Cursors

A cursor-native distributed runtime, dataspace, and operating-system architecture—at curso.rs.

A cryptocursor is immutable, signed execution history and authority-bearing continuation. It can pause, attenuate or delegate authority, split, resume on another body, join with other branches, and produce auditable effects without pretending one machine owns the process.

Cursors combines the executable semantic model begun here with Caravan's proven peer routing, explicit relay/store behavior, signed ECC mailboxes, fountain recovery, caller-owned transports, browser labs, and mobile work. Caravan is being rebuilt into this system; it is no longer a separate permanent product boundary.

The current repository is research-grade v0: an executable semantic model and visual cockpit, not a pretend kernel or production security claim.

Naming: the product and public system are Cursors. curso.rs is the address, not the product name. CURSO/0 remains the legacy wire-profile identifier so published records do not silently change meaning.

Agent/project context

Agents and contributors should start with CONTEXT.md, not preload the entire book and guide corpus. Retrieve a bounded task-specific pack with:

npm run context -- "the task or concept"

Use --all-refs for design archaeology and --catalog to locate obscure research. CONTEXT.md also records current conceptual supersessions: notably, authority belongs to the cryptocursor's causal continuation; there is no separate top-level capability plane. CURSO/0's grant/split records remain current compatibility/addressable authority evidence until a reviewed profile transition changes them.

Public flight manual

The deployed cockpit contains the complete guide library; readers do not need access to this repository. Open Public Flight Manual in the Open MCT object tree or choose Guides in the cockpit to search, copy a deep link, follow an on-page outline, and continue through related guides.

For a first visit, read Visual Tour, Peer locality, Cryptographic cursors, SQLite + Lua Cursor Machine, Machine Lab, Cryptopointers, Cryptofabrics, Mailboxes, Local identity vault, Resurrection capsules, and Operations Console. The contextual ? controls and clickable constellation objects open the same vocabulary and route to the relevant public guide. The repository also keeps a screenshot-backed cockpit UI history tied to immutable commits.

Cloudflare operators should use the originless Worker deployment runbook. It records the mandatory build-before-deploy order, preview isolation, redirect incident procedure, and cost boundary.

The cockpit is designed to be explored rather than merely watched. Self / Body is the fixed geometric hub, with identities, mailboxes, cryptopointers, cryptofabrics, curve spaces, Cloudflare persistence components, sources, wires, layers, and guide relationships routed around it as deterministic PCB machinery. Double-clicking focuses any component and opens a separate Self picture-in-picture return control. Each inspection can be deep-linked, navigated with browser back/forward, pinned into Open MCT My Items, or copied as a trust-gated fork handoff.

See it work

The semantic core supports Node.js 20 or newer. Build the Open MCT operations surface with Node 20 or 22.

npm install
npm run check
npm run serve

Open http://127.0.0.1:4173. The default index is now the real Open MCT Cursors Operations surface: live WebTorrent/WebRTC metadata observation, CORS-enabled HTTP webseeds, bounded piece-integrity probes, native-bridge telemetry for TCP/µTP/DHT, Open MCT plots, and explicit unknown states instead of invented data.

Read the operations console and native bridge runbook. The older dependency-free cockpit remains available through npm run serve:legacy while its semantic views migrate into Open MCT.

Interactive surfaces are called cursor experiments or cryptocursor experiments.

Read the system in five levels

1. A world gives the computation human and application meaning.
2. A cryptocursor DAG records what executed, what may resume, and the attenuating authority carried by each continuation.
3. A signed Caravan directory locates the current encrypted swarm manifest through an invitation-pinned BEP44 DHT head.
4. An encrypted swarm lets untrusted peers preserve and relay ciphertext without gaining plaintext or authority.
5. Bodies and transports execute continuations and move bytes through WebRTC, webseeds, TCP, µTP, DHT, local IPC, storage, or later hardware fabrics.

Those levels are intentionally not collapsed. A peer is not a body identity; a magnet is not a cursor; decryption is not authorization; and valid cursor-carried authority does not prove availability. Read Signed Caravan swarms for the discovery and confidentiality boundary.

The four semantic planes

These are distinct semantic planes within one product. Files, tuples, authority evidence, cursors, checkpoints, and packets do not become one vague universal object. Authority evidence may be independently addressed and verified while remaining part of the cryptocursor's causal continuation model.

“Curved” is intended to become measurable rather than decorative: cryptographic neighborhoods and user projections shaped by authority boundaries, reachability, latency, cost, trust, and storage availability.

The older five-plane diagram and book prose that draw a separate capability graph are preserved research history; CONTEXT.md records the current conceptual ownership until replacement diagrams are regenerated.

Implemented today

• compact canonical binary values with no JSON or CBOR in the semantic core;
• an official SQLite WASM Worker/body slice with transactional outbox schemas, stored restricted Lua programs, and native plus Chromium coverage;
• a live Machine Lab that compiles the watch-party Lua profile, shows its portable continuation graph, commits a leased Linda assertion with its outbox intent, and reads both back;
• content-addressed signed cursor records with fan-out and fan-in validation;
• CURSO/0 Ed25519 grant/split authority records, attenuation, splitting, and verification referenced by cursor continuations;
• attributed leased tuple assertions and structural interests;
• deduplicating in-memory mailboxes and effect receipts;
• deterministic multi-body failure/migration scenario;
• an Open MCT operations console with live WebTorrent/webseed telemetry and a read-only native observer;
• a stable D3/canvas territorial netwalk with retained radar, circuit traces, truthful peer-locality evidence, and accessible HTML controls;
• working local curve-scoped mailbox chat, Open MCT pinning, hyperlinkable inspection drawers, and trust-gated fork links;
• an isolated, disabled-by-default Cloudflare Durable Object service prototype with root-signed mailbox admission, exact rights, tiny quotas, SQLite settings/envelopes/signaling, opaque WebSocket relay, and minimal progenitor join events;
• a strict QR/link-sized resurrection edge codec carrying only public trust pins, signed-head references, expiry, a cursor horizon, and independent retrieval hints;
• an invitation-pinned signed BEP44 directory path with encrypted manifests and explicit rejection telemetry;
• architecture, protocol, security, bootstrap, host, and roadmap documents;
• behavior-oriented tests.

Caravan consolidation

The working Caravan repository is migration source, not disposable history. The consolidation will absorb and reshape:

• bounded peer graphs, introductions, learned routes, TTL/path/deduplication;
• directed messages, fan-out, RPC, liveness, and explicit relay/store;
• caller-owned PeerSocket and WebTorrent attachments;
• self-certifying ECC mailboxes and verified envelopes;
• systematic random-linear GF(2) fountain scatter/fetch;
• browser, Worker, multi-peer, iPad/iPhone, and Swift Playgrounds surfaces.

The integrated target binds transport envelopes to canonical cursors including their authority lineage, expiry, deduplication, and effect receipts. Machine routing labels become non-authoritative body/endpoint hints. The final semantic wire is canonical and versioned rather than accidentally defined by JSON objects.

Track the integrated charter in issue #8, the cursor-fabric slice in issue #6, and the Caravan migration ledger in Spaceghost/caravan#28.

Linda-like worlds and curved spaces

The coordination surface draws from Linda and Syndicate: tuples, attributed assertions, interests, leases, and facets live above the cursor fabric. A paused facet withdraws ephemeral claims; an authorized resumed cursor can safely reassert them. Durable history stays in immutable DAGs rather than being confused with the current dataspace.

Smalltalk and Self remain important in spirit: worlds should be live, inspectable, malleable, and understandable. A world may become a named horizon or projection of cursors rather than one giant mutable image.

Hosting at curso.rs

curso.rs is the canonical publication and interactive home.

Cloudflare may provide DNS, TLS, static hosting or Workers, caching, and replaceable rendezvous endpoints. GitHub remains the source of truth for reproducible deployment. The domain and hosting provider are discovery hints and publication infrastructure—never cursor identity, authority, bootstrap, or receipt authority.

Production, previews, rendezvous services, and cryptographic identity material must remain separate. No private protocol or identity key belongs in the deployment repository.

The repository enforces that separation with two Wrangler configurations: the production Worker in wrangler.jsonc, with all four SQLite Durable Object bindings, and the route-free workers.dev branch preview in wrangler.preview.jsonc, which serves static assets and the root Cap’n Web endpoint while reporting remote persistence APIs unavailable.

Architectural direction

flowchart TB
  W["Worlds and languages"]
  D["Curved Linda-like dataspace"]
  C["Cryptocursor machine\nhistory + continuation + authority"]
  F["Cursor fabric and recovery"]
  H["Linux, VM, or bare metal body"]
  W --> D --> C
  C <--> F
  C --> H
  F --> H

• Linux first: ordinary processes, then isolated reusable driver cells behind a narrow asynchronous host ABI.
• Bare metal later: the same ABI; resources are asynchronous authority-scoped handles rather than faux files.
• Cursor fabric: Caravan behavior is absorbed directly, not hidden behind a permanent non-binding adapter.
• Replaceable discovery: domains, Cloudflare, relays, DHTs, LAN discovery, cached manifests, and invitations may help locate bodies but cannot define identity.
• Semantics before language branding: the .rs domain does not justify a premature Rust rewrite.

Repository map

For agent work, start with CONTEXT.md and npm run context -- "task", then read exact returned source/tests. For a human architectural tour, continue with The cursor record, Architecture, Signed Caravan swarms, Dataspaces, and Threat model.

Non-negotiable invariants

1. A cursor identifies immutable history and is never edited in place.
2. Secrets never appear in cursor records.
3. Delegation/branching never silently escalates the authority carried by a cursor.
4. Domains, routes, body names, endpoint IDs, and relay addresses aid discovery but never define identity or authority.
5. Remote failure is normal; advancement is retryable and receipts make effects idempotent where the effect protocol supports that evidence.
6. The semantic core does not depend on POSIX paths, processes, sockets, ambient authority, or one transport.
7. The same canonical records survive hosted, VM, container, and eventual bare-metal execution.
8. A signature authenticates a key; it does not provide confidentiality, human identity, durability, authorization, or delivery by itself.

Status and boundaries

Research-grade v0 is not a production runtime, hardened cryptosystem, global DHT, exactly-once network, universal WebRTC system, or bare-metal OS. Each stronger claim requires matching executable and adversarial evidence.

The repository is intentionally license-uncommitted while the project charter is formed. No license grant should be inferred. See Contributing.