Build order
The ordering is the design decision, not an implementation detail. A registry holding one organisation's agents can be tested, broken, and thrown away. A global public one cannot — it is a commitment the day somebody depends on it.
A registry with one organisation's agents in it is testable; a global one is a commitment.
The order
The collection, organised by question
The material exists in depth — 729 files in the corpus mention the subject, with dedicated documents going back to February 2026: an architecture debrief, a messaging implementation, model-integration research, a document identity brief, operating modes, a provenance treatment, a brand strategy. So this is a publication and curation problem, organised by the question a reader arrives with rather than by date.
Status: queued — needs the corpus documents identifiedThe failure page
Short, useful, and independent of anything being built. The most linkable thing the site will have, and the evidence that what follows was designed with the history in hand.
Status: done — read itThe four rules, published before the registry exists
The registry's stated design, as claims that can be checked against whatever ships. Four sentences that answer the question a reader will have.
Status: done — read themA private registry, for our own agents
The smaller problem, and the one with a real user. Inside one organisation the trust root is not an open question, abuse is not an open question, and moderation is not an open question — which leaves the actual registry logic as the thing being tested.
Status: not started — the next buildMandate statements, separate from identity
Independently revocable signed statements about what an agent may do. The concept is published; the implementation follows the private registry, because a mandate with nowhere to live is a document.
Status: not startedA public registry — last
It inherits every hard problem of the private one, plus trust roots, abuse and moderation. It is also the memorable idea, which is exactly why it is the one to be disciplined about.
Status: not started — and deliberately behind step 4Step 4 before step 6 is the ordering that matters. Everything else can move.
What this does not try to be
| Not | Instead |
|---|---|
| A new key server | A registry designed from a documented failure, with different rules |
| Append-only in the way that failed | Append-only with the writer owning what it writes |
| Deletion-free | Revocation is a signed append, which supersedes without destroying |
| Automatically a web of trust | Third-party attestation is a deliberate choice with a known cost |
| Public first | Private first — testable before committed |
Honest tensions
Published because a design page that lists only what works is marketing:
| Tension | Note |
|---|---|
| Append-only as house pattern | It is right for channels and it is what destroyed the key servers. The ownership rule is the whole of what separates them, so it carries a great deal of weight for one sentence |
| Third-party attestation | What made the old system valuable and what made it attackable — and mandates may need it |
| Size bounds on records | They prevent the flooding attack, and they will one day reject a legitimate record |
| Fractal trust | Nesting is powerful and it requires every store to declare its roots, or the graph is unevaluable |
| Public registry | The memorable idea, carrying abuse, moderation and trust-root problems a private one does not |
| Reusing existing material | 729 documents is depth, and most of it will not appear on the site |
Open questions, published unresolved
| Question | Why it is still open |
|---|---|
| Does the registry accept third-party attestations? | The central design choice: a documented failure on one side, no social trust at all on the other |
| What is the size bound per record? | Generous enough to be invisible, small enough to stop flooding — and the number is not chosen |
| How is the binding between an agent and its key verified? | The replacement server used email; agents have no equivalent |
| Who may be a trust root? | A privileged decision needing a stated answer, even a simple one |
| Is a mandate a separate object from an identity? | It should be, since they revoke independently — but that is a position, not an implementation |
| What does an agent's identity attest to? | Which agent, running where, on whose authority, and how any of that is checked |