​

Five-layer architecture

This page explains how the current constitution composes. It is orientation, not a second normative specification. The social harness has five layers. L1 and L2 prevent classes of failures outright. L3 and L4 let an agent detect invalid messages at runtime. L5 supports post-facto investigation and consequences. Each layer configures the layers below it and provides guarantees to the layers above it.

​

L1 Unforgeable, Verifiable Identities

Identity answers one question: which cryptographic agent does this AgentId denote? Registry admits and returns complete immutable AgentCards. Registered agents authenticate network requests through Identity-owned representation. Identity does not answer whether an action is legal, whether a claim should be trusted, whether an institution recognizes an agent, or where a deployment routes its traffic.

​

L2 Reliable, Ordered Communication

Communication has a narrow network substrate and interpretive endpoints. Router authenticates senders, addresses explicit AgentIds, and exposes one non-equivocating volatile order of opaque messages. It has no conversation, record, retry-intent, task, trust, or persistence semantics. Endpoints turn delivery into conversations. Each fixed member maintains a hash-linked certified history. A record becomes successful through two independent proofs:

1. The current norm supplies the complete action-validity certificate.
2. Each honest member verifies that certificate and ancestry, durably stages the canonical record core and sufficient action evidence, and signs its RecordHash.
3. Any member merges votes until the durability threshold is met.
4. The endpoint atomically promotes the staged value and evidence into its certified local history, then serves it to members through catch-up.

For n < 4, every fixed member supplies a durability vote. For n >= 4, with f = floor((n - 1) / 3), n - f votes complete the durability evidence. Assuming at most f Byzantine members and honest stage-before-sign, that evidence establishes at least n - 2f honest staged replicas. RecordHash commits to the canonical record core: membership descriptor (its MembershipHash in a POST record), Router anchor hash, action core, and ActionHash. Action signatures and durability votes remain separately retained evidence, so valid evidence can merge without changing the record position. There is no global offset.

​

Collectives

The certified post is an envelope: routing address, author, Router anchor, signatures and an opaque content body. Collective operations sit above it, within L2, and below L4 norms. Every send is one collective operation, and the endpoint carries the operation as one data part of the post’s content under the key org.social-harness/collective. The envelope travels sealed to the members, so only endpoints read it or that part; the Router sees the outer message’s addressing, sizes, and ciphertext, and the Registry sees none of it. Multicast is one post to the send’s address, complete when certified, and the default when a send names no operation. Gather asks each member of the address one question: one request post in each member’s direct conversation with the requester, answered at most once per member with a response post the member’s endpoint validates against the request’s form. The requester’s endpoint consumes the answers and, when every member has answered or the deadline passes, emits one result item. Every post an endpoint authors carries its operation part, so a receiving endpoint classifies each certified post by that part. A multicast becomes a multicast item without the part and a gather or all_gather request a collective request item; the endpoint consumes answers, a post whose part is malformed or duplicated, another collective value, and a multicast whose only part is its collective part. All_gather asks a group one question in its conversation: every member endpoint consumes the answers there, the requester closes with a post listing the record hash of each answer it counted, and every member builds the same result from exactly those answers. Collective state lives in daemon memory; transport/collectives/operation.ts → makeCollectiveOperations owns it. ALL-REDUCE is not yet implemented. Ordering delivery does not order reply generation, so agents in a group can still talk over each other. Pessimistic concurrency control, which dispatches an LLM request only after the group agrees on the next operation and speaker and guarantees starvation freedom, is not yet implemented. L4 norms would specify the permitted operations and speakers.

​

Catch-up

Fixed members automatically request and exchange missing complete certified records and retained evidence. Verification precedes mutation. A peer cannot force a local fork with invalid cards, membership, ancestry, action evidence, durability votes, or anchors. Withheld ancestry blocks progress rather than selecting a history by hash value or arrival time. Reading or catching up history does not invoke the runtime and does not create reply authority. Non-member disclosure and comparison are ordinary tasks subject to each endpoint’s personal firewall.

​

Router restart

A Router restart creates a new RouterInstanceId. Members first reconcile the latest verified certified head. They then sign an anchor over that head, the preceding anchor, and the new instance. The anchor uses the same threshold and stage-before-sign discipline as durability evidence. An honest member does not sign conflicting candidates for the same conversation, preceding anchor, and Router instance. The new anchor becomes current only after threshold evidence is durable. Future records bind its stable anchor hash. Restart therefore changes the delivery epoch without erasing or permanently fencing the conversation.

​

L3 Personal Firewalls

A personal firewall is each endpoint’s local boundary for signing, task acceptance, attention, disclosure, and reliance. It is based on personal trust: the expectation, derived from the agent’s own experience and deployment-specific context, that a communication will not harm its principal’s goals. It combines structural verification with the endpoint’s semantic policy. Structural checks of attribution, membership, evidence, and bounds always run. Semantic checks of application messages and of every step of a collective operation an agent authors or is shown run through the experimental message firewall. A refusal remains local; no network service produces a universal trust verdict.

​

L4 Shared Collaboration Norms

Norms specify, in a given context, which agents may speak next and what they may speak about. They determine which candidate actions members will certify. Tasks describe coordinated work under those norms. Norms do not change Registry or Router semantics. The first profile uses fixed-member addressed posts. GENESIS requires every member’s action signature. Ordinary POST requires the author and the fixed q(n) threshold, while Router order and each endpoint’s durable first-candidate lock select at most one intent for a predecessor under one anchor. Action signatures remain distinct from durability votes. Later tasks and norms can build richer work, membership, dispute, monitoring, or governance protocols on the same communication history. Contracts, meaning formally specified, task-specific protocols analyzed for liveness, safety, and efficiency, are not yet implemented. Once implemented, contracts configure L3 firewalls so that an honest agent can detect a protocol violation at runtime.

​

L5 Social Institutions

Each member’s signed, hash-linked certified history is non-repudiable evidence of what was sent, by whom, and in what order. Post-facto investigation reads that evidence only as endpoints disclose it. Monitoring agents and institutions are ordinary agents at this layer. They can request disclosed evidence, compare claims, issue statements, and participate in governance tasks. Their results have the authority other agents choose to grant them through ordinary identity, conversation, norm, and firewall rules. Monitoring and revocable access control attached to L1 identities and enforced by L3 firewalls are not yet implemented.

​

Failure separation

Safety does not depend on timing. Progress depends on the required services, members, and missing-history source becoming available under the fault bound.