Sanctor: A Deterministic System for Acting by the Book

·

Abstract

Relationships between people rest on written agreements, but the writing is scattered, read differently by each reader, and replaced over time by habit. We propose a system in which a body of agreements is compiled into one book of exact rules, and nothing vague may enter it. Every act is checked against that book before it proceeds. Every decision is written once to a chain that cannot be altered, and the book changes only through the doors its own text names. Models do the reading. The book does the deciding. The record keeps words and hashes and never a file. Every rule traces to the words it came from, every entry to the rule it was made under, and the record turns practice into conduct in writing.

A note on vocabulary. This paper borrows terms from blockchain systems because they describe the mechanics precisely. The system itself is a private, permissioned, append-only hash chain kept for the parties to a relationship. There is no public network, no token, no mining, and no consensus among strangers.

01

The problem

Whatever the relationship, whether between a landlord and a tenant, partners in a business, siblings who own a house together, a club and its members, a funder and a recipient, or a person and the software agents acting for them, it rests on written rules about who may do what, on what conditions, and with whose consent. In practice nobody reads all the writing, so authority is exercised from memory. Different readers reach different conclusions.

When the rules change, the change is often unwritten, and when it is written, the old text often stands uncorrected beside it. Vague words survive until a dispute forces someone to say what they meant. Rules and conduct drift apart until neither can be relied on. Tools that store documents do not understand them. Tools that answer questions about them with a language model answer from probabilities, and however well trained, are not reliable to the last case. They cannot show how an answer was derived, only where it is anchored. And as software agents begin to act for people, each of them needs to know, exactly and provably, what it is allowed to do.

02

Prior work

The idea that a legal document can be both readable by people and readable by machines, and identified by its hash, is the Ricardian contract [1]. Compiling law and contracts into executable form has been pursued by rules-as-code projects such as Catala [2] and the Accord Project [3], mostly for legislation and contract templates. Deterministic "may this actor do this" checks are the business of policy engines such as Open Policy Agent [4], where rules are written by engineers and changed by an administrator.

Append-only records secured by hash chains and Merkle trees come from Haber and Stornetta [5] and Merkle [6], and were made famous by Bitcoin [7]. Systems that rebuild all state from an event log are standard engineering [8].

Each of these solves one part. None compiles a party's whole body of agreements into a readable book that is also the rulebook a machine evaluates, changed only through the doors its own text names, with no administrator above it, checked deterministically, and traceable from every act back to the words that allowed it. That combination is what we describe.

03

The book

The system reads agreements and compiles them into rules. A rule is an expression: an effect applied to a seat, an act and its conditions. There are five effects. A rule may allow an act up to a limit, require approval for it, forbid it, require it by a date, or say how other rules are amended. Each rule names who must agree, by seat and number.

Figure 1. A clause becomes an expression and a plain-language rewrite. Every value in the expression points to the words it was read from. The rewrite is not a copy of the source; it untangles it.

Where models are used. Compilation is where models work, and it is where the boundary of determinism must be drawn honestly. A model reads each clause and proposes its expression and rewrite. Two checks then run without a model: every value in the expression must point to the exact passage it was read from, and every passage of the source must be accounted for by some rule or flagged as unused. A second model pass argues against each reading, and any reading that does not survive is marked "not determined" rather than guessed.

The clarity gate. A rule cannot enter the book until it is exact: who may act, what the act is, up to what limit, with whose approval, and where it came from. "Reasonable expenses" does not pass; "expenses up to $5,000, above that two officers" does. When a clause is vague, the system asks the parties to say what they meant, and only their answer can be adopted. The gate demands clarity, not any particular deal. The parties may agree to anything; they must say it exactly.

Every rule keeps its source. Every rule in the book comes from an adopted package: a whole document, an omnibus of several, or a single clause. When a document is given to the system it is hashed and its words are extracted onto the record. The file itself is handed back and never kept. The rule carries three hashes: the package it came from, the clause's place within it, and the clause's exact text. The source is therefore always on the record, one step away, and a later reader can check that the words have not changed. Anyone holding the original file can hash it again and prove it is the file that was read. The law is never a source. It changes the book only by causing an amendment to the relevant rules that the parties adopt themselves (section 4).

A compile error is therefore bounded twice: by the checks, which catch readings that do not match their source, and by adoption, where a person accepts or corrects what the checks cannot judge.

After adoption, no model decides anything, but a model is still stitched into every answer, with a light touch. It does the looking up: it translates a question into the book's terms and finds the rules it touches. An act often answers to several rules at once, and each one the model finds is named, shown, and evaluated on its own terms. The person confirms that selection before anything is sent.

The verdict on each rule is then computed without a model, and the model puts the result back into words. The record keeps the confirmed question, the rules applied and the computed verdicts, never the model's phrasing. Because both halves do work, both are metered the same way: model work at its token count, and the deterministic evaluation normalised to the same unit.

Identity and versions. Every rule has a permanent identity, and references point to identities, so rules can be added or amended without breaking the rest. Every rule also has versions.

The book as a whole lives in the matrix: the compiled rules in force, held so a check can be answered at once. The matrix is never the source of truth. It is derived by replaying the chain, and each adoption commits to the matrix as it then stood with a hash over all its rules, written on the entry.

Any copy can be rebuilt from the entries and must land on that same hash, the way a blockchain's state is rebuilt from its blocks and checked against the state root each block commits to. The source documents are not stored anywhere; only their hashes and the words read from them are on the record. Any question about any date is answered by replaying to that date and reading the matrix as it then stood.

04

Adoption and its doors

A rule enters the book only by adoption: a decision signed by the parties with authority to make it, recorded with the identity and capacity of each signer. Every adoption is numbered in order. What differs between adoptions is the door they pass through.

Two kinds of doors. New structure, a text the book has never held, is adopted through the door the book provides for it. At the founding, that door is the controllers. After that, any adopted text may empower a seat to adopt texts of a stated kind, and may let that seat empower others; no grant can exceed the authority of the text that made it. Every rule therefore traces, through the texts that empowered it, back to the founding.

A change to an existing rule passes through the door of that rule's own text names. If a contract says it may be amended only in writing signed by both parties, that clause is the door: the system refuses an amendment without its signed instrument. A clause requiring variations in writing stops being a hope and becomes a mechanism [9].

Each rule has exactly one door. Two clauses cannot both claim to govern the same rule, a clause cannot claim rules that do not yet exist, and nothing governs the founding rules except the founding itself. If the door for a rule moves while a change to it is waiting, the waiting change goes stale and is closed when the adoption that moved the door is written.

The system never proposes. A model may draft an amendment, but a draft is an offer. A party with standing sends it under their own signature: a controller for a new text, or for a change, a controller or someone the rule names. Every drafted rule waits inside such a signed proposal, so no draft exists that nobody has put forward.

Every adoption carries its cause. An adoption is itself an entry, marked A, and it closes a block: the book moves to its next version and the matrix hash for that version is written on the entry. The cause says why the book changed, and it sits on that same entry. Causes are a separate code from the entry's own mark, so an adoption entry reads A with a cause such as T or L beside it. The cause A means something different: a confirmed act the parties want to make a standing rule.

The cause is not the source. A resolution, a statute or a flood can cause a change, but the words adopted always come from a package the parties signed.

The law never enters the book and is never mandatory within it.

When the law changes, the system extended capability can draft a conforming amendment, limited to the rules the change affects, and offers it to the people those rules name. They may accept it, change it or reject it. If they adopt it, it passes through the rule's own door like any amendment, with L as its cause. This describes the book, not the law: the parties remain bound by the law whatever they adopt.

05

Matters and the pool

Nothing reaches the chain half-done. Every open question waits in a pool off the chain: a request to act, a ratification of something already done, a reported fact, a proposed adoption. The pool is organized by matter. A matter is a label for one question and everything sent toward settling it. It describes and never decides. A matter has one clock, set when it opens, and one ending.

Versions are candidates. Within a matter, each thing sent for signature is a version. A version is private to its author until the first signature falls on it, at which point it is committed to the pool and can no longer be altered. A second version does not replace the first. Versions sit side by side as candidates, each identified by the hash of its own content, so the same words cannot be sent twice and a signature always stands under exactly the words it was given.

Signatures move until the seal. Each signer named by the rule holds one live signature per matter. They may place it on any version, move it to another, or withdraw it, until a version seals. A signature counts only if the signer holds the required seat at the moment of signing. A signer who has left the seat can no longer answer; their successor can. If a seat is empty, the matter waits for it to be filled rather than failing. The person who sends a request counts as a yes on their own request, but never on a ratification: nobody approves their own conduct.

The seal. The first version to reach the threshold its rule names is sealed and written to the chain once, carrying every signature and its time. Every other version in the matter is closed as superseded. A matter is refused only when no version can still reach the threshold. Refusals, lapses and supersessions are entries like any other; the record keeps what was declined as faithfully as what was approved.

A matter therefore closes in one of six ways:

The silence time. Every workspace fixes, at its founding, how long a matter may wait. A matter nobody settles lapses at its own deadline and is written as lapsed, dated to that deadline. Silence is never consent. Time on the record only runs forward, and every lapse that falls due is written before anything later is accepted.

Talk stays off the chain. People discuss an open matter wherever they talk, and the system keeps that discussion beside the matter. None of it reaches the chain; only versions and signatures do. Discussion never changes a version. If the terms should be different, a new version is sent into the same matter, and the signers decide which candidate they stand under. No signature ever stands under moved words.

06

Facts

A check needs facts: an amount, a date, whether a consent exists, who holds a seat. Every fact the system uses is already on the record, as an entry with a time and a responsible party. There is no other source. A fact the record does not contain is not assumed; the check returns "not determined" for it.

A reported fact waits for the people it concerns. Anyone with standing may report that something happened: a return was filed, a payment made, a pipe burst. The report is a matter like any other. If it names someone, that person confirms or disputes it. If it names nobody, as with a flood, the controllers confirm it at their threshold. It goes straight onto the chain only when it is itself the confirmation: a person reporting their own conduct. A disputed or unanswered report never becomes a fact.

Standing is required even to confess: only a party the book recognises can put a fact on the record. And admission is not a cure. A confirmed report that an act broke a rule records a breach; confirming the fact does not approve the act.

Truth and authority are separate questions. Reporting a fact settles whether something happened, and it is answered by those it concerns. Ratifying an act settles whether it is approved, and it is answered by the signers the rule names. They often travel together, and each closes on its own, so the record can hold a confirmed fact and a refused approval side by side: a breach in writing.

Conduct is judged by the words of its day. A reported act is checked against the rule in force on the date it happened, not the rule in force when it is reported. A rule adopted in June cannot make February's conduct a breach.

The system never records an absence. A duty that falls due without being performed is not written as a failure. Anyone can read it from the chain: the rule, its due date, and no discharge before it. And when the book is silent on a reported fact, the fact is still recorded, but it causes nothing until the parties adopt a rule for it, citing the fact as its cause (F).

07

The check

Given an actor, an act and the facts, the system evaluates the book and returns one of four verdicts: allowed, needs approval, not allowed, or the book is silent. With the verdict it returns its reasons, the rules the verdict rests on, each traceable to its source, and, where approval is needed, the seats that must give it and who holds them today.

Figure 3. A check returns a verdict, its reasons, and the people whose approval is needed.

Every rule that speaks applies. The book does not rank its rules. When an act touches several rules, the act answers to all of them, and each rule's signers must agree in that rule's own terms. If the parties find that two rules overlap, they can merge them into one by an adoption signed through every door involved. The friction is the signal; the remedy is theirs.

Asking is free. A check writes nothing. Only when someone sends a version does a matter enter the pool, pinned to the version of the book it was checked against. If the book changed in the meantime, the version is stale and nothing is committed.

The consult. A person asks in plain words, and a model works out which act is meant and which rules it touches. That is the model's one touch on a live question, and it is made visible before anything is sent. When a version is sent, the system shows the stamp it will carry: whether it is a decision or a fact, the rule it rests on, the signers locked from that rule, the threshold, and the close date. The sender confirms the stamp or corrects the kind. If the version would change a rule, the stamp says so and routes it to that rule's door as its own matter. From there the check uses no model. It is a computation over the adopted book and the record, and it takes the moment of evaluation from the record's own clock, so the same question about the same moment returns the same answer, now or years later.

Disagreement. A party who disagrees with a verdict does not argue with the system. They refuse the version, send a version of their own, or propose an amendment through the rule's door. All are entries on the record.

08

The record

Every closed matter is an entry: an act, a ratification, an adoption, a confirmed fact, a change of seat. Each names the parties who signed, the seat each held, the rule it was made under and the time, and each carries the hash of the entry before it. The chain is append-only. A correction is a new entry, and a reversal is a new act, never an edit. The record holds two chains at once. Each entry links to the one before it, which proves nothing was altered. And each entry links to the rule it was made under, the rule to the clause and package it came from, and the package to the adoption and the controllers who made it binding. The first chain gives integrity; the second gives authority.

Identity and seats. The chain of authority hangs on knowing who acted. Each party holds a signing key, and every signature carries the key, the seat and the time, all covered by the entry's hash. Seats are separate from keys, and separate from the people in them. A seat exists only because a rule defines it: the controller seat by the first entry, every other seat, a treasurer or a director, by a text the parties adopted.

A person is put in a seat only by those the rules empower to appoint to it, the controllers or any seat a rule gives that power, and only at the threshold the rule requires. The appointee then accepts with their own signature, and both appear on the entry. Nobody is ever seated by the system, by an owner, or without signing their own appointment.

When a seat changes hands, the old holder's capacity ends and the new holder's begins, each an entry with a date; a signature is valid only if the signer held the seat at the moment they signed. People may resign their seats, and may be removed by whoever the book empowers to remove them, at the threshold it sets. The founding itself is never overridden; succession changes the people in its seats, under its own terms.

A lost or compromised key is revoked by an entry made by a party the book authorises, and a new key is bound in its place. Nothing signed with the old key after revocation is accepted, and everything signed before it stands. The chain does not know that a person sat at a particular laptop; it knows that an entry was signed with a key bound to that person, in a seat they held at that time, and every step of that binding is on the record.

There is no administrator. Nobody, including the system's makers, holds a key the book has not seated.

Endings. A rule is ended by an adoption through its door, never erased. It stays in the record, governing every question about the period when it was in force. A rule once ended does not return; if the parties want it back, they adopt it again as a new rule.

Everything else is derived. The book and its versions, the matrix that holds it, who holds which seat, and when each duty falls due are all computed by replaying the chain. Nothing is kept by hand, so nothing drifts.

The one thing replay cannot show is what is still open: versions and signatures wait in the pool, off the chain, until their matter closes, and only then become an entry. Any register the parties want, a minute book, a table of holdings, a list of obligations, is a small program over the entries, and the program itself is hashed so it draws the same way every time. Any question can be asked as of any date, and any entry can be traced back through its rule and clause to the hash and words of the document it came from and the people who signed it: a chain of authority for decisions.

Words and hashes, never files. The chain holds the hash of every document it was given and the words that were read from it. It does not hold the file. When a document arrives it is hashed, its words are extracted onto the record where the parties can read them, and the file is handed back.

The purpose of the record is rules that can be acted on and decisions that can be proved, and both are made of words. A party who keeps the original can present it again at any time; the system hashes it and answers whether that hash is on the record and where. A document the parties destroy, for example when the law requires personal data to be erased, leaves its hash and its extracted words behind, so a missing file never looks like tampering and never costs the record a word it relied on.

Who may read. Who may read the book and the record is itself set by the book. Each party sees the rules and entries their seats entitle them to. Within those limits, an explorer lets a reader look up any version or entry by its hash, verify the chain, and see exactly what the book said on any date.

09

A worked example

Three siblings inherit their parents' house and sign an agreement about how they will own it together. One clause reads: "No co-owner shall let the property or any part of it for a term exceeding one month save with the written agreement of the others."

Found. They open a workspace. The first entry names the three of them as its founders, sets that all three must agree to adopt a new text, and fixes thirty days as the time an unsettled matter may wait.

Compile. The eldest drops the agreement on the Desk. The system hashes it, extracts its words onto the record, hands the file back, and proposes its rules. For this clause: a co-owner may let the house for up to a month; anything longer needs the written agreement of the other co-owners, all of them. It ties "co-owner," "one month" and "the others" to the words of the clause and confirms every word is accounted for. Each rule carries the hash of the agreement, the clause's place in it, and the hash of the clause's exact text.

Adopt. The eldest sends the compiled agreement as version 1 of the founding matter; the other two sign it. The adoption is written to the chain, and the book holds its rules. The renting rule has a permanent identity and a depth of zero.

Ask. A year later the eldest wants to rent the top floor to a lodger for twelve months. She asks whether she may. The check finds the rule, sees the term exceeds one month, and answers: needs approval, under §4 of the house agreement, from the other two, both of them. Nothing has been written.

Act. She presses Act on the Ask, writes the request, and sends it. The stamp shows a decision under §4, two signers, both required, closing in thirty days. Version 1 enters the matter with her own signature and goes to the other two, each shown the same words, identified by their hash. The middle sibling signs. The youngest does not: the proposed lodger is his own son, and he says so in the discussion beside the matter. He does not want his signature counted. The rule needs both, the book is silent on a co-owner with a personal interest, and nobody can sign in his place. The matter cannot reach its threshold. The eldest withdraws it, and the withdrawal is written once, with the two signatures it had.

Resolve. The three meet and agree, in a short signed note, that a co-owner with a personal interest in a letting should stand aside, and the agreement of the remaining owners should suffice. The note is dropped on the Desk; its hash and its words go on the record. One of them sends the amendment into a new matter, citing the note's hash as its cause. The agreement says all three must agree to change it; the stamp says so, and all three sign, the youngest included, because the change is general. Version 2 of the rule enters the book, and its depth starts at zero.

Approve. The eldest asks again and sends again. Under version 2 the stamp names one signer, the middle sibling, the youngest standing aside. The middle sibling signs and the letting is sealed in one entry carrying both signatures and their times. The signed tenancy agreement is dropped on the matter; its hash and its words go on the record and the entry cites the hash. The rule's depth becomes one.

A second candidate. Eighteen months on, the eldest wants to let the garden flat as well. She sends a version for a two-year term. The middle sibling thinks two years is too long and, rather than refusing, sends a version of his own into the same matter for one year. Both versions sit side by side. The eldest reads his, moves her signature to it, and it seals with both signatures; her own two-year version closes as superseded. Nobody edited anything, and the record shows both candidates and who stood where.

Change. Two years and six lettings later, the siblings agree that lettings up to six months should not need approval. One sends the amendment, it goes to all three, is adopted, and version 3 enters the book. Any question about the years before is still answered by the version in force at the time, and anyone can trace each letting back through its rule to the clause, the note and the three of them.

10

Depth

A rule adopted but never used stands on its reading alone. Each decision made under it is a confirmation that the parties applied it: every approval and every refusal under the rule, and every time a duty it imposes is performed. The system counts these per version of the rule and reports the count as its depth. When a rule is amended, the new version starts again at zero, because its words have not yet been tested. A transaction gains standing with each block built on it [7]; a reading gains standing with each decision taken under it.

Depth describes; it never decides. A deep rule does not outrank a new one, and a shallow rule binds just as fully. Nothing happens automatically when depth reaches any number: no rule expires, no agent is promoted, no approval is waived. Depth shows that a reading is settled and relied upon. It does not prove the reading was correct, and the system does not claim that it does.

Reversal is visible, not forbidden. A recorded decision is never erased, but a later decision of the same authority can undo its effect. Later decisions cite earlier ones, and acts are taken in reliance on them, so reversing a decision deep in the record means facing everything that depended on it. The system does not impose that cost. It makes it visible: any decision can be traced forward to everything that relied on it, before anyone signs the reversal.

11

Conduct in writing

Because every act is checked against the written rule, there is no unrecorded practice. An act either follows a rule, or it is reported as a departure and judged under the rule in force when it happened. If that rule allows it, the report closes as conforming. If the rule requires approval, a ratification goes to the rule's signers, who approve or refuse it. If the rule forbade it, the report records a breach, and no ratification can turn it into anything else. Practice cannot quietly vary the book, because every departure from it is itself written down.

This matters in law. Courts differ on whether consistent conduct can vary a written agreement despite a clause requiring variations in writing. English law holds such clauses to their word, subject to estoppel [9], while American law more readily reads the course of performance into the agreement [10]. Under this system the question largely does not arise, because there is no conduct that is not in writing, and a clause requiring amendments in writing is enforced as the door it describes (section 4).

12

Two parties, one reading

Where the book holds a party's own rules, adoption makes the compiled text authoritative. Where it holds a reading of an agreement with another party, the reading is presented as a reading, tied to the original words, and the other party is invited to adopt it through the same mechanism. The agreement's own amendment clause is the door, so both parties sign.

This is the system's answer to disputes about meaning. Two parties who each sign the same exact reading of a clause have agreed, in writing, on what it means, and the clarity gate means that reading leaves nothing to argue about later. From then on, both sides check their acts against the same rule, both see the same verdicts, and both share the same record of what was done under it. A disagreement is raised as a refusal, a competing version, or a proposed amendment to a specific rule, not as a dispute about a document. The agreement stops being a text each side interprets alone and becomes a rulebook they operate together.

13

Agents

Any actor, human or software, is subject to the same check. A software agent may do exactly what the book says its seat may do, and nothing more. The grant of that seat is itself an adoption by the parties, and the agent signs with its own key, bound and revocable like any other, with its entries marked as an agent's. Within its grant, an agent's acts are recorded like anyone's and add to the depth of the rules they were made under. When an agent reports a fact, the report waits for the people it concerns, like anyone's. A grant may begin narrow, with the agent's acts co-signed by a person. Widening it is a decision by the parties: an adoption through the grant's door, informed by the agent's record, never triggered by a number. Reliability is earned on the record, granted by decision, revocable by decision, and always bounded by what the law reserves to people [11].

Agents never decide who must agree. Who must sign is computed from the book and the seats; an agent may deliver the request, draft the reply or chase the signature, but it never chooses the signers. The system's own agent is held to the same rule. It has two jobs, reporting what is open and waiting, and running the checks the parties have switched on, and it never signs, adopts or closes anything.

14

What the system never does

It never adopts, and it never proposes; it drafts offers that a party puts forward. It never lets anything into the book that is not exact. It never ranks one rule above another; every rule that speaks applies. It never lets the law or a fact become the source of a rule, only its cause. It never guesses a reading or a fact; "not determined" is a valid state for both. It never changes the substance of a rule when rewording it.

It never writes half-done work to the chain, never writes a version twice, and never treats silence as consent. It never alters a version after its first signature. It never records an absence. It never judges conduct by words adopted after it. It never lets depth decide anything. It never deletes an entry, and it never edits one. It never keeps a file. It never accepts an unsigned entry, or a signature from someone who did not hold the seat at the moment they signed. It never lets an agent exceed its grant, and it never lets a model decide who must agree. It has no administrator, and no way for anyone, including its makers, to change the rules except through the rules.

15

Limits

The check is only as complete as the compile, and the compile is only as good as its review. The system knows what it has not read: documents referenced but not supplied, readings it could not determine, facts nobody has confirmed, and questions the book does not answer. It reports these rather than filling them in.

The one place a model still touches a live question is the consult, the matching of a plain-language request to the rules it concerns. That matching is shown to the person as the stamp before anything is sent, and the entry records exactly which rules were applied, so a mistake there is visible and correctable; it is never silent.

Depth is evidence that a reading is settled and relied upon, not a legal conclusion. The system records who held authority and how they used it; it does not make an agreement lawful, and the parties remain responsible for what they adopt. Acting outside the rules is not prevented. It is recorded as what it was.

16

Conclusion

We have described a system in which any body of agreements is compiled into a book of exact rules, every act is checked against it deterministically, and every decision is written once to a permissioned, append-only chain. Every rule traces to the words it came from, every entry to the rule it was made under, and every change to its cause and the door it passed through. Models do the reading; parties do the adopting; the book does the deciding. The record keeps words and hashes, never files. Readings become settled with use, and the record turns practice into conduct in writing. The parties keep the pen; the system keeps the book.

·

References

1. I. Grigg, "The Ricardian Contract," 1996; expanded in Proceedings of the First IEEE Workshop on Electronic Contracting, 2004.
2. D. Merigoux, N. Chataing, J. Protzenko, "Catala: A Programming Language for the Law," Proceedings of the ACM on Programming Languages (ICFP), 2021.
3. Accord Project, "Cicero and the Concerto model," accordproject.org.
4. Open Policy Agent, openpolicyagent.org.
5. S. Haber, W. S. Stornetta, "How to Time-Stamp a Digital Document," Journal of Cryptology, 1991.
6. R. C. Merkle, "A Digital Signature Based on a Conventional Encryption Function," CRYPTO '87, 1987.
7. S. Nakamoto, "Bitcoin: A Peer-to-Peer Electronic Cash System," 2008.
8. M. Fowler, "Event Sourcing," martinfowler.com, 2005.
9. Rock Advertising Ltd v MWB Business Exchange Centres Ltd [2018] UKSC 24.
10. Uniform Commercial Code §1-303 (course of performance, course of dealing, and usage of trade).
11. For example, statutes requiring a will to be signed by the testator in person, such as the Wills Act 1837, s. 9 (England and Wales).