Implementation ledger · 21 July 2026
No future tense wearing a fake moustache.
This page separates usable product, code-level foundations, convergence work, institutional work, and hard prohibitions. A route or schema is not evidence that a safe public institution exists.
Available now
People can use these product and public-record foundations today.
Four spaces and Fracta
Learn, Think, Explore, Connect; private local ions; recursive Think structures; the Learn atlas; public object inspection; profiles; and an explicit publication path.
Deliberate publication
Preview with zero public writes, registered-device signatures, explicit public or unlisted scope, typed artifacts, signed Veins, stable links, and durable local receipts with safe reconciliation.
No silent status edits
Public Artifacts use an explicit created → amendment/challenge/review → release graph. Each legal transition appends an attributable Event and Receipt; governed edges require an artifact-scoped capability, and profile withdrawal closes visibility without deleting the Actor.
Wikipedia and arXiv lanes
Dedicated read-only corpus routes separated from the Commons public graph. Horizon refuses a silent public-graph fallback.
Claims and attestations
Signed low-risk claims and responses now use canonical Public Artifacts with stable IDs, revisions, typed relationships, and server receipts. Self-attestation is rejected; domain readouts never become a global total.
Account, Actor, and profile
The private Account, durable Actor, and revocable profile are distinct. Profile visibility does not create or erase the Actor, and Account control cannot silently rewrite public history.
Inspectable projections
Explore and Connect can read safe public projections, stable links, sources, relationships, and selected case history. A public projection is a view of protocol state, not proof of truth or institutional maturity.
Executable audits
System-boundary, route-exposure, retired-species, copy, public-address, and Horizon continuity checks.
Foundation exists
The contracts and tested paths exist, but the full public institution does not.
The live shell consumes canonical AuthorityScope, Context, Lens, Proposal, Presence, and Canvas Recipe records. @Compose can prepare a temporary recipe for the current installed renderer; Replay reuses its seeds and Refresh recomputes against the current permission-filtered Context. A person can explicitly save or discard a device-local recipe without making geometry canonical. Durable local proposal actions and agent tools that declare a receipt now produce a device receipt instead of relying on display copy.
Typed group membership and withdrawal, public proposals, non-binding proposal attestations, capability-gated ballot records, five eligibility levels, verification-event records, entity continuity, duty invitations, private issues, case routes, and review actions have code-level foundations. They are structures inside Connect, not extra product spaces or proof of a staffed institution.
Ed25519, ML-DSA-65, hybrid envelopes, key rotation, recovery, revocation, and device-key graphs. This proves key control, not unique personhood.
Private-issue triage into a formal case; named duty invitations; explicit conflict response and acceptance; actor-bound, case-scoped, action-limited, expiring capability grants; deterministic process plans; email notice dispatch; append-only notice and receipt events; a token-protected respondent acknowledgement and reply portal; a reply clock based on confirmed receipt; evidence packets; field/town-hall records; selected assembly gates; tally replicas; bounded AI packets; findings; appeals; and superseding findings.
Public proposals, votes, governance-right, standing, review, and object-context foundations. These are not yet a mature constitutional institution.
Content-addressed export bundles, signed release manifests, redacted-by-default payloads, and fail-closed import verification preview. No live federation yet.
A runnable Capacitor/Swift host for the shared product kernel. UX refinement, physical-device coverage, signing, universal links, and store privacy review remain.
Source policies and spans, bounded packets, proposed graph diffs, review records, release manifests, current-events staging, and explicit spend/release gates.
Convergence underway
The model is becoming the product instead of sitting beside it.
- Some older participation and governance readers still use compatibility terms where public artifact, Actor, permission boundary, or connection should be explicit.
- Think remains the mature recursive interaction constitution. Learn keeps its distinct Venn renderer while inheriting complete-label, stable-orientation, deterministic-emergence, inspection, and accessibility laws.
- The shared shell now exposes scope and intent without replacing Think’s mature canvas controls or Learn’s corpus and atlas controls.
- Human Actors, signed profile projections, private-routed peer connections, typed membership and withdrawal, public proposals, and non-binding attestations now use the append-only protocol path. Binding participation still requires a separately issued procedure and capability.
- Runtime types do not by themselves prove a staffed public institution; operating rules, accessible ceremonies, independent audits, and real human stewardship remain necessary.
Designed next
The next work is institutional as much as technical.
| Before | Required work |
|---|---|
| Observed community-trust pilot | Withdrawal and correction flows, evidence consent, moderation, appeal, abuse testing, and graph-anomaly false-positive measurement. |
| Non-binding public case pilot | Delivery retry/bounce operations plus SMS, postal, and in-person adapters around the implemented email and respondent portal; live randomness and independently reproducible selection reveal; evidence encryption and redaction; invitation and recusal; accessible town halls; field safety; bounded live AI; and abuse reporting. |
| Binding civic participation | Consented personhood pilot, no-ID and no-smartphone paths, civic credential lifecycle, coercion recovery, independent selection/tally audit, constitutional governance, and steward recall. |
| Scarce-resource execution | Governed resource registry, custodial authority, mandates, named executors, concurrency controls, ecological/legal/safety review, halt and recall, outcome audit, and separated compensation. |
| Full decentralization claim | Independent nodes, signed per-body logs, peer discovery, interest-scoped replication, multi-node policy and tally verification, key history, private evidence exchange, fork resolution, and demonstrated recovery from founding-infrastructure loss. |
Known debt
What is deliberately unfinished or transitional.
- The legacy public
ions/linksprojection is retained only for reading old addresses. Public mutation is locked, retired follow/contact writes fail explicitly, and new Connect writes use typed signed routes. - Historic Wikipedia rows remain quarantined until corpus counts, roots, and link continuity are attested before a separate purge.
- Participation now includes private issue and entity-claim workflows. Direct formal-case intake is retired: a named moderator must accept the exact private-issue triage duty and receive its scoped capability before promotion. Every later private case read or action independently checks its accepted duty and matching capability; moderator or custodian status alone is never access.
- Current-events operation is confirmation-gated and operator-triggered, not an autonomous public truth machine.
- Local AI availability depends on device support and installation; custom remote models are opt-in.
- The Remembrance License remains a draft requiring specialist legal review.
- Native iOS and Android are not store-ready standalone products.
Not on the roadmap
Some absences are features.
No rank of human worth, morality, loyalty, desirability, or total reputation.
No paid verdict, bought attestation, token-weighted vote, or capital-owned public memory.
No automated truth, guilt, personhood, finding, sanction, or resource allocation.
No background sync that turns local ions, account data, source nodes, or candidates into public records.
Release posture
What must be true before calling a build releasable.
- Server typechecking, boundary audit, route exposure audit, retired-species audit, and Ion Commons examples pass.
- D1 migrations are applied deliberately, with production confirmation and post-migration corpus/address checks.
- The web client passes TypeScript, copy, build, Horizon continuity, public addressing, and focused end-to-end flows.
- Private, account, public, knowledge, and candidate stores remain separated in both code and copy.
- Secrets, private infrastructure, credentials, and recovery material remain outside source packages.
- Licensing is described as Remembrance / ethical source / source available—not unqualified open source.