Boundaries before cleverness.

System map

Clients at the edge, one public spine, five data planes.

Web client / iOS host / future community clients
        │
        ├── device workspace ── local ions, files, Local AI
        └── explicit network actions
                  │
           Global Server (Cloudflare Worker)
             ├── account & authentication
             ├── public heap and projections
             ├── read-only knowledge corpora
             ├── civic and trust procedures
             └── candidate / operational workspace
                  │
            D1 · R2 · Durable Objects · Workers AI (bounded)

The browser and iOS host share the React product runtime. The native host owns operating-system boundaries; the Global Server owns durable public and account contracts. The public website and these docs explain the system but do not hold private product state.

Five-plane model

Each plane has a distinct promise.

The whole organism

Six layers connect without collapsing their authority.

Clients

The shared kernel owns product behavior.

Shared contracts under Production/Platforms/shared cover API, identity, heap, publishing, and local Think behavior so future native work can reuse semantics without cloning frontend accidents.

Fracta runtime

The client computes views from explicit boundaries.

AuthorityScope
 permission-filtered Context
 declarative Lens
 View Recipe
 renderer
= Fracta Canvas

The Canvas is derived presentation. Canonical truth remains in local stores, reference corpora, account stores, or typed Public Artifacts. A View Recipe can replay a recorded arrangement or deliberately refresh it against current data. Models may propose semantic intents and Lens configuration; the host owns permissions, geometry, persistence, policy, tools, and accessibility.

Think’s recursive canvas is the mature behavioral reference. Learn’s Venn atlas remains a distinct renderer while adopting the same guarantees for semantic zoom, complete labels, stable orientation, predictable child emergence, Vein traversal, deterministic reinstantiation, and nonvisual navigation.

Global Server

A Cloudflare Worker with explicit route families.

The server separates anonymous public reads, account and identity routes, Ion Protocol participation, community trust, civic cases, governance and review, maintainer operations, the Ion Commons workspace, and compatibility utilities. Every literal route must be classified by the route-exposure audit.

Participation spine

Reality can precede signup without becoming public accusation.

account → confirmed account → verified person → community reviewer → case moderator

private issue → unclaimed entity → match proposal → human review
             → entity claim → claimant accepts or disputes matched history

accepted issue → private civic case + deterministic process plan
               → notice → reply → evidence → human review → appeal

Access levels describe eligibility, not worth or automatic authority. A separate duty contract now binds one selected person to one task, expiry, selection record, registered-key conflict response, and append-only completion history. The unassigned pool contains opaque task references, not private review content. Matching never merges automatically. Claiming an entity never erases or accepts its history. The remaining gap is real operation: external notifications, safeguarding, accessibility, pagination, and staffed public institutions.

Public persistence

Typed records and append-only events are primary; old addresses remain readable.

ion_commons_records now stores typed Public Artifacts, first-class signed Veins, human and group Actors, signed profile projections, membership records, proposals, attestations, revisions, Events, and Receipts. heap_events remains append-only truth for older decentralized-heap participation paths, with heap_ions as its materialized view. Legacy public-artifact mutation in ions is locked. Historic addresses remain readable; old unit and governance readers are compatibility debt, while retired Actor follow/contact write routes fail explicitly instead of mutating another truth store.

Identity & security

Account, Actor, and profile never collapse into one row.

• Production auth fails closed if durable D1 persistence is unavailable.
• Durable Account tombstones invalidate existing sessions after deletion.
• OAuth starts issue signed state and nonce; callbacks validate both.
• Actors remain durable subjects even when no Account controls them or a profile is invisible.
• Profile output is allowlisted rather than returning arbitrary Account or Actor metadata.
• Public writes bind the authenticated Account to a server-derived or governed Actor control relationship.
• Client-held signatures are verified against registered public keys.

Signature contracts support Ed25519, post-quantum ML-DSA-65, hybrid verification, key graphs, revocation, and rotation. This proves key control for a scoped action; it does not prove unique personhood or permit public-history rewrite.

Reference data

Wikipedia is physically and logically air-gapped from Commons truth.

GET /v1/knowledge/wikipedia reads dedicated knowledge_nodes and knowledge_edges. Its reader has no public Commons store dependency and no mutation method. The versioned server atlas prefers a real v2 branch and fills only an empty matching domain from the quarantined v1 edition. Every node keeps its original corpus and version; source editions are never silently blended or renamed.

Horizon never falls back to the public graph when the corpus is unavailable. A future device pack will use the same read-only contract with a signed manifest, immutable chunks, stable source IDs, and explicit storage controls.

Candidate lane

Automation proposes. Release remains another act.

source policy → source span → bounded worker packet → proposed graph diff
              → human or governed review → release manifest → public projection

Current events, source adapters, AI analysis, and publication intake feed candidates. Time passing, source prestige, or an AI summary cannot make a record accepted truth. Paid inference, destructive reset, graph-diff apply, and public release have separate authorization and confirmation gates.

Deployment topology

Test and production are intended to be materially separate.

Test Workers must use separate D1 and R2 stores before mutation, paid inference, broad ingestion, or reset testing. Secrets live in local configuration, CI secrets, or Worker secrets—never the repository.

Decentralization path

Seed the exits before claiming the destination.

The current Global Server is centralized because the system must work before it can distribute safely. The protocol is honest only if central custody is treated as a transition with testable exits—not as decentralization by branding.