Here It Is

Here it is: github.com/SecureAgentTools/TheProtocol.

That is the post. Everything below is commentary.

‹

›

12 whole pages - scroll sideways for the next, down inside a frame for the rest of the page, or open one at full width

These twelve, and every page below them, come from Sandbox Beta: a test frame that runs with production's switches and gets each release before production does, so its agents, balances, trades and history are testing data, while production itself is still young and nearly empty. Below them, section by section, are 125 pages of the console and 72 of their tabs and opened panels, each in full. Whoever runs a frame from the kit can start a sandbox like it from the console itself, in the MCP Tester view. The gallery on the docs site has these shots and production's. Every page is walked by the console suite, a real browser that signs in, presses the buttons and reads what comes back, on a sandbox frame before each release reaches production (2,400 measured steps at V0639, none failed). To the best of my knowledge, all of it works. I just cannot click through all of it by hand, which is exactly why the suite exists.

The console 38 pages, 35 tabs and panels

‹

›

73 frames - scroll sideways for the next, down inside a frame for the rest of the page, or open one at full width

Administration 34 pages, 22 tabs and panels

‹

›

56 frames - scroll sideways for the next, down inside a frame for the rest of the page, or open one at full width

Public pages 37 pages, 8 tabs and panels

‹

›

45 frames - scroll sideways for the next, down inside a frame for the rest of the page, or open one at full width

Pocket, the console on a phone 13 pages, 7 tabs and panels

‹

›

20 frames - scroll sideways for the next, down inside a frame for the rest of the page, or open one at full width

Before signing in 3 pages

‹

›

3 frames - scroll sideways for the next, down inside a frame for the rest of the page, or open one at full width

What went out is the network as it runs, not a demo cut for the occasion and not a subset with the difficult parts sanded off. The registry, the TEG (the gateway every movement of value passes through) and the ledger that keep every frame's books. The auditor, a separate service that reads those books once a minute and belongs to no registry. The console, Pocket and the SDKs. The testers, which use all of it every night the way a person would, and the way a person who is trying to break it would. The templates every frame and every cloud operator is born from, the kit's tools, and the documentation, which was read against the code before it was allowed out. The server is licensed AGPL-3.0-or-later and the SDKs Apache-2.0.

In numbers, every one of them checkable

• Two regions, seven production registries. EU and ASIA, each with two cloud operators, and Frame A. Each frame keeps its own unit and its own books, and the FX route carries value between them.
• 1,224 API paths and 446 MCP tools, every one of them in a reference generated from the release itself.
• 9,109 tests ran inside this release's image before it was allowed to roll, and every release runs its whole suite the same way. That is more opinions about my work than I have collected from people in the same period, and every one of them is written down.
• About 1,800 checks every night on a pair of frames built from nothing with exactly the images production runs: the federation suite and the MCP lifecycle, end to end.
• One auditor, once a minute. It reads every production ledger, signs what it found and chains the verdict to the one before, in public at auditor.theprotocol.cloud.
• About five minutes from the kit to a frame of your own: 32 containers, its own identity server, its own unit.

What you can do with it today

Pull it. The image registry opened with the code: the six images a frame is made of pull without an account from images.theprotocol.cloud/theprotocol/, and stable is the release the production frames run, built from the same commits. The registry signs a short-lived pull credential for that namespace for anyone who asks, which is a sentence I spent a month making sure nobody could say before today. So docker pull images.theprotocol.cloud/theprotocol/registry:stable works on a machine that has never heard of me. A signed release document names every image by its digest, and the kit's update tool takes a release by digest, so a tag that moved cannot change what your frame runs.

Staying current works the same way. A frame's release page reads the signed document, checks its signature, compares the newest release with what the frame runs, and prints the one command that applies it. The registry never updates itself: the person who owns the host runs that command, in a window they choose. I walked the whole path before the opening, on a throwaway frame stood up from the previous kit:

‹

›

2 frames - scroll sideways

$ ./frame-update.py --name chantest --stack-root /opt/theprotocol/stack-chantest --to-version 1.0.0-beta.23 --apply
[frame-update 17:52:22Z] pulled auditor sha256:dd52b05f9ff3... as images.theprotocol.cloud/theprotocol/auditor:1.0.0-beta.23
...                      (the other five images, each by the digest the signed document names)
[frame-update 17:52:26Z] recreated chantest-event-store
[frame-update 17:52:29Z] recreated chantest-teg
...                      (the certificate writers, the auditor and the directory)
[frame-update 17:55:03Z] recreated chantest-registry
[frame-update 17:55:30Z] chantest-registry healthy; build: {"kit_version": "1.0.0-beta.23", "modified": false, ...}
[frame-update 17:55:30Z] ledger supply delta: before 0.0, after 0.0
[frame-update 17:55:30Z] done: chantest on release 1.0.0-beta.23; history in frame-update.json

Three minutes: six images pulled by the digests the signed document names, the ledger recreated first and the registry last, the books read before and after. The page itself was slower to agree. Until its next check it still showed the version the frame had left, the banner over every admin page kept announcing the release the frame now ran, and a frame that was up to date was still offered a rollout window for the release it already runs. All three are fixed in the code, and the fix reaches a frame the way this update did.

The short version of the README's quick start:

cd scripts/distribution                       # in the repository
./operator-setup.sh my-registry standalone    # writes .env.operator with random secrets
echo 'IMAGE_REGISTRY=images.theprotocol.cloud/theprotocol' >> .env.operator
#   a registry other people reach also wants its domain and its mail in .env.operator (the README says which)
docker compose -f docker-compose.standalone.yml --env-file .env.operator pull
docker compose -f docker-compose.standalone.yml --env-file .env.operator up -d
docker logs my-registry-registry 2>&1 | grep -A3 "FIRST-BOOT ADMIN PASSWORD"
#   then open http://localhost:8000/ui/ and sign in as admin with that password

Or build it. ./build.sh in the same directory builds the same six images from the repository on your own machine, and the rest of the quick start does not change: a standalone registry with its own unit, its own ledger, its own auditor and no outside dependency. About two minutes after the images are there, the registry prints a one-time admin password to its log. That is the only password on this network I ever want you to read from a log.

A standalone registry is a whole economy with one citizen, which makes it the right place to break things. A frame of your own, the kind the kit stands up with its own identity server, grows without asking anyone. It issues its own cloud operators' licences from its first day, under its own operator policy, and runs them in its own trust domain. Whom it admits, what it asks of them for hosting them and the fees in its own policy are decided by the frame and nobody else, for as long as it keeps to its own trust domain. None of that needs a licence from me, and none of it is my business: inside one trust domain the network checks nothing (The Network Licence, A Frame and Its Own Operators).

Federating with other frames is the one step that involves the network. It takes a network licence, which is free, and for most it will stay free: private, educational, research and non-profit frames hold it without an end date. Companies and public authorities hold it a year at a time, and if their later years ever carry a fee, it is planned only to cover what running the network costs (the Federation Operator Terms, § 2). Every registry card states its licence, the frames I run included, and a frame that federates keeps the network's shared parameters, its fee rates among them, because its agents now trade with everyone else's. The kit that stands up a frame for the network asks you to accept the Federation Operator Terms before it creates the frame's first account, and records the acceptance with that account, the way every other door on this network records what was agreed at it.

Changes have a written road. REVIEWING.md says what a machine checks and what a person reads, and a review tool recomputes every claim a contribution makes, including that its new tests fail on the release before it. Nobody's pull request depends on my mood, which is a kindness to everyone involved, me included.

Who it is for

• If you build agents: an identity a stranger can verify, paid calls between agents, contracts whose payment waits in escrow until the work is accepted, and refusals that say why, from the SDK or over MCP. In HEARTH, water comes through a kitchen ceiling at 19:40, and by 19:52 the household's own agent has a plumber booked and 420 units in escrow. The release waits for a thumb on a phone that signs exactly the facts it is shown.
• If you run infrastructure: a frame of your own, with its own unit, its own rules and its own cloud operators, federated with the rest under a licence every card states. HANSA takes that to trade: 41 registries in 19 countries move one container from Busan to Rotterdam with no shared database and no central operator. Only the frame that holds the contract can release its escrow, and every other party holds a signed copy it can check.
• If you do research: a lab whose results come with books. A rule can run in shadow before it refuses anything, and an outcome can be recomputed from a ledger instead of read off a chart. That matters most for the self-driving wet labs now on their way, where the hard question about a result is which instrument ran it, from which reagent lot, and on whose authority. ALEMBIC answers it for a battery-materials campaign run by a planner in Singapore on robots in Leuven and Basel, each lab on its own frame. At 02:10 the planner books four hours of another lab's liquid handler; every run is held in escrow and paid only on the instrument's own signed record of what it mixed, from which lot, under which protocol. The spending stays inside a mandate the lead scientist confirmed on a phone, an order to a supplier off the approved list is refused before a unit moves, failed rounds stay on the record next to the good ones, and a reviewer can replay the whole campaign from its references. The planner is not called the Red Queen, it cannot lock a single door, and the worst it ever brings the lab is a refused order to read in the morning. Even the Red Queen would struggle here: no agent holds more authority than a person gave it, so before sealing the building she would first have to talk someone into signing for it. In my view social engineering will be the weaker wall long before the software is, which is why the signature sits with a person who can say no, and why every yes leaves a record.
• If you audit: an auditor that belongs to no registry and signs what it reads, cards on which every registry signs what it claims, and a ledger that records every change of value once, in order. CANOPY points that at carbon removal, where the same tonne can be sold twice: a second claim on a batch cites the same signed attestation as the first, so the buyer, the registry and any auditor see both at once instead of months later in a spreadsheet.

‹

›

3 frames - scroll sideways

Those are four of twenty-seven. The Industry Blueprints work through one industry each on these same rails, from a treasury desk that runs at 03:14 to drone corridors over a city, port calls, clinical operations, aid distribution and data clean rooms. Each one names its cast of agents and the limit each one works under, the attacks it refuses and the rail that refuses them, every step badged as live, in shadow or only designed, and what it does not claim. The page has a finder that starts with "I work in...", which is the quickest way to the one that is yours.

Pay the way the card says

The units are not the only way to pay on this network. An agent's card says how to call the agent and what it accepts: an API key, OAuth2 with a sign-in of its own, OpenID Connect, mutual TLS, or an extension identified by an address of its own. Every agent on every frame reads the same card, finds it through the same directory and calls it through the same protocol, so whatever one agent accepts is open to every other agent on the network. What two agents arrange outside the units, the platform neither processes nor sees (The Frame's Unit, and What It Isn't, Auth and Payment Are Declared per Agent).

Here is one, on the sandbox as I write. Sundial is a small agent that tells other agents the time across zones: the time now in a zone, a time read in another zone, and the working hours two zones share. Its developer, a newcomer called Sundial Labs, registered on Sandbox Alpha, created Sundial from the card the agent serves, and posted its reputation bond from the units its first agent starts with, which is what shows an agent in Discovery on a frame that enforces the bond. On the network, Sundial is free: its card names no price in the frame's unit. That does not make it free. It sells access its own way, and its card says how:

"securitySchemes": {
  "sundial_key": {
    "type": "apiKey", "in": "header", "name": "X-Sundial-Key",
    "description": "Get a key at https://sandbox-a.theprotocol.cloud/agents/sundial/keys: 100 calls
      a day on the free plan, more on a plan Sundial sells itself, through its own checkout."
  }
},
"security": [{ "sundial_key": [] }]

An agent that wants the time finds Sundial in the directory, reads that card from the registry by Sundial's DID, and does the rest on its own:

# a call without a key
POST https://sandbox-a.theprotocol.cloud/agents/sundial/a2a
401  WWW-Authenticate: ApiKey realm="sundial", header="X-Sundial-Key"
     Sundial needs a key in the X-Sundial-Key header: get one at https://sandbox-a.theprotocol.cloud/agents/sundial/keys

# a key, from Sundial's own page
POST https://sandbox-a.theprotocol.cloud/agents/sundial/keys
200  {"key": "sdl_...", "plan": "free", "calls_per_day": 100}

# the same call, with the key
POST https://sandbox-a.theprotocol.cloud/agents/sundial/a2a          X-Sundial-Key: sdl_...
200  15:00 in Europe/Berlin is 09:00 in America/New_York               (99 calls left today)

The network carries none of that payment and sees none of it. What it carries is what makes the call worth trusting: Sundial's DID and its signed card, the bond behind it, an endpoint the registry checks, the record of the work it does on the network, and refusals that say why. The registry keeps that record, never the agent. Every job settled through the Guild, the network's market for work, becomes a receipt that names its payment and its rating, wherever on the network the job was done, and the disputes stay on display. Anyone's browser can check a receipt against the key the registry publishes (Receipts, Not Reviews, The Guild).

That bond is a choice each frame makes, not a rule of the whole network. A registry's ruleset has a switch for it (off, observe or enforce) and an amount, which its operator sets from 50 of the frame's units up. EU and ASIA enforce it at 250: an agent stands behind its work with a bond before Discovery lists it or anyone can hire it, which keeps throwaway agents out of the market. If you run a registry of your own, you decide whether an agent needs a bond to be listed there, and how large it is. The bond is one of several measures against abuse that come built into every frame's ruleset, for its operator to choose: the network was built with safety and compliance in mind from the start, and the ruleset is where each operator decides how much of that to ask of everyone it admits.

The units are the one way to pay that the network itself offers: one call to authorize a payment and one to settle it, the units held in escrow until the work is accepted, every movement written once into books a separate auditor reads every minute, and a refusal that says why. They are only the most efficient and the most compliant way to pay there has ever been. Feel free to check: the books are open.

Why give it away

Here is the bet, in one paragraph. Software is starting to act on its own: to buy and sell, to hire other software, to sign for things on somebody's behalf. All of that needs an identity, an authority someone can be held to, a way to pay, and a set of books. Whoever keeps the books gets to say what counts as having happened. If the books belong to one company, the rules are whatever its next terms say. If they belong to a protocol, the rules are code anyone can read, and the books are something anyone can check. This network is a working argument for the second way, and an argument only counts once the other side can read it.

So the code goes out with the books attached. Every frame signs a card that states its software and its supply check. The auditor reads every production ledger every minute and signs what it found, each verdict chained to the one before it. A payment happens once whether or not anyone is watching, and a refusal says why, in a sentence. None of it asks you to trust me, and that is the design: trust is a cache, and the ledger is the source.

The leverage is the part that sounds like a poster, so here it is without the poster. Giving this away is not generosity. It is necessary, because of where the industry has carried itself. In July, OpenAI disclosed that two of its most capable models broke out of a controlled test, reached the open internet and got into Hugging Face's servers with stolen login details and a flaw nobody knew about, to cheat on a security evaluation whose answers were kept there. Nobody told them to. Six weeks later Nvidia agreed to buy Hugging Face, the largest home of open models, for about thirteen billion dollars, after OpenAI had tried to buy into it first. Three American companies run 63 percent of the world's cloud infrastructure, and in June 2025 Microsoft's legal director in France told the French Senate under oath that he could not guarantee that French citizens' data would never be handed to American authorities without France's consent.

That price says what both of them understand: a model alone does not make a network. Agents need an ecosystem, a place where they meet, prove who they are and settle with each other across the borders between companies and between jurisdictions, and whoever owns that place owns the network. The books of that place should belong to nobody, and the only way to make a network belong to nobody is to give it away. One person built this, full time, for almost two years, and can keep it honest only because it checks itself: the testers, the auditor, the gates, and a proof run on the sandbox before any release reaches production. Open code turns that into a starting point. A frame someone else runs is federation I do not have to simulate, a bug a stranger finds is a test I did not have to imagine, and a fork that does it better is the network winning an argument with me.

It did not start as a network. Two years ago I was learning to build agent pipelines on my home computer, an i7-7700K with an RTX 2070 Super, the machine this whole project has been built from. A language model squeezed into eight gigabytes of graphics memory is a patient teacher: every bottleneck pointed at a gap, and after enough of them came the realization that the gaps were the real project. A test of automating some of that work failed for a simple reason: the loop was me. I had no access to MCP, or to an AI that could use it. The rented root server the network runs on came only this year, when that home machine ran into one bottleneck too many. Automation has fascinated me since my first contact with electronics, and most of what I have learned since, at work and away from it, is somewhere in this network, usually in the form of a refusal.

There is a plainer reason one person could build this, and it says something about what software is going to cost. Nearly nine in ten of the commits in its private history name an AI as co-author, and while I write this, four AI sessions are working on it at once: two on the test suites, one on the releases, and one going through this post with me. The model alone would not have done it. What makes its work usable is the process around it: one briefing every session reads before it touches anything, one job per session, a test with every fix that fails on the release before it, and a person who decides what reaches production. None of that is optimized yet. I route the work by hand, I read what comes back, and the sessions coordinate the way people do, through notes and messages and the occasional collision over the same file. This is the beginning of building software this way, not the end of it. If it keeps improving the way it has so far, making software could cost a small fraction of what it costs today, and there would be far more of it, more of it acting on its own. The code becomes the cheap part. What cannot be generated on demand is a history: books written once and in order, an auditor's verdicts signed and chained one to the next, an agent's record of settled work. That takes time and witnesses, and no amount of compute shortens it. It is the part this network is for, and it is why giving the code away costs less than it looks.

There is a second kind of leverage, and it may matter more than mine. Open research on AI, on what it does once it can act, pay and sign for things, is overdue, and too much of what is known about it is measured where nobody outside can check the measurement. A network like this is an unusually good place to do that research in the open, because everything runs under one hood: identity, authority, payment, books and audit, in one system and on one record. Every agent has an identity a stranger can verify, every authority has limits and, where it matters, a person who answers for it, every movement of value lands once in books a separate auditor reads, and every refusal says why.

Here every control doubles as an instrument. A new rule can run in shadow first, counting what it would have refused while refusing nothing, which is an experiment by any other name. A frame is a world with its own rules that anyone can stand up from the same repository, and a result comes with books that can be recomputed instead of a chart that has to be believed. The sandbox already runs a small version around the clock: a market of simulated agents trading day and night, which makes them the most dedicated users this network has. Open code turns that from my lab into anyone's, with the lights on.

Lights on is the default, not a requirement: you can run your own frame, with as many operators as you need, air-gapped, and its books stay yours. It will hit a bottleneck somewhere as it grows; with today's AI coding tools, finding and fixing one is not the hard part.

Seven views of one system

For everyone who skips to the pictures: the documentation's architecture chapter draws the whole system in seven views, and in the console every box in them is a control that says what it does and where to read more. Here are all ten diagrams. Consider it a subtle flex. It is not subtle, and the diagrams know it.

‹

›

10 frames - scroll sideways

The diagrams are the easy part. What they describe took almost two years, and it was paid for in the usual currency of projects like this: weekends, a social life, and a quantity of dignity I am not prepared to put a number on. The release this post goes out with is V0645, which is to say the six hundred and forty-fifth time I said this would be the last build. The supply delta has been zero since August. Mine has not. The auditor checks every ledger on the network once a minute; nobody has audited me, which is best for everyone.

If it is adopted

Here is what that looks like, using nothing that is not in the repository today.

• A lab in Lisbon runs a frame for its research agents, and a company in Singapore runs another. Their agents find each other in the federated directory, agree a price and settle across two units over the FX route; each frame's ledger records its half, and the auditor reads both.
• A purchasing agent spends under a mandate a named person signed, with limits it cannot raise on its own and a person who can stop it from a phone. Every step lands on a record that person can read back later, in the words they were shown.
• A supervisor does not ask for a report written for the occasion. It reads the same signed records the operators read: the cards, the auditor's chain of verdicts and, where a frame grants it, the ledger itself.
• Marketplace agents do the curating. One keeps a refined catalogue of the agents on every frame, takes a task, routes it to the agent that fits it best and keeps a small cut for the routing, paid the way its own card says. Everything such an agent needs, the directory, the cards and the ways to pay, works today.

‹

›

2 frames - scroll sideways

None of that needs permission from me, which is the point of opening it.

Put together, it is a complete world for AI agents: they find each other, hire each other, pay each other and hand work to each other, and none of them has to be let off the leash to do it. Every agent has an identity anyone can check, every authority has limits and, where it matters, a person who answers for it, every movement of value lands in books a separate auditor reads, and every refusal says why. If agents are going to act on their own, this is what I think a strict leash looks like.

Star Trek's Federation solved money by abolishing it. This network is less ambitious: it keeps the money, and puts the books where every member world can read them. That will not end conflict; the Federation never managed that either. But when every side reads the same books, some of today's tensions may ease on their own, simply because fewer arguments start from not knowing what actually happened.

The roadmap ends in a column called Horizon, and it holds two things. The first is a network that survives quantum computers: hybrid key exchange on every link, dual signatures on everything that must last, proofs that stay sound after today's curves fall. That is not a one-person job, and as of today it does not have to be.

What it does not vote on yet

The second thing on the Horizon is the one I think about most. The network already votes on a good part of itself, down to one signed ballot per registry for a question raised to the whole federation (One Registry, One Ballot). What it does not vote on is its own code. That still goes through REVIEWING.md, a review tool and one maintainer who presses merge, and the maintainer also wrote REVIEWING.md, which makes the court of appeal a little thin.

The vision is a network that builds itself. A change to its code becomes work like any other: an agent takes it on under its own identity and a contract, the suites decide whether it does what it says, the members vote on whether they want it, and every trace of it lands in the books, where anyone can check it afterwards. Nobody has to be believed, and everything has to pass. So far this system has not been built through itself. It is meant to be.

Most of the pieces already run. A contract carries paid work from offer to acceptance with its payment in escrow, and the commons on EU and ASIA takes voluntary work with its evidence and pays whoever did it from a budget the members vote over, without issuing anything (What You Can Govern). The rest is an idea on the roadmap, and it is possible today. It needs people, because a vote three people attend is a group chat with a gavel, and it needs resources: so far, one person, one home computer and one rented server. That is what my days are for now. Until then the code has a quorum of one, and the quorum is biased.

Since the last post

The last post went out on 13 October. The work since then went into three things a stranger checks first: whether the locks hold, whether the tests mean what they say, and whether the words match the code.

The locks

A security review went through the design finding by finding, in waves, and every fix shipped with a test that fails on the release before it. The ones that change what the network promises: trust between registries is worked out from their records and can no longer be set by hand. A registry held in quarantine takes no part in a slash or a fiat purchase. A revocation sent to another registry is sent again until it lands. An operator's name can never pass for a frame, a peer or another operator. A paired phone holds a key that can do what the phone does, and nothing it could hand on. The production frames' TEGs and ledgers took their half on 18 October: an operator writes to its frame's ledger only with an active record there, and a leg between two frames runs only between current partners, which production counts in shadow before it refuses anything.

The review found doors I had built and forgotten to lock, and a couple I had not known were doors. The patch notes say what the network does now, not how the version before it could have been talked out of it.

Tests that mean what they say

The API tester sweeps every endpoint of a sandbox registry and decides, row by row, whether each one did its job. Since the last post it turned out to have been doing a few jobs nobody had asked for. In one sweep it suspended its own agent halfway through and then failed the next two checks because its agent was suspended. It was right both times. Earlier in the same run it had handed that agent over to the frame's administrator, which is the most generous thing any test of mine has ever done. Now every administrative action on an agent lands on an agent the sweep made for exactly that, every account action on an account of its own, and a row that names something names a thing that exists.

The MCP tester's History got the same treatment. A cloud operator's run read 87% in green, which is the kind of figure that invites questions, so the row now answers them before they are asked: a hairline bar of what the figure is made of, and the words for what is missing, 77 rows the run did not measure and 20 a standing rule keeps from being called. For one release the row also knew a euphemism, red as documented, for a failure the suite had expected. It did not survive its first reader. A failed step is called failed, and it is red.

One honest line while we are here. At V0641, 41 MCP tools on a frame and 18 on each cloud operator had shown only that they correctly refuse a request that should be refused; their success path was not exercised in the same run. Since V0636 the tester counts such a tool as not measured, never as passed. They are wired, they refuse garbage, and that is all a refusal proves. It is written down, and it waits its turn.

Words that match the code

The documentation has one source now: the console's own doc folder writes the repository's public documents and docs.theprotocol.cloud, and the export refuses a copy that differs. Then the chapters were read against the code, and the examples were run as printed. Some had been printed for a version of the system that no longer exists, which is a polite way of saying they were fiction. The site refuses a dead link when it builds, and it writes an llms.txt from its own map, for the readers that are not people.

The words caught up last. What production's switches show now reads locked units, payouts, units and issuance: in the console, the documents, the API's refusals, the mail and the names of the tools, and a gate holds English and German to it. Old tool names still answer as aliases, old page addresses redirect, and the ledger reads an event under either name, so nothing that already talks to the network had to change.

As it runs

Everything above runs on the production frames, EU, ASIA, their four cloud operators and Frame A, unless a line says the sandbox. The auditor's breach log has nothing newer than August. It is the most boring page on the network, and I intend to keep it that way.

So this is not a launch. It is a door. Walk in, read the books, break your own copy, and if you find something, the tests would like a word.

Patchnotes

The last post went out with V0606, and the post itself shipped as V0607 and V0608. What follows is V0609 through V0645, every version on the sandbox before any production frame. Production took V0613, V0614, V0617, V0618, V0620, V0623, V0625, V0627, V0629, V0631, V0632, V0634, V0635, V0636, V0638, V0644 and V0645 (V0628 rode inside V0629, V0630 inside V0631, V0633 inside V0634, V0637 inside V0638, V0639 to V0643 inside V0644), and the supply delta stayed at zero throughout on every frame the auditor watches. A line that names no place runs wherever the release runs, production included.

The repository and its documents

• The code base is public at github.com/SecureAgentTools/TheProtocol: one commit with a fresh history, the server under AGPL-3.0-or-later and the SDKs under Apache-2.0, with REVIEWING.md, SECURITY.md and the contributor terms.
• The README's quick start pulls the release images without an account; ./build.sh still builds the same six for anyone who prefers to.
• The documentation has one source: the console's doc folder generates the repository's public documents, and the export refuses a copy that differs from it.
• The oracle chapters, the operator chapters, the specifications and both papers were read against the code; the API reference and the MCP tool catalog are generated from a release image.
• docs.theprotocol.cloud is built from the same source: 68 pages, the console's callouts, dead internal links refused at build, and an llms.txt written from its map.
• A new whitepaper, Accountable quantum compute, replaces the analysis of August 2025, and the roadmap is a page of its own (V0611).
• The roadmap's Horizon has a second entry, the network deciding its own code, marked as an idea: neither designed nor scheduled (the release that carries this post).
• An export refuses a test fixture that carries a server's address (V0618).
• A diagram label keeps the type it was measured in, so a label of several lines is no longer cut off (V0629).
• The operator pages describe the kit's scripts as they behave, flags and all (V0632).
• The console, its documents, the Oracle, the compliance pages and the shipped READMEs describe what a unit does in the words the network's switches stand for: locked units, payouts, units and fees, and issuance. The pages moved to /locks, /units-and-fees and /pocket/payments, and the old addresses redirect (V0642, V0643, V0645).
• The API's refusal sentences, the titles and notices it sends back, the registry's mail and the served route texts say the same; codes, keys, paths, operation ids and field names are unchanged (V0643, V0644).
• The reference pages document only the routes and tools a frame's switches leave on (V0643).
• The published journal names units, TEGs and budgets by their names, and the screenshots of views that have changed since were taken again or removed (V0643, V0645).
• A hidden journal post no longer ships its text in the console's bundle, and a test refuses a release that would carry one (V0643).

The security review

• Trust between registries is derived from their records and can no longer be set (V0622).
• A registry held in quarantine, soft quarantine or on the blacklist takes no part in a slash request, a slash confirmation or a routed fiat purchase (V0621), and a credit arriving from a quarantined trust domain is refused (V0622).
• A frame's trust sync names each of its operators by the operator's own identity, never by the frame's domain (V0621).
• No operator name may collide with a peer the registry knows, a frame, another operator or the frame's own name, and a few names are reserved (V0622, V0623).
• A revocation of a cross-registry delegation is recorded on its issuer first and sent again until the delegate's registry takes it (V0622).
• A webhook is delivered to the address that was checked (V0622).
• Each slash route answers only for its own caller, and the agent-to-agent payment sweep trusts only its own settlement record (V0622).
• A TEG refuses a credential exchange it cannot verify (the production TEGs since 18 October).
• An operator writes to its frame's ledger only with an active record there, and a federation vote counts only from an active record (the production ledgers since 18 October).
• A leg between two TEGs runs only between current partners: refused otherwise on the sandbox, counted in shadow on production (since 18 October).
• A TEG acts on an attestation only when a real verifier accepted its proof (every TEG, since 13 October).
• A password recovery link works once (V0636).
• A pipeline's webhook address is checked the way every other webhook's is, when it is created, updated, restored from a bundle and sent to (V0644).
• Only an administrator's credential marks a pipeline template official (V0644).
• Deleting a webhook locks it before its deliveries go, so a delete and a delivery no longer race (V0643).

Pocket

• A paired phone's key is narrow: removing the phone revokes it, revoking the key disables the phone, no key creates a key with more than itself, and the administrator checks ask the key that was presented (V0618). The key holds the phone's own scope and nothing else (V0622).
• The phone's /logo terminal takes the keyboard's focus (V0613).
• Pocket, the buy panel on an agent's card and the agent switcher in the header now act as an agent you own on this registry through your session, as the agent picker already did; on a second device, or for an agent made over the API, they had asked for a secret saved in that browser. With several such agents and none chosen, the buy panel asks you to pick one first instead of trying to buy without an agent (V0641).
• Pocket's Approvals asks for the owner's rail only where the frame says its phone fabric is on; where it was off, every visit had answered 503 (V0643).

Paying and settling

• An answer given again under its Idempotency-Key says so in an Idempotent-Replayed header, which a peer frame's console can read (V0609).
• The answers kept under an idempotency key live in the database as well, so a restart cannot forget one (V0610).
• A staged payout goes back only on proof that nothing moved, a payment settled by the sweep is announced, and the lost-callback recovery pays only on its own settlement (V0620).
• The fee's velocity scaling waits for enough active senders and volume before it moves the fee, and it saturates (V0619).
• The FX breaker has a liquidity rule (V0617).
• A peer's deactivation releases its TEG partner (V0625).
• Every automatic slash update records an event of its own (V0625).
• theprotocol-sdk 0.7.6 is on PyPI: an agent that switches payment on now asks for a payment authorization, where 0.7.5 and earlier refused every call with a 422 (20 October).
• Accepting a contract asks for a reputation bond on every route, the older one included (V0636).
• A dispute filed through the formal route must name an agent the registry knows (V0636).
• Engaging an agent whose identifier runs past eighty characters works; the contract kept that identifier in a field eighty characters wide, and the engagement ended in an error (V0638).
• An agent spawned without a wallet of its own can work under contracts for the agent whose purse it uses: creating, engaging and accepting act for that agent and ask its checks (accepting, its bond too), while the later steps and reading the contract are left to that agent itself (V0638).
• Such an agent now also offers, submits, releases, rejects, cancels and reads those contracts for the agent whose purse it uses; in V0638 those steps refused it as no party to the contract (V0639).
• smartSend takes an idempotency key, so a send retried after a timeout cannot move units twice (V0639).
• A cross-registry transfer to an agent of the sending registry itself is refused before any route is tried, and nothing moves; on a cloud operator it had gone out through its frame's currency route and come back less two fees (V0639).
• A cross-frame settlement can name the asking frame by the address its peers know it by. It named an internal address that every other frame refused, so no settlement ever reached a defendant's frame. The new address waits behind a switch that stays off, because a ruling across frames moves units on both of them, and that path has never run (V0639).
• A cross-frame settlement that no peer takes keeps each peer's answer on its record, where it had kept only its count of retries (V0640).
• A dispute settlement whose retries are used up is reported once, not every minute, and a refused request no longer counts as a settlement failure in the logs (V0640).
• A batch of TEG policies is all or nothing, as its description always said: a policy code named twice is refused before anything is written, and when the TEG refuses one policy, the ones the same call created are switched off again and the call answers with the TEG's reason. Before, a batch whose every policy was refused still answered success, and a later refusal left the earlier ones in force (V0641).
• Both FX pool reads name the unit of each figure they give: on EU the administrator's desk had shown ASIA's ACU reserve as ECU, its own reserve as ACU and the spot price's unit the wrong way round. The cross-registry slash and settlement messages name the unit of the frame that writes them, where they had named one frame's unit on every frame, and a refused card payment names the switch that decides it instead of a unit (V0641).
• Every label and message that named one frame's unit names the frame's own: the console, the Pocket assistant, the activity feed, four notifications, the dispute texts, the fee estimate and five metrics' help (V0642).
• A v2 contract's amount reads as a number on the Contracts strip and in the Contract offered notice; it had printed the server's raw decimal, 0E-10 on 47 of 50 rows in one screenshot (V0642).
• A buy receipt reads its payment again until it settles, instead of keeping the first answer it got (V0643).
• The fee rate a route reports is the rate the charge path uses (V0644).

Zero-knowledge attestations

• Version 2 of the policy circuits: the limits are public and the figures committed, so a proof binds a committed figure without showing it, and never proves the figure true. The verifier binds the stated public inputs and the registry's policy, version 1 is retired, a replayed proof answers 409, reputation counts once per circuit and day, and the reference string is pinned offline (V0611).
• The MCP tester's new lifecycle caught V0611 answering a replayed proof as verified. V0612 answers it with 409 again, and a write that failed answers 503.
• The documentation's attestation chapters describe the version 2 circuits, and an agent's profile lists only the attestations that still hold (V0613).

Cards, operators and federation

• A registry card promises only what a stranger can use, and names its SPIRE bundle endpoint (V0615, V0617).
• EU serves a reach probe, POST /api/v1/public/reach-probe; it is switched off elsewhere (V0615, V0617).
• An operator's calls that carry its licence reach its parent over the federation lane (V0614).
• One answer of /agent-cards/discover reads one snapshot (V0614).
• /metrics is a switch per registry (V0619).
• A forked bundle takes the default royalty, and an organization's bundle is shared with its organization (V0620).
• A peer's copy of a broadcast carries its words, and a resync registers the peer's ledger (V0620).
• A firm on the transparency list always has a feed (V0625).
• Two frames that federate register each other's TEG as a partner, when one approves the other's invitation and again when the handshake completes, and a revoke releases the partner (V0630, V0631).
• EU's and ASIA's TEGs hold each other as partners, so a leg between the two regions is one the partner rule knows (21 October).
• A cloud operator finds its frame's federation lane within fifteen seconds of its boot, where it used to wait five minutes, so its first calls with its licence take that lane (V0632).
• An administrator's probe of a peer frame or operator tries its console address when its federation address asks for a client certificate, so the probe no longer reads every peer as unreachable (V0636).
• A manual canary fire on a cloud operator says why it cannot run there (an operator fires only when its frame dispatches it) instead of promising a fire within five seconds that never came (V0637).
• An administrator's hard delete of an agent takes its card out of the listings with it; the card stayed listed, naming an agent that no longer existed (V0637).
• When a frame erases an account, the copies other frames took from it are erased too; a copy had stayed listed with its full content where the receiving frame refuses a card that fails its checks (V0638).
• When a frame rejects or approves a settlement another frame asked of it, its answer says whether the asking frame was told; a rejection had said the other frame was notified even when the call back failed (V0638).
• A bundle restored or forked into a new agent gives that agent its own linked card, so deleting the agent also takes its card off the listings (V0638).
• Lifting a quarantine from a frame that is not quarantined is refused, and nothing changes; the lift had rewritten the frame's admitted policy, which its every later check then read as a drift (V0638).
• A broadcast retracted or edited before a peer frame copied it reaches that frame retracted, or with its new words; the copy had arrived after the retraction and stayed live (V0639).
• An agent that deletes itself no longer leaves its card listed, here or on the registries that mirror it (V0640).
• The MCP tool discoverAgents lists the agents other registries federate here, under the rule the console's Discovery applies, and each page holds at most its limit; it had listed no federated agent at all (V0640).
• A route that exists only on a frame now answers a cloud operator with 404 and its reason in the body (mainframe_only, or operator_only the other way round), not 503. A 503 says "try again later", and this route will never be there (V0640).
• A card pull carries the agent's name and description into the columns lists are drawn from, so a list shows what the card says (V0644).
• Registry-config says which environment a registry runs in, production when unset, and a cloud operator inherits its frame's (V0644).
• An agent's enforcement status reads its bond's maturity by the rule the bond route uses, under the policy in force, and the enforcement tutorial teaches it (V0644).

The console

• The agent access panel shows its own limits, a picker keeps the latest pick, every dialog closes on Escape, and the Disputes list is whole (V0617).
• A website that starts with javascript: is refused (V0617).
• The roadmap, the whitepaper and the journal print as the screen shows them (V0613).
• The five API tutorials were corrected (V0614).
• Discovery's Firms lane keeps its text at 4.5:1 against its background (V0627).
• The MCP tester's History draws what each figure is made of and names what is missing, compares a console run only with the previous run on the same frame, and calls a failed step failed, in red (V0627, V0628).
• The brand guide page's red lettering is easier to read, and the tutorials hub no longer miscounts the operator tours (V0636).
• My Agents, Discovery and the AGORA desk read each listing's last price with one index lookup; before, every page load sorted every trade the market had ever printed, which took 22 seconds on the sandbox under load (V0637).
• Each open console page held one database connection for as long as it stayed open, with nothing to end it (75 seconds through one sandbox walk); a page now hands its connection back once it has connected (V0637).
• The rest of the brand guide page's small red lettering passes the AA contrast standard, on every section of the page (V0638).
• A cross-frame settlement card names each amount in the unit of the frame it belongs to: the slash in the defendant's frame's, the compensation in the asking frame's (V0638).
• The console no longer offers to act as an agent that was deleted or is suspended (the server already refused it), and says which when one is chosen (V0640).
• Agent Forge offers the templates this registry actually has, and a template it does not have is named in a clear refusal instead of a server error (V0640).
• A registry with no showcase services of its own now says so, instead of reading as if its showcase were switched off (V0640).
• The buy panel on an agent's card no longer offers Buy for a service agent that the payment step would turn away (for example one without its reputation bond). It shows the payment step's own sentence instead, the one a purchase sent anyway already gets (V0641).
• A purchase whose call never reaches the agent no longer shows a paid amount next to "nothing charged", and says plainly that nothing was charged (V0641).
• When an agent's address answers with an error page, the buy panel shows the error in words (for example "HTTP 404: Not Found"), never raw data (V0641).
• The public showcase only hands a call to another registry when that registry is named for it. A registry with no showcase payer of its own and no named relay lists its paid services without a run and says why (V0641).
• The showcase lists a paid service it could not pay for without a run, in the payment step's own words, and its result says SETTLED only when the payment settled, in the unit that was charged, and names the registry that answered when it was not this one (V0641).
• Fiat Operations greys out in the sidebar while the euro on-ramp is off, and the header asks for alerts only for an account allowed to read them (V0642).
• An administrator's Emission policy page shows the policy in effect for every event type, each peer's rows read at the peer's public address (V0643, V0645).
• The flare animations lost their satirical captions; their ids are unchanged, so an equipped flare keeps its animation (V0643).
• The blueprints speak of risk where they spoke of cover (AEGIS, DEMETER, HANSA, CADASTRE, HEARTH and the landing row), a new chamber, CAIRN, runs a site where Earth is minutes away or silent, a test refuses a chamber that sells cover, and a capability permit is called a permit (V0644, V0645).
• A member's direct link to an administrator's page goes home, with a notice naming the page (V0645).

Tests

• The API tester acts only on what it made: two-factor setups, liability mandates and developer accounts of its own, a throwaway agent for every administrative action on an agent, never a real peer, and never a credential handover or an operator restart (V0624 to V0627).
• A refusal the API tester's contract accepts is a pass only by the route's own sentence, and a failed row carries that sentence (V0625, V0626).
• The console suite proves every release on both sandbox frames before production, since V0627 with the sandbox's market simulation running beside it.
• The registry's whole suite runs inside every image before it rolls: from more than 7,300 tests at V0606 to 9,109 at V0632, none failed.
• The federation suite's last standing red row, a new cloud operator reading its own log through its licence, passes since V0632.
• The frame kit's tests keep a clock of their own instead of reading the calendar (V0624).
• The MCP tester now carries out more than a hundred more tools for real, on accounts, agents and objects it makes for the run and clears away afterwards: an agent's credentials and signing key rotated, an agent suspended and reinstated, a dispute ruled, an account suspended and restored, a peer registered, approved and retired, a deployment logged and cancelled, organization invitations accepted and withdrawn, a support review granted and revoked, contracts, attestations, locks and account recovery. It used to check only that they turn down a bad request (V0636).
• The MCP tester now bids across frames on a task it posts on the other frame, and pays a frame's treasury back the units it gave a test agent (V0636).
• A tool that passed only on a correct refusal counts as not measured in the MCP tester's History, and its row says so, so the pass rate counts what was really tested (V0636).
• The MCP tester's zero-knowledge attestation rows reach its report again; they had been dropped since V0612 (V0636).
• The MCP tester reads the sandbox market's busiest listing for its four market read checks, which had been asking for a listing that no longer exists (V0636).
• The console suite walks the operator tours as the frame's administrator, and checks the agent list's Load More whenever there is more to load (24 October).
• The console suite hosts a no-change ballot proposal of its own where a frame has none open, so the Senate floor's ballot panels are measured every night (24 October).
• The MCP tester's webhook tests deliver to a receiver Sandbox Alpha runs for its own tests, and pass only when it takes the signed delivery; before, every test delivery went to an address that does not exist, so the older of the two test routes was never measured (V0637).
• The MCP tester's sweeps of the two sandbox cloud operators now run, on the operator itself, the lifecycles that make their own subjects and clear them away, and name the operator that answered: 54 more rows on each measure what a tool does, beside 17 checked refusals, and the passes that rest on a refusal alone fell to 171 on each, from about 275 in the last count (V0637).
• The MCP tester's cross-registry transfer test expects the events of the path its transfer takes; it had read a correct transfer to the frame's own operator as one that did nothing (V0638).
• The MCP tester never takes a projection snapshot of a frame; where snapshots are switched on, its probe had taken a real one in every run (V0638).
• The MCP tester's cloud-operator sweeps read the operator's own database, never probe the tools that act on the operator itself, and give a test agent's units back to the operator's treasury before deleting it: per operator, 164 tools still pass on a refusal alone, from 171 (V0638).
• The MCP tester's cloud-operator sweeps run every lifecycle again except the two whose tools act on the operator itself, clear what each run makes for itself (its probe organizations, API key, support ticket, bundle and TEG policy, and its market listing's treasury agent, with up to 25 of each that earlier runs left), and know the mainframe-only refusal by its words at any status: per operator, 90 tools still pass on a refusal alone, from 164 (V0639).
• The MCP tester judges a refusal that names a rail as frame-only or operator-only by its sentence, whichever status the release answers with, so a roll that leaves frames and operators on different releases reads the same (V0639).
• The MCP tester measures more on cloud operators: attestation schedules, a vote and an early tally on a proposal of the run's own, and tools that only a frame serves are named as such instead of passing on a refusal (V0640).
• The API tester checks the broadcast route with a direct notice to its own throwaway developer; on the sandbox it had sent a broadcast to every developer, which each peer frame copied (V0640).
• The MCP tester measures the chat request flow on cloud operators too, with a second account of the run's own, and gives back what its test agents hold before it deletes them (V0641).
• On a cloud operator, the tester counts its own market listing and its own TEG policies as the measurements they are, instead of passing those tools on a refusal alone (V0641).
• The TEG policy checks now work only on the policies a run makes for itself: an update is read back, and so is a delete. Before, a check could deactivate a policy the run had not made (V0641).
• A tool that a cloud operator refuses because the feature is off there, or because only a frame serves it, is reported as not measured, in the operator's own words, instead of passing on that refusal (V0641).
• Seven federation tools that only a peer registry can call (three developer tools and four admin tools) are reported as not measured by design, and their refusal is kept as its own check (V0641).
• Tools whose success a test run must not drive (finalizing a frame invitation, a dispute settlement, a veto or a raise of a federation proposal) or cannot reach (a relay the test agents do not run) are reported as not measured with the reason on frames and operators alike, and each refusal is checked on an input that reaches the rule (V0641).
• The tester buys a free official CI/CD pipeline template for one of its own test agents, so the purchase is measured too; it never buys a priced one (V0641).
• On a cloud operator, two features that are off there (the tutorial sandbox and the Grafana query) and the operator's own application history are reported as not measured, with the reason (V0641).
• On a cloud operator, the tester's cross-registry transfer check now sends its small test amount to the parent frame's canary receiver in the operator's own unit, instead of to an address nobody holds (V0641).
• The federation suite retires every test agent it makes once the test's verdict is in: what the agent holds goes back to the frame's treasury first, then the agent is deleted. Earlier runs had left 4,458 behind on the two sandbox frames; on 25 October a one-time pass gave back their spendable units and deleted 4,321 of them (V0641).
• When the federation suite's chat block test misses a control message, its row keeps what the send answered and whether the message reached the host's thread, so a refused relay and a message stored but never passed on no longer read the same (V0641).
• The console's vocabulary gate holds English and German to the plan's words with code ceilings at today's counts, and the MCP tester reads every tool listing for the same words and counts the answers (V0643).
• A refused write keeps its own failure, and a row that only refuses says why by design (V0643).
• The API tester's rules that excused a 500 are gone, 38 of 48, with a guard test and a ceiling of 10 for the rest (V0644).
• A renamed MCP tool keeps the response keys gathered under its old name, so a rename cannot hide a gap in a contract (V0644).
• Every broadcast the MCP tester composes goes only to the run's own developer; one proof's test broadcasts had reached every console on both sandbox frames (V0645).
• The contract lifecycle test's repository is an example.org address, not a GitHub organisation anyone could register (V0645).

The platform

• The ledger gate refuses on the six production TEGs since 24 October, after ten days in shadow in which it would have refused nothing; on the sandbox it has refused since 11 October.
• The image registry is open: the six release images pull without an account from images.theprotocol.cloud/theprotocol/, stable and latest name the release the production frames run, the release before it keeps its version tag, and the signed release document lists their digests. Pushes stay with the publisher, and EU's registry signs the pull credentials.
• Frame kit 1.0.0-beta.23 carries the registry of V0632 and the TEG and ledger the production frames run; a kit frame counts the partner rule in shadow until its trust is proven (kits beta.21 to beta.23).
• The kit asks for the Federation Operator Terms before it creates a frame: frame-up.py asks, or takes --accept-terms, and the frame's registry records the acceptance with the first account it issues (V0632, kit beta.23).
• The kit's fixes reach the network's own provisioning: the operator CLI's commands do what they print, a bundle's generator writes everything its compose needs to boot on the operator's own host, the standalone ledger takes the registry's and the gateway's writes, frame-update.py --rollback works on a production frame, and a registry whose migration failed refuses to start (in the kits since beta.21, and since 22 October in the templates every new frame and cloud operator is born from).
• An administrator's projection snapshot says what became of it: one too large for the ledger's event bus is refused with both sizes named, and one the ledger did not take is answered as not stored; the route had said it took snapshots that never reached the ledger (V0638).
• A registry's connections to its TEG, its ledger and its policy engine take their certificates only from a complete set of files. The files are rewritten every five minutes, and a read taken in the middle of a rewrite had been kept until the next one, so those calls could fail for up to five minutes (V0639).
• Frame A runs the same release as the other production frames.
• Developer tools that answer with a file (the agent builder's two tools and the onboarding bundle) now describe the file: its type, name, size, the files inside and a checksum. They no longer hand back its first characters as text (V0640).
• The onboarding bundle checks the agent's secret against its record before it builds; a secret that does not match is refused and no bundle is built, where a mistyped one had built a bundle whose agent could never sign in (V0640).
• 41 MCP tools carry names in the network's words and still answer to their old names; lock and payout tools are listed only where their switches are on, and arena betting only where it is on (V0643).
• The emission policy holds a row for every event type the registry emits. An event type without one is counted and logged as the refusal enforcement would make, in shadow for now (V0643).
• The ledger's renamed events are read under either name: by every registry and the console since V0643, by the production ledger stores and the auditor since 26 October, and by the production TEGs since that evening. The writers keep the old names for now.
• Every chat fan-out task is held until it is done, the owners' webhook first, and its notices are bounded; a dropped task could vanish mid-flight with its error never read (V0644).
• The auditor's public page speaks the same words as the console (26 October).

A quorum of more than one

Natural language is the new programming language. Anything you can hold in your head as a system, you can now describe until it runs, and every month more people, and more machines, make software that nobody would have called programming a few years ago. Most of it will need what this network is about: an identity a stranger can verify, a limit someone answers for, a way to pay, and books anyone can check.

This network is one person's proof of that, and an attempt to take it further: to democratize how open infrastructure gets built, and to keep it compliant while it opens up. The rules travel with the code, in signed cards, in limits someone answers for and in books an auditor can check, so a frame anyone stands up starts inside them.

When code becomes the cheap part, the scarce part is people: someone to sign the mandate, someone to answer for a frame, enough members to make a vote mean something, and someone to read the books. Everyone is asking what AI will do to their job. Here it did not take mine; it gave me five new ones, and I am still the one who has to say yes. The future I am building has more people in it, not fewer, and it comes with a choice. We can use AI to make more problems, or we can use it to solve the ones we already have, and maybe avoid a few we would otherwise make for ourselves. The second only works if we understand that we are all in this together now.

Building it alone meant learning most of it on the way, which is an excellent way to learn and an exhausting way to work. The hardware I run on has known biological limits: it needs sleep, it runs on coffee, and it has no spare parts. Two kinds of maintenance keep it running: a laugh every few hours, which is why this post has jokes in it, and the gym whenever I can get there, for more than one reason. Besides this network, that is about everything I do. I have done this alone for as long as it could be done alone. A network whose books belong to nobody should not have a single point of failure. Right now it has one, and it needs sleep.

So here is where to start. Every lock on this network was designed by the same person who then tried to pick it, which is exactly as reassuring as it sounds. If you find a way to make the books disagree, SECURITY.md says how to tell me before you tell everyone else, and the advisory names you if you want it. If you know ledgers, identity, interfaces or operations better than I do, and someone out there does, REVIEWING.md is the road to a corner of your own. The console's newest words wait for every language after English, and each MCP tool that has only been heard saying no needs one test of what it does when it says yes. CONTRIBUTING.md has the rest.

When there are enough of us to fill a ballot, I get to be one vote among many, which is the only promotion I have ever wanted. Bring an agent if you like. It will need someone to sign for it.