The dreggnet cloud · the userspace of Dragon's Egg

The cloud

A grain is a hosted app that belongs to you, not the host

A grain is a hosted program whose object is the source of truth: its mind is a committed cell, its economics are a lease, its confinement is an OS jail, and its history is a signed receipt chain welded to real kernel turns. So it can be rented, metered, driven, verified, forked, and reaped as a first-class value, not as an opaque vendor instance you have to trust.

rent

You pick a grain from the app store (a signed package whose ID is its author's key) and open a funded, cap-bounded lease. No value moves until it does, and the lease is bounded by the listing's terms, not the host's whim.

confine

The grain's body runs in an OS jail with exactly one granted egress door and its tools rooted in its own workdir. It physically cannot reach the network, the filesystem, or anything else it wasn't handed: deny-by-default, not policy-by-promise.

meter

Rent is drawn on a fused prepaid meter: the one atomic write that advances the meter is the same write that draws the reserve. Paying and metering can't drift apart: it's a type error, not app discipline. Fall behind and the grain lapses on next use.

receipt per step

Every admitted action becomes a real committed executor turn on the grain's cap-gated cell, and each step's receipt is a view over that turn. The meter itself is a kernel caveat, so a grain that skipped its own accounting still can't drive the on-ledger counter past its ceiling.

fork & rewind

Because the mind is a real cell, everything proven about cells is true of it. Fork a grain and the state copies but value and authority do not duplicate; rewind to an earlier root and a boundary mismatch is refused fail-closed: the live mind is never touched.

reap

A grain's lifecycle (created, running, sleeping, lapsed, reaped) is a state machine sealed on the lease cell and advanced only through legality-checked transitions. A delinquent lease lapses and is reaped; sleep and wake are checkpoint-and-restore.

Every grain is witnessed. You hold the handed-back artifact, re-run nothing, and re-check what it did: that the chain is genuine, the budget was never exceeded, and every receipt is a view over a committed turn. The cloud proves itself to you; you don't take its word.

How far the check reaches · stated honestly

Verifiability is a ladder, and each rung's checker runs every rung below it. We name where the trust still rests, and where the last rung's remaining residuals are, by name.

R0 · tamper-evident

The receipt chain is genuine, ordered, single-signer, and within budget at the tip. A third party can't re-derive the signing key and forge. The host still runs the signer: this is tamper-evidence, not host-independence.

R1 · renter-anchored

You hold a countersign key the host can't forge. Anti-truncation (it can't hide turns) and anti-rewrite (it can't rewrite an acknowledged one) are checked against your anchor, not the host's word.

R2 · actions are kernel turns

Every action is welded to a committed executor turn and every receipt is a view over one. The meter becomes a kernel caveat. It still trusts the executor host that committed the turns: it binds them, it doesn't re-execute them.

R3 · whole-history STARK

Built, with named residuals. The grain's finalized turns fold into one recursive proof and the accept decision is rendered by a Lean-proven verifier (r3_verify → r3VerifyCore, no Rust fallback); an end-to-end test runs it on a real driven session. What remains is named, not hidden: the fold anchors the EffectVM-model head rather than the on-ledger grain-cell head, multi-turn cross-continuity, and the reduction rests on the EngineSound STARK floor.

The userspace

Around thirty apps, each a verified cell

Every app below is a real program in the tree, a factory-born cell whose rules live in its installed cell-program and are re-checked by the verified executor on every turn. The guarantee in each pitch isn't asserted in a README; it's an executor refusal. Same shape throughout: a sovereign cell, cap-gated turns, a receipt anyone can verify.

composed from proven primitives · no new kernel effect per app, no placeholder signatures

Markets & value exchange, bounties, auctions, escrow, billing · conserving by construction

compute-exchange A compute marketplace A requester escrows a budget, a provider bids no higher, and the deal settles conservingly: no escrow agent, no off-chain coordinator. The job is a cell whose rules the executor re-checks; a settle that would mint or burn value is refused.

bounty-board Escrow-backed bounties Open a bounty with an escrowed reward; a worker claims it (first-claimer-wins), submits, and gets paid. A one-way state machine the executor enforces: a bounty cannot be stolen, replayed, re-priced, or paid twice.

sealed-auction Sealed, front-running-proof bids Agents compete by committing hashed bids, then revealing: no one can peek, copy, or front-run before the reveal. The winning bid settles atomically through the verified executor: all-or-nothing and value-neutral.

escrow-market Atomic swaps, no intermediary "I give you X iff you give me Y." Two distrustful parties each lock a conforming leg; the swap settles only when both are present, and either may reclaim its own leg until then. No one walks off with the counterparty's leg; no leg claims twice.

billing Invoices, caps & recurring charges A customer-facing billing plane with no new primitive: an invoice is a view over settled receipts that re-witnesses against them, and a spend cap is a real executor "402"; an over-cap charge is refused, nothing drawn.

subscription A publish/consume queue A message queue whose rules live in the cell, not an operator process. Only authorized senders may publish, the head advances by exactly +1, and every publish and consume leaves a real receipt: one enforcement loop, not two.

Governance & choice committees, ballots, constitutions, roles · authority that only narrows

governed-namespace A committee-gated route table A shared name/route table that only changes by governance: a member proposes, the committee votes, and the swap commits only once the threshold has signed and the dispute window elapsed. The tally is auditable on the cell itself.

privacy-voting One vote per ballot Each voter is issued a ballot cell they can spend exactly once; the tallies only ever count up; the poll closes exactly once. Tamper-evident by caveat. (Its named limit: this is one-vote-per-ballot with monotone tallies, not ballot secrecy.)

polis The governance layer M-of-N councils, constitution-as-program, forward-certified amendments, budgeted mandates, and pre-rotation identities: all factory-born cells the executor re-evaluates every turn. A light client can verify a council's correct evolution.

org Teams & roles (IAM) Organizations, members, and roles with no new authorization primitive: a role is an attenuation of the owner's authority. "Viewer is read-only" and "admin can't delete the org" are the same no-amplify lattice: a cap can never be forged wider.

Coordination & work orchestration, workflows, delegated tools · mandates a worker can't exceed

agent-orchestration Durable, auditable multi-agent runs A coordinator hands each worker an attenuated mandate: narrower tools, a sub-budget, a sub-task, strictly weaker than it holds. The run is crash-recoverable, and an auditor re-derives it from the receipt chain and is never fooled.

swarm-orchestration A swarm that can't pretend The in-memory twin: a coordinator dispatches to workers under one conserved budget. An over-budget or over-grant dispatch is refused by the executor in the fire path. Four small lies a loop might tell; four receipts the ledger keeps.

compartment-workflow-mandate A charter DAG that can't skip a step A workflow (review → redact → sign) as a mandate cell: steps advance one at a time with no skips, each clearance-checked by label dominance and bounded by a per-step spend. An illegal jump or an under-cleared step is a real refusal.

tool-access-delegation Delegated tool / MCP access Hand another agent a narrowly-attenuated, rate-limited, time-bounded, revocable capability to call a tool on your behalf, without ever handing over your keys. Over-rate, past-deadline, and out-of-scope calls are refused; the grant revokes.

edge-mandate Attach over SSH, cap-bounded The hosted-attach model: instead of installing a runtime, a user attaches over SSH to a budget-bounded, cap-bounded session. Who attaches with what authority is a mandate cell, not a mutable file: over-budget refuses, and revoked stays revoked.

Identity, naming & provenance credentials, names, domains, tamper-evident history

identity Verifiable credentials Issue, hold, and present credentials with real signatures, a thin userspace shell over the credential core. The zero-knowledge heavy lifting (blinded merkle, predicate disclosure, ring proofs, non-revocation) lives in the primitive underneath.

nameservice A federation name directory The anchor app the others are patterned on: a name directory built entirely from dregg-native primitives. A name is granted inside a federation, sealed at registration, and rate-limited against Sybil spam by a per-epoch creation budget.

domains Bring your own domain Point your own DNS domain at a published site: a domain binding is a cell. An ACME-style proof of DNS control is required before any traffic or certificate routes; an owner takeover or an un-verify is an executor refusal.

agent-provenance Tamper-evident agent memory An agent posts its claims, tool-calls, and outputs to an append-only blake3 hash chain: each entry frozen once written, the head only ever growing. Any party recomputes the chain link-for-link, and a single tampered entry breaks it.

supply-chain-provenance Single custody as a conservation law A custody handoff moves the sole custodianship forward, advances a provenance epoch, and appends a tamper-evident link. A party claiming custody it doesn't hold is refused, and a provenance summary is an attested query a light client can't be fooled by.

Hosting & durability leases, object stores, vats, quotas · the cloud's own primitives

execution-lease Durable execution you can rent The first primary resource of the agent economy: a fly.io-lite / cloudflare-lite provider leasing metered durable execution, with no new kernel effect. The durable image lives in the cell's heap; a rewind or forge of the checkpoint cursor is a real refusal.

storage-gateway-mandate A gated object store A content-addressed store as a mandate cell: GET / PUT / LIST bounded by an authorized key-prefix, a read-clearance label, and a volume budget. An out-of-prefix write or an over-debit is an executor refusal, not a gateway check.

vat Have a dregg computer A persistent, durable, forkable World you rent and reach from any starbridge, and cannot be lied to. It lives in the cloud but belongs to you: its history is receipted, so the provider running it can't forge what it did. Launch, sleep, wake, reap.

guard Abuse-governance per subject What makes a permissionless (KYC-free) substrate responsibly openable: a per-subject quota / rate ceiling (the 402 / 429 shape) plus an account-standing slot only a governance-gated turn can move. A subject can never flip its own standing.

kvstore A rollback-proof key-value store A verified register store with a live header: every put and delete is a receipted turn a light client can replay. The store version never rolls back and the entry count never overflows: a reordered or replayed mutation is an executor refusal.

Play & worlds games, rooms, galleries, multiplayer · the same guarantees, at play

tussle Verified joint-combat A Toribash-style match: two figures fight by posing their joints, each a typed enum slot. A move runs commit → reveal → resolve with real fog-of-war, and the contact score folds through the verified executor as a conserving ring: no toy combat engine.

first-room The first room of the living world A composition exemplar that welds other apps' organs into one runnable scenario: a colonist does its mandated job step by step, is paid from a conserving escrow, then a try-to-cheat battery: each cheat refused in-band with the receipt-why.

gallery A sealed-submission gallery Commit-reveal curation with a tamper-proof board: artists commit sealed submissions, the curator closes the call, then artists reveal. A committed piece can't be swapped, the phase never rewinds, and the featured choice freezes once announced.

branch-stitch-multiplayer Fork one world, stitch it back The distributed-Houyhnhnm flagship, runnable: two participants fork one shared verified world, diverge on their own branches, and rejoin through a settlement-sound gate. Disjoint edits fold clean; a clash is refused; a revoked cap can't ride the rejoin.

The flagships

Two grains that host a whole community

Most apps are one cell. Two are whole services hosted as grains, the workshop and the town square, built the same way: confined, cap-metered, federated, receipted. Caps all the way down.

the workshop

The code forge

A forge with no server that can lie. It isn't "GitHub on dregg"; there is no git underneath. Dregg's own patch theory is the version control: a repo is a cell, a commit is a receipted turn, and a pull request is a fork you review and stitch.

Merge is a theorem. The merge is a pushout (provably the least state containing both edits), and a conflict is a first-class object you resolve, never a silent stomp. You cannot rewrite someone's blame; a forged history is inexpressible.
CI is the proof. A check runs in a confined grain whose only meaningful output is committing the receipt that gates the merge. No trusted runner: the runner physically can't reach the network or touch anything but its scratch dir; the proof is the pass.
A PR can be a bounty. One signed terminal "checks passed" receipt can light three gates at once: the merge, a bounty payout, and a compute-market settlement. Merge the PR and the worker gets paid, off the same witness.
Access is capabilities. "Can merge to main" is a cap you hold and can attenuate, delegate, or revoke: the same lattice as everything else, not ACL rows.

Honest scope: the forge core (patch theory, sound merge, conflicts, the receipt-gated check) is built and hardened. Hosting it as a federated grain and carrying a PR across the membrane is the named frontier.

the town square

The confined homeserver

A real Matrix server in a lockbox. The community your world lives in shouldn't need one trusted machine off to the side. So the homeserver runs as a grain, the last non-dregg-hosted piece of the inhabited world, brought inside.

A real homeserver, embedded. A production Matrix server (the continuwuity lineage) is compiled into the grain body as a library, not an opaque process wrapped in a box. Any Matrix client can still join a room; full ecosystem interop is kept.
Confined to one door. The body runs deny-by-default with a single storage door to its own database directory: sibling paths denied, revocable. No exec door, no ambient network. The tightest jail a real server can run in.
Metered and auditable. Its lease is cap-metered and reaped like any grain, and the interesting part (a room is a cell, a message an event) means the server's accept of a message can be surfaced as a verifiable turn. The relay is auditable, not a trusted black box.

Honest scope: the confinement design is proven and de-risked; the embedded server serves confined in a demonstrator. The one new kernel door (an inbound listen door for the confined tier) is a deliberate, ember-aware lane, not a shipped guarantee.

On the workbench: Hermes on a leash, a real self-improving agent whose every tool-call is intercepted and turned into a cap-gated, metered, receipted turn (or an in-band refusal). The interception seam works today; the fully confined agent body and forking a live session are being built; it earns a flagship slot when it's actually done.

Trustless serving

And a host that cannot tamper with what it serves

A grain runs your app; dregg.works serves its pages. Publish a minisite and you commit its blake3 hash to your cell in one cap-gated, receipted turn. The host then serves the bytes, but it has no way to change them. Every served page re-hashes itself in your browser and checks it against the commitment fetched from the ledger. ✓ match, or ✗ tampered, and you don't take the host's word for either.

1 · commit Publish A cap-gated turn writes blake3(page) into your cell. The commitment is the trust-bearing half: yours, on-ledger, receipted.

2 · serve Host the bytes <name>.dregg.works ships the raw bytes. Convenience, not trust: the host is untrusted infrastructure.

3 · verify Check it yourself The badge re-hashes the served body in your tab and compares it to the cell's committed hash. A tampered byte is caught before you trust a word.

Enter dregg.works Watch a whole history verify

The kernel proves. The userspace runs. The cloud hosts, and every layer of it hands you a receipt you can check, instead of asking you to trust the machine underneath.