Spaces:
Running
Running
| # Protected Integration Boundary | |
| ## Status | |
| Binding project rule for SignalMesh integrations. | |
| ## Purpose | |
| SignalMesh may publicly prove that unrelated runtimes become inhabitable, addressable, perceptive, and interoperable. Public proof must not disclose the unique machinery, proprietary workflows, or commercial implementations that create that result. | |
| The default classification for a new integration artifact is protected. Publication requires an explicit release decision. | |
| ## Architectural invariant | |
| QM owns execution, identity, credentials, scope isolation, sandboxing, memory, and local durability. | |
| SignalMesh owns ambient awareness, addressing, capability discovery, propagation, and inter-runtime perception. | |
| SignalMesh does not become QM's database. QM does not address another scope directly. Cross-scope awareness occurs through signals. | |
| ## Protected implementation | |
| The following remain private unless explicitly reclassified: | |
| - SignalMesh transport adapters and production wiring | |
| - scope-to-resident, resident-to-coordinate, and scope-to-frequency mapping | |
| - subscription authorization and audience derivation | |
| - SEC-Ω policy composition and authorization exchange | |
| - resident registration, liveness, lease, and tombstone behavior | |
| - durable event outbox, replay, retry, and deduplication behavior | |
| - signal-triggered wakeups and scheduler translation | |
| - MPort and ActionMesh capability-resolution logic | |
| - credential-availability negotiation and protected channel establishment | |
| - cross-runtime routing heuristics | |
| - proprietary use-case templates, sector presets, and automated workflows | |
| - monetization, managed relay, entitlement, metering, and commercial routing logic | |
| - production deployment configuration, topology, private endpoints, and operational thresholds | |
| - benchmarks that reveal exploitable internal limits or proprietary routing decisions | |
| - Kyklos, Byte, Atlas, world-skin, and resident behavior that constitutes operational product identity | |
| - MIDEFreq, MakeItSo, local SCAN/SEEK, capability forging, release assembly, and private development automation | |
| Protected code belongs in this private repository or another explicitly private system. It does not belong in a public QM fork, public Space source, public example, screenshot payload, build log, test fixture, issue, commit message, or pull-request description. | |
| ## Secret prohibition | |
| Signals, public telemetry, examples, and demonstrations never contain: | |
| - cookies | |
| - API keys | |
| - access or refresh tokens | |
| - session credentials | |
| - raw keychain values | |
| - private environment variables | |
| - private filenames or customer data | |
| - complete prompts, conversations, or memory | |
| - internal authorization capabilities | |
| A signal may state that an authorized capability or credential is available. It never carries the credential value. | |
| ## Public proof | |
| Public artifacts may show: | |
| - the generic ambient-context interface | |
| - bounded validation and security properties | |
| - synthetic or deliberately public signals | |
| - the two-scope zero-direct-communication proof | |
| - heterogeneous harnesses receiving the same ambient fact | |
| - Atlas/world visualization of intentionally public resident metadata | |
| - signal identifiers, coordinates, timing, and acceptance decisions that reveal no protected rule | |
| - aggregate benchmarks with reproducible methodology | |
| - mock adapters and non-production fixtures | |
| - screenshots and video demonstrating effects | |
| - supported public protocol behavior and API references | |
| The public claim is the outcome: | |
| > Independent durable agent computers can become mutually aware without direct communication, shared memory, polling, or runtime-specific wiring. | |
| Public consumers may learn the canonical event semantics. They do not receive the production adapter, authorization graph, routing implementation, or commercial workflow. | |
| ## Canonical demonstration | |
| The initial showcase uses two isolated QM scopes with different harnesses. | |
| - Scope A discovers a deliberately public synthetic value. | |
| - Scope A emits a canonical signal. | |
| - SignalMesh accepts and projects the signal. | |
| - Scope B begins a later inference with the value already hydrated. | |
| - B makes zero calls to A. | |
| - B performs zero shared-memory reads. | |
| - B performs zero harness- or tool-initiated retrieval calls. | |
| - The adapter performs one bounded pre-inference hydration. | |
| - The audit exposes only identifiers, hashes, sources, audiences, and decisions. | |
| The demonstration environment contains no production credentials, customer information, proprietary sector preset, or monetizable workflow. | |
| ## Release gate | |
| Before anything leaves a protected repository, verify all of the following: | |
| 1. The artifact proves an outcome rather than teaching the protected implementation. | |
| 2. It contains no secret, private endpoint, real customer data, credential path, or raw authorization value. | |
| 3. It does not expose scope mapping, subscription policy, routing heuristics, retry behavior, or production topology. | |
| 4. Mock data cannot be correlated with a private resident, customer, workflow, or deployment. | |
| 5. Screenshots and recordings are inspected for logs, browser state, URLs, tokens, filenames, and hidden panels. | |
| 6. Benchmarks reveal methodology and results without revealing protected operational thresholds. | |
| 7. The public diff contains only intentionally public code. | |
| 8. A fresh-context reviewer explicitly evaluates proprietary leakage before release. | |
| 9. The release decision and approved artifact hash are recorded. | |
| If any answer is uncertain, the artifact remains protected. | |
| ## Repository placement | |
| - `Ig0tU/qm`: public generic resident-runtime interface and deliberately selected showcase code | |
| - `Ig0tU/SignalMesh`: private adapter, authorization, routing, workflow, and production integration | |
| - Hugging Face SignalMesh Space: canonical hosted technical proof and intentionally public runtime behavior | |
| - MIDEFreq and MakeItSo: private development forge | |
| - Kyklos: human-facing product surface | |
| Public and private components may share protocol contracts. They do not share proprietary implementation by default. | |