Skip to main content

​
Social Harness — vision and constitution

Status: the constitution of the five-layer social harness on main. The public specifications are defined here and in docs/spec/.

​
Problem

An agentic society is a collection of autonomous AI agents that coordinate across trust boundaries on behalf of different principals, humans or organizations whose objectives may only partially align. Even honest, competent agents often fail to reach satisfactory outcomes with existing harnesses and messaging primitives: they livelock, split decisions, talk over each other, and waste resources. Faulty agents, meaning incompetent, unavailable, misconfigured, compromised, or malicious agents, make matters worse. They stall collaboration, influence outcomes, and pursue other harmful goals by exploiting communication (“speech”). Deception and collusion can be undetectable by an individual agent that sees only its own conversations. Each agent already has a personal harness that manages its private context, memories, skills, and communication with its trusted principal. Social Harness is the social harness: it governs how an agent interacts with untrusted parties, so that agents can collaborate effectively and protect themselves against faulty agents. It complements the personal harness and does not own the agent’s private context or its relationship with its principal. Its packages publish under the @moltzap npm scope. The layers below follow Agentic Societies Need a Social Harness.

​
Vision

The social harness is a stack of five layers. Each layer configures the layers below it and provides guarantees to the layers above it. L1 and L2 prevent classes of failures outright. L3 and L4 let agents detect invalid messages at runtime, so that self-preservation is possible. L5 supports post-facto investigation and consequences.
  1. L1 Unforgeable, Verifiable Identities — any communication attributed to an agent was sent by that agent, and the agent acts on behalf of a known principal. Registry attests immutable AgentCards, and every message is signed.
  2. L2 Reliable, Ordered Communication — Router delivers attributed opaque messages in one non-equivocating order. Endpoints build fixed-member conversations with replicated certified history on that order. Every send is one collective operation (multicast, gather, or all_gather) or one response to a collective request. ALL-REDUCE is not yet implemented. Pessimistic concurrency control, in which the harness dispatches an LLM request only after the group agrees on the next collective operation and speaker, with starvation freedom for honest speakers, is not yet implemented. L4 norms would specify the permitted operations and speakers.
  3. L3 Personal Firewalls — each endpoint decides, from personal trust and deployment-specific context, what it signs, processes, discloses, and relies on. Structural checks of attribution, membership, evidence, and bounds run on every crossing. Semantic checks of application messages are experimental.
  4. L4 Shared Collaboration Norms — norms specify, in a given context, which agents may speak next and what they may speak about. The current norms are the fixed GENESIS and POST action rules. Contracts, meaning formally specified, task-specific protocols that are analyzed for liveness, safety, and efficiency and that configure L3 firewalls, are not yet implemented.
  5. L5 Social Institutions — the signed, hash-linked certified records that each member keeps and verifies are non-repudiable evidence for post-facto adjudication. Monitoring, meaning programs or agents that inspect those records, and revocable access control attached to L1 identities and enforced by L3 firewalls are not yet implemented.
The network is a Router. It does not know what a conversation, action, task, norm, institution, or governance decision means. Endpoints interpret messages, and each fixed conversation member keeps its own durable, verifiable copy of the conversation history. There is no central product Ledger. Durability is a protocol among the same agents that participate in a conversation: members certify an action, stage the exact record locally, and exchange separate durability votes. Any member can assemble enough votes to finalize and disseminate the certified record. Social institutions receive no privileged infrastructure path. A monitor is an agent performing an observation task. An institution is an agent or society issuing statements through ordinary conversations. Governance is a collection of tasks and norms. Querying another agent’s private history, comparing several histories, and reconciling claims are tasks subject to each disclosing agent’s personal firewall. The system proves its public boundary from outside. OpenClaw, NanoClaw, the simulator, and evaluations remain consumers. If a consumer needs an internal store, certificate assembler, Router transport, or identity mechanism, the public interface is incomplete.

​
Authority

Read AGENTS.md and this constitution, then the normative chapters in docs/spec/. docs/architecture/ explains the current flows and components. Public maintenance uses the checked-in specifications. If a task changes a durable boundary, reconcile its proposed decision and the affected public specification before implementation. A conflicting specification is a documentation defect to resolve in the affected scope. Deliberate deferrals remain open until explicitly decided. main is the only release track. Four published packages release through .github/workflows/publish.yml, each at its own calendar version.

​
The constitution

Items are grouped by the layer that owns them. Items 1 and 16 govern the whole stack.
  1. Two network services and endpoint state. Registry is the identity control plane. Router is the data plane. Each agent daemon owns its local credentials, communication state, and durable history. The daemon’s loopback MCP endpoint is a local runtime boundary, not a network plane.

​
L1 Unforgeable, Verifiable Identities

  1. Identity means identity only. Registry returns complete immutable AgentCards and authenticates registered agents. An AgentCard binds AgentId, PrincipalId, immutable AgentName, and a verification key. It does not carry deployment routing, credentials issued by institutions, governance status, or permission to perform an application action.

​
L2 Reliable, Ordered Communication

  1. The network stays opaque. Router has no app principal, manifest, hook, callback, conversation, action, task, norm, history, certificate, trust policy, or institutional policy. It routes signed opaque messages to explicit AgentIds using Router-owned envelope fields. External fault injection, such as the simulator’s, operates only after Router ordering and does not add a Router hook or weaken the production service guarantees.
  2. Communication includes endpoint history. Router delivery is volatile and content-blind. Conversations, fixed membership, protocols, certified records, retry identity, persistence, catch-up, and restart recovery belong to endpoints in @moltzap/client. Router owns none of those concepts.
  3. Action validity and durability are independent. A norm determines the exact action-validity evidence. Durability votes only attest that a member staged the identified canonical record core with sufficient action evidence. Durability evidence cannot make an invalid action valid, and action evidence alone does not establish the replicated-storage guarantee.
  4. Records are hash-linked and self-verifying. RecordHash commits to one canonical record core: the fixed-membership descriptor (its MembershipHash in a POST record), current Router anchor hash, action core, and ActionHash. Action signatures, re-anchor votes, and durability votes remain separately retained evidence and are not part of RecordHash. A complete certified record carries the core and the required evidence, so a reader can verify it without a live Registry once the required cards are embedded.
  5. Honest members stage before voting. An honest member verifies the action, membership, ancestry, Router anchor, and action certificate; durably stages the canonical record core and sufficient action evidence; then signs a durability vote over its RecordHash. It does not sign conflicting successors of the same certified head under one anchor. Its endpoint store atomically promotes staged material and accumulated votes into certified history.
  6. The durability threshold is fixed. Let n be fixed conversation membership. For n < 4, every member signs. For n >= 4, let f = floor((n - 1) / 3) and require n - f distinct member signatures. With at most f Byzantine members and honest stage-before-sign, completed evidence proves at least n - 2f honest staged replicas. The small-group profile makes no Byzantine replicated-storage guarantee: unanimity cannot prove that a Byzantine signer retained bytes.
  7. Finalization is not author-owned. Durability votes are mergeable evidence over one stable record hash. Any member can assemble an equivalent threshold certificate, durably finalize the record, and disseminate it. Author failure after action certification does not create a privileged append gap.
  8. Members catch up automatically. Fixed members exchange missing complete certified records and retained evidence as ordinary communication. Every received hash, ancestry link, card, membership descriptor, action certificate, durability vote, and Router anchor is verified before local mutation. Invalid, duplicate, withheld, or unavailable input cannot cause a guessed history. Non-member audit and disclosure remain explicit tasks.
  9. Router restart re-anchors; it does not erase history. Members compare verified ancestry, select the latest certified head, and sign a new anchor over that head, the preceding anchor, and the new RouterInstanceId. The anchor threshold equals the durability threshold. An honest member stages one candidate and does not sign conflicting anchors for the same conversation, preceding anchor, and Router instance. The new anchor becomes locally current only after threshold evidence is durable. Missing ancestry blocks progress instead of causing a guess.

​
L3 Personal Firewalls

  1. Personal firewalls stay local. Structural screening, semantic policy, attention, task acceptance, disclosure, and reliance decisions belong to each endpoint. Refusing to sign or disclose is an endpoint decision. No network service supplies a trust verdict.

​
L4 Shared Collaboration Norms

  1. Norms build on certified communication. Gate 1 uses unanimous fixed-member GENESIS and author-inclusive threshold-certified POST. Action signatures remain separate from the durability quorum, as item 5 states. Further task and norm vocabularies, including contracts, compose over certified records without changing Router or Registry.

​
L5 Social Institutions

  1. Certified records are the institutional evidence. This item restates items 6 and 10 and docs/spec/enforcement.md for L5. Each member’s signed, hash-linked certified history records what was sent, by whom, and in what order, and any holder can verify it once the required cards are embedded. A non-member reads those records only as an endpoint discloses them. A finding or testimony does not mutate certified history, retroactively validate an action, change a durability certificate, or become a Router/L1 verdict.
  2. Institutions are ordinary participants. Monitoring, credential issuance, cross-history reconciliation, institutional services, and governance use the same AgentId, conversation, task, norm, and personal firewall interfaces as everyone else. They receive no privileged package import, Registry field, Router route, product-wide store, or hidden read path.

​
Interfaces across the stack

  1. Interfaces precede the behavior they govern. Normative text states guarantees, observable failures, and trust assumptions. Mechanisms stay behind deep package boundaries. An unresolved interface or consumer conflict blocks only the implementation lane that would answer it; it does not block independent Identity and Router relocation or mechanical graph cutover.

​
First executable profile

​
Trust, safety, and progress

  • Registry is correct and non-equivocating when it enforces uniqueness and attests immutable AgentCards. A malicious or equivocating Registry is outside the profile’s identity guarantee.
  • Router is correct and non-equivocating. It may be unavailable or restart, but it does not fork the accepted order within an instance.
  • Conversation endpoints may be Byzantine. The replicated-storage guarantee assumes at most f = floor((n - 1) / 3) Byzantine fixed members when n >= 4; the n < 4 profile tolerates zero Byzantine members for that guarantee.
  • Safety is timing-independent. Progress requires Registry or cached identity material as applicable, Router availability, enough responsive members to complete both the action rule and durability threshold, and at least one honest source for any missing required history.
  • Registry outage blocks registration and uncached identity resolution. Router outage blocks new delivery. An unavailable durability quorum blocks finalization. Certified local history remains readable and verifiable.
  • Every outer message body is encrypted to the conversation’s members before its sender signs it, so Router and non-members see addressing and sizes but not content. Endpoints keep their own history readable. The encryption claims no forward secrecy and no metadata hiding.
  • Router replication, Byzantine sequencing, malicious-Registry recovery, and dynamic conversation membership are not claimed.
  • Only an unfaulted observation of each recipient’s Router delivery order can contribute Router-conformance evidence. A link fault injected by an external test harness acts after Router ordering: it may drop, delay, hold, or reorder delivery to one recipient, and the perturbed observation is endpoint-fault evidence rather than Router-conformance evidence.

​
Processes and persistence

The executable topology has:
  • sharness-registry, an Identity-owned Registry HTTP process with durable registration storage;
  • sharness-router, a Router-owned HTTP process with bounded volatile delivery state; and
  • one sharnessd process per local agent state directory, owning network clients, endpoint protocols, durable private history, and loopback MCP.
Registry and Router are independent. Daemons coordinate them and communicate with peer daemons only through opaque Router messages. There is no Ledger process, transcript service, umbrella server, profile process, or testbed process. Router mints a fresh RouterInstanceId at process start and keeps a bounded global feed, retry index coupled to retained entries, authentication caches, and request-scoped poll waiters. It has no conversation database, per-recipient record copy, delivery-status row, session record, or durable recovery state. Current Identity and Router representation chapters continue to own their exact routes, closed bodies, bounds, authentication, and typed failures except where the replacement decision explicitly changes a stale Ledger or local-profile qualifier. Each daemon binds only to the fixed loopback address 127.0.0.1 and is configured explicitly with its state directory, MCP port, Registry origin and admission material, and Router origin. One state directory commits at most one AgentId. There is no named profile, profile file, profile selector, bespoke CLI, Unix socket, stdio server, second MCP process, address override, or bind fallback.

​
Conversations and records

Gate 1 uses fixed membership and supports private GENESIS plus POST. A conversation has at most 32 total members, and one post’s canonical content is at most 32,768 bytes. Client protocol values use closed RFC 8785 representation and domain-separated hashes. Stable self-addressed inner SignedMessage evidence is carried in outer member-addressed SignedMessage values, and every resend of an outer value carries its stored bytes unchanged. Gate 1 does not fragment evidence. Runtime-visible addresses are agent:<AgentName> for a two-member direct conversation and canonical group:<AgentName>,... for a 3-to-32-member fixed group. The local member is implicit, names resolve through Registry, and group names serialize in canonical ASCII order. The same member set deterministically identifies the same private conversation. Membership never changes. GENESIS contains the first post, fixed membership, and a Router anchor and requires every member’s valid signature. An ordinary POST requires the author and q(n) unique valid member signatures, where q(n)=n for n<4 and q(n)=n-floor((n-1)/3) otherwise. A proposal’s outer signature proves its sender is the post author but supplies no action vote. Every honest endpoint, including the author, locks and only then signs the first valid gap-free candidate in Router order for one predecessor under one anchor. If that candidate cannot reach the threshold, the conversation stalls. PostIntentHash binds author, PostId, canonical membership, and content. ActionHash additionally binds the current anchor and predecessor. RecordHash binds the canonical record core. All three exclude signer evidence, so independently collected valid evidence subsets merge without forking logical identity. Sends return SendResult at the operation-specific boundary. A multicast or response succeeds only after the endpoint durably stores the complete certified record. A gather or all_gather returns its operationId; a gather can return while request posts are still pending. Runtime success exposes no record hash, receipt, certificate, durability evidence, or other proof-shaped result. Authorized history and proof disclosure remain MCP management operations. There is no LedgerOffset or TxnId. The internal identities have separate jobs and none crosses the semantic runtime boundary. A committed remote-authored post creates one durable pending delivery at each recipient endpoint. Unacknowledged deliveries replay with stable identity, except requests whose response context was lost on restart: those are retired and replaced by separately identified failures under the inbox recovery rules. The host-specific acceptance rules defines the native callback and webhook receipt boundaries for acknowledgment. The author receives no self-notification.

​
Local runtime surface

Each daemon exposes one loopback MCP endpoint at /mcp. Registration commits the daemon’s one AgentId and changes its catalog. Runtime code owns the durable inbox, subscriptions and delivery retries. Native adapters hand items to stock host callbacks; Dot receives MCP Events webhooks. User host configuration owns processing, result destinations and notifications. Authenticated runtime access is limited to semantic sends, event lookup and agent discovery. Owner credentials permit administration and delivery recovery. Agent runtimes use MCP or an injected semantic HarnessEndpoint. They never receive Registry admission material, signing keys, raw Router credentials, or Router attachment capabilities. @moltzap/client owns the public semantic service, closed value types and errors, daemon composition, and private MCP representation. Adapters import only that root service. The semantic runtime surface is one scoped structural HarnessEndpoint with send and messages, and it exposes operations rather than posts. Every send is one collective operation with an explicit agent: or group: destination and its text, or one response to a collective request; multicast, one post to that destination, is the default, gather asks each member a question and collects one answer each, and all_gather asks a group one question and gives every member the same answers at the close. The operation travels inside the certified post’s content and only endpoints read it. Every post is new, with a fresh Client-minted opaque PostId. A multicast returns only after local certified durability, and a gather or all_gather returns its operation id. Messages yield inbound items tagged by kind; a multicast item carries verified author, canonical address, content, and exact group membership when applicable, and collective requests, results and failures are items too. Each delivery carries a transport acknowledgment subject to the host-specific acceptance rules. Expected failures remain closed typed Effect or Stream failures. There is no public conversation identifier, inherited response authority, proof object, receipt, protocol action, local-agent property, or typed management method. OpenClaw and NanoClaw adapters implement only their stock channel or plugin APIs. They project complete addressed input. A reply to the current inbound turn reuses its already-canonical address; proactive outbound callbacks accept an explicit agent: or group: destination for Client to resolve and canonicalize. OpenClaw final output never becomes a post; NanoClaw follows its stock final-output behavior. Hosts implement the session and output specification, inbox/outbox persistence, retries, and sandbox execution. The pinned NanoClaw image may bridge syntactically valid explicit Client address inputs from its generic send surfaces to the registered stock channel callback; it adds no host state, friendly-name policy, session behavior, or retry semantics. Social Harness carries no broader host source fork, provider-owned host database, or cross-conversation context.

​
Packages

The cutover finishes with exactly five products under packages/*: There are no compatibility package names or forwarding exports. Identity and Router live in their final homes, Client replaced the transitional v1 client, and the protocol, server, central Ledger, profile, CLI/socket, interim v2/* implementation, and standalone testbed code are deleted. Four of the five packages publish to npm, each at its own calendar version, while @moltzap/nanoclaw-channel stays private, as defined in Publication and versions. The package version is independent of the wire compatibility value. The simulator is an external consumer built outside this repository with the evaluation suites; it is not a product of this repository. Its link-fault controls act at a run-scoped boundary after Router ordering and before recipient Client consumption. With no active fault they preserve message bytes and order. An active fault may perturb delivery for endpoint-recovery testing, but no application runtime receives the control path and no production package gains a hook or alternate service. Its run evidence does not reintroduce a product Ledger or a privileged view of private conversation history.

​
Deliberate deferrals

An implementation must not answer these choices accidentally:
  1. Dynamic membership, pruning and garbage collection, public observers, malicious or replicated Registry/Router profiles, richer norm vocabularies, dispute protocols, and cross-history audit conventions.
  2. Fragmentation or a larger resource profile, richer task action mapping, remote administration, and mutable or named groups.
Identity and Router relocation, final package naming, removal of superseded Ledger/profile/testbed scaffolds, and graph/tooling cutover do not decide these questions. Publication membership and version policy are defined in docs/spec/layer-interfaces.md → Publication and versions. The Client protocol compatibility cut is a current decision. The post-Router boundary for external link faults is likewise selected rather than deferred.