls), Tier 1 runs in the background and checks more signals. This adds 10-20ms but only when the user is actively engaged and less likely to notice latency. Tier 2: Full traversal on demand. When the user explicitly requests a detailed Gauge report (via right-click menu), Tier 2 runs the complete traversal of all 15 families. This might take 50-100ms but is explicitly requested by the user. Scope always operates on the current Gauge state (whatever tier is active), so Scope incurs no additional cost. Tier 0 runs constantly, enabling Scope to always provide a current signal, even if that signal is based on a limited sample. When Tier 1 or Tier 2 data arrives, Scope updates automatically. INSTRUMENT INTERACTION: THE READING ORDER Scope reads instruments in a specific order to handle dependencies: 1. Read Gauge (current state) 2. Read Trace (navigation context) 3. Read Ledger (change history context) 4. Read Scope's own baseline (initial state) 5. Apply worst-state-wins 6. Render output This order ensures that Scope's output reflects the most current information. If a user navigates away and then returns, Trace updates first (new navigation recorded), then Gauge and Ledger update (new page state), then Scope re-reads and re-renders. COMPOSITION AS TRANSPARENCY, NOT OPACITY The key to the compositor's adherence to AURiX invariants is that composition is transparent: - The composition rule is public and fixed. - The rule is deterministic and reproducible. - No signal is hidden to reach a particular output. - The detailed signals are always available for inspection. - The cursor is a summary of the constraints detected by multiple instruments, not a categorical judgment of the page. Compare this to a typical browser security indicator (green padlock = safe, gray = uncertain, red = not secure). These indicators are opaque: - The rule that determines green vs. red is proprietary. - The rule changes with software updates. - Many signals influence the determination but are not visible to the user. - The user cannot verify the determination. - The indicator purports to summarize "safety," which is interpretation. The AURiX Scope compositor is deliberately the opposite. Every signal that influences the output is available. The rule that determines output is declared. The output is called "Stable/Uncertain/Fracture," not "Safe/Suspicious/Dangerous." The user knows exactly what the signal means and can verify it or dispute it. ACCESSIBILITY AND INCLUSIVITY The signal design prioritizes accessibility: - Shape encoding (circle, circle, triangle) is readable by people with color vision differences. - Clear contrast ratios between foreground (the instrument) and background (the page) ensure visibility for people with low vision. - The signal is minimalist and does not rely on animation or motion, supporting people with vestibular disorders. - The signal does not flicker or refresh too rapidly, supporting people with epilepsy. - The geometric simplicity ensures the signal is recognizable at small sizes and high zoom levels. The design philosophy: "AURiX should look like revealed state, not borrowed prestige." The signal is not designed to impress. It is designed to be clear, stable, and understandable. CONCLUSION The Scope compositor achieves meaningful visual feedback without imposing interpretation by applying a mechanical, formally declared composition rule to outputs from multiple instruments. The rule is deterministic: two implementations produce identical results from identical inputs. The signal is transparent: all underlying data is available for inspection. The output is actionable: the user can see constraint and decide what it means. By compositing rather than independently judging, Scope maintains invariant compliance while producing a visual signal that actually conveys information. The traffic-light cursor is useful now because it reflects real structural constraint, not a scoring algorithm. And reds can appear because structural constraint is observable, even if judgment about intent is not. ================================================================================ END OF WHITEPAPER