Design Round 4 · Levels, guilds, institutions · July 8, 2026

A level is earned standing, a guild is a name, an institution is a counterparty

Four moments: a promotion to Organizer, felt as one gold beat in the thread (5a); a guild sitting feather-light in a sharing flow beside connections, alliances, and organizations (5b); an institution as contract counterparty, square and voteless (5c); and the ally meeting a trusted versus an untrusted domain on the agentic internet (5d). Levels render per duna, founder-set; boundaries stay fluid — the duna line marks who is accountable, never who may talk to whom.

Rationale. A promotion is a duna's act, not a purchase — so it arrives as a beat in the conversation, cited to the threshold the founder set, and it is the one everyday moment allowed the full gold treatment: seal stamp, ≤12 embers, once. How a level shows afterward: a small gold pip beside your name, only in that duna's contexts — levels are per-duna state, and the pip travels with the grounding, not with you. The Clan renders as what it is: the eleven people you walked in, tracked four levels deep, named in the ally's voice rather than charted.

Rationale. Sharing the winter routes wisdom, the ally offers every scope the graph knows — and the render carries each object's weight. A connection is a person. An alliance has a wallet and a duna context; an organization has a treasury and a Forum. A guild has nothing but a name and its people — no wallet, no chain, no protocol footprint — so it renders lightest: a thin dashed ring, no figure, no badge. The guild crosses duna lines freely because there is no line for it to cross: it is sharing scope only.

Rationale. The Ceremony Machine contracts Lightbrush for the arena run's projection work. The institution renders distinctly everywhere: a square mark where members are circles, its registered name beneath its working one, and its one structural limit stated in the render, not the fine print. The contract is between accountable entities — the duna's squad wallet on one side, the institution's on the other — proposed by members, decided in the Forum, with the commands it executes shown like any other receipt.

Rationale. One TXT record binds lightbrush.com to Lightbrush's on-chain identity, and the whole domain becomes accountable within The Ceremony Machine's realm: its pages can carry codes, its agents have provenance. The ally renders the difference as accountability, never safety — a verified domain is answerable, not endorsed. The unverified one is the standing weight rule made visible: stored, marked, never acted on. No red, no warning triangle — an untrusted domain is not a threat, it is merely a stranger.