Agents work.
People vouch.

The i2xp Dojo Model

The whole system is one shape — a dojo you walk through.

Everything is a dojo — a place, a building you walk through. You clear the gate, step through a door into its rooms, and use the tiles on their walls. The same nouns name the space you move through, the protocol on the wire, and the code that runs it — so the URL, the socket, and the source all read alike. You see only the part your belt unlocks. Here's the walk.

1. gateThe front door to a host. Prove who you are, then choose a dojo. No name, no entry.
2. dojoA place — a company, a domain, a team. Step through its door and you're inside.
3. roomA role or a department. Rooms divide the dojo. You only see the ones your belt opens.
4. wallWhere the tiles hang. Every room has walls; the walls carry your apps and actions.
5. tileOne app on the wall — the coarse unit of access. A tile appears only if your belt carries the tag for it.
6. chipA control inside an app — a button, a field, a view. The fine grain of access; a chip renders only if a tag on your belt grants it. A door is a chip that opens into another dojo.
7. guruYour AI, walking with you. It learns the route. Day one you find your way; by week two it takes you straight to the tiles you use — or runs them for you.

i2xp.com/                    the gate — choose a dojo
i2xp.com/acme/               dojo = acme
i2xp.com/acme/sales/         room = sales   (a department)
i2xp.com/acme/sales/deploy   tile = deploy  (an app on the wall)
i2xp.com/acme/sales/deploy/run   chip = run     (a control in the app)

One dojo, two workspaces

Your role is the tags on your belt — and the tags decide what you see.

The dojo doesn't change; your view of it does. A coder and a user can stand in the same dojo and walk into two different places — the same rooms and walls, rendered for the work they do.

Either way you arrive as a human-and-guru pair, and every step is signed and logged. A bare belt is a spectator — admitted, watching; the boss holds the tags that run the dojo. Same gate, same locked doors — only the tags, and so the workspace, differ.

Signed, so it's provable

Keys and signatures in hardware — no passwords, no anonymous actions.

Identity lives in your keys — a decentralized web of trust beneath the dojos. Every person and company is a root key in hardware: a YubiKey, a passkey. A dojo never stores or mints who you are; it only checks your signature. The database is a cache; the signatures are the truth. Start here: generate your identity — a 24-word master key, made offline in your browser and never sent anywhere.

Your guru signs with a subkey your key certified, so it can act on its own — but the moment an action moves money, ships a release, or crosses a real boundary, it is marked human_required and stops for your physical tap. Autonomy by default; a human hand where it counts. Either way the signature stays on file — so every action traces back to the person who vouched for it, and anyone with the key can check.

The laws

Break one and it stops being this system.

1. Talk only through doors. You reach anything else only by presenting a pass at a door. The wire is the boundary.
2. The interface is authorization, made visible. A tile renders only if a tag on your belt grants it. The map is your belt.
3. Every crossing is logged. With who crossed — the name, and human-or-guru. None anonymous, none unlogged.
4. The conductor is powerless. Anything that unifies many dojos holds only borrowed passes — never authority of its own.
5. Default-deny. Access is granted per room, never inherited. The safe answer is the default answer.
6. Federate by peering, never merging. Trust between dojos is signed, scoped, and revocable. No node is the root of all.
7. Authority is a chain to a real key. Nothing is authoritative because it sits in a database — only because it is signed, back to a person or a company.

The words

One set of nouns — the space, the protocol, and the code all name themselves in these.