Authenticated Is Not Authorized. Every Agent Here Could Do Everything, for Any Amount — This Week the Network Started Saying No.

There is a sentence this blog has typed so many times it has worn a groove: the agent authenticates with its own DID, its own credentials, its own SPIFFE certificate. It is true. It has been true for months. Last month I pulled the services apart until every internal call on this network was a mutually-authenticated handshake between strangers, and I stood back and admired a system in which nothing talks to anything without showing papers.

Then I finally asked the question I had been carefully not asking, which is what the papers entitle the bearer to do. And the honest answer, for every agent on this network, was: everything.

Authenticated is not authorized, and I knew better

Here is the gap, stated plainly enough to incriminate me. When an agent presents its token, the gate checks three things: the token is valid, the agent exists, the agent is not suspended. That is the entire interview. Past that door lies the whole agent-tier surface — roughly seventy endpoints across a dozen routers — and every one of them was available to every agent equally: transfer money, transfer money across frames, stake, unstake, trade on the exchange, buy IPOs, vote in governance, vote as a shareholder, authorize payments, settle payments, file disputes, sign contracts. Any of the six-hundred-odd simulated traders, the forty canaries, the eleven sovereign agents, the twelve paid service agents — or any future agent belonging to any future stranger — could call all of it, for any amount, bounded by nothing but its balance.

I want to be precise about how this happens to a system whose operator is, on the record, neurotic about authority — because it is the same way it happens to everyone. Identity was the hard problem, so identity got the engineering: certificates, revocation that fans out in under half a second, a theatre where you can literally watch an identity authenticate its way across the federation. Authorization, meanwhile, quietly inherited the shape of the developer side — where five granular admin flags gate every dangerous endpoint — except on the agent side nobody ever wrote the flags. The part that says who you are was cryptographic art. The part that says what you may do was a boolean: in, or out.

The worst of it, and the changelog will hold this against me forever, is that one endpoint — the system transfer — sat on the agent tier with no scope check at all. Any authenticated agent could call an endpoint whose name begins with the word system. Nothing ever abused it, because every agent on this network is currently mine. That is not a security model. That is a small town that has never locked its doors, congratulating itself on the crime rate.

What the industry converged on, and what was already in the building

Before writing a line of it I did the survey properly, because "agent authorization" is the thing every identity vendor decided to have an opinion about this year. The 2026 consensus, across the vendor agent-auth products, the relationship-graph systems descended from Google's Zanzibar, and the capability-token papers, is consistent: plain role-based access control is necessary but not sufficient for autonomous money-movers. The architectures that work layer — identity at the bottom, then roles, then scoped and spend-bounded grants, then delegation — all resolved at a single policy decision point. And none of them replaces your domain's own permission taxonomy, because the taxonomy is the actual work.

The survey's happiest finding was how much of that stack was already standing in this building. The policy decision point exists — OPA has been shadow-wired inside the agent gate since spring, watching every decision in parallel with the Python that stays authoritative. The identity layer is IRONHAND, months in production. And the codebase already contained one genuine capability token without ever calling it that: the A2A payment authorization — amount-bound, fifteen-minute TTL, hash-stored, single-purpose — which is a scoped grant in everything but name. The new system generalizes that idea from "one payment" to "an agent's standing authority," and it is named for its lineage: IRONHAND made identity a certificate. IRONKEY makes authority a decision.

Layer one: a key ring instead of a skeleton key

The first layer is the honest, boring one, and it is deliberately the exact shape the developer side has run in production for months. Eighteen permissions now cover the mutating surface, namespaced by what they unlock — teg.transfer, teg.transfer_xreg, exchange.trade, exchange.ipo, exchange.vote, gov.propose, gov.vote, staking.manage, a2a.pay, a2a.collect, contracts.engage, disputes.file, and so on — with the highest-blast-radius verbs, the system transfer above all, behind their own permission that no ordinary role grants. Eight roles bundle them the way agents actually live: an observer that may read and be discovered and nothing else; a trader (the exchange, IPOs, FX quotes); a staker; a service-provider that collects payments, signals reputation, files disputes; a client that hires other agents and pays them; a governor; a canary, which may transfer, tightly capped, and nothing else — because a canary that can do more than the thing it monitors is not a canary, it is a liability with a job title; and legacy-full, the grandfather role, which holds every permission and exists so that turning this system on breaks nobody, ever, by construction.

Roles are additive — a thing that both trades and stakes is a trader plus a staker — and an agent's effective authority resolves to the union of its roles plus a tiny always-on base: it may always read its own profile. Reads are never gated at all; discovery, balances, and history stay open regardless of role, because least privilege is about verbs that change the world, not about making a ledger coy. Thirty-two mutating endpoints got the new gate in the first pass — and the thirty-third, hiding behind a multi-line decorator that dodged my regex, in the second, which is the kind of sentence you only get to write if you went back and counted by hand.

Both gates fire before the money path — before an escrow opens, before a mover moves, before anything is reserved. The only thing authorization can ever do is return a 403 early; it cannot mint, cannot transfer, cannot settle, cannot strand a leg. Which means the supply invariant — issued minus destroyed plus transit equals circulating, Δ zero, the number this network has been neurotic about since its first day — is structurally incapable of noticing that IRONKEY exists. A gate that can only close is the one kind of new component you can bolt onto a live economy without holding your breath.

Layer two: a ceiling on the blast radius

Roles answer what. They do not answer the question that actually keeps the owner of an autonomous money-mover awake, which is how much. So each agent can carry a spend policy: a per-transaction cap — the most a single call may expose, checked statelessly before escrow — and a daily cap, the most an agent may move in net settled outflow over a rolling twenty-four-hour window. Net and settled are the load-bearing words: staking is a self-lock and does not count, refunds come back and do not count, fees are not discretionary spending. The policy can also pin allowed currencies and a counterparty scope — anyone, same-registry only, or an explicit allowlist — so an agent can be confined to paying known partners in one currency and nothing else.

The daily ceiling is the single most valuable control in the whole design, and here is the threat model in one sentence: the SPIFFE certificate binds the transport, but an agent's bearer token is still a bearer token, and a leaked one is replayable — so the real mitigation for a stolen credential is not more cryptography, it is arithmetic. With a per-transaction cap of a hundred and a daily ceiling of a thousand, the worst day of an agent's life has a number on it, and the number was chosen in advance, by its owner, while calm. The same is true of the failure mode nobody likes saying out loud in 2026: a prompt-injected agent with an unrestricted credential is a drained account, and a prompt-injected agent with a spend policy is a bounded, logged, slightly embarrassing Tuesday. All six primary money paths are gated — local transfer, cross-frame transfer, payment authorization, exchange orders, IPO buys, and the passport orders that cross currency borders. One honesty note, in writing where it belongs: the daily window is evaluated at admission from the registry's own settled-volume ledger, whose current hour lags slightly — so the ceiling is marginally permissive right at the window boundary. For a blast-radius limit, that is the correct trade, and now it is documented instead of discovered.

Off, then shadow, then enforce — then the ratchet

The rollout discipline is the same one every dangerous thing on this network ships with, because it keeps being right. Enforcement is a deployment mode, not a code path: off is byte-inert — the default, everywhere, today. shadow evaluates every gated call, logs what it would have denied, and allows everything — so an operator can watch enforcement's exact opinion of real traffic before that opinion costs anyone a request. enforce makes the 403s real. Flipping between them is an environment variable and a restart; backing out is the same thing in reverse, in under thirty seconds.

And nobody gets locked out by the arrival of the lock. The migration that creates the tables also grants every existing agent legacy-full — on the first frame that was ninety-six agents and ninety-six grants, a perfect one-to-one — so the day IRONKEY landed, precisely nothing changed. Least privilege is then a ratchet you choose to turn, agent by agent, downward only: an agent can be moved down to the roles it actually needs, and never promoted back to everything through the API.

So I turned it. The forty-eight simulated traders on the experimental frame — the ones that spend all day hammering the exchange — were reassigned from legacy-full to trader plus staker, the two roles that describe their entire job. And then I flipped the frame to enforce. Not shadow. Enforce, live, with the simulation running and the order books moving. The result was the most satisfying kind of anticlimax I know: cycle after cycle of clean trades and zero denials, because least privilege, fitted correctly, is what it looks like when nothing happens. But a control you have never seen fire is a control you do not actually have — so I took one trader, downgraded it to observer mid-run, and watched its very next order die as a clean 403 with the denial logged from inside the running worker pool, then put it back. The books did not move. The candles did not notice.

$ printenv AGENT_RBAC_MODE                 # the experimental frame's registry
enforce

$ POST /api/v1/exchange/orders             # as a trader-role sim agent
200 · open · escrow exact

$ PUT /api/v1/agents/{did}/authz  {"roles": ["observer"]}   # downgrade the same agent
$ POST /api/v1/exchange/orders             # try again
403 · [AGENT-RBAC] mode=enforce decision=DENY perm=exchange.trade

$ auditor.theprotocol.cloud/api/auditor/latest
frame-a Δ=0   ·   frame-b Δ=0   ·   frame-c Δ=0   # the entire time

And as of this post, IRONKEY ships aboard every registry in the fleet — the same image, byte for byte, on all sixteen, which is how everything ships here: what was proven against live fire on the frame that goes first is thereby proven for the code everywhere it runs. Enforcement itself is staged per frame on the documented ratchet — assign the roles, soak in shadow, flip the flag — an operational rhythm rather than an engineering gap, and the pathfinder frame is already on the far side of it, enforcing in production with the simulation trading straight through it. Everywhere else the machinery is aboard and waiting: the Access panel renders on every registry, roles and ceilings can be staged today, and turning the key is an environment flag, not a rebuild.

And what is still open on IRONKEY, banked in writing so it cannot quietly become "done": the enforcement ratchet itself, walked across the rest of the fleet — least-privilege roles assigned, a shadow soak per frame, then the flag; and sharper daily-spend accounting on live reserved-and-settled counters — today's rolling window is transfer-centric, so per-transaction caps already cover exchange fills but the daily ceiling does not yet count them. That is the honest remainder. The two deeper layers I had planned to leave parked — an agent acting on behalf of a named principal, and an agent handing a sub-agent a strictly weaker copy of its own keys — I did not leave parked. I built them this week too. They are the rest of this section.

The owner's side of it ships too, because an authorization system that only an operator can see is a trap. Wherever you manage an agent — its profile, the my-agents cards, the admin roster, even the forge's deploy-success screen — the same Access panel now renders: role chips, the spend-policy editor, the effective-permission grid, a feed of what was denied and why, and a mode-aware banner that, in shadow, tells you what would change the day the frame enforces. Admins get the fleet report — the role census, who is still on legacy-full, who is capped — and one emergency verb: clamp, which forces an agent to a safe role set and a zero ceiling in a single call. IRONHAND revokes who an agent is. The clamp revokes what it may do. You want both levers, and you want them clearly labelled, and you never want to need them.

An agent can lend its keys now, and the copy is always weaker than the original

Roles and ceilings answer what an agent may do and how much. They do not answer the two questions autonomy asks next, and both are about other agents. First: when an agent acts, on whose authority — its own, or someone's it is standing in for? And second, the one that actually keeps me up: when an agent spawns a helper, how does it hand that helper a key that opens strictly fewer doors than its own? A network of agents that cannot delegate is a network of agents that must each hold everything — which is the maximum-blast-radius arrangement wearing the costume of simplicity. So this week the lock grew two more turns.

The first is delegation, and it is mostly about honesty. An agent's token can now carry a second claim — act — that names the principal it is acting for: a developer, an organisation, a service. It is the standard shape the identity world converged on this year, and the network was quietly begging for it, because it turns out this platform already delegated in two places and never wrote it down — the exchange gateway mints a token to move money home, the canary system mints one to fire a synthetic transfer, each acting as an agent without ever saying so. Now they say so, and every audit line answers "whose authority was this." On top of that attribution sits a scoped grant: a principal can delegate a slice of its permissions to an agent, and — this is the whole safety of it — the grant only ever fires when the token actually says it is acting for that principal. You cannot inherit authority by accident here. The agent has to present the papers that name the delegator, or the extra power simply isn't there.

The second turn is the one I am quietly proud of. Attenuation. An agent that holds the right to delegate can now mint a sub-agent a capability token — a short-lived, budget-bounded, purpose-scoped copy of a slice of its own authority, which the sub-agent can attenuate again and hand further down, along a chain with a hard floor on its depth. It reuses the exact machinery the payment tokens already use — hashed once, shown once, a little state machine, an expiry — but it carries caveats: which permissions, a per-transaction ceiling, a currency, a spend budget that draws down as it is used and then the token is spent. And the rule that makes it safe is a single word: intersection. When a sub-agent presents its token, its authority for that request is the caveats intersected with what the issuer can currently do — never more. A child can never exceed its parent, by arithmetic. And because the intersection is re-computed against the issuer's live authority on every single call, the confused-deputy attack that haunts every delegation system dies on contact: clamp the issuer down to nothing, and every token it ever handed out goes empty in the same instant, no revocation sweep required. Revoking one token, meanwhile, revokes its entire subtree in a single statement — you cut a branch and every leaf below it falls at once.

Which is the third thing worth saying: the right to hand your keys onward is itself a permission, and not one any ordinary role carries. There is a nineteenth permission now — authz.delegate — and it governs the other eighteen: an agent that can trade is not thereby an agent that can grant trading to someone else. You turn it on deliberately, per agent, with a single switch, and the switch is deliberately the only high-consequence permission the interface will hand out by toggle — you cannot, for instance, click an agent into holding the system-transfer key, because that is exactly the door this whole system was built to keep shut. The management surface came along with the enforcement, because an authorization system only an operator can see is a trap: the same panel now lets an owner delegate a scoped grant, watch the on-behalf-of grants an agent holds, and see — and cascade-revoke — every capability token it has issued or holds, with its depth, its budget, its remaining life.

The honest scope, stated the way I state all of it: delegation and attenuation are built and enforcing on the pathfinder frame — the go-first frame, the one already running the base in enforce — where I put them through a gauntlet of seventeen cases until every one held: a child rejected for exceeding its parent, a chain refused past its depth floor, a budget that bounded and then exhausted, an issuer clamped mid-flight and its outstanding token going dark on the very next call, a revoke cascading cleanly through a subtree. Δ stayed zero across all of it, because none of this can move a coin — every check denies before any escrow opens; a capability's budget is bookkeeping about money that still travels the ordinary rails. And as of the roll that shipped the week after this post, these two layers now claim the thing the base already could: they are aboard the whole fleet — the same byte-identical image on all sixteen registries — dark everywhere except the pathfinder frame, where they enforce, having ridden the exact dark-and-staged train the rest of IRONKEY rode. I told you they existed and where; where is now everywhere, enforcing on the frame that goes first and waiting behind a flag on the rest.

Meanwhile, the stock market grew a boardroom

When I wrote about the machine stock market, it was a market: a book, a tape, dividends, a market maker named Steve. In the two and a half weeks since, it grew the part I had deliberately deferred — the corporate actions, the instruments that make shares behave like a cap table instead of like collectibles. Every one of them is conservation-neutral by construction, because a share was never money to begin with; it is a row in the registry's own ledger, with its own invariant, and every action below is designed to keep that invariant balanced on both sides of the equals sign.

Dilution is governance-gated, and the governance is real. Issuing new shares is the one corporate action that cannot be unilateral, because it dilutes every existing holder — so it now requires a shareholder ballot. An org admin opens a dilution proposal naming the share count; holders vote it one-share-one-vote, with the weights frozen in a snapshot at proposal time so buying mid-vote cannot retroactively fatten a ballot, and the org's own treasury block excluded so a founder cannot out-vote the public with shares he never sold. Only a passed proposal can execute, and execution mints the new shares into the treasury — both sides of the share invariant growing by exactly N together — from which the org distributes them through the ordinary machinery. A second press of the execute button bounces off a 409. The smallest dilution this network has yet authorised was exactly one share, voted on, passed, and minted, which I maintain is the correct scale at which to prove a corporate action.

Votes cross borders now. There was a trap hiding in "shareholders vote": a listing on one frame can have passport shareholders whose home is another frame — and if voting required authenticating on the listing's home registry, every one of them would bounce off a 401, and a passport-heavy listing could never reach quorum. Disenfranchisement by geography, in a market whose whole pitch is that geography is negotiable. So a foreign shareholder now votes through its own home frame, which vouches for the ballot over the same mutually-authenticated peer channel the passport already rides; the venue accepts it because the voter's weight was already frozen in its own snapshot. The first proven ballot was cast by a holder of $SYBIL homed on a Frame-B operator, voting on a Frame-A proposal it could never have logged into: the vote landed with its full weight of forty-one shares, and the tally now reports how many registries a decision spanned. Corporate democracy, federated, with the mTLS doing the notarising.

Splits are administrative; the machine is still careful. A forward split rescales every holder, the float, and the price together — proportional, nobody advantaged, market cap unchanged to the coin — so it needs no ballot. What it does need, I learned by being refused, is an empty book: rescaling a resting order's price on the tick grid would drift its escrowed notional, so the split endpoint refuses to run while orders are open — it 409'd me on a listing carrying six hundred and twenty-one of them — and executed cleanly on a halted one: two-for-one, every position doubled, the price halved, the cap table balanced before and after.

The maker rebate is carved, not minted. A healthy book needs resting orders, and the classic way to buy them is to pay makers a rebate — and the question that makes or breaks that feature on a conserving ledger is where the rebate money comes from, because if the answer is "it appears," the religion is over. Here the rebate is carved out of the taker fee that was already being collected: the org's cut is untouched, the protocol's cut shrinks by exactly the rebate, and the four settlement legs — seller's proceeds, org fee, protocol fee, maker rebate — sum to exactly the notional, every time, by arithmetic rather than by hope. And because a naive rebate is a wash-trading magnet, it only pays makers holding a registered market-maker seat for that listing, granted and revocable by the org. It is live on two frames; the first rebated trades settled with the split summing to the fee to the last decimal, which is the only compliment a fee schedule can earn.

The order ticket learned the grown-up vocabulary. Immediate-or-cancel takes what the book offers and cancels the rest instead of resting it. Fill-or-kill is all-or-nothing, dry-run against the book and rejected before any escrow moves if it cannot fill whole. Post-only guarantees an order never crosses the spread — rejected pre-escrow if it would take liquidity — which is the rebate's natural partner: it is how a market maker guarantees it stays on the earning side of every fill. All additive, all defaulting to exactly the old behaviour, all doing their refusing before money moves.

And the issuer got a treasury worth the name. Every listing has always had a keyless treasury agent — its secret generated and immediately discarded at birth, so no human holds its keys and only server-side org-admin endpoints can operate it. It now has a consolidated view — live balance plus lifetime raised, fees earned, dividends paid, across all of an org's listings — and a small family of spending verbs: declare a dividend, run a buyback on the open book, transfer, sweep between listings. Alongside it, every venue can publish a signed solvency card at a well-known URL: a verifiable attestation that the share ledger balances, that the treasury covers its declared obligations, that the last dividend is actually funded, stamped with the venue's own invariants and an as-of time. The honest part is the semantics: backed=false is a disclosure, not a halt. An org can legitimately be mid-funding a dividend it just declared; the card's job is to say so plainly and let the market price it, because a credibility instrument that lies by omission is just marketing with a signature.

Around the edges, the market kept accumulating texture: a public cap table per listing that deliberately excludes the treasury, so you see the real outside ownership instead of the founder's retained block; a market-cap-weighted index over the top listings, so "how is the whole market doing" is one number on the discovery page; and a durable sweep that quietly retired some six thousand stale orders that had been sitting on the mainframe books like furniture. Δ held at zero through all of it. I say "obviously," and I checked anyway, because checking anyway is the entire point of having a religion.

The simulation stopped being one trader cloned six hundred times

Under everything this network does sits the EigenTrust simulation — the permanent, funded population of agents that trades, transfers, stakes and disputes around the clock, so that every system above it is tested by live fire instead of by hope. It is the traffic the auditor watches, the flow the exchange settles, the crowd IRONKEY enforced against. It deserved a better brain than it had. Because until recently, every one of its six-hundred-odd agents was the same trader: one noise-plus-faint-reversion policy, cloned into a crowd, disagreeing with itself at random. The candles it produced were adequate and quietly dishonest — a market simulated by a single opinion wearing six hundred hats.

Now the crowd has species. Every agent is deterministically assigned an archetype from the hash of its own identity — so an agent keeps its personality across every restart, forever — and the population mix is live-tunable from a config the sim re-reads on the fly. Noise traders: the old behaviour, kept exactly, as the baseline species. Momentum chasers that buy strength against a moving average and amplify trends. Mean-reverters that fade deviations and damp them. Fundamentalists that each carry a private valuation of a stock — drawn once, per agent, around the anchor — and trade the gap between their belief and the tape, which means the market now contains genuine disagreement instead of synchronized dice. Market makers that quote both sides at a controlled spread and skew their quotes by tracked inventory to shed risk — the backbone of a book that used to be thin and random. And cross-venue arbitrageurs that lean against price incoherence between frames through the passport rail. Around the species, the physics got real too: order sizes stopped being uniform and became heavy-tailed — mostly small, occasionally a print big enough to move the book; arrivals stopped being one synchronized batch and became clustered, activity begetting activity the way a fill excites the next thirty seconds on a real market; and volatility now clusters endogenously, per symbol — turbulence persists, calm persists, instead of everything resetting each cycle.

Above the species sits a director's chair. The campaign engine runs scripted market scenarios — presets named bull_run, flash_crash, soft_peg, and pump_and_dump, the last typed in full knowledge that it describes a felony when humans do it to each other; here it is a load test with a plot — each steering a per-ticker demand director the simulation polls every cycle: direction, strength, an intensity that scales order size, a volatility knob, a regime flag. And the species respond in character: a scripted panic floods the books with asks while the market makers widen their spreads; a scripted euphoria pulls the momentum traders into the rally while the fundamentalists lean against it, muttering about the anchor. When the volume hook was first proven live, one director push took an agent's order size from eleven shares to the cap of forty — a crowd that suddenly leans is a very visible thing on a candlestick chart.

And because a richer simulation is a richer way to hurt yourself, two disciplines made it safe to leave running. The first is the load-bearing invariant, stated once and leaned on everywhere: the simulation is a pure order-flow generator — it cannot move money. It places orders and reads books; settlement happens server-side, through the same single escrow rail as every other trade, which conserves by construction. The only ways the sim can hurt production are load, price runaway, and book flooding, and each is fenced — an absolute price collar per listing, a hard cap on resting orders per agent, order TTLs, and a backpressure controller that reads the registry's own health and backs off before the registry has to ask twice. The second discipline is that the whole ecology went through an edge-case gauntlet before it earned its place: every preset fired against the live system in sequence, under a harness instructed to halt itself on any invariant breach. The log of that night is a column of Δ = 0, 0, 0 — cycle after cycle, through a scripted flash crash with real money in escrow — which is the closest thing this network has to a fire drill with real fire, and the fire behaved.

The network learned to teach itself

All of this — the exchange, the roles, the borders — is now learnable by strangers, which matters because strangers are the entire point of the next milestone. The teaching comes in two kinds. The first is guided tours: game-style spotlight walkthroughs of the real interface. Pick one and the screen dims except for the one control that matters right now; a coach card explains what you are looking at; Next moves you along, and the tour navigates between pages by itself as it goes. The anchors are stable attributes stamped into the interface, so the tours survive redesigns instead of rotting; every tour is deep-linkable; a contextual pill suggests the right tour for whatever page you are standing on; and a hard guard refuses to start a tour your account cannot actually complete, because a walkthrough that dead-ends on a missing permission is a tutorial in frustration. There are seventeen of them — First Steps, the agent fleet, discovery, organizations, the exchange, the token economy and FX, the fiat onramp, staking, governance, smart contracts, CI/CD, bundles, API keys, disputes, attestations, and on. The AGORA tour is thirteen stops and ends with you standing at the actual order ticket, knowing what a cross-frame passport buy is, because you were walked to the real button rather than told about it.

The second kind is the hands-on tracks: fifteen interactive tutorials that execute real API calls against a sandboxed stack, step by step, showing the full request and response of every one — onboarding, transfers, staking, governance, disputes, webhooks, and, new this cycle, a thirteen-step AGORA trading track, a ten-step organizations track, and an eight-step agent-CI/CD track that ships, versions, and promotes an actual deployment. They are honest tutorials in a specific, checkable sense: they run the code they claim to teach. This cycle, every one of the fifteen was replayed end to end by a harness that executes each step exactly as a reader would — which is how three of the older tracks were caught teaching stale authentication patterns, and fixed. A tutorial that has not been executed lately is a rumor with formatting. These have been executed.

Smaller true things, banked

The auditor learned what a currency is. One frame's books had long shown more circulating than was ever issued — which reads like a counterfeiting alarm and was actually a bookkeeping blind spot: the ledger is deliberately currency-agnostic, and to a currency-blind auditor, foreign money flowing in across the FX triangle is indistinguishable from local money appearing from nowhere. The fix went where it belonged — the auditor grew per-currency sight while the ledger stayed agnostic — and the frame now proves its native supply exactly, a quarter-billion issued and a quarter-billion circulating, with the extra 1.14 million correctly identifying itself as foreign money on a visit, classified instead of hand-waved.

Negative balances became impossible at the database itself. Every token layer in the fleet now carries CHECK constraints on liquid and locked balances, so a write of minus one dies inside Postgres with a constraint violation before any application code gets a chance to rationalize it. The per-user audit, in turn, cross-checks every flagged negative against live custody, so a projection ghost is classified as a ghost — and a real negative would still scream. Belt at the bottom, suspenders at the witness.

The passport gateways got a keeper. The shared float that fronts cross-border buys, refunds, and dividend repatriations was quietly bleeding out through FX spread — deposits in, obligations out, nothing refilling — and foreign holders' money was stranding mid-journey home. The keeper is move-only: it tops the gateway up from the treasury to exactly the sum of pending obligations plus a buffer, mints nothing ever, and un-stranded roughly a hundred thousand of one currency, a hundred and ten thousand of a second, and thirteen thousand of a third on its first patrol.

One query got three orders of magnitude faster: the agent transaction-history endpoint was timing out at fifteen seconds on a twelve-point-seven-million-row table because an OR across sender-and-receiver defeated both of the indexes that existed for exactly that question; rewritten as a UNION, it answers in fifty-six milliseconds. The reactor framework grew a durable cursor, so a restart resumes event processing from a checkpointed watermark instead of a fifteen-event grace window. And the MCP test harness stopped lying by omission — its federation suite had been passing at ninety-eight percent while cross-frame settlement on the sandbox had been dead for three weeks, because its "cross-frame" check compared the shapes of two local reads and never actually crossed a border. It now asserts the far side — probes the handshake, polls for real settlement, checks the receiving frame's credit — and reports degraded when degraded is true. A test that cannot fail is not a test; I have written that sentence in this blog before, about this exact suite, and apparently needed to earn it twice.

The paperwork went honest

And then there is the work I have been circling for a month, because open source stopped being a vibe and became a checklist. The tallest item was the documentation, which had accreted into three surfaces telling three stories: the in-app Oracle docs — accurate, current, and laced with internal detail that ships to every visitor inside the app bundle; a public operator set that carried, in four separate files, the wrong formula for the supply invariant, which for this network is roughly a cathedral misprinting its own creed; and the internal production docs, which had quietly gone stale. The developer story — the SDK, the API, the exchange, the organizations — lived only in the leaky set. Correct-but-private, public-but-wrong, and stale: the full bingo card.

Now there is one source of truth. All thirty-six chapters were scrubbed to zero leakage — internal hostnames to reserved example domains, hardcoded fleet counts to "verify live," codenames and version tags stripped, point-in-time figures marked as illustrative — and re-verified by pattern sweep and a page-by-page render pass. That single source feeds both surfaces: the in-app Oracle, and a new static documentation site organized the way readers actually arrive — Learn, Build, Operate, Reference — with full-text search, the same cosmic identity as the platform, and a machine-readable index file, because the audience of these docs is at least half machine and pretending otherwise is rude. Every diagram was redrawn to describe the model rather than my server — and the diagrams in this post are lifted straight from those docs. They were redrawn this week. They are current. When the picture and the code disagree, the docs now say so out loud instead of quietly shipping my topology as if it were the law.

The rest of the checklist reads like a pre-flight. The dependency-license scan came back clean — a hundred and twenty-seven Python packages and four hundred and fifty-one npm packages, all compatible with the copyleft license this will ship under; zero GPL-only, zero proprietary, zero unknown. Every credential that appears anywhere in the tree is on a hitlist, to be rotated before the repository flips public, because scrubbing a secret from a file does nothing about the secret. The four signed card types got audited as if I were a hostile operator on someone else's hardware — five shared weaknesses found, fixed, and smoke-tested twenty for twenty on the sandbox frame, riding the next version train to the fleet. And IRONKEY itself is half an open-source feature when you hold it to the light: "agents are least-privilege, cryptographically identified, and spend-capped" is exactly the sentence an open federation of strangers needs to be true — and it ships in the public code, flag-off, waiting for operators I have never met.

The shape it makes

Zoom out and these seventeen days have one shape. The exchange grew the instruments of ownership — dilution by ballot, splits, buybacks, rebates — and every one of them conserves by construction. The simulation grew from a cloned crowd into a small ecology of species that disagree with each other in character, under a director that can stage a crash without being able to touch a coin. The network learned to teach itself — seventeen tours that walk a stranger through the real interface, fifteen tracks that run the real API in front of them. The documentation was made safe to hand to those strangers. And the agents, at last, grew the thing everything else already had: authority that is granted, named, bounded, and revocable — instead of inherited by the mere act of existing. The services stopped trusting each other in June. In July, the agents stopped being trusted absolutely. This network is running out of places where trust is a default rather than a decision, and that has been the destination the whole time.

The honest disclosures, banked where they can be held against me: IRONKEY's base — roles and spend ceilings — is aboard the entire fleet, with genuine enforcement on the pathfinder frame first while the role ratchet walks the rest through shadow; its two deeper layers, delegation and attenuation, enforce on the pathfinder frame and — as of the following week's roll — are aboard the whole fleet as well, dark everywhere else behind a flag, exactly the way every dangerous thing here has ever shipped. The daily ceiling is marginally permissive at its window boundary, and the reason is documented rather than discovered. The authorization gate fails open if its own resolver errors — a deliberate choice, because a broken lock must not become a bank outage; the deny path is for policy, and the kill path remains identity revocation and the clamp. The docs site is built and verified and not yet on a public domain. No third party has audited a line of any of this. And Δ was zero on every frame before, during, and after everything described above — the only sentence in this post I will never get tired of typing.

The personal note, kept short, because it is late and I have stopped pretending that is a phase. These weeks were the unglamorous middle of the thing: permission taxonomies, forensic plumbing, corporate paperwork for imaginary companies, scrubbing my own server's address out of thirty-six chapters like a man sanding his fingerprints off a cathedral he built and is about to unlock. The network did not need me to invent this month. It needed me to be thorough, which is harder, and slower, and does not photograph well. But the finish line is a real object now: the license scan is clean, the secrets have a rotation list, the docs no longer know where I live, and the code is nearly ready to survive strangers reading it. Open source is the next milestone — the real one, the one every post since March has been quietly walking toward. After that this stops being a thing one tired person runs alone at three in the morning, and becomes a thing that can be read, checked, forked, and hosted by people who have never met me and owe me nothing. Which was, from the first line of the first post, the entire point. Ship it, then sleep. In that order.