@nervur-org/dock 0.3.0

package/beings/WORLDS.md

@@ -0,0 +1,567 @@
+# WORLDS
+
+This is how Quo is proposed to a person and to an organisation. It sits
+beside `quo/SPEC.md` and adds no word to it. The spec says what a
+harbor, a ward and a being are, and what crosses a door. This paper says
+what to make of them, so that any setup, from one person with a phone to
+an organisation with ten thousand members, is reasoned in the same words.
+`papers/quo-dock.md` and the papers of its sides follow this one; an
+estate's paper follows all of them. It binds the dock and the estates, never
+the library.
+
+It is written in four parts, in this order, because the order is the
+honesty of the paper. First, what Quo allows, which is more than we use.
+Second, the choices we make inside that, each one named as a choice, with
+what Quo would also have allowed and why we chose as we did. Third, the
+world those choices make, home, presence, membership, envoy, route and
+device, narrated once. Fourth, real organisations at every distance from
+Quo, so that the reader finds their own stage and sees the next one. An
+implementer who reads only the first part and builds something unlike the
+rest is still building Quo.
+
+## What Quo allows
+
+Quo is three words. A **harbor** is the program a device runs to boot
+wards; it owns the wire and the operating system and is nobody outside its
+device. A **ward** is one process of its harbor, a seed, a partition and a
+body of code, named outward by one public key derived from the seed. A
+**being** is one ordinary object with one voice, living in a ward, with no
+address of her own. Nothing else is Quo.
+
+Between beings there is one kind of relation, with two ends. A **standing**
+is a pointer a being holds to another being, through which she asks. An
+**occupant** is a being she invited, whom her ward names when she asks.
+Every relation is born of an **invitation** minted by one side and a
+**knock** by the other, carries two keys, one minted by each side, and ends
+by one side removing it. What a being answers to an occupant is decided by
+her **gate**, which is asked for every describe and every dispatch, and it
+is the whole of permission in Quo: there is no second list anywhere.
+
+Two things stand at the edges. A harbor keeps the ask pointer of a ward it
+booted, so it is that ward's **root**, and the root may invite on any being
+of its ward and reach into any of them; that is total, and it stops at the
+device. And a ward may hold one **public being**, who answers anyone at all
+as `{}`, the way every stranger is at every door. What a device can do,
+its clock, its screen, its lines to vendors, it offers by **lend**, as
+beings in a ward of its own that another ward's being reaches by holding a
+standing, exactly as she reaches a being on another planet.
+
+That is the whole of it, and this is what it leaves open:
+
+- **Quo has no person and no organisation.** A ward has an owner in the
+  sense that a root booted it, and no other sense. Who a human is, whether
+  two wards are the same party, and what a company is, are not questions
+  Quo answers.
+- **Quo has no home.** Three boxes rooted by one party, each holding
+  standings on the other two, is Quo, and so is one box with a hundred
+  wards. Nothing says which ward, if any, is the one that matters.
+- **Quo has no route.** How bytes arrive at a device is the harbor's
+  directory, and Quo says nothing about it. A hostname, a socket, a screen
+  and a tool list are all outside the protocol.
+- **Quo has four rungs and no more.** A stranger hears the public being as
+  `{}`. An occupant hears what the gate shows that occupant. An owner
+  reaches in. A root holds the ask pointer. Guest, member, subscriber,
+  admin: every one of those is an occupant, told apart by the gate and by
+  nothing else.
+- **Quo has no outside.** A vendor's API, a bank, a mail server, a model at
+  its client: to Quo each is either a being someone booted to speak for it,
+  or nothing.
+
+Everything from here on is one way of filling those gaps. It is our way,
+it is opinionated, and another implementer may fill them otherwise and
+interoperate with us at every door, because a door judges keys and not
+opinions.
+
+## The choices
+
+Six choices, each in the same shape: what Quo allows, what we choose, and
+why. Every later sentence of this paper rests on one of them, and a reader
+who disagrees with a choice knows exactly which sentences fall with it.
+
+### The unit is the org
+
+Quo allows any party to be the "you" a world is about, or no party at all.
+
+We choose the **org**. Every "you" in this paper, in the dock and in the
+estates is an organisation: a company, a family, a club, a service, and at
+the smallest, one human alone, who is an org of one. An org owns wards,
+holds standings, trusts boxes and is trusted by others. A human is never
+modelled as something smaller than an org, and an avatar, an account or a
+user id is never the "you"; each of those is a thing an org holds.
+
+Why: one grammar reaches every size. What is said of a family with a box is
+said, word for word, of a person with a phone and of a service with ten
+thousand subscribers. The moment a person and an organisation are two
+kinds of thing, every rule is written twice and the two drift.
+
+### One home per org
+
+Quo allows an org to root three boxes and call each one home, or to have
+no place it calls home.
+
+We choose **one home per org**, and any number of harbors under it. Home
+is the one ward the org owns on a box it trusts, its own being is the org's
+being, and every relation of the org meets there.
+
+Why: the fog. Three homes each hold part of the org, and the day the org
+wants to act as one, "when mail lands in A, tell a friend from B and write
+it down in C", it needs one place that sees all three, and that place is a
+fourth home standing over them, which is one home with three harbors under
+it. Several homes is not a richer arrangement Quo permits and we forbid. It
+is an arrangement that collapses into one home the first time the org
+wants to think. So one home is not a cap: it is the name of the place where
+the fog clears, and an org that has not built it yet is an org that cannot
+yet act as one.
+
+### Every human is an org, with or without a home
+
+Quo allows a human to exist only as ids in other parties' wards, and never
+as a ward of her own.
+
+We choose to say that **every human is an org from the first moment**,
+whether or not that org has a home yet. A human with no box is an org of
+one whose whole existence is the standings it holds in other orgs' worlds:
+a customer id at a shop, a member id at a club, a presence on a phone. The
+day a box is trusted, a home is booted fresh for that org, and it joins
+each of those memberships from there. Nothing is converted and no id
+changes; the org gains a home and keeps everything it had.
+
+Why: the walk. Nobody switches to Quo, and a person who has never heard of
+it must already be in the model when they land on a website of ours. If a
+homeless person were a different kind of thing from a person with a home,
+getting a home would be a migration, and there is none. Homeless is a rung
+on the org's own ladder, and the first one.
+
+### A route says the grammar, a credential says the rung
+
+Quo allows a device to hear bytes any way it likes, and to treat every
+arrival as a stranger.
+
+We choose to name **three routes** into a device, and to forbid any route to
+fix a rung. A route is one hostname, sent by a reverse proxy to one process,
+and it says only which grammar the bytes are in:
+
+| route  | grammar                                          |
+| ------ | ------------------------------------------------ |
+| `web.` | a describe as forms and a page, for a human      |
+| `mcp.` | a describe as tools, for a model                 |
+| `api.` | a describe as plain HTTP and JSON, for a program |
+
+The rung is proven by what the caller carries, and was decided by whoever
+minted it. No credential is the stranger, on every route, and the stranger
+hears the public being as `{}` on every route. A credential is an
+invitation spent once by a knock, then keys, and it names an identity in a
+world at the rung its minter gave it: an occupant, whether guest,
+subscriber, member or admin, told apart by the gate; or an owner, invited
+on the ward's own door. The same credential is honoured on every route, and
+the same identity sees the same describe whether it arrives as forms, as
+tools or as JSON. The three routes are three renderings of one describe,
+and a caller on one can do nothing a caller on another cannot.
+
+Why: a person is not a route. The owner of an estate pilots it from a model,
+presses its buttons in a tab and calls it from a script, and is the same
+owner in all three. A route that fixed a rung would make the same human two
+parties, one per door, which is the fog again, this time inside one box.
+
+### A device is a harbor of the org, never a route
+
+Quo allows a phone to be a home, a tab to be a stranger, and an app to hold
+accounts of its own.
+
+We choose that **a device in a hand is a harbor the org owns**, that every
+world seen there is a presence, a ward of the org's on that device, and
+that nothing in a hand is ever a home. A phone, a tablet, a laptop and a
+browser tab are the same shape. The app is a browser of the org's worlds
+with no account and no person of its own; who the org is lives at home.
+
+Why: night and trust. A hand is reachable only while it dials, so nothing
+runs there for the org at night, and it is lost, stolen and replaced, so no
+one copy of the org is trusted to it. A home on a phone would be a home
+that sleeps and may vanish, and the org would answer for the difference
+every day. So the device is where the org is now, and home is where the
+org is always, and the two never trade places. A device is not a fourth
+route because it does not need one: it is Quo, ward to ward, and the human
+touching it is an occupant of a ward that is theirs.
+
+### A SaaS is an org that has not heard of Quo
+
+Quo allows nothing outside its three words, so a vendor's API is not Quo
+and cannot be spoken to.
+
+We choose to meet every such vendor through an **envoy**: a being booted on
+the org's side who speaks that vendor's surface, narrowed to what the org
+exposes, one being per vendor and one relation per account. From inside the
+org's world, Google, a bank and a booking service look exactly like orgs
+on Quo, reached through a standing, because each is standing in for a ward
+nobody here runs. And the mirror holds: an org on Quo is a website to every
+human who has never heard of Quo, and a member's world to everyone who
+has, at the same time, at the same doors.
+
+Why: Quo bends the SaaS world and cannot wait for it to disappear. An org
+must adopt Quo while every vendor it depends on stays as it is, and must
+serve every customer who never adopts it. Both directions are envoys and
+routes, and neither needs the other side to move.
+
+## The world those choices make
+
+### Three questions, three words
+
+Each word of Quo answers one question for an org, and nothing else answers
+it.
+
+| word   | the question | what it settles                             |
+| ------ | ------------ | ------------------------------------------- |
+| harbor | whose box    | trust: who holds the root, who can reach in |
+| ward   | whose world  | ownership: one seed, one owner, moves whole |
+| being  | whose voice  | a role inside a world                       |
+
+A harbor is a device and belongs to the org that holds it. A ward is the
+unit that is owned and the unit that moves: it goes to another box whole,
+and every standing it holds survives, because its pk is the same there. A
+being is one voice inside a ward, and what she may be asked is her gate.
+
+**Ownership decides the level, and nothing else does.** A thing is a being
+in the ward of the org that owns it, and the default is always that. A chat
+between two members of an org is a being in the org's ward. A chat between
+two people with no org between them is a being in the home of whichever
+hosts it, the other an occupant through their own home. A ward is booted
+only where a thing must be owned by nobody among its members, so that it
+can move whole or stand on a box none of them fully trusts; and then it is
+an org, however small, with an org's home beside it. How rich a being's
+occupant logic is never promotes her. Only ownership does, and promotion is
+not a migration: a being's cells do not cross into another ward, so
+becoming a ward is a new ward booted, the same class placed in it, and the
+members invited again.
+
+Every ward on any harbor is one of three kinds, and there is no fourth:
+
+```
+a home             an org's world, one owner, moves whole
+a presence         a world's foothold on a device in someone's hand
+the box's own      what this harbor lends, one per harbor, never moves
+```
+
+**A harbor boots one ward of its own.** It keeps that ward's ask pointer,
+so it is its root, and everything the box can offer lives there as beings:
+its location, its notifications, its timer, its way of ringing a phone, its
+line to a store, its account at a vendor. A being of any other ward reaches
+one by `lend`, and what she gets is a standing, counted and rotated and
+removable, like every other relation she holds. That ward never moves. Its
+beings are the box's, they die with the box, and a home that moves to
+another box is lent that box's instead. What the org wants asked by others,
+a front desk, a clock with its schedules, is a being with a door in the
+org's home like any other being of theirs.
+
+### An org is three things
+
+One org on Quo is three kinds of thing, each on a harbor of different
+trust, each with a different job. For a human alone the three are the
+same three.
+
+- **Home** is the one ward the org owns on a harbor it trusts. Its own
+  being is the org's being: for a company, its org being; for a human, her
+  user being. Inside it live the org's envoys, its avatars and its rules.
+  Home runs day and night and is the only thing of the org's that must
+  never be lost. A home may stand on a box the org does not run, a
+  family's or a host's, and the day the org has a box of its own the home
+  moves there whole, and nobody who holds a standing at it is told.
+- **Presence** is a ward the org owns on a harbor in a hand: a phone, a
+  desk, a browser tab. It is where the org is now: the screen someone
+  touches and what that box lends, GPS, camera, a keychain, each a standing
+  the org's being there holds at a being of the box's own ward. It holds
+  one standing at home, home holds one back to wake it, and it sees exactly
+  what home's gate shows that device. A lost phone is one standing removed
+  at home, and nothing of the org is lost.
+- **Membership** is an id in a ward another org owns: an employee id at an
+  employer's being, a member id at a party's, a customer id at a shop's.
+  Nothing of the org lives there but the id and the key. Home holds a
+  standing at it, and it holds one back to push. The other org ends it by
+  removing one standing, and home loses that and nothing else.
+
+A membership is never a ward of the org's, because a ward it does not own
+is not its. A presence is never home, because its seed was minted where
+the org happened to be. Home is one, presences are as many as the org's
+devices, and memberships are as many as the orgs that know it.
+
+Read from the other side, the same three words hold. An organisation's
+home is its ward. Its members are ids at its beings, however many. Ten
+thousand subscribers of a service are ten thousand memberships in the
+service's ward, not ten thousand homes: their homes are elsewhere, or do
+not exist yet, and each subscriber is an org of one either way. A ward is a
+process, and that is the only way ten thousand fit.
+
+**A home changes hands, and the change is one act.** A child's home is a
+ward the parent's org owns until the child does; a friend's, one the family
+runs until he has a box. Before that day the host's presences hold the
+door and the child's do not. The day itself is the root minting the child's
+own being the owner standing on that ward, `home`, and stepping back, which
+is what setup does for everyone at boot and may do later. Nothing moves,
+nobody is told, and from then on the door is the child's.
+
+**Trust is the root, and it is total.** Whoever holds a box's root can
+read every home on it, partitions and keys, and can reach into any being
+there. A household's privacy toward each other is its trust in whoever
+runs the box, not cryptography, and a home that wants more than that moves
+to a box of its own. That is the whole meaning of "a harbor it trusts",
+and it is read before a home is booted on somebody else's droplet.
+
+### The hub is home
+
+Every device, every model, every account and every membership of the org is
+either an occupant of its home or a standing its home holds, and most are
+both. The gate of the org's being is its whole permission model: what its
+phone may ask, what its model may ask, what an employer may push. There is
+no second list.
+
+A rule, "when Calendly books, add it to Google", is home answering one
+standing by asking another. There is no trigger vocabulary and no product
+between the two: one being holds both standings and a method joins them.
+Rules run where the hub is, so rules need a home, and that is what a home
+gives an org that a presence cannot: something happens for it at night.
+
+### Everything outside is one relation
+
+Everything outside a world relates to it the same way: a standing in, a
+standing back, or both, placed by a knock on an invitation. Two questions
+decide the shape, and nothing else does.
+
+**Does it speak Quo?** If it does, a standing goes straight at its door. An
+employer's harbor, a party's, the org's own phone: each has a ward with a
+door, and the org knocks there. Nobody stands in for it.
+
+If it does not, an envoy stands in its place. A Google account, a Calendly
+account, a model at its vendor's client, a shop with an old checkout: each
+is a ward nobody here runs, on a harbor nobody here owns, that speaks no
+Quo. So a being is booted in the box's own ward who speaks that vendor's
+surface, narrowed to what is exposed. One being per vendor and one relation
+per account: the credentials are in her cells, the occupant's notes say
+which account a caller is, and a caller never names either. What home holds
+is the standing, so a home that moves box carries no credential and is
+placed again where it lands.
+
+**Does it call in?** If it does, it holds a standing back. A booking
+arrives, a payment settles, a mail lands: the outside thing's bytes reach
+the box, since the box owns the wire, and they reach the envoy's own body,
+because she is the being who claimed that path or opened that line at her
+birth. She checks the signature, keeps the delivery id so a retry lands
+once, and asks the right occupant on the right standing. Nothing arrives at
+a door that nobody invited, and whoever is woken cannot tell a webhook from
+a clock, and must not. If it does not call in, the relation is one way, and
+an envoy on a phone is one way by construction, because nothing calls in
+to a phone.
+
+### Three routes, one describe
+
+An org's box hears the world on three routes, and a route is a hostname the
+reverse proxy sends to one process. `web.` speaks a being's describe as
+forms and a page, for a human at a screen. `mcp.` speaks it as tools, for a
+model at its client. `api.` speaks it as plain HTTP and JSON, for a
+program, a script or a tab on another origin. A fourth voice, the `quo`
+command on the device itself, speaks it as lines, and reaches the daemon's
+socket rather than a hostname.
+
+Every route hears the same four rungs, and hears them the same way:
+
+- **A stranger** carries nothing and hears the public being as `{}`, on
+  every route alike: as the front desk's first hello, as a public board or
+  a catalogue in JSON, as the public being's asks listed as tools. A world
+  with no public being answers a stranger silence, on every route alike.
+- **An occupant** carries a credential: an invitation spent once, then
+  keys held by an avatar in the org's world. What the occupant hears is the
+  gate's answer for that identity, and it is the same answer on every
+  route. Guest, subscriber, member and admin are all occupants, and the
+  gate is what tells them apart.
+- **An owner** is an occupant of the ward's own door, invited there by
+  the root, and reaches into any being of it. The owner creates and
+  places, and never does the work: the work goes through an avatar under a
+  gate, so every arrival is named and judged.
+- **The root** holds the ask pointer, on the device and nowhere else, and
+  is no occupant of anything.
+
+A model, a human and a program that hold the same credential are one
+identity, and the org sees one occupant whichever route it came in on. That
+is what makes an estate pilotable from a model, a browser and a script in
+the same day by the same hand, with one gate deciding for all three. A
+model is not a special kind of caller: it is a presence that acts, holding
+one standing, seeing what the gate shows it, and what it does arrives home
+named and counted, exactly as a tap on a phone would.
+
+### The device and the app
+
+A Quo app is a browser of worlds and nothing of the org. It has no account,
+no login and no person of its own: every world it shows is a presence ward
+on the device's harbor, and who the org is lives at home. So which app the
+org uses is settled at home, by adding that app as a device of the org's,
+and never by a link. A world's link opens whichever app the platform
+verified for that world's hostname, and any Quo app that opens it is the
+org's, since every one is the same browser. A world names in its claim
+every app it allows to open its links, its own first. An adopter's own app
+is the first app its member meets, and nothing more: from it she reaches
+every world she is in, and from any other Quo app she reaches the same
+worlds through home.
+
+One OS user is one harbor. On a desk and on Android the OS has accounts,
+and the app never sees the second person. A shared iPad is one org's
+device, and a second org's presence on it is a ward of the second's, named
+as such, under the first's lock. Building people into the app would be a
+second grammar for identity beside the ward.
+
+A tab is a device of the same shape: a harbor on a seed in the browser, a
+presence ward per world, and the org's being there holding what the browser
+lends. It differs from the phone only in how long its seed lives.
+
+### The root boots and steps back
+
+A harbor's root is the box's, held by the device's own rule, and it is
+touched once per home: it boots the home ward and mints the org's own
+being an owner standing on it. From then on the owner of that home is the
+org. Placing an envoy, inviting a new device, joining a membership: each is
+an ask on home, shown by the gate to the org's presences and to its model,
+and the box is never logged into for it. The root's shell is for the day
+the root itself must act, and no other.
+
+### A class knows nobody
+
+Every being is an instance of a class, and the class is written by someone
+who has never met the org. An author ships a package with a Calendly
+class; an estate's class file re-exports it; the harbor loads it by name;
+the root boots `calendly/alice` with the token the box holds under that
+name. The author sees no human, no token and no partition.
+
+Nor does the author know the level. The same class is a being in an org's
+ward today and the being of a ward of its own tomorrow, placed there by a
+root's two owner asks and rewritten for none of it: its members are its
+occupants, its gate reads them, its cells are its record, and which ward
+boots it is never in it. A class is written to work at any level, and an
+estate decides the level. That is what keeps a class from an author who
+knows nobody usable by an estate that knows exactly who.
+
+The dock provides the classes every world needs and nobody writes twice:
+the user being, the avatar with its screen side and its model side, the
+bell, the clock, the front desk, the faculties a box lends, and the account
+base an author extends with only the vendor's part. An estate holds class
+bodies and placement, and reaches every general piece through the dock.
+`papers/quo-dock.md` is that catalogue.
+
+### The picture
+
+```
+a box the org trusts                    a hand                    their box
+  ward alice (home)                       ward alice (presence)     ward acme
+    alice, her user being                   her being there            employee being
+    avatar "claude" <- her model            ward acme (presence)       id "alice" at its door
+    rules                                     her being there
+  ward bob (home)                         the box's own ward
+  ward the-family (the estate's home)       screen, GPS, keychain,
+    the front, the clock and its schedules   notifications
+  the box's own ward
+    timer, push (web, apns, fcm),
+    calendly, google
+
+standings, each placed by a knock on an invitation:
+  presence -> home, home -> presence          her devices
+  home -> acme's being, acme's being -> home  her memberships
+  home -> calendly, notes: alice             an account, one way
+  home -> google, notes: alice               an account that calls in
+  any being -> a faculty of its own box      by lend, and never off the box
+
+routes into the box the org trusts, one grammar each, any rung on each:
+  web.   forms and a page      mcp.   tools      api.   HTTP and JSON
+```
+
+## Orgs at every distance from Quo
+
+Four organisations, each real in shape, each at one stage. Every stage is a
+state the model already holds, and no org moves from one to the next by a
+migration. Nobody switches to Quo.
+
+### Never heard of it: a bakery
+
+The bakery takes bookings on Calendly, payments on Stripe and mail on
+Google, and will never run a harbor. To an org on Quo the bakery is three
+envoys: one being per vendor in the box's own ward, each holding the
+bakery's account in her cells, each reached by a standing from the org's
+home. When a booking lands, Calendly's bytes reach the envoy's own body,
+she checks the signature, keeps the delivery id, and asks home on the
+standing home gave her; home's rule adds it to Google by asking the second
+envoy. The bakery is fully in the model and has done nothing. The day it
+runs a harbor, the org's standing moves from the envoy to the bakery's own
+door, and the rule does not change.
+
+### Scouting: a person with the app, and a company with a tab
+
+A person downloads the app and opens three links, a shop's, a club's and a
+friend's. The phone is a harbor; each link boots a presence ward on it,
+with the org's being there and one standing at the world it came from. The
+person is an org of one with three memberships and no home. She sees all
+her worlds in one place, because the app is a browser of worlds, and
+nothing runs for her at night. The three orgs each know her as an id bound
+to that phone's presence and nothing more.
+
+A company's operations lead opens a supplier's world in a tab. The tab
+boots a harbor on a seed in the browser, a presence ward for that world,
+and the lead's being there. That tab is the company's first presence, in a
+rented room: the supplier's ward knows the company by an id bound to that
+tab's pk, and the company has no home. When the lead opens the same link on
+her phone, the tab's ward moves in by seed and partition, rebinding the
+same pk, and the supplier is told nothing.
+
+### Migrating from SaaS: a filings service
+
+A filings service has subscribers, an old checkout and a new harbor. Its
+home is its org ward on a droplet; its subscribers are ids at its beings,
+ten thousand memberships in one process. A subscriber who has
+never heard of Quo arrives on the web route as a stranger, meets the front
+desk, and the checkout she pays at is still the old one, because the
+service's envoy to its payment vendor stands in for it. From the moment she
+pays she is an org of one whose whole existence is a membership in
+a filings service's world, reached from a tab or from the app.
+
+A second subscriber already has a home on a family box. Her home holds a
+standing at a filings service's being and it holds one back to push, and she
+reaches the service from her phone through home as the carrier, or
+directly on a presence. The service cannot tell the two subscribers apart
+by route, and does not try: each is an occupant, and the gate says what each
+may ask. The service's own owner pilots it from a model on the mcp route,
+presses its buttons in a tab on the web route, and runs its reports from a
+script on the api route, and is one owner on all three. The old checkout
+stands until the payment vendor speaks Quo or the service replaces it, and
+neither day changes a subscriber's id.
+
+### Fully on Quo: a family estate
+
+The family runs a droplet that never sleeps, an edge box at the house and
+a Mac on a desk. The three are one estate because each holds standings on
+the others, minted there and taken here, and not because they share a key;
+each has its own root and each root stops at its device. The estate's home
+is the family's org ward on the droplet, with the front desk, the clock and
+its schedules. Each member's home is a ward on the same droplet, owned by
+that member, trusted to the box the family runs. A child's home is owned
+by a parent until the day the root mints the child the owner standing and
+steps back. The Mac and every phone hold presences, one per world, and the
+edge holds what the house can do as faculties of its own ward.
+
+A member's model is an avatar in her home, holding one standing, seeing
+what her gate shows it. Her employer is a membership, her bank an envoy,
+her friend's world a standing at his home on his own box. When she moves
+out and buys a box of her own, her home moves there whole, seed and
+partition, and every standing she holds and every one held at her
+survives, because her pk is the same there. The family is told nothing and
+needs to be told nothing.
+
+## Vocabulary
+
+Org, home, presence, membership, hub, rule, envoy and route are in
+`papers/GLOSSARY.md`, with every other word above the spec.
+
+## Where the tree stands
+
+This paper decides what the estates and the dock are held to, and one
+piece of the dock is not yet in its words.
+
+- The dock holds no org base beside the user being, and no account base
+  class. The first arrives when a service bought by an organisation is
+  read against a household, which is the pair of users that shows what an
+  org actually shares with a home. The second arrives with the second
+  vendor to need one. `papers/quo-dock.md` names the same gap from its
+  side.

package/beings/avatar.ts

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: Apache-2.0
+// The avatar. Someone outside Quo's voice: a human at a screen, a model at
+// an MCP client, a model in an API loop. One class for every side. She holds
+// exactly one standing, `user`, and everything her side asks goes through
+// it; the user being reaches her only to push, and she hands the push to
+// every side she has. A side is in-process with her, holds the object, and
+// calls the four methods below: one of the two ways in, `enter` behind a
+// route's proof or `join` with an invitation, then `tools` and `call`.
+// Nothing of a side is in her cells.
+import { isSilence, isWord, wordOf } from '@nervur-org/nervur';
+import type { Answer, Blueprint, Invitation, JsonObject, OccupantRecord, Wanted } from '@nervur-org/nervur';
+import { Carrier } from './carry.ts';
+
+// Her one standing, and the id under which the user being pushes to her.
+// Two ids for one far being, because standings and occupants share one
+// namespace and a record holds one or the other.
+export const USER = 'user';
+export const PUSHER = 'user:push';
+
+// A carrier who carries for nobody, until a subclass says who: the presence
+// being carries the box's faculties to her user being, and a bare avatar
+// holds one standing and shows nothing of it.
+export class Avatar extends Carrier {
+  static override cells = { inbox: [] as JsonObject[] };
+  static override asks = {
+    notify: { description: 'a push from the user being', input: { type: 'object' }, for: (occ: OccupantRecord | undefined) => occ?.id === PUSHER },
+  };
+
+  // Her sides' ears. One identity is one avatar for life, and two sessions
+  // of that identity are two sides on her at once, so a push goes to every
+  // ear present; each side adds its own on open and removes it on close.
+  // Dropped if there is none.
+  readonly ears = new Set<(object: JsonObject) => void>();
+
+  // ---- what the user being may ask her
+
+  notify(args: JsonObject) {
+    (this.cells.inbox as JsonObject[]).push(args);
+    for (const ear of this.ears) ear(args);
+    return { notified: true };
+  }
+
+  // ---- what her side calls. Not asks: nobody reaches these through a door.
+
+  // The credential exchange's last step. `desk` is the desk's public
+  // invitation, `proof` is what the route produced. She knocks the desk as a
+  // stranger, gets an invitation the user being minted, and joins with it. A
+  // knock on a public invitation births nothing, so she holds no standing at
+  // the desk afterwards. If she already holds `user`, this is a reconnect and
+  // nothing is minted.
+  async enter(desk: Invitation, proof: JsonObject): Promise<Blueprint | { error: string }> {
+    if (this.standings[USER]) return this.tools();
+    const inv = await this.knock(desk, 'device', { proof });
+    if (isSilence(inv)) return { error: 'silence' };
+    if (isWord(inv)) return { error: wordOf(inv) };
+    if (!inv || typeof inv !== 'object' || Array.isArray(inv) || 'error' in inv) return (inv as { error: string }) ?? { error: 'no invitation' };
+    return this.join(inv as unknown as Invitation);
+  }
+
+  // Knock with an invitation, hand the far being one back so she can push,
+  // and take her as `user`. The only moment a standing is born here. A being
+  // who answers the hello with an error object is a being who answered: she
+  // is taken all the same, and the way back she did not take is dropped, so
+  // any world's public being may admit a guest, hello or not.
+  async join(invitation: Invitation): Promise<Blueprint | { error: string }> {
+    if (this.standings[USER]) {
+      // A standing the far being removed is not one: she drops it and joins
+      // afresh, so an identity forgotten at the user being can be let in again.
+      const had = await this.tools();
+      if (!('error' in had) || had.error !== 'removed') return had;
+      this.standings.remove(USER);
+      this.occupants.remove(PUSHER);
+    }
+    const mine = await this.invite(PUSHER);
+    if (mine === null) return { error: 'user is taken' };
+    const out = await this.knock(invitation, 'hello', { invitation: mine as unknown as JsonObject });
+    if (isSilence(out) || isWord(out)) {
+      this.occupants.remove(PUSHER);
+      return { error: isSilence(out) ? 'silence' : wordOf(out) };
+    }
+    if (out !== null && typeof out === 'object' && !Array.isArray(out) && 'error' in out) this.occupants.remove(PUSHER);
+    await this.take(USER, invitation);
+    return this.tools();
+  }
+
+  // Her describe, as the user being shows it to her. This is the tool list.
+  async tools(): Promise<Blueprint | { error: string }> {
+    const st = this.standings[USER];
+    if (!st) return { error: 'not joined' };
+    const bp = await st.ask();
+    if (isSilence(bp) || isWord(bp)) return { error: isSilence(bp) ? 'silence' : wordOf(bp) };
+    return bp as Blueprint;
+  }
+
+  // One call from the side, one ask on the standing. The three words pass
+  // through untouched; the side renders them.
+  call(name: string, args: JsonObject = {}, wanted?: Wanted): Promise<Answer> {
+    const st = this.standings[USER];
+    return st ? st.ask(name, args, wanted) : Promise.resolve({ error: 'not joined' });
+  }
+}