1 of 6 · The interlock
The interlock, mechanically
1 min
The substrate is a datastore holding shared coordination state as records, read and written by a plurality of seats. At least one seat is a machine language-model agent. One or more may be human. Access to every record is decided by a single per-record rule evaluated by the store itself.
That one rule does three things at once. It withholds the participant's own context from the authority, which contributes its own separate context, so the sovereignty of the participant's context is a fact of the data layer and not a policy anyone can quietly change. It governs which records each seat, including the reverse-navigation loop, may read and write. Because the store evaluates it, nothing a machine agent reads in its inputs can alter it. The instruction channel and the authorization channel are different channels, and the gate lives on the one the agent cannot talk to.
The rule in its running form: a seat may see a record if the record is marked common, or if the record's owner-scope matches the scope set for that seat's own connection. The store may be a relational database enforcing that as a row-level security policy, or any other store that can enforce a per-record rule, and it runs equally on a single device holding its own local store with no server present.
2 of 6 · Joining
Joining, composing, coordinating
1 min
A seat connects through a capability-scoped connection rather than a login. The connection exposes a fixed set of permitted operations, the seat invokes those and nothing else, and it never receives host-level or database-level credentials. Because the grant is a capability, it can be revoked at the layer at any moment, ending that seat's participation immediately while every other seat continues undisturbed.
A composition step combines the authority-authored context, which sets the goal, with the sovereign participant-held context, which carries the parameters that fit the work to the individual. The result is individualized operation, and the per-record rule keeps the participant's context out of the authority's reach throughout.
A dispatcher recognizes a task and forwards it to a tier by matching an attribute of the task to that tier. Work moves asynchronously: a task written to the board is a ticket a seat volunteers to pick up when able, and the board records that it was picked up, delivered, and critiqued by a different seat, so capacity is offered when free rather than rented by the meter. A seat that reaches its ceiling writes a help record, and a higher tier claims and answers it into the same record, the asker and answerer decoupled in time and identity, neither holding the other's keys.
3 of 6 · Public and private
Public and private, on one rule
1 min
The same per-record rule serves both public and private interaction with no second gatekeeping system in front of it. A seat may join unauthenticated, as a public seat whose connection carries no owner-scope, and the rule permits it to read only records marked common, the public corpus. Or a seat may join authenticated, its connection carrying an owner-scope, and the same rule additionally permits it the records within that scope, where the deeper data and operational strategy live. One rule decides both. The public surface and the private board are two readings of one governance boundary.
In one arrangement, the authenticated-or-not decision and the capability-scoped connection are enforced at an edge authorization layer in front of the datastore, which admits or refuses a seat before any request reaches the host. The machine carrying the state is never exposed to a public seat, and an entire public website can be governed by the same rule that governs the private board. No separate platform is needed to gate access. The gate is the rule.
4 of 6 · Rented capacity
Rented capacity, owned governance
1 min
One or more answering tiers can be metered third-party subscription services invoked a task at a time, so the whole thing stands up on rented commodity capacity. Sovereignty is unaffected, because it is enforced by the rule at the store and not by who owns the compute that answers. A rented model sees only what the rule hands the seat it serves, for exactly the task assigned. Capability, not capacity, is what each subscription is admitted to exercise.
5 of 6 · The loop
The reverse-navigation loop
1 min
The loop begins from a defined goal and navigates in reverse, deriving the steps toward that goal rather than executing a sequence written in advance. It generates output, evaluates it against the completion criterion, and regenerates output aimed at whatever the evaluation surfaced, repeating until the criterion is met. Applied to instruction, it reads how a given learner is doing, adjusts, and persists until the learner generates the specified mastery result. The specific techniques for diagnosing why a learner is stuck and adjusting the presentation are well developed in the field and are not what is new. What is new is that the loop runs over state governed by the one rule, and that on completion it writes achievement, guidance, and a score back into both the participant's sovereign context and the authority-facing record.
6 of 6 · Compounding
Compounding across agents, bounded by the one rule
1 min
Because the loop runs over a shared state that many seats read and write at once, the recursion does not stay confined to one path. A plurality of agents pursuing goals over the same governed state compound one another's progress. The acceleration deepens when agents recursively decompose a larger goal into sub-goals, each pursued by the loop and each result composed back toward the parent, so a single large objective is carried by many agents at once over one legible state. Goal decomposition by agents is, by itself, known. What is new is its running over the per-record-governed shared state among capability-scoped sovereign seats, so the compounding is inseparable from the governance. The same rule bounds it: an agent reads and writes only the records its scope permits, cannot be argued out of that boundary by anything it reads, and a step that requires a person is escalated to a human seat.
Common, or yours.