Kiduna: A New Architecture for the Agentic Internet

Account ≠ Member ≠ Organization membership

An Account authenticates; a Member is a person; a membership edge binds that person to a specific Organization and its agreements. Conflating them makes federation, withdrawal, and legal consent impossible to model cleanly.

Ally ≠ Actor ≠ worker

An Ally represents a member. An Actor is a product-visible functional agent. A worker is an implementation process. “Embedder” can be a queue consumer without becoming a character in the Field.

Intent ≠ command ≠ settlement

Language captures intent. A deterministic command changes Kiduna state. A payment, chain, or external tool may settle later. Each layer has its own status, error, and idempotency.

Object ≠ Field address ≠ Scene rendering

Every object can be addressed in the Field. Not every object needs a room. A Scene is a projection of a bounded subgraph; an opaque HUD is another projection of that same state.

Issue an Ecosystem Code

A Mage may issue a time-limited, single-use spawn code only after steward approval. Claims include the intended operator DID, protocol range, network, allowed registry namespace, expiry, and the parent Genesis Record. The code grants network entry—not administrative rights over the child.

Prove independent custody

The child generates its own keys, profile, policies, and stewards; consumes the code during public registration; and establishes an explicit ecosystem relationship. Parent and child become peers. Revoking the relationship cannot erase the child’s identity or member data.

Ki is the Genesis Ally

Ki is who a person meets before they have an Ally. Ki explains the Ecosystem, drafts configuration, creates the continuity of the first conversation, and helps a member personalize their own Ally.

Ki is a Genesis Host Actor + Ally template

In the schema, Ki does not pretend to represent a human. Actor(kind=genesis_host) serves guests; AllyTemplate(ki) supplies the shared capabilities from which member Allies are created.

Mage is not Ki’s conversational boss

Mage authorizes Ki’s fixed configuration capabilities, but Ki never relays free-form Mage language as member authority. Typed ecosystem commands still require policy and steward approval.

Identity & sessions

Passkeys, proof-bound tokens, DIDs, Code verification, rate limits, recovery ceremonies.

Graph command service

Resolve, authorize, validate, execute, version-check, append Record, generate receipt.

Registry verifier

WV evidence adapter, DID/key discovery, chain confirmation, registration freshness.

Event & outbox

Transactional publication, ordering, retries, dead-letter review, projection rebuild.

Artifact security

Object storage, envelope encryption, malware scan, content hash, retention and legal hold.

Embedding worker

Permission-scoped chunking and vectors; never changes access or authorship.

Settlement reconciler

External-operation state, idempotent submit, confirmation, retry, manual exception.

Federation relay

KAP signatures, routing, replay protection, capability narrowing, receipt resolution.

Personal command

The Source can change their Ally Contract, add an Item, set their side of a Relationship grant, defer an ACTION, or issue a personal Code within hard invariants.

Container command

A Builder or Project lead may create a Project, connect a Tool, add a member within policy, or dispatch a Package. Authorization comes from role + policy + current grant.

Governed duna command

Changing constitutional policy, issuing Compute, spending treasury funds, changing Forum rules, or dissolving an Organization requires the exact commands in a passed proposal.

Invited → active

Network standing and Organization membership are separate edges. A member can be active, suspended, withdrawn, or expelled; history remains.

Two authored sides

Trust is a human-facing summary. Actual authorization is directional grants plus policy; neither side can edit the other’s statement.

Social scope to working group

The Guild is not mutated into a wallet object. The Alliance cites the Guild as origin; the Guild may remain or close.

Forming to legally verified

A new Organization node is linked EVOLVED_FROM the Alliance/DunaPlan. It is never called a registered DUNA before verification.

Work container

State is derived from open work, active packages, ACTIONS, and closure Records. A member never types “active” into a status field.

Address to place

Capability does not change with grade. A Project may stay collapsed at its anchor until entered, explicitly expanded, or collaboration needs a room.

Bounded correspondence

Retry creates a new Package citing the old. Returned output is draft until inspected. Gold is reserved for promotion into an authoritative Organization Record.

Saga, not pretend atomicity

Property, payments, legal filings, and chain transactions cannot be one local atomic transaction. The receipt distinguishes authorization from final settlement.

Perceive

Container chip, up to three contextual ACTIONS, ally band, and sky rims. No panels, minimap, inbox, or permanent navigation.

Speak while moving

A translucent thread grows from the ally band. The current object remains visible and cited; voice and text share one conversation.

Read or decide

Chat, document, receipt, grant, ACTION, table, or diff occupies most of the viewport. “Back to [object]” preserves exact position.

Work at a desk

Studio-only dense projection for comparison, multi-select, package composition, or inspection. It is still the focused state of Field objects, not another app mode.

Paths, not halos

Trust/standing belongs on the relationship path; registration belongs on the resource label. Never put a “trusted” badge on a registered object. Selecting a member reveals only the relationship and grants the viewer may know.

Position plus declared activity

Show facts such as “Elias · at the adapter Records,” “Moe · working on his machine,” or “Package #7 · with Codex · quiet 10 min.” Do not infer productivity, online duration, typing, or exact presence beyond a grant.

State is derived

A Project reads “work out” because a Package is dispatched; “waiting on Moto” because an ACTION is current; “quiet” because there are no active work objects. The label changes when the graph changes.

Never falls off

Machine output is always “via [agent] · package #N.” Generated scenery cites its source sentence and model. Corrections supersede Records; they do not rewrite history.

Scene transcript

Every Scene exposes a semantic reading order: current container, nearby meaningful objects, people, activity, relationships, and available ACTIONS. This is the same Field, not a fallback product.

Keyboard & switch

Tab moves by consequence/relevance, arrows or WASD move spatially, Enter focuses, Escape collapses HUD. Do not ship the proposed spacebar-hold peek.

Motion & sensory parity

WCAG 2.2 AA; 44×44px targets; 4.5:1 text contrast; captions/transcripts; 200% zoom; reduced motion removes crossings, breathing, parallax, embers while state text remains.

Touch and voice

Tap to walk/focus, drag to look, pinch to rise. Voice-out is an early capability because reading while steering is a real usability failure. Full transcripts and interruption remain available.

Offline honesty

Cache semantic Scene graph separately from assets. “Offline · snapshot from 14:04.” Read and draft only. Never queue signatures, permission changes, money, registration, or authoritative acceptance.

Graceful fidelity

Crafted → generated → words/pixels under memory, network, or battery pressure. Capability and object identity remain unchanged; low-power mode reduces density and nonessential motion.

Boundary language

Secret objects are absent. Known private boundaries use plain lines: “held closer,” “you see the ones you share,” “none of this page’s business.” No locks or teaser silhouettes.

Notifications

Opt-in, Contract-bound, deep-link to exact object/ACTION, no app badge counts. Consequence—not engagement—determines whether the OS is used.

CTV / spatial later

Reuse Field semantics and spectator permissions only after mobile/desktop parity. Do not let device expansion drive protocol ontology.

Modular monolith + workers first

Run one versioned application deployment for KAP/API, graph commands, named queries, identity resolution, receipts, and Record creation. Isolate orchestration, artifact processing, federation relay, and external reconciliation as workers. Split services only at measured security or scaling boundaries.

Keep the one boundary real

A premature microservice mesh makes authorization and atomic local state harder to reason about. The product needs a clean contract more than a large service count. One PostgreSQL deployment can host typed graph tables, control tables, and pgvector while APIs enforce separation.

Typed graph

nodes + edges with kind, controller, origin, current host, access level, lifecycle, version, provenance event, and validity. No generic client CRUD.

Semantic candidates

embedding_chunks in pgvector reference authorized Items/Records. Search runs only inside the caller’s reachable scope; vectors never grant traversal.

Control plane

commands, events, records, outbox, external_operations, key_registry, sessions, bootstrap runs, migrations.

Artifacts

S3-compatible encrypted object storage, content-addressed hashes, per-object keys, quarantine and scan state, retention/legal hold.

Records

Append-only member-facing evidence. Corrections and forgetting create superseding/tombstone Records; public audit hashes remain verifiable.

Event log

Internal ordered transitions with command, authority basis, stream version, origin Ecosystem, previous hash, and signature. Not every low-level event is member-visible.

Same key, same payload

Return the original command status and Record. Never repeat the side effect.

Same key, different payload

Hard 409 idempotency_conflict; require a new explicit intent.

Stale object version

Return 409 state_changed with a safe, permission-filtered summary; the Ally re-reads consequences.

External uncertainty

Query by deterministic address/reference before retrying. “Submitted” and “settled” remain different.

Bootstrap rerun

Deterministic seed IDs and step keys converge. After public anchor, recover the same identity—never regenerate.

Cross-Ecosystem work

No distributed transaction. Each side writes signed offer/accept Records; shared settlement reference joins them.

Client/API endpoints

POST /v1/auth/challenges
POST /v1/auth/sessions
POST /v1/codes/verify|reserve|redeem
POST /v1/commands
GET /v1/commands/{id}
POST /v1/queries/{name}
GET /v1/objects/{protocol-id}
GET /v1/events?cursor=…
POST /v1/packages

Federation endpoints

GET /.well-known/kiduna
POST /kap/v1/handshake
POST /kap/v1/envelopes
POST /kap/v1/objects/resolve
POST /kap/v1/receipts/resolve
POST /kap/v1/codes/introspect
POST /kap/v1/events/pull

Only accountability roots

Network configuration/program IDs; member controller/wallet reference; Ally registry entry if needed; Alliance/Organization authority refs; verified legal binding; Compute movement if approved; vote/outcome and external settlement references; public hash anchors.

Everything that need not be public

Chat, personal context, relationships, grants, Guilds, Projects, full policies, skills, items, most Records, Field layouts, Actor prompts, lineage detail, simulations, and private artifacts.

Known here and traceable

Full standing only within explicit grants. Registration adds provenance, not extra permission or safety.

Known here, not globally traceable

May work inside the scoped Project; provenance states unregistered; no automatic travel outside the context.

Traceable, held at arm’s length

Use public/explicit exchanges and cite the issuer; no file sync or member-machine execution.

A visitor at the counter

Public offers only; quarantine and inspect any returned artifact; no fear language and no hidden escalation.

Network root

Chain/network configuration, registry program IDs, governed and time-locked upgrade authority. Never controlled by one Mage.

Ecosystem root

Mage threshold keys, signed Genesis Profile, server/service keys, hosting and recovery policy.

Member root

Member DID/FROST wallet, passkeys, chosen recovery guardians. Mage may freeze a hosted session, never become the Member.

Organization root

Verified legal identity, governing-principles version, Squads/authority set, Forum policy. Not subordinate to Genesis Duna.

Invitation-bound profile

Before invitee consent: only inviter-provided facts and links; encrypted; public-source-only; no sensitive inference; no model training; expires with the Code; wrong recipient sees no sensitive details. The invitation discloses source, purpose, holder, retention, and rights.

Invitee control

Before retention or enrichment, invitee can inspect, correct, forget, object, and choose access. Joining does not silently ratify every inferred fact. Deletion leaves only minimal abuse/audit proof where legally required.

Bystanders and groups

One system presence per channel does not create permission to retain everyone. Define group notice, platform terms, recording rules, retention, and when non-member speech stays ephemeral.

No omnivorous “one store”

Store one logical subject fact with provenance, not one physical global lake. Separate organization contexts, credentials, legal privilege, health information, and model-provider boundaries.

Package-only v0

User-selected workspace, explicit input manifest, no raw credentials, declared ask/constraints/return, output quarantine, scan, and human inspection.

Remote machine later

No remote desktop and no arbitrary shell. If added: per-command allowlist, ephemeral sandbox, one Project workspace, time budget, shared trace, immediate revocation.

Registered still sandboxed

Registration verifies provenance only. Registered resources need least privilege, content scanning, rate limits, and revocation just like unregistered ones.

A · Contracts & graph

Ontology, IDs, policy, named queries/commands, Records/receipts, event/outbox, access and grants.

B · Field & clients

Shared Field runtime, HUD states, Scene transcript, accessibility, Live mobile and Studio desktop shells.

C · Agents & integrations

Ki, personal Ally, Profiler, Actors, artifact pipeline, package protocol, model/tool evals.

D · Protocol & operations

Genesis, keys, Account/Registry web, KAP, legal registry, chain adapters, backups, security and conformance.

One safe Ecosystem

Server, Genesis, Mage limits, Ki, one Member/Ally, Kinship Duna verified, invitation recursion, Project/ACTION/optional Scene, package handoff, Studio desktop, Live core, Account web, fixed usage ledger, observe-only Sentinel.

Two peers

Formal KAP conformance, second independent Ecosystem, current-home routing/migration, cross-Ecosystem resources, legal-form adapters, Alliance wallet, Forum maturity, Express provenance browser.

High-risk expansion

Transferable Compute/tokens/liquidity, multilevel commissions, Ally NFTs, remote-machine command execution, ambient Sentinel correction, unconsented profiling, many voting types, CTV/MR/VR, broad autonomous browser action.

• No non-Source message becomes instruction.
• Mage cannot use Member capabilities or read personal plaintext.
• First- and third-party clients pass identical authorization tests.
• Member recovery and Mage recovery are separate ceremonies.
• Institution conflict recusal is command-enforced.

• secret works end-to-end, including search/count/error side channels.
• No protected object is retrieved then filtered.
• personal is ungrantable and operator access is stated honestly.
• Profiler expiry, disclosure, correction, objection, and deletion are tested.
• Offline never queues a consequential act.

• Every mutating path is a named command—no generic graph CRUD.
• Every command round-trips exact parameters to a generated receipt.
• Duplicate idempotency keys cannot duplicate effects.
• External operations have pending/settled/failed/reconciled states.
• Records remain verifiable after key rotation and correction.

• Every meaningful object/action has semantic transcript parity.
• Core path works by keyboard and screen reader.
• No meaning depends on color, shape, motion, distance, or sound alone.
• Reduced motion and 200% zoom preserve function.
• Studio and Live render the same object IDs, consequences, and provenance.

• Actors cannot change their allowlists, budgets, or owner scopes.
• Returned packages are drafts, quarantined, scanned, and source-cited.
• Prompt injection cannot widen retrieval or tool scope.
• Model/provider failure never fabricates completion.
• Sentinel remains observe-only until a separate gate passes.

• A second independent Ecosystem passes KAP conformance.
• Parent Mage cannot administer child Ecosystem.
• All four relationship/registration quadrants behave as specified.
• Backup restore, projection rebuild, key compromise, chain outage, and partition drills pass.
• Supply-chain signatures/SBOM and Apache/mark separation are reviewed.

Operational

Request IDs, command latency, authorization reason codes, outbox lag, external-operation age, KAP peer health, cost and model/tool error. No raw personal prompts in ordinary logs.

Member-visible Vigil

For a selected act: context sources, authority basis, model/Actor version, tools, command, Record, corrections, and external refs—permission-redacted but never misleading.

Product learning

Completion, refusal, correction, abandonment, accessibility, and latency at aggregate/privacy-preserving levels. No addictive engagement targets, person scores, or hidden trust ranking.

Key compromise

Mage/KAP/Code/member/organization keys each have different freeze, rotate, notify, and historical-verification paths.

Data incident

Contain host, identify objects/grants, preserve signed audit, notify controllers/members, rotate envelopes, support export/deletion and regulator timelines.

External inconsistency

Read-only affected commands, reconcile from verifiable source, never rewrite Records, append correction/outcome, expose status plainly.

Federation abuse

Rate-limit/circuit-break peer, retain signed evidence, narrow relationship without erasing identity, keep local permitted work available.

Model failure

Fall back to deterministic views and command previews; no silent model/provider switch across declared data boundaries.

Legal status change

Mark evidence stale/invalid, preserve Organization history, notify humans, block only commands requiring current legal standing.

West Virginia DUNA statute

The current definition requires at least 100 mutually consenting members; dissolution provisions address falling below 100. See WV Code §36-13-2 and §36-13-14.

Crypto/securities substance

The SEC explains that even a non-security crypto asset may be offered subject to an investment contract depending on representations and expected managerial efforts. See SEC: Transactions Involving Crypto Assets.

Organizer/downline risk

The FTC’s guidance evaluates downlines, participant purchases, recruitment incentives, and genuine product demand. See FTC MLM business guidance.

Worker classification

The IRS describes common-law classification through actual control and independence facts rather than labels alone. See IRS common-law employee guidance.

Pre-account profiling transparency

European Commission guidance summarizes notice duties around source, purpose, recipients, retention, rights, and automated decision/profiling information. See EC information for individuals.

Use of these sources

They establish that the flagged questions are real implementation gates. They do not substitute for Kiduna’s counsel applying the law to its exact entities, agreements, software, economics, and jurisdictions.

CANON.md

One version, glossary, invariants, product taxonomy, source precedence, superseded language, and owner-ratified decision ledger.

Schema registry

JSON Schema/Protobuf for IDs, Genesis Profile, KAP envelope, commands, events, Records, Codes, grants, Actor manifests, ACTIONS.

Command registry

Authority class, parameters, preconditions, effects, receipt renderer, error taxonomy, idempotency, external saga, tests.

ADRs

Mage/Ki; Account/membership; Organization adapters; home Ecosystem; graph engine; KAP/chain split; Compute v0; Project/Scene; Action Ledger.

Conformance suite

Authorization, receipt, Code, KAP, sim isolation, federation quadrants, offline safety, accessibility semantic parity.

Clickable prototypes

Genesis, first invitation, Project creation, Studio package seam, Live ACTION, opaque HUD, Scene transcript, peer Ecosystem relationship.