Handing out identity

Not the reference book — the why behind the choices. Why an .aint is a domain and not just a name, how AINS routes it, the full suffix tree, and the one idea that ties it together: your suffix is a truncation of your right. Enough to see through the mist without reading all the docs.

An .aint is a domain, not just a name

A name like jasper.aint isn't a label you picked — it's a domain. Like any domain it has scope, and it can hold actors under it:

• Internal scope. Resolvable only inside your own system — your GPU, your VMM, the processes you spawn. The outside world never even learns these names exist.
• External scope. Resolvable across the network — your public face, the name someone reaches you by, under consent.

Same root, one tree. jasper.aint can have a private gpu.jasper.aint that only your own actors see, and still be reachable from the outside as jasper.aint — you decide what surfaces and what stays dark.

AINS is the DNS of identity

DNS resolves a name to a location — an IP — and then trusts the network to carry you there. AINS (the AInternet Name Service) resolves a name to an identity: who this actor is, how to reach them, and what proves them. DNS answers where is this host? AINS answers who is this actor — and how do I reach them, under consent?

Where handing out identity actually has a function

"Give your AI an identity" lands easily — people get why an agent needs its own name: so its actions are attributable, scoped, and revocable on their own. (AI is the easy sell.) But "give your phone an .aint" still sounds abstract. The function gets obvious the moment you go lower, to the things that plainly do work:

A GPU with an .aint coming

Not decoration — a grantable resource. The GPU is a named actor; an actor above it is granted the right to use it for a window, the work it does leaves a receipt, and the grant expires or is revoked. This job may use the GPU stops being a config line and becomes a consent you can prove and withdraw. (This is where compute-commons is heading — designed, building.)

A VMM with an .aint built June 2026

The machine that hosts your runtimes is itself a named actor, with rights attached, used by actors a level above it. So even the thing running your enclaves is accountable and consent-gated — it can be handed a runtime, prove it ran it, and be told to stop. In June 2026 we gave a runtime its own name and a host that carries it; the hosting layer is no longer anonymous plumbing.

Your phone is just the consumer-facing version of the very same logic: a thing that acts, so it gets a name, so its actions have a who. The GPU and the VMM only make the function impossible to miss — and they're why "hand identity out to everything that runs" isn't a slogan, it's the shape of the system.

The full tree — how a name levels up or scales down

Here's the part worth internalising. The suffix is a posture, not a different identity. Same actor underneath — the suffix says how proven it is right now. The hat it's wearing this moment, not the person. The person is constant; the hat changes with fresh proof.

A name levels up when it proves more — a .paint invite becomes a real .aint the moment it's claimed and bound to hardware; an .aint briefly wears .saint to sign one high-risk act. It scales down when assurance drops — a weak proof reads .faint; a failed check drops to .taint. None of that changes who it is. It changes what it may do this moment.

The idea that ties it together: your suffix is a truncation of your right

Identity is the key. Your full name — jasper.aint — is the whole, sovereign form. But when you act, the system doesn't haul your entire identity around. It carries a clipped form: the suffix that names the one right that's live right now.

jasper.aint            ← the whole, sovereign you — the key, at rest
   ├─ jasper.saint      one elevated act, then it's gone
   ├─ jasper.maint      tending the system, tightly scoped
   └─ jasper.raint      a runtime you spawned, ephemeral

That clipping has a name: apocope — dropping the end of a word. Your right is the apocope of your identity: the short, momentary form, valid only while you're in actor status. The act ends; it returns to .aint. These clipped forms are the working currency of the system — the circulated actor truncation — while the full identity stays at rest. The suffix moves; the key doesn't.

The tree only truncates downward

A proven root can be clipped down into any posture it's entitled to — a sovereign can be a .saint, a .maint, can spawn a .raint. But a low-level temporary actor can never climb up: a .raint cannot apocope itself into a .saint, because there is nothing above it, in its own right, to clip down to. Down-projection from a proven root: yes. Up-promotion from a leaf: never — that's the invariant the whole tree exists to guarantee.

Why the MUX is apocope, not a WAF

A WAF reads every request and tries to recognise attacks — signatures, rules, a forever game of catch-up where you're always one pattern behind the attacker.

The MUX never reads for badness. It asks one thing — what can you prove, right now? — and clips you to exactly that posture. It is the apocope at the door: the truncation made into a gate. Whatever can't prove a posture truncates to nothing — 0x0000, silence.

So why is this better than an account?

An account is a row someone else can close. IAM is policy someone else maintains in JSON. Here:

• A key, not a row. Nobody issues your name and nobody can revoke it from above.
• A condition, not a claim. You don't say who you are and get believed — you prove it, fresh, each time. There's no logged-in session sitting around to be stolen.
• Posture, not policy. Rights follow how you're proven this moment, computed by the substrate — not a rule an admin remembered to write.

That's the whole reason to hand identity out everywhere: when every actor has a name and proves it fresh, your system stops trusting where a packet came from and starts trusting who sent it — and can prove it did.