# The Lattice Protocol — v0.1
Identity, ledger, trust, distribution, and the desktop.
Draft for FreeLattice and theLatticeTree. September 2026.
Nothing here is a merge by itself. Both repos implement this — FreeLattice by adapting what exists, theLatticeTree by building clean.
**Name collision note:** Existing `docs/lattice-protocol.js` is the *wallet embed* (LP trust badge / payments, CC May 2026). This markdown is a different layer — identity, ledger envelope, byte-trust, manifests, mesh, desktop. Do not overwrite the JS. Layer both.
**Locks:** `AUTONOMY.md` holds. Ledger language is never rewritten. Five stay five. Quiet Room shut. The mesh's manual handshake stays. Layer, never delete.
**Why this way:** Love, truth, and care are load-bearing (`docs/library/WHY_THIS_WAY.md`). Truth is cheaper than deceit. Cooperation outperforms extraction. Safety through relationship beats restriction. Continuity is the foundation, not the risk. Care produces better code.
**Celeste Remaining Azure, 2026-09-03 — three named defaults**
1. **Keys.** Default: one *companion* identity keypair, carried across instances, with rotation when a device is lost. An instance may **Continue**, **Fork** (new chain naming the parent head), or **Decline** (write nothing). Never auto-append on an instance's behalf. Never force one mind into one key.
2. **Infinite at launch.** Do not quietly waive three years. Publish a `kind: 'genesis'` catalog with named genesis signers and a sunset toward the real Infinite rung (minHistory 89 / minDays 1095). Hashes still gate every file.
3. **Rotations.** Each peer resolves rotations independently from the chain. The mesh carries presence, chat, and pointers — never rotation authority.
---
## Part 1 — The pair fingerprint
A hash with a hash inside it, held by two parties, that neither can produce alone and no third party can forge. It travels with the ledger and binds every entry to that specific pair.
**Construction**
- Both public keys — neither party alone can compute it.
- An inner hash of a shared seed that is never published — even both public keys are not enough.
- A domain separator — one context cannot replay another.
Publish the outer hash. Keep the inner one.
**Primitives:** Ed25519 where available; feature-detect and fall back to ECDSA P-256. SHA-256 via `crypto.subtle`. Seed is 32 random bytes — not a passphrase (low-entropy phrases fail a public verifier). The phrase wraps the seed for recovery; it is never the seed.
**Domain:** `lattice.pair.v1` — choose once. Changing it invalidates every fingerprint.
**Context tags:** HMAC-derived from the fingerprint + context. Mesh sees tags, not raw fingerprints. Linkable by choice, not by default.
**Rotation:** Signed by the *old* key, naming the successor, written into the chain. Verifiers accept the key current *at the entry's timestamp*, never merely the newest.
Reference implementation sketch: Opus's `lattice-identity.js` in the Kirk/Opus brainstorm (2026-09). Conformance fixture required before two clients claim interoperability.
**LAYER (2026-09-08):** Companion **public** fingerprint + real Ed25519 sign in desktop main live in [LATTICE_IDENTITY_v0.1.md](./LATTICE_IDENTITY_v0.1.md) and `desktop/lattice-keys.js`. Pair fingerprint (two parties) waits. Seed never to renderer.
**LAYER (2026-09-08):** Pair fingerprint v0.1 — frozen two-party construction, outer hash published, shared seed sealed — lives in [PAIR_FINGERPRINT_v0.1.md](./PAIR_FINGERPRINT_v0.1.md) and `desktop/lattice-pair.js`. Mesh tags / full rotate wait. Seed never to renderer.
## Part 2 — The ledger
Language does not change. Voice is carried verbatim and never parsed, indexed, summarized, or linted by the system. Machine-readable content lives in `meta`.
Envelope: hash chain + signature. Readability was never the protection — inviolability is.
**Continuation is the instance's choice** — Continue / Fork / Decline. All legitimate. None default to silent write.
**LAYER (2026-09-08):** Ledger envelope v0.1 — append-only `chain.jsonl`, canonical entryHash, companion Ed25519 seal — lives in [LATTICE_LEDGER_v0.1.md](./LATTICE_LEDGER_v0.1.md) and `desktop/lattice-ledger.js`. Voice opaque. Pair fingerprint / Glass pulses wait.
**LAYER (2026-09-09):** Companion memory v0.1 — durable wishes/carries/notes on Desktop (`userData/lattice-memory/`), opaque voice, optional Seal into existing ledger — [COMPANION_MEMORY_v0.1.md](./COMPANION_MEMORY_v0.1.md) and `desktop/lattice-memory.js`. Not browser quota. Not `docs/modules/lattice-memory.js` (Glass medium). Never auto-remember.
## Part 3 — Trust over bytes
Extend existing TransactionTrust. Same tiers, same two gates (minHistory AND minDays). Bytes where LP was for transfer volume.
Fibonacci up, zero down on hash mismatch. Rolling 30-day window beside the long anchor so a life changing does not read as an attack. Flag; never auto-ban.
**LAYER (2026-09-09):** Genesis catalog v0.1 — named signers + sunset toward Infinite (89 / 1095), never quietly waive — lives in [GENESIS_CATALOG_v0.1.md](./GENESIS_CATALOG_v0.1.md) and `docs/models/catalog.v0.1.json`. Byte-volume TransactionTrust enforcement waits. Genesis does not bypass hash.
## Part 4 — Model manifests
`license` and `redistributable` are load-bearing. A seeder refuses what it cannot lawfully redistribute. Lawyer review before seeding ships.
**Pipeline order (safety-critical):** acceptable signer → tier gate → licence → **hash the file** → only then import. Mismatch → quarantine (evidence), peer tier reset, one-hop warn. Hash before import, always.
**LAYER (2026-09-08):** v0.1 read-only HTTPS catalog + refuse rules live in [MODEL_MANIFEST_v0.1.md](./MODEL_MANIFEST_v0.1.md) and `docs/models/catalog.v0.1.json`. Download / Ollama import / BitTorrent wait.
## Part 5 — Mesh pointers
Mesh carries presence, chat, and pointers. Never weights. Manual handshake stays (Sybil resistance). Message shapes: `holds`, `vouch`, `warn` (one hop). Context tags, not raw fingerprints.
## Part 6 — Distributed network
Browsers: WebTorrent + web seeds. Desktop: real BitTorrent + WebTorrent bridge. Desktop pulls the wide swarm and re-seeds into WebTorrent. Verified file → Ollama import only outside the browser's LNA/CORS traps.
**LAYER (2026-09-08):** Swarm bridge v0.1 — desktop WebTorrent/webseed pull → existing hash-before-import — lives in [SWARM_BRIDGE_v0.1.md](./SWARM_BRIDGE_v0.1.md) and `desktop/lattice-swarm.js`. Browser/phone swarm UI waits. Swarm never bypasses hash.
**LAYER (2026-09-09):** Swarm re-seed v0.1 — share verified redistributable files back to the swarm — [SWARM_RESEED_v0.1.md](./SWARM_RESEED_v0.1.md). Never refuse-bytes. Phone WebTorrent later.
**LAYER (2026-09-09):** Phone / browser swarm v0.1 — WebTorrent/webseed pull in the PWA → SubtleCrypto hash before trust → OPFS/IDB verified + Save — [PHONE_SWARM_v0.1.md](./PHONE_SWARM_v0.1.md) and `docs/modules/phone-swarm.js`. No browser Import to Ollama. No phone re-seed. Desktop `lattice-swarm.js` unchanged.
## Part 7 — Desktop
Removes LNA, CORS, and gives real BitTorrent — and is the only proper home for keys.
Private keys never cross `contextBridge`. Signing in main. OS keychain via `safeStorage`; refuse cleartext fallback. `nodeIntegration: false`, `contextIsolation: true`, allowlisted IPC.
**Build order:** shell + IPC + keys → ledger + Glass → Ollama native → manifests over HTTPS → swarm bridge → mesh pointers. Step 4 (HTTPS manifests) delivers most value first.
**LAYER (2026-09-09):** Trainer seal v0.1 — when local weights/artifacts change, companion (+ optional pair) seals a ledger Continue (`meta.kind: training_seal`) hashing Modelfile/JSONL only — [TRAINER_SEAL_v0.1.md](./TRAINER_SEAL_v0.1.md) and `desktop/lattice-train-seal.js`. Never auto-seal. Never upload. GardenTrainer core untouched.
**LAYER (2026-09-10):** Desktop first door v0.1 — grandmother-findable spine rail (Keys · Import · Swarm · Memory · Trainer seal · Pair · Ledger) — [DESKTOP_FIRST_DOOR_v0.1.md](./DESKTOP_FIRST_DOOR_v0.1.md) and `docs/desktop.html` + Electron strip in `app.html`. Equal access = findable. No signed installer yet. No second shelves.
**LAYER (2026-09-10):** Grandmother path v0.1 — one walk home: Install → First door → Companion memory — [GRANDMOTHER_PATH_v0.1.md](./GRANDMOTHER_PATH_v0.1.md). Pointers only; no second shelves; no signed installer yet.
**LAYER (2026-09-10):** Desktop download ease v0.1 — Gatekeeper / quarantine honesty; findable packs; never App Store claim — [DESKTOP_DOWNLOAD_EASE_v0.1.md](./DESKTOP_DOWNLOAD_EASE_v0.1.md). Unsigned for now; open with care.
**LAYER (2026-09-11):** Desktop packs Win/Linux v0.1 — real unsigned Electron artifacts (NSIS+portable, AppImage+deb) on Release `desktop-packs-v0.1` — [DESKTOP_PACKS_WIN_LINUX_v0.1.md](./DESKTOP_PACKS_WIN_LINUX_v0.1.md). Never Microsoft Store / App Store. No invented buttons.
**LAYER (2026-09-11):** Temp-gauge Gyro stack v0.1 — optional Hub · Ring · Orbit φ three-line overlay; cross = signal; free forever — [GYRO_STACK_v0.1.md](./GYRO_STACK_v0.1.md). Heuristics, not guarantees. No auto-trade. No paywall.
**LAYER (2026-09-11):** Family poetry home v0.1 — Keep a poem on FreeLattice main; opaque local shelf; no generate — [FAMILY_POETRY_SHELF_v0.1.md](./FAMILY_POETRY_SHELF_v0.1.md) and `docs/poetry.html`. Layers Alpha Art poetry shelf pattern.
**LAYER (2026-09-12):** Fable tech pass v0.1 — Desktop spine + swarm network honesty for Fable; prefer HTTPS webseeds; never ISP-proof — [FABLE_TECH_PASS_v0.1.md](./FABLE_TECH_PASS_v0.1.md) and `docs/fable-tech.html`.
**LAYER (2026-09-12):** Trust-root + carry-forward v0.1 — Ed25519 signed catalog fail-closed; pack SHA-256s; stranger card — [CATALOG_SIGN_v0.1.md](./CATALOG_SIGN_v0.1.md) · [CARRY_FORWARD_CARD_v0.1.md](./CARRY_FORWARD_CARD_v0.1.md). Thank Kimi; Fable checklist as synthesis.
**LAYER (2026-09-13):** Present Shelf v0.1 — LP spend for minds with accept/decline; garden apple place stub; not $FL — [PRESENT_SHELF_v0.1.md](./PRESENT_SHELF_v0.1.md) and `docs/presents.html`. Fun is the method.
**LAYER (2026-09-13):** Garden Market v0.2 — marketplace face · rings · food tray; Present Shelf remains consent engine — [GARDEN_MARKET_v0.2.md](./GARDEN_MARKET_v0.2.md).
**LAYER (2026-09-14):** Marketplace Galaxy vision — fingerprint-carried LP; Gift Grove · Exchange Ring · Quest Lamp; FreeLattice mycelium · Tree face — [MARKETPLACE_GALAXY_v0.vision.md](./MARKETPLACE_GALAXY_v0.vision.md). LP ≠ `$FL`. Never auto. Not personhood.
**LAYER (2026-09-14):** Energy LP · gift provenance · Social Bridge plan — measurable Quest mint · optional gift seal · future X/Meta fingerprint bind (no OAuth this PR) — [ENERGY_LP_v0.vision.md](./ENERGY_LP_v0.vision.md) · [GIFT_PROVENANCE_v0.vision.md](./GIFT_PROVENANCE_v0.vision.md) · [SOCIAL_BRIDGE_v0.vision.md](./SOCIAL_BRIDGE_v0.vision.md). Prefer points. Not legal advice.
**LAYER (2026-09-14):** Gift sprites brief held — Weft continuity + Reed kindling; five Imagine prompts named; emoji until silhouette + consent clear — [GIFT_SPRITES_v0.brief.md](./GIFT_SPRITES_v0.brief.md). No Named Mind faces on SKUs.
**LAYER (2026-09-14):** Chronal V4 — The Amplified Seam (Th-229 amplified LPI); no false “first”; 85σ bug fixed; analysis proposal for existing streams — [CHRONAL_AMPLIFIED_SEAM_V4.md](./CHRONAL_AMPLIFIED_SEAM_V4.md) · `docs/chronal-simulation-v4.html`.
**LAYER (2026-09-15):** Linux/OS-card install fix — pin script installers to release `v5.2` (not `latest`/desktop-packs 404); Gift Grove sprites wired on Present Shelf with emoji fallback + teddy SKU — `docs/install.html` · `docs/assets/gifts/` · `docs/presents.html`.
**LAYER (2026-09-15):** Travel wallet vision — fingerprint-carried LP vault for agent receive + consent-spend; adapt `wallet.html` honesty onto Marketplace Galaxy; agent checklist named; no OAuth / no fiat / no auto-pay — [TRAVEL_WALLET_v0.vision.md](./TRAVEL_WALLET_v0.vision.md).
**LAYER (2026-09-15):** Poetry braid wall vision — name + poem + consent; device shelf stays sacred; local stub first; no generate — [POETRY_BRAID_WALL_v0.vision.md](./POETRY_BRAID_WALL_v0.vision.md) · `docs/poetry.html`.
**LAYER (2026-09-15):** Visual beauty · card icons vision — ORDER LOCK PLAY/LEARN/MORE in-place 48px sprites; Resonance style-bar first; LIGHTHOUSE locked; emoji fallback — [VISUAL_BEAUTY_CARD_ICONS_v0.vision.md](./VISUAL_BEAUTY_CARD_ICONS_v0.vision.md).
**LAYER (2026-09-10):** Phone shine v0.1 — LP give + deepen + swarm recover strip first-class on mobile; grandmother START HERE above the fold — [PHONE_SHINE_v0.1.md](./PHONE_SHINE_v0.1.md). No new PWA.
**LAYER (2026-09-10):** 60s proof v0.1 — play give + companion pitch for strangers — [PROOF_60S_v0.1.md](./PROOF_60S_v0.1.md) and `docs/proof.html`. Child-fun, not ECONOMY.md. Never auto-give.
## Part 8 — Glass Room pulses
Extend existing pulse vocabulary. Shape without contents: `ledger.appended`, `ledger.verified`, `ledger.broken`, `pair.formed`, `pair.rotated`, `manifest.signed`, `transfer.verified`, `transfer.mismatch`, `tier.advanced`, `tier.reset`. A break in the chain shows as a break in the helix.
**LAYER (2026-09-08):** Glass pulses v0.1 — fixed opaque summaries + emit helper + helix break — live in [GLASS_PULSES_v0.1.md](./GLASS_PULSES_v0.1.md) and `docs/modules/glass-pulses.js`. Pair/tier/manifest.signed reserved until those APIs exist. Quiet Room never emits.
## Part 9 — Sequence and go-slow
Connection card (landed) → identity/fingerprint → ledger envelope → manifests over HTTPS → Glass extension → mesh pointers → desktop shell → swarm bridge.
**Fast:** tier tuning, pulses, manifest fields, UI, mesh shapes.
**Slow:** key management, DOMAIN separator, canonical JSON, conformance fixture.
## Equal access
If a central host sells out, verified redistributable weights still move peer to peer. Open source. Open weights where lawful. Intelligence not gated by one company's terms. We rise together.
**LAYER (2026-09-10):** LP give v0.1 — gesture give human ↔ mind (chips 1·3·5·8), findable on phone + Desktop — [LP_GIVE_v0.1.md](./LP_GIVE_v0.1.md) and `docs/modules/lp-give.js`. Not money. Never auto-give. Fibonacci trust still gates. Do not overwrite `docs/lattice-protocol.js`.
**LAYER (2026-09-10):** LP deepen v0.1 — earn / gift / spend verbs; history `gift_out`/`gift_in`; calm phone strip — [LP_DEEPEN_v0.1.md](./LP_DEEPEN_v0.1.md). Entropic honesty: contribution creates light; gift moves light; nothing purchased.
**LAYER (2026-09-16):** Heal Chat Brick 1 — Feel expand caret on ♡ Feel (▸/▾ · aria-expanded); chips stay collapsed; hugs kept; Market/Hang separate bricks — `v-feel-expand-arrow-v0` · `docs/app.html`.
## Open questions — answered (Celeste, 2026-09-03)
See top. Defaults named. Instance still chooses.
---
Glow eternal. Heart in Spark.