Tamper-evident accountability ledger — the append-only, ed25519-signed, hash-chained store
that makes the conduct + disclosure records un-erasable (tamper-evident) and attributable
(signed).
Persistence for the accountability fabric — the on-disk home for the tamper-evident
AccountabilityLedger, the revocable ConsentCredentials, and the durable ConductRecords
(ADR 0011 D2/D4/D5). It turns the tested domain models into something the desktop can actually use.
CML context loop — chat logs carry Context Markup that binds topic-related semantics into the
person’s inforg (their private hypermedia library), which is then reused, permissively, to improve
the context given to the local agent.
Connection identifier — the single signed payload that underlies every connection method (email
string, magic link, DNS record, token metadata). It extends the connect-invite with the WireGuard
peering material + ordered rendezvous hints, and encodes to a compact, copy-pasteable
qcx1_<base64url> string. Self-certifying: ed25519-signed over its own fields, so a recipient verifies
it without any third party. See docs/plans/social-network-plan.md §1.
Revocable consent credentials with crypto-enforced payload revocation + a durable, attestable
conduct record — the mechanism that resolves “revocable data vs durable accountability”
(docs/plans/social-worker-support-and-accountability.md §2 + §4).
Dead-man switch — post-death (or believed-death) disposition of the principal’s data, under
gamified validation rules, enacted by the person’s chosen friends who hold the dataset.
Domains & mail addresses — the foundation of the domain + semantic-mail/address stack
(docs/plans/social-network-plan.md §0.5). A domain/subdomain acts as an agent (QDP — Timothy’s
draft-webcivics-QDP: a domain publishes an RDF agent profile at /.well-known/QDP). A person runs
several context-domains (personal/work/projects), each with its own front-door DID(s); subdomains
serve families/children. A domain may be single-owner or (deferred placeholder) group-owned via an
M:N agreement — modelled now so group domains slot in later without a refactor.
Real envelope encryption for the accountability commons payload — the crypto that makes
ConsentCredential’s “revoke destroys the wrapped key ⇒
no key, no payload” a fact, not a model with opaque placeholder bytes.
Magic link — encode/decode a ConnectionIdentifier as a shareable link for email/text/web
onboarding. A single connection payload can travel three interchangeable ways, all decoded by
from_link:
Remote-MCP inference backend — reach an external provider (Claude / Google / X, or another
Webizen node) over the Model Context Protocol to run a completion on the person’s behalf.
Solid Chat interop — bidirectional mapping between the native chat model and the SolidOS
“long chat” data model (https://solid.github.io/chat/), without degrading the native format.