# Cursors **A cursor-native distributed runtime, dataspace, and operating-system architecture—at [curso.rs](https://curso.rs).** A cryptocursor is immutable, signed execution history **and authority-bearing continuation**. It can pause, attenuate or delegate authority, split, resume on another body, join with other branches, and produce auditable effects without pretending one machine owns the process. Cursors combines the executable semantic model begun here with Caravan's proven peer routing, explicit relay/store behavior, signed ECC mailboxes, fountain recovery, caller-owned transports, browser labs, and mobile work. Caravan is being rebuilt into this system; it is no longer a separate permanent product boundary. The current repository is research-grade v0: an executable semantic model and visual cockpit, not a pretend kernel or production security claim. **Naming:** the product and public system are **Cursors**. `curso.rs` is the address, not the product name. `CURSO/0` remains the legacy wire-profile identifier so published records do not silently change meaning. ## Agent/project context Agents and contributors should start with [`CONTEXT.md`](CONTEXT.md), not preload the entire book and guide corpus. Retrieve a bounded task-specific pack with: ```sh npm run context -- "the task or concept" ``` Use `--all-refs` for design archaeology and `--catalog` to locate obscure research. `CONTEXT.md` also records current conceptual supersessions: notably, **authority belongs to the cryptocursor's causal continuation; there is no separate top-level capability plane.** CURSO/0's grant/split records remain current compatibility/addressable authority evidence until a reviewed profile transition changes them. ## Public flight manual The deployed cockpit contains the complete guide library; readers do not need access to this repository. Open **Public Flight Manual** in the Open MCT object tree or choose **Guides** in the cockpit to search, copy a deep link, follow an on-page outline, and continue through related guides. For a first visit, read [Visual Tour](docs/visual-tour.md), [Peer locality](docs/peer-locality.md), [Cryptographic cursors](docs/crypto-cursors.md), [SQLite + Lua Cursor Machine](docs/sqlite-lua-cursor-machine.md), [Machine Lab](docs/cursor-machine-cockpit-lab.md), [Cryptopointers](docs/cryptopointers.md), [Cryptofabrics](docs/cryptofabrics.md), [Mailboxes](docs/mailboxes.md), [Local identity vault](docs/local-identity-vault.md), [Resurrection capsules](docs/resurrection-capsules.md), and [Operations Console](docs/operations-console.md). The contextual `?` controls and clickable constellation objects open the same vocabulary and route to the relevant public guide. The repository also keeps a screenshot-backed [cockpit UI history](HISTORY-UI.md) tied to immutable commits. Cloudflare operators should use the [originless Worker deployment runbook](docs/cloudflare-deployment.md). It records the mandatory build-before-deploy order, preview isolation, redirect incident procedure, and cost boundary. The cockpit is designed to be explored rather than merely watched. Self / Body is the fixed geometric hub, with identities, mailboxes, cryptopointers, cryptofabrics, curve spaces, Cloudflare persistence components, sources, wires, layers, and guide relationships routed around it as deterministic PCB machinery. Double-clicking focuses any component and opens a separate Self picture-in-picture return control. Each inspection can be deep-linked, navigated with browser back/forward, pinned into Open MCT My Items, or copied as a trust-gated fork handoff. ## See it work The semantic core supports Node.js 20 or newer. Build the Open MCT operations surface with Node 20 or 22. ```sh npm install npm run check npm run serve ``` Open . The default index is now the real **Open MCT Cursors Operations** surface: live WebTorrent/WebRTC metadata observation, CORS-enabled HTTP webseeds, bounded piece-integrity probes, native-bridge telemetry for TCP/µTP/DHT, Open MCT plots, and explicit unknown states instead of invented data. Read the [operations console and native bridge runbook](docs/operations-console.md). The older dependency-free cockpit remains available through `npm run serve:legacy` while its semantic views migrate into Open MCT. Interactive surfaces are called **cursor experiments** or **cryptocursor experiments**. ## Read the system in five levels 1. A **world** gives the computation human and application meaning. 2. A **cryptocursor DAG** records what executed, what may resume, and the attenuating authority carried by each continuation. 3. A **signed Caravan directory** locates the current encrypted swarm manifest through an invitation-pinned BEP44 DHT head. 4. An **encrypted swarm** lets untrusted peers preserve and relay ciphertext without gaining plaintext or authority. 5. **Bodies and transports** execute continuations and move bytes through WebRTC, webseeds, TCP, µTP, DHT, local IPC, storage, or later hardware fabrics. Those levels are intentionally not collapsed. A peer is not a body identity; a magnet is not a cursor; decryption is not authorization; and valid cursor-carried authority does not prove availability. Read [Signed Caravan swarms](docs/signed-swarms.md) for the discovery and confidentiality boundary. ## The four semantic planes | Plane | Answers | Durable? | |---|---|---:| | Object DAG | What immutable material exists? | Yes | | Cryptocursor DAG | How did execution and authority advance, branch, attenuate, delegate, migrate, and join? | Yes | | Curved dataspace | What is asserted or wanted, and in which projected neighborhood? | Usually no | | Cursor fabric | How does material travel, store, relay, and recover? | Transport-dependent | These are distinct semantic planes within one product. Files, tuples, authority evidence, cursors, checkpoints, and packets do not become one vague universal object. Authority evidence may be independently addressed and verified while remaining part of the cryptocursor's causal continuation model. “Curved” is intended to become measurable rather than decorative: cryptographic neighborhoods and user projections shaped by authority boundaries, reachability, latency, cost, trust, and storage availability. The older five-plane diagram and book prose that draw a separate capability graph are preserved research history; [`CONTEXT.md`](CONTEXT.md) records the current conceptual ownership until replacement diagrams are regenerated. ## Implemented today - compact canonical binary values with no JSON or CBOR in the semantic core; - an official SQLite WASM Worker/body slice with transactional outbox schemas, stored restricted Lua programs, and native plus Chromium coverage; - a live Machine Lab that compiles the watch-party Lua profile, shows its portable continuation graph, commits a leased Linda assertion with its outbox intent, and reads both back; - content-addressed signed cursor records with fan-out and fan-in validation; - CURSO/0 Ed25519 grant/split authority records, attenuation, splitting, and verification referenced by cursor continuations; - attributed leased tuple assertions and structural interests; - deduplicating in-memory mailboxes and effect receipts; - deterministic multi-body failure/migration scenario; - an Open MCT operations console with live WebTorrent/webseed telemetry and a read-only native observer; - a stable D3/canvas territorial netwalk with retained radar, circuit traces, truthful peer-locality evidence, and accessible HTML controls; - working local curve-scoped mailbox chat, Open MCT pinning, hyperlinkable inspection drawers, and trust-gated fork links; - an isolated, disabled-by-default Cloudflare Durable Object service prototype with root-signed mailbox admission, exact rights, tiny quotas, SQLite settings/envelopes/signaling, opaque WebSocket relay, and minimal progenitor join events; - a strict QR/link-sized resurrection edge codec carrying only public trust pins, signed-head references, expiry, a cursor horizon, and independent retrieval hints; - an invitation-pinned signed BEP44 directory path with encrypted manifests and explicit rejection telemetry; - architecture, protocol, security, bootstrap, host, and roadmap documents; - behavior-oriented tests. ## Caravan consolidation The working Caravan repository is migration source, not disposable history. The consolidation will absorb and reshape: - bounded peer graphs, introductions, learned routes, TTL/path/deduplication; - directed messages, fan-out, RPC, liveness, and explicit relay/store; - caller-owned PeerSocket and WebTorrent attachments; - self-certifying ECC mailboxes and verified envelopes; - systematic random-linear GF(2) fountain scatter/fetch; - browser, Worker, multi-peer, iPad/iPhone, and Swift Playgrounds surfaces. The integrated target binds transport envelopes to canonical cursors including their authority lineage, expiry, deduplication, and effect receipts. Machine routing labels become non-authoritative body/endpoint hints. The final semantic wire is canonical and versioned rather than accidentally defined by JSON objects. Track the integrated charter in [issue #8](https://github.com/Spaceghost/curso.rs/issues/8), the cursor-fabric slice in [issue #6](https://github.com/Spaceghost/curso.rs/issues/6), and the Caravan migration ledger in [Spaceghost/caravan#28](https://github.com/Spaceghost/caravan/issues/28). ## Linda-like worlds and curved spaces The coordination surface draws from Linda and Syndicate: tuples, attributed assertions, interests, leases, and facets live above the cursor fabric. A paused facet withdraws ephemeral claims; an authorized resumed cursor can safely reassert them. Durable history stays in immutable DAGs rather than being confused with the current dataspace. Smalltalk and Self remain important in spirit: worlds should be live, inspectable, malleable, and understandable. A world may become a named horizon or projection of cursors rather than one giant mutable image. ## Hosting at curso.rs [curso.rs](https://curso.rs) is the canonical publication and interactive home. Cloudflare may provide DNS, TLS, static hosting or Workers, caching, and replaceable rendezvous endpoints. GitHub remains the source of truth for reproducible deployment. The domain and hosting provider are discovery hints and publication infrastructure—never cursor identity, authority, bootstrap, or receipt authority. Production, previews, rendezvous services, and cryptographic identity material must remain separate. No private protocol or identity key belongs in the deployment repository. The repository enforces that separation with two Wrangler configurations: the production Worker in `wrangler.jsonc`, with all four SQLite Durable Object bindings, and the route-free `workers.dev` branch preview in `wrangler.preview.jsonc`, which serves static assets and the root Cap’n Web endpoint while reporting remote persistence APIs unavailable. ## Architectural direction ```mermaid flowchart TB W["Worlds and languages"] D["Curved Linda-like dataspace"] C["Cryptocursor machine\nhistory + continuation + authority"] F["Cursor fabric and recovery"] H["Linux, VM, or bare metal body"] W --> D --> C C <--> F C --> H F --> H ``` - **Linux first:** ordinary processes, then isolated reusable driver cells behind a narrow asynchronous host ABI. - **Bare metal later:** the same ABI; resources are asynchronous authority-scoped handles rather than faux files. - **Cursor fabric:** Caravan behavior is absorbed directly, not hidden behind a permanent non-binding adapter. - **Replaceable discovery:** domains, Cloudflare, relays, DHTs, LAN discovery, cached manifests, and invitations may help locate bodies but cannot define identity. - **Semantics before language branding:** the `.rs` domain does not justify a premature Rust rewrite. ## Repository map | Path | Purpose | |---|---| | [`CONTEXT.md`](CONTEXT.md) | compact agent/human semantic kernel and research map | | [`src/`](src/) | executable semantic core | | [`operations/`](operations/) | Open MCT plugin, live telemetry runtime, and operations views | | [`bridge/`](bridge/) | read-only native BitTorrent/WebRTC observer and signed Caravan DHT directory resolver | | [`web/`](web/) | legacy dependency-free cockpit during semantic-view migration | | [`examples/`](examples/) | runnable stories | | [`test/`](test/) | behavior-oriented specification | | [`protocol/`](protocol/) | canonical record specifications | | [`docs/`](docs/) | architecture, security, decisions, roadmap | | [`HISTORY-UI.md`](HISTORY-UI.md) | reproducible screenshot history and visual decisions | | [`bootstrap/`](bootstrap/) | non-authoritative discovery manifest design | For agent work, start with [`CONTEXT.md`](CONTEXT.md) and `npm run context -- "task"`, then read exact returned source/tests. For a human architectural tour, continue with [The cursor record](docs/crypto-cursors.md), [Architecture](docs/architecture.md), [Signed Caravan swarms](docs/signed-swarms.md), [Dataspaces](docs/dataspace.md), and [Threat model](docs/security.md). ## Non-negotiable invariants 1. A cursor identifies immutable history and is never edited in place. 2. Secrets never appear in cursor records. 3. Delegation/branching never silently escalates the authority carried by a cursor. 4. Domains, routes, body names, endpoint IDs, and relay addresses aid discovery but never define identity or authority. 5. Remote failure is normal; advancement is retryable and receipts make effects idempotent where the effect protocol supports that evidence. 6. The semantic core does not depend on POSIX paths, processes, sockets, ambient authority, or one transport. 7. The same canonical records survive hosted, VM, container, and eventual bare-metal execution. 8. A signature authenticates a key; it does not provide confidentiality, human identity, durability, authorization, or delivery by itself. ## Status and boundaries Research-grade v0 is not a production runtime, hardened cryptosystem, global DHT, exactly-once network, universal WebRTC system, or bare-metal OS. Each stronger claim requires matching executable and adversarial evidence. The repository is intentionally license-uncommitted while the project charter is formed. No license grant should be inferred. See [Contributing](CONTRIBUTING.md).