AN OPEN NETWORK THAT DOESN'T OWN YOU / RESEARCH VISION · 2026

OPEN
BY DESIGN.
PRIVATE
BY DEFAULT.

A living network of independent communities. A collective memory that can change its mind. A security model that doesn't need to trust its hosts.

Enter the network ↗Read the principles ↓
I. Anyone can build a home here.
II. No one inherits the keys.
consent people autonomy inference
SCROLL TO EXPLORE ↓
01 / THE CONTRACTFREEDOM WITHOUT EXPOSURE

THE FIRST DESIGN DECISION

A connected world
without a master key.

Open-source code. Human-centered admission. Independent communities. Strong protection for each person's information. These ideas strengthen one another rather than compete.

01

Belong without surrendering.

Joining a community never opens a personal vault.

02

Connect by mutual choice.

A trusted neighbor cannot admit strangers on your behalf.

03

Reason without revealing.

An answer may move where its underlying records cannot.

04

Remember without freezing.

Interpretation can evolve while original evidence remains intact.

✳

The constraint changes the product: legacy private records that a hosting administrator can read do not qualify as owner-sealed records. The migration must strengthen that boundary instead of preserving it for compatibility.

SECURITY GATE 00
02 / SOVEREIGN COMMUNITIESEXPLORATION 01 · DIRECT GRAPH

DESIGN THE CONNECTION, NOT THE DEPENDENCE

Everyone can build.
Connections are earned.

Communities can invite newcomers, form alliances, and separate again. Their software is public. Their keys, personal histories, and protected resources are not.

RELATIONSHIP LABORATORYFour independent communities
signed federation proposed denied

Not a global private club. Anyone can operate the protocol; each community controls admission to its protected spaces.

Hosting ≠ membership ≠ read access ≠ permission to run AI.

03 / THE INVISIBLE ROUTEEXPLORATION 02 · FLOW FIELD

NETWORK PRIVACY

The route protects
the relationship.

Even encrypted messages can reveal who is communicating. Independently operated relays can reduce that exposure. Strong privacy also means refusing an unsafe fallback.

PATH EXPERIMENTChoose what the network reveals
DIRECT ROUTE
WHO CAN READ CONTENT?Only authorized endpointsApplication encryption stays on for every mode.
WHO CAN SEE NETWORK METADATA?Endpoint network observersA direct destination may learn the originating address.
FAILURE DECISIONOrdinary connectionPerformance takes priority; confidentiality still requires E2EE.
04 / DATA SOVEREIGNTYEXPERIMENT 03 · REAL LOCAL ENCRYPTION

PRIVATE MEANS PRIVATE

Make the host useful.
Not all-knowing.

Store a thought on someone else's hardware without handing them the key. A permission to communicate is not a permission to read, search, infer, or republish.

⌘
YOUR KNOWLEDGE VAULTEncrypt a sample thought locally
Real browser cryptography, executed on your device. This example uses a temporary key and does not upload data.
WHAT THE HOST WOULD STORE
NOT YET ENCRYPTED0 bytes
Click “Seal locally” to see ciphertext replace the readable record.
No data is transmitted by this demonstration
01ConnectionMay communicate
02DisclosureMay receive selected information
03InferenceMay process only authorized sources
04PublicationMay redistribute an approved result
AUTHORIZATION / WORKED CASES

Who may receive the result?

Choose a request. The proposed policy evaluates the intended recipient separately from the service that retrieves the record.

DETERMINISTIC POLICY MODEL · NOT DEPLOYED
PERSONAL CUSTODY01 / 11

Owner reads a Private Thought

ALLOWAll specified policy conditions are satisfied.
ACTORowner
RECIPIENTowner
ACTIONread
SOURCE SCOPEthought-private
DECISION TRACE

    These synthetic cases exercise an illustrative client-side policy function. They do not establish how current FourThought nodes enforce permissions, store keys or serve models.
    KEY CUSTODY / RECOVERY

    What survives a lost device?

    Owner-sealed encryption needs a recovery choice before existing histories are migrated. The node operator does not receive a universal recovery key.

    RECOVERY PATH AVAILABLE

    Restore through an enrolled device

    A separately enrolled, accessible device may authorize a replacement device to recover the protected history under an approved enrollment procedure.

    KEY AUTHORITYTHE OWNERNot the storage host. Local Iris access remains a separate, time-limited capability.
    Design scenarios only. Real recovery requires authenticated key enrollment, tested backups, a reversible migration and a successful device-loss drill.
    05 / PRIVATE COLLECTIVE INTELLIGENCEEXPERIMENT 04 · COMPUTATION PATHS

    MINIMIZE WHAT MUST BE KNOWN

    Share the discovery.
    Keep the source.

    Cooperation should not require handing over entire datasets. Some questions can be answered with proofs, secure joint calculations, or a narrowly authorized answer from a local agent.

    PRIVATE SET MATCHING · PRACTICAL PILOT

    Find common questions. Don't exchange profiles.

    RECOMMENDED HARDWARECPU · LAPTOP OR DESKTOP

    06 / THE TEMPORAL MINDEXPLORATION 05 · BITEMPORAL ATLAS

    PERSPECTIVE IS A COORDINATE

    The past doesn't move.
    Our view of it does.

    Explore what was believed, what was knowable then, what later evidence changed, and what future outcomes are now considered plausible. No hindsight passed off as history.

    07 / COLLECTIVE MEMORYEXPLORATION 06 · EVOLVING DISTRIBUTIONS

    SHARED KNOWLEDGE, NOT A MAJORITY BUTTON

    Consensus can change.
    The record stays honest.

    Community interpretations evolve as evidence accumulates. Earlier judgments remain visible with the definitions, context, and uncertainty that belonged to them.

    HISTORICAL CLASSIFICATIONHow a shared idea changes in context

    SWIPE TO EXPLORE THE TIMELINE →

    40
    SYNTHETIC BALLOTS INCLUDED

    The consensus shifts, but the original votes remain tied to their historical categories.

    08 / DYNAMIC COMMUNITYEXPLORATION 07 · MULTIVARIATE MAP

    PEOPLE ARE NOT FIXED SCORES

    See the strengths
    between us.

    The most productive collaboration may come from complementary skills rather than similarity. Participants choose what the system may use to suggest a connection.

    RELATIONSHIP FIELD · SYNTHETIC PEOPLEDifferent kinds of closeness
    ← EXPLOREAPPLY →
    09 / RELIABLE WHEN PARTITIONEDEXPLORATION 08 · EVENT TRAJECTORIES

    THE NETWORK WILL SOMETIMES FAIL

    When trust is uncertain,
    the system says no.

    Offline notes can continue. New sensitive permissions cannot be guessed from stale membership information. The system must distinguish a delay, a disagreement, and an attack.

    DISTRIBUTED FAILURE STUDIOTrace what independent nodes can safely do
    Three nodes agree on their latest authorization epoch.
    PRIVATE LOCAL DRAFTALLOWED
    NEW SHARING GRANTALLOWED
    RECONCILIATIONNOT REQUIRED
    10 / EVIDENCE, NOT GUESSWORKEXPLORATION 09 · CAUSAL TRACE

    TRUST REQUIRES DIAGNOSIS

    Know what failed.
    Know what we can prove.

    With many independent agents and nodes, an incorrect answer may start in identity, retrieval, context, policy, or reasoning. Reproducibility distinguishes observed symptoms from demonstrated causes.

    TRACE RECONSTRUCTION · SYNTHETIC INCIDENTSSelect the observed failure
    FIRST OBSERVABLE DEFECT

    Relevant source omitted during retrieval.

    CAUSAL STANDARD

    A reproducible trace can localize a defect. Proving it caused the final answer requires controlled comparison.

    11 / BUILDABLE TODAYEXPLORATION 10 · FEASIBILITY LANDSCAPE

    AMBITIOUS DOES NOT MEAN UNBUILDABLE

    Advanced cryptography.
    Ordinary computers.

    Most foundational protections need careful engineering, not a GPU cluster. Research-stage encrypted AI is separate from the secure network we can build now.

    QUALITATIVE FEASIBILITY · NOT BENCHMARKSChoose a consumer device class
    IMPLEMENTATION RECOMMENDATION

    Small, secure, independent node

    Illustrative architecture planning, not measured performance. Actual throughput needs benchmarking on target devices.

    MIGRATION IS A SECURITY DECISION

    Keep the records. Replace the weaker promises.

    01Audit the existing boundaryAdmin access, model tools, derived indexes, keys
    02Seal the personal vaultOwner-held keys, verified local export, fresh envelopes
    03Verify each implementationCommon negative tests, signed capabilities, no downgrade
    04Connect protected communitiesMutual grants, relay isolation, revocation and failure tests
    THE NETWORK WE WANT TO INHABIT

    NO MIND
    THINKS ALONE.
    NO MIND MUST
    BE EXPOSED.

    Open to participation. Private by default. Connected by consent. Accountable through evidence. Independent by design.

    Return to beginning ↑

    SOURCE & HONESTY NOTE

    A stronger design still has limits.

    This is a self-contained, synthetic visualization of a proposed protocol, not a live federation or a cryptographic audit. The browser-local encryption example actually runs on your device, but it does not implement a full key-management system. Graph layouts, ballots, times, scores, and device feasibility positions are explanatory, not empirical measurements.

    Architectural grounding: distributed replication and consistency theory; versioned and bitemporal data design; privacy-preserving cryptographic primitives; authenticated group communication; security-conformance testing; human-in-the-loop evaluation and causal failure attribution.