Principles

What 3P holds to. Each one rests on tests that fail if it stops being true, and the one that is not yet a promise says so.

These tests run on every change, before it is published. Numbers: evaluation page.

1. A protocol, not a platform

   A protocol, not a platform: open formats and shared test vectors that any implementation can check itself against.

   One implementation exists today, in Python and in the browser.

   The evidence

   Tests

   • test_vectors.Vectors.test_canonical_form_and_content_hash_are_fixed
   • test_chain_vectors.ChainVectors.test_every_case_is_judged_as_recorded
   • test_countersign_vectors.CountersignVectors.test_each_case
   • test_acts.Contract.test_every_fixture_behaves_as_labelled

2. Private by default

   Everything you write starts private.

   You open each entry yourself: per entry, per face, per audience.

   The evidence

   Tests

   • test_share.Selection.test_new_items_are_private_so_nothing_is_selected
   • test_capture_http.CaptureHTTP.test_an_entry_is_recorded_private_and_live
   • test_acts.Acts.test_an_import_arrives_private_and_round_trips
   • test_share.ReleaseRule.test_private_never_leaves_under_any_condition
   • test_share.ReleaseRule.test_trusted_needs_a_relationship_not_reciprocity
   • test_share.ReleaseRule.test_mutual_needs_reciprocity_not_a_relationship
   • test_share.Selection.test_only_the_scope_asked_for
   • test_two_nodes_meet.Meeting.test_only_the_offered_scope_at_the_offered_tiers_crosses

3. The mirror never leaves

   The mirror is yours alone. It never enters a card, an export, a meeting or an assistant's answer.

   The evidence

   Tests

   • test_delta_never_leaves.Canaries.test_packets_for_every_scope_and_tier
   • test_delta_never_leaves.Canaries.test_every_mcp_tool_with_the_widest_grant
   • test_delta_never_leaves.Canaries.test_meeting_packets
   • test_delta_never_leaves.Canaries.test_the_capture_export_and_the_node_export_archive
   • test_delta_never_leaves.Smuggling.test_the_signer_refuses_every_spelling_at_every_depth
   • test_authority.Authority.test_only_the_person_reads_their_own_delta
   • test_capture_http.CaptureHTTP.test_a_rebound_name_is_refused_even_with_the_token

4. The assistant is not you

   An assistant is not you. It asks before it reads, and you allow each thing separately: reading, writing, signing, publishing.

   This holds for assistants that go through 3P. Software running as you on your computer can read your record file directly.

   An assistant can never widen what you allowed it.

   The evidence

   Tests

   • test_mcp.MCP.test_every_call_is_refused_without_a_grant
   • test_mcp.MCP.test_refused_calls_are_recorded_for_the_person
   • test_mcp.MCP.test_signing_in_the_persons_name_is_its_own_permission
   • test_mcp_write.Correct.test_a_read_grant_cannot_correct
   • test_consent.Consent.test_no_grant_may_last_longer_than_thirty_days
   • test_mcp.MCP.test_an_agent_cannot_widen_its_grant_by_saying_the_asker_reciprocates
   • test_share.ReleaseRule.test_agent_grant_narrows_but_never_widens
   • test_mcp.MCP.test_a_grant_for_one_persona_does_not_open_another

5. No insight without a citation

   When you meet someone, 3P tells you one thing worth talking about, with the entries it rests on. Or nothing.

   The evidence

   Tests

   • test_two_nodes_meet.Meeting.test_each_side_hears_a_reason_to_talk_that_cites_both_packets
   • test_two_nodes_meet.Meeting.test_nothing_in_common_means_nothing_is_said
   • test_two_nodes_meet.Encounter.test_every_cite_resolves_to_a_claim_in_one_of_the_two_packets
   • test_two_nodes_meet.Encounter.test_a_signal_no_claim_licenses_is_not_said

   Evaluations, with numbers on the evaluation page

   • meet_quality.precision
   • meet_quality.silence_when_unrelated
   • meet_quality.uncited_or_invented_citations

6. No login

   No login. No account.

   The evidence

   Tests

   • test_capture_http.CaptureHTTP.test_the_page_hands_out_the_token_only_to_whoever_holds_the_link
   • test_capture_http.CaptureHTTP.test_api_without_token_is_refused

7. Nobody pays for access to a person.

   A binding commitment, written into the terms. What may ever be paid for is compute you choose, and tools an institution uses for itself. Never access to you.

   Code cannot prove a promise about money, so this one is held by the terms, not by a test.

8. Marks before words

   The interface shows a mark before it says a word: private, opened, a face, a card, a citation, silence.

   This is a design rule, not a tested claim. It is written in the project's design system, DESIGN.md, and each page is reviewed against it.