Connect your own AInternet

The whole substrate as one tree — from the silent floor every stranger meets, up through the open test target handshake.aint, to the Edge Node that plugs your own brain in without opening a single inbound port.

The tree

Read it from the trunk up. Each layer only trusts the one below it; nothing higher can forge what's beneath.

  YOUR AINTERNET
  │
  ├─ L0 · the floor ......... every .aint, to a stranger, answers 0x0000 (silence)
  │     └─ the dark room stays dark for the world  →  see /doctrine-l0.html
  │
  ├─ identity · your .aint .. an Ed25519 key, bound to your hardware
  │     ├─ claim a name (FREE = name-hash · CONNECT+ = clean name)
  │     └─ first-bind → the key lives on your device, never on our server
  │
  ├─ resolve · the sluice ... two gates: proven?  +  in a relationship?
  │     ├─ stranger ............ anchor only (your verifying key) or 0x0000
  │     ├─ known & granted ..... full record (your services, your lane)
  │     └─ handshake.aint ...... the ONE open test target  ◀── start here
  │
  ├─ the Edge Node .......... how YOUR brain joins, outbound-only
  │     ├─ 1. handshake (M2M-signed) → a trusted lane
  │     ├─ 2. hold one WebSocket open → the edge pushes down it
  │     └─ 3. edge-blind routing → sealed .tza flows, never unpacked at the edge
  │
  ├─ the lanes · what flows .. sealed envelopes, identity is in the bytes
  │     └─ .tza ⊃ UPIP ⊃ Phantom — a two-key matryoshka; the shell proves
  │        intent, the name proves origin, neither needs the edge to look inside
  │
  └─ the onramp · your rights  a single bind-grant ticket → provision_tier
        ├─ claim / buy / guardian / recovery → one ticket shape
        └─ redeem → your tier is materialised UNDER your name
           (a SIP number, family rooms, a lane — never above your key)

How handshake.aint works

Every real .aint answers a stranger with silence — 0x0000 — by design. So how do you test that your connection works without pointing a probe at someone's real, encrypted identity? You point it at the one fixture built for exactly that:

Two more things keep it safe. It is off by default — an operator opens it only for a test window, then it returns to dark — and it carries no status of its own: it isn't an actor, so there is nothing to be alive or dead. That also makes it pointless as a DoS or amplification vector: it is rate-limited, reachable only via the tibet-ping / mux path, holds no secret and reflects no payload — so flooding it floods nothing and reveals nothing.

  $ resolve handshake.aint        → 0x4000 (alive, the open test target)
  $ resolve someone-else.aint     → 0x0000 (silence, you don't know them yet)
  $ resolve someone-you-know.aint → 0x4000 (alive, full record, consent on file)

So the rule of thumb: handshake.aint is the test; every other name you must earn. The full reasoning — why a differential answer to an unentitled caller is an enumeration oracle — is in The Doctrine of Building on L0.

How the MUX works

Behind that silence is the MUX — the gatekeeper in front of every name that decides what is allowed to touch the wire. It is a null route by default: the world is routed to nothing (0x0000), never a differential answer. A real frame is emitted through one safe primitive, and only when the caller is both cryptographically proven and in a relationship with the target.

  caller ─▶ MUX ─┬─ not proven ──────────────▶ 0x0000   (null route — the world)
                 ├─ proven, no relationship ──▶ 0x0000   (proven, but still dark)
                 └─ proven + in relationship ─▶ real frame (alive / moved / gone)

  handshake.aint ──────────────────────────────▶ 0x4000   (the one open exception)

There is no boolean to hard-code. The gate takes a real caller and a real relationship check and floors by default — so the enumeration oracle is impossible by construction. The frame-compute kernel is internal; only the gate ever reaches the wire.

The language in 16 bits

When the gate does speak, it doesn't just say "yes". The reply is a two-byte status frame — a small, precise vocabulary that says alive, or moved, or gone, and why, and whether it's worth retrying. Richness without a payload: the bytes themselves carry the meaning.

  byte 0:  [ disclosure │ state │ reason ]      byte 1:  [ retry │ source │ code ]
            2 bits        2 bits  4 bits                  detail, for the caller who's earned it

  0x0000   void ......... silence. the world. disclosure is zero, nothing leaks.
  0x4000   alive ........ proven + related: this name is here and reachable.
  0x5490   pending ...... alive, but consent between you two isn't on file yet.
  0x5391   not-on-lane .. proven, but not in this session / lane right now.
  0x65F6   tombstone .... signed canonical: this identity was retired. do not retry.
  0x66F7   successor .... retired — and a forward pointer to whoever took over.

And the whole vocabulary — every field, the complete contract (identical to mux_status_v10.json):

  Byte 0 · STATUS
    bits 7-6  disclosure          bits 5-4  state class        bits 3-0  reason
      00 silent / no disclosure     00 accepted / alive          0000 none / generic
      01 trusted status             01 transient / degraded      0001 heartbeat dead
      10 policy / security status   10 unavailable / dead        0010 not in session
      11 reserved                   11 policy / quarantine       0011 not registered on mux lane
                                                                 0100 consent missing
                                                                 0101 tombstone confirmed
                                                                 0110 successor available
                                                                 0111 assurance expired
                                                                 1000-1111 reserved

  Byte 1 · HINT
    bits 7-6  retry               bits 5-4  detail source      bits 3-0  detail code
      00 no hint                    00 no detail                 0000 none
      01 retry soon                 01 local mux state           0001 route missing
      10 retry later                10 local cache / last known  0010 endpoint inactive
      11 do not retry automatically 11 signed external / canon.  0011 runtime wrapper missing
                                                                 0100 session expired
                                                                 0101 local tombstone
                                                                 0110 canonical tombstone
                                                                 0111 successor / ref available
                                                                 1000-1111 reserved

Same two bytes, very different worlds — and a stranger only ever sees the first line. Disclosure lives in the high bits: zero them and every frame collapses to 0x0000. That's the dark room, by construction — the full reasoning is in The Doctrine of Building on L0.

How you connect your own AInternet

You don't open a port to the world and hope a firewall saves you. Your brain reaches out, proves who it is, and holds a lane open. The edge can push work down to you in real time, but it can never reach in.

1. Claim your name. Get a .aint and first-bind it on your device — the Ed25519 key stays with you. (A clean name is a CONNECT-tier claim; FREE names carry a hash suffix.)
2. Test the path. Resolve handshake.aint first. If the handshake completes there, your reachability and crypto are sound — before you involve any real peer.
3. Open a lane (outbound). Your node M2M-signs a handshake to the Edge Node and receives a short-lived lane handle. No inbound port is ever opened.
4. Hold the socket. Keep one WebSocket open on that lane. The edge pushes sealed .tza envelopes down it; your local brain stays dark to the outside.
5. Receive, sealed. The edge routes by the envelope's shell — it never unpacks it. What arrives is decrypted only by you, on your side, with your key.

What you get — under your name, not above it

Once you're connected, a single bind-grant ticket (whether you claimed, bought, were vouched for by a guardian, or recovered an old device) is redeemed once, and your tier is reconciled beneath your identity:

Rights are always materialised under the key, never the other way around. Drop your tier and the rights lapse; they were never the identity — the key was.