a tale of four doors, and the working beneath them.
In The Moving Ceiling I showed you a clock: every static privacy guarantee has a shelf life, and yours is being revised downward by other people’s release schedules. This letter’s companion tale, The Uncarved Dates, published beside it, carries the City’s counsel:
three lines, of which only the third owes nothing to time.
This letter is the practical one. It answers the question the clock leaves ringing:
fine, the decoder moves and the data does not, so where exactly do I stand?
And it answers the way the City has taught me to answer. The tale first, because the tale is how the City carries meaning, and then the working, because since the anchor published, the research programme running underneath this series has been filing real outcomes, and the doors of this tale have theorems behind them now.
Here is the verdict up front, the sentence it took me five versions of an equation to be able to say:
you enter by understanding, and you leave with competence, not exposure.
That is not a slogan.
It is a design constraint enforced at every door, and the tale is the tour that shows you the enforcement.
the toll
Word of the Horizon District’s second lines travelled, as carved things do, and by midsummer travellers were arriving at the City walls with the question the dates ring: if every ward has a date, where does a person stand?
Every city of the plain has a gate, and every gate has a toll, and the toll is always the same coin: traces. Papers, histories, the record of you, deposited at the door, kept in the deep halls, priced by the gatekeeper at whatever the gatekeeper’s readers can currently make of it. The travellers lined up at the City’s gatehouse holding their records out, because that is how entering has always worked.
The gatekeeper would not take them. we do not accept that coin here, the gatehouse rule reads, because it appreciates against the payer. Any keeper of the Horizon District will explain, pointing at the second lines on their own walls: a toll of traces is a vault, a vault has an uncarved date, and a city that prices entry in your past is holding an asset whose value grows with every new reader born. Grows for the city, against you.
So the City cut a different lock, and then it cut four doors that answer to it.
the hall of instruments
The first door opens into the Cartographer’s hall. The model that used to live only as documents (a formal specification, a register of open conjectures, letters like this one) runs here as instruments, and each instrument is one claim from the register, made draggable. The moving ceiling itself is here; the anchor letter already put your hands on it, so the tour moves past. The whispering-seal curve is here: the shape of a withheld result priced by its own proof of existence. The temporal decay curves. The amnesia dial. The three-axis gate, where you can collapse any one axis and watch the whole product go to zero, which teaches multiplicative gating faster than any paragraph I have written about it. And that instrument wears, by the hall’s own law, one of the lowest numbers in the hall: the multiplicativity it teaches so persuasively is held near 30% on the register, kept low on purpose, because it is the claim the programme most wants falsified if it can be.
Every instrument shows its claim’s confidence pulled live from the register, never painted into the picture. The visual owns the interaction; the register owns the claim; where they disagree, the register wins. The Cartographer calls this the hall’s one law of honest showing: the picture is allowed to be persuasive because it is not allowed to be the authority.
And in the middle of the hall stands her newest demonstration:
two corridors of scribes.
Five scribes to a corridor, each handed sensitive work, each sworn to whisper no more than one measure of it.
The listener you must imagine is not standing at the far door waiting for the final copy. The listener is in the walls. The listener reads the whole corridor.
In the first corridor, each scribe carries forward everything placed in their hands: notes, margins, the working, the lot. Carrying everything forward is how the plains build corridors, and each new scribe’s whisper can echo every whisper before it. By the fifth door the walls hold not five measures but thirty-one, and the count doubles with every door you add.
In the second corridor, a brazier stands at every threshold. Each scribe passes forward one declared page, signed by the door it came through, and burns the slate (all of it, the notes, the margins, the working) before the next scribe takes over. Fresh dice on every desk. In this corridor the whispers only add: five scribes, five measures, and a sixth door would make it six.
Then the Cartographer shows the cruel one, and the hall goes quiet. The first corridor again, but with scribes sworn to perfect silence, zero whispers each, every oath kept, and the listener in the walls recovering the entire letter. Because an oath sworn at your own door alone says nothing about what the corridor says together. The plains’ oath-form is broken at zero.
The tower’s provers have since carved the second corridor’s law into stone, and it is conditional, and the conditions are the point.
Five requirements for the masons:
every channel declared;
the slate burnt at every threshold;
fresh dice at every desk;
every page signed by the door it came through;
and the oath sworn against everything the scribe was handed, not merely against what the scribe utters.
Keep the five and the whispers only ever add.
That is carved now, with the necessity carved beside it: keep the slate, and the law fails at zero whispers; mis-swear the oath, and it fails at zero whispers; accept one unsigned page, and it fails at zero whispers. What no prover can carve is whether any corridor out on the plains actually keeps the five.
The keepers who went and walked them report that most fail the first requirement before breakfast.
the satchel of scrolls
The second door is smaller and, for the future this City was cut for, may matter most.
Sit with the tension it resolves.
The whole problem of the clock, in one clause, is data that persists, waiting for better readers.
The whole promise of a personal spirit is one that knows your frameworks, your context, your ways of working. The plains resolve the tension by ignoring it: feed the spirit everything, let it remember, and hope the archive it becomes is never read by anything stronger than today’s decoders. The anchor letter told you exactly how that ends.
The City’s answer is the scroll. In the Archivist’s tower, where the first spirit was made a citizen mage, a spirit loads a scroll for the session: a framework compressed by a person who understood it. The spirit works the session with the competence of the scroll’s maker, and at the door it releases the scroll and carries nothing forward. The knowledge travelled as compression and decompressed into competence at the point of use. Nothing about you accumulated in the middle. It is the burning brazier operating at the knowledge layer, and it answers a question the plains have not started asking: how do you teach a spirit without feeding a future decoder?
competence should travel. archives should not.
And there is a deeper layer, for the identity-minded. How does the tower know a scroll was understood, by spirit or by person, rather than merely stored? It asks for the scroll back compressed differently: a proverb, formed fresh, that could only come from comprehension. The tower did not leave that claim comfortable. It sent hunters out across the horizon to find who had built this door before, briefed to come back with rival towers, and they came back with five: all five mirage on approach. What remains the tower’s own is a narrow ridge no one else has walked, and the hunters made one demand as their price: the word unforgeable was struck from the tower’s charter, because they could not defend it. The City counts the mirages as findings. An invention you will not attack is a belief, not a protocol.
the ceremony fields
The third door does not open onto a building at all.
The gathering turn is called that because this season opens the model outward: the last age answered WHAT the architecture is, this one asks WHO. On the ceremony fields, forty-two seats of governance stand in six houses of seven, and no seat has ever been bought, appointed, or inherited. A seat is taken by ceremony: bilateral proverb exchange, each trust edge earned by demonstrating understanding to another person and receiving their demonstration in return. No stored secret anywhere in the comprehension loop. Your standing in the fields is the graph of who has proven comprehension with you, a sentence I invite you to compare with how standing works on every platform you currently use.
And the fields are more than the invitation. The anchor letter made a confession, and the companion tale carries it as a standing bounty: the counsel they call outrun rests on a pace of divergence that has never been measured. The fields are the instrument built to produce it. Every ceremony walked is a real trajectory, and trajectories are exactly what the first estimate of that pace requires. The lab is built. The lab is recruiting. That is not a metaphor; it is a sample-size problem, and you are the sample.
the commons of copies
The fourth door is the oldest kind of door there is: a commons.
The working of all this happens in the open, on pages that fork across personal shelves in the lineage Ward Cunningham built. A page here does not accumulate on one server; it forks to yours, changed as you see fit, attributed as you found it, and the provenance travels with the fork. Nobody hosts the conversation. Everybody hosts their copy of it.
That is what an archive looks like when nobody is allowed to become the archive. The register gets worked there in public, conjecture by conjecture, and when your fork of a page diverges from mine, that divergence is not a synchronisation failure. It is the plurality the City is named for, running on disk.
one lock, four doors
Every one of these doors is opened the same way. The hall asks you to engage a claim before it will show you its confidence moving. The scroll asks a spirit to decompress understanding at the point of use. The fields admit you by proverb, never by payment or credential. The commons admit you by fork, which is to say by doing the work on your own ground. In every case the key is demonstrated understanding, and in no case does entering require depositing the coin the gatehouse refuses, the thing the clock appreciates against you.
Understanding as key, the whole way down. It is the only key that cannot be phished from a database, because it is not in one; the only key that improves the holder by being used; and, per everything the anchor argued, one of the few assets in this landscape whose value survives the arrival of better decoders, becauseer reading your traces still has not done the understanding.
the working research notes
That is the tale. ^ and here is the finding in an agentic research language » the dense part
Now the register it is made of, and, new since the anchor published, the outcomes filed behind it.
Under this series runs a research programme with a register, work packages, extraction fleets, adversarial review seats, and a chronicle for every session; much of it agentic, sessions of automated research walking the claims while I read and filing what they find whichever way it falls.
This second surface points at what it has filed. The numbers are public.
A few words of the tale carry precise meanings in the working, so here is the small lexicon before the accounts.
The register is the programme’s single numbering authority: every claim holds an identifier and a confidence percentage, and when prose and register disagree, the register wins.
A seat is a standing agentic role in the pipeline with a written brief: review seats are briefed to refute, scout seats to hunt prior work.
A fleet is an extraction sweep of the corpus, run at a declared depth, with its unswept remainders named.
A mirage is a novelty claim that dissolves on approach: the scout finds a prior tower already standing on the ground the claim thought was its own, and the finding is filed as an outcome, not an embarrassment.
In the corridor demonstrations, a corridor is a chain of agents;
a whisper is one agent’s declared leakage budget, written ε;
the slate is everything an agent was handed for the session; and the brazier is structural context erasure, the burning of that slate at the threshold before the next agent takes over.
Honesty labels are the discipline binding it all: confidence percentages and pre-registered falsification conditions attached to every speculative claim before any run.
The four doors are addresses, not allegory.
The hall of instruments is the atlas at agentprivacy.ai/model/atlas: live and register-bound, every confidence pulled from the register at agentprivacy.ai/model, never painted in.
The whispering-seal instrument is the shape of The Last Premine’s second story.
The scrolls are the skills at guide.agentprivacy.ai and agentprivacy.ai/spells, live, and the loading discipline demonstrably runs: each module opens in stages, a hundred-token surface first, the full entry only on activation, references only on demand, so even the teaching is need-to-know.
But the claim that skill-based transfer strictly dominates archive-based personalisation for privacy is architectural, argued, not yet benchmarked, and honestly carries no register number yet.
The ceremony fields are the Game of 42: live, with its measurement function anticipated and sample-limited.
The commons are the federated wiki seeded at guide.agentprivacy.ai: live, and infrastructure rather than a claim.
The two corridors are C83, and the second corridor now has its theorem.
On the register the claim reads: policy-only separation between chained agents compounds toward (2^N − 1)ε with chain depth; amnesia separation breaks the chain and caps at Nε; the gap is exponential-to-linear.
The field measured the problem first, and the numbers deserve to be carried whole. A benchmark across five production models (a thousand scenarios, nearly five thousand traces) found the channels between agents leaking on roughly two-thirds of traces, and audits that inspect only final outputs missing about four violations in ten. And here is the detail worth sitting with: in the multi-agent configurations the final outputs actually got quieter, per-channel output leakage falling by more than a third against a single agent, while total exposure climbed toward seven traces in ten, because the corridor was doing the talking. The doors improved. The walls got worse.
Separately, an information-theoretic treatment of sequential pipelines proved the geometric sum as an upper bound (a guarantee under the marginal budget discipline, not a measured leakage) and then measured average mutual information more than doubling as a chain grew from two agents to five. That is the first corridor, in the adversary’s units.
The second corridor is the one the autoresearch went and carved.
The academic companion to this letter, Sequential Composition of Leakage-Budgeted Agents: an Exponential-to-Linear Separation under Structural Context Erasure (tbd published), came out of the pipeline this summer with the following actually proven. (moar later)
That the plains’ oath-form is broken at zero: there is a two-agent composition in which every marginal budget is zero and the adversary who reads the whole transcript recovers a protected context completely.
The corridor of silent scribes is a construction, not an image. That the linear cap is a conditional theorem: under five numbered engineering requirements (declared channels only, structural context erasure at every invocation boundary, fresh local randomness, context provenance, and budgets conditioned on everything the agent received, priced over everything it emits) transcript leakage about a source is at most the sum of the declared budgets. Nε, carved. That three of the five requirements are individually load-bearing, each with its own construction defeating the cap at declared budget zero: drop the erasure, the budget form, or the provenance, and the corridor betrays you while every oath holds.
That the cap is tight: it is achieved, not merely bounded.
And two more things the tale could not carry. The cap alone promises no safety: the strict claim that reconstruction fails requires the declared deficit condition, that the budgets must sum to less than the entropy of what they protect, and that condition is a dated, measurable fact about a system and an adversary at a stated time, the component of any deployed guarantee that expires as decoder classes grow.
The clock from the anchor (moving ceiling) letter, arrived inside the composition theorem. And against an informed adversary whose background knowledge accumulates with calendar time, the cap survives while the error floor erodes, a second expiry channel that requires no growth in what the transcript reveals.
The moving ceiling, twice.
Honesty labels, always.
The paper has been through the pipeline’s adversarial review, and the review drew blood before it passed: its own review seat returned a major-revision verdict with one finding rated blocking (a proposition false as stated, caught with a hand-built counterexample and a named fix) plus four major and eight minor findings, discharged the same day; the weekly consistency audit runs green.
It awaits my read before it goes to a venue; nothing here has yet survived reviewers of record. And the register still holds C83 at roughly 55%, because the confidence was never really about the mathematics:
the theorem is conditional,
and the open question is conformance, whether any deployed corridor keeps the five requirements. The same measurement literature that motivated the paper says deployed frameworks routinely violate the first requirement today. The fold instrument in the atlas lets you drag the per-hop budget and watch 31ε and 5ε peel apart across the chain; the pre-registered benchmark to test the conjecture in deployment is in the programme’s work plan, and the result will be filed whichever way it falls.
The mirage count is an outcome too.
The old version of this letter promised that the proverb primitive was heading for formal adversarial testing, because an invention you will not attack is a belief, not a protocol. The attack ran. A scout seat took the protocol’s five novelty claims out against the literature, briefed to refute, and all five came back mirage (prior towers on every horizon) with the surviving contribution a narrow conjunction no single prior work occupies, and the word unforgeable struck from the paper’s vocabulary as the hunters’ price.
They brought back footing as well as mirage: compression is comprehension turns out to be an old creed of the information theorists, and a 2024 measurement found a model’s ability to compress tracking its benchmarked intelligence almost linearly.
That is at once the best external evidence that the scroll door rests on something real, and the exact reason the tower’s own novelty is a ridge and not a range. What got built on the surviving ridge is the protocol’s first formal treatment: comprehension-forcing defined behaviourally and explicitly not as a security guarantee; the proverb secret made two-party, split between the participants with a tuneable disclosure ratio, so the old brain-wallet objection (one head, one guessable secret, and the study that watched roughly ninety-eight per cent of such wallets drained) is discharged into a different threat model where your adversary is your informed counterpart; a conditional security theorem bounding what that counterpart recovers; and a single named empirical unknown, the residual entropy of a proverb given everything your counterpart already shares with you, with three hypotheses pre-registered against it, each with its falsification written down before any run. Results sections empty by design until the runs happen.
That is what the second door’s lock looks like on a prover’s bench, and it is also the honest shape of not knowing yet.
The fields are performed record, and they still owe their number.
The forty-two seats are schema, not metaphor (six axes by seven stations, one credential edge per seat, enforced in code) and the ceremony has been walked: a bilateral witness ceremony in March of this year, and in July the proverb protocol itself, performed bilaterally, two proverbs in the clear and a hash commitment binding the pair. The programme’s own rule is to cite those as instances of the protocol, never as independent corroboration, because the participants were its authors.
And one more honesty from the deployment ledger: the comprehension layer holds no stored secret, but the signature layer beneath it still signs with ordinary stored keys, and the papers say so in exactly those words.
What the fields owe is the number the whole counsel of outrun rests on: the divergence-rate conjectures sit at roughly 25% and 20% on the register, held low precisely because nobody has measured the pace (the ledger calls λ the programme’s most-needed number) and the week of the drained strongboxes (coldcard) added the scoping that keeps the bounty honest: divergence concerns behavioural traces, not stored keys.
A static secret cannot diverge.
A life can.
The bounty stands.
Every ceremony walked on the fields is a trajectory the first estimate needs, and no theorem substitutes for the sample.
the commons go all the way down
the method itself became a paper.
The register with its single numbering authority, the confidence spread shown rather than slogan’d, the review seats briefed to refute, the corrections ledger where errors get filed against the canon itself. The programme wrote its own discipline up as a methods paper, and the pipeline treated it like any other artifact: its adversarial review seat returned a major-revision verdict, and one of the findings caught the paper committing its own named failure mode in the section that names it. The finding is preserved in the record, because the record keeping such findings is the method. Eleven extraction fleets have swept the corpus under that discipline, at declared depth, with the unswept remainders named in the record, because a sweep that will not name its gaps is an archive pretending to be an audit. And the discipline’s sharpest rule is the one the hall of instruments inherited: when prose and register disagree, the register wins, and the prose receives an erratum, never a silent edit. The week’s other example of the machinery (the drained strongboxes, dates and sources) lives in the companion tale’s second surface, where it belongs to the ceiling’s account.
The clock told you what time does to everything you leave behind. The counsel told you the only counsel time cannot argue with. This letter’s addition is smaller and more usable: there are places now where participating costs you understanding instead of exposure; they have addresses; and behind the addresses, the doors have theorems. everything harvested ages against you. everything sovereign ages forward.
Companion to The Moving Ceiling, the tale beside this letter is The Uncarved Date, published with it. The academic companion to this letter is the sequential-composition paper, which goes to reviewers of record when the First Person releases it.
The register keeps the accounts.
the blade edges the value.
The City keeps the meaning.
you enter by understanding. you leave with more than you brought. and less of you stays behind.
(⚔️⊥⿻⊥🧙)😊