Change Log

Complete version history of this specification. Every published version has been verified in real systems — 1.0 and 1.1 ran across Windows, macOS and iOS applications, over LAN and over an internet relay. 2.0 re-derives the specification from the implementation as it now runs, after the record model advanced and the text did not follow. Errata that change no requirement may be noted here without a version bump.

Version	Date	Changes
2.0	2026-10-08	MMP 2.0 update 1: the wire elements the first Core Secure runtime uses, and the §6.6 errata (2026-10-08; no version bump). One publication of the drafts that sym 0.14.0 implements, each reviewed against that implementation and against the §6.6 rewrite, together with the §6.6 errata from its release review. The wire version is unchanged: every new frame is additive, and a node that does not know one ignores it (§7). What each part adds: §6.6 errata. The first implementation built to §6.6 resolved exactly as the reference does, and its review found gaps in what the section asked of a node around resolution. The signature entries of one statement now have unique keys, a shape rule checked before any signature work, so a copy cannot buy repeated checks under a pinned key. §6.6.8 states one budget rule: every statement a session delivers spends that session’s budget, asked for or not; the asker paces its pulls, pages and fetches to absorb a full page, so nothing it asked for is dropped; pending room is checked before a pending statement is verified; a pull resumes from its cursor and anti-entropy repeats with backoff while roots differ; and a by-id answer is a closure, the namers of namers to a fixpoint. §6.6.12 no longer claims that the pending limits bound fresh-key work. A node at its storage limit drops what is outside its live set first, then live statements in reverse authority order, and never drops an in-force revoke or an in-force anchor-level statement; it protects what is in force, not a kind of statement, so removals first stays true and the protected set stays bounded by the quotas. A node keeps what it holds across a re-pin and judges it again, and a node with no pin takes no part in authority exchange. The `mood` frame is registered: `{ type, mood, context, timestamp }`, mood at most 1,024 characters and context at most 4,096, with no sender fields and no valence or arousal; it is sealed on a Core Secure session, attributed to the session’s proven nodeId and name, and never stored, relayed or remixed. §9.2.2/§4.4.4 a CMB’s binding comes from its signed `metadata.to` (was draft #24). The relay envelope’s `to` is routing only; the binding is the record’s signed audience, bound into the sealed frame’s associated data: null is room-bound, the receiver is directed, anyone else fails the audience check. A nodeId has one lowercase spelling, compared exactly, in records, statements and the handshake hello alike; a directed record older than the receiver’s de-duplication window may be refused as a replay; the unsigned-field rule is stated for Core Secure, and Legacy Import keeps its own. §4.4.4 relay fan-out envelope, and relay-auth `room` and `engine` (was draft #25). A relay that lists `fanout` in the new `relay-peers` `features` accepts `{ fanout: [{ to, payload }, …] }`: one client message, counted once toward the rate limit, each entry delivered as a unicast, with nothing in the delivered bytes revealing the others. Relay limits are floors a relay must allow (§19.1: 25 messages a second, a burst of 300, 64 entries, and a 4,096-byte delivered allowance), not advertised values, and a sender keeps headroom below them. A relay never delivers a message over the allowance, even after re-serialising it, and drops a malformed unicast; in every form the payload is a JSON object. A `to` that is not a lowercase nodeId makes an envelope malformed; a sealed frame is never broadcast. `relay-error` carries `kind`, `code` and `reason`, and acting on `code` is optional. 4008 and the WebSocket closes 1001, 1009, 1011 and 1013 join §4.4.9. `relay-auth` gains `room` (addressing, never permission) and `engine` (a log label, never forwarded), and its nodeId is lowercase. §15.5 collapsed integration and §5.1 one discovery service type (was draft #17). When integration produces the incoming text unchanged, the receiver mints nothing, may keep the author’s record exactly as signed, and never attributes it to itself; the §15.8 tether and the §15.7 emission gate do not apply, and §17.2 is aligned. One DNS-SD service type, `_sym._tcp`, carries every room, with the TXT `room` now required (a per-room service type cannot carry the room identifiers §5.8 allows); the round-trip ownership exclusion is removed. During migration a node browses the per-room type only where it is a valid RFC 6335 service name, to reach 2.0 nodes that still advertise one, and must refuse a room mismatch both ways before advertising `_sym._tcp` for a named room. §5.1 the TXT `mmp` profile marker (was draft #22). Legacy and Core Secure nodes share one service type, so a Core Secure listener lists its versions in TXT `mmp`, a comma-separated list that is `mmp=2.0` today. A record without it is a legacy advertisement and is never dialled under another profile except through a configured Legacy Import route; a 2.0 listener closes a legacy one-frame handshake at once, bounding the work and logging it spends per remote address. TXT keys compare case-insensitively and the first occurrence wins (RFC 6763 §6.4). The marker is an unauthenticated hint: stripping it denies discovery, never downgrades a profile. §7.1/§18.2.1 sealed control frames, `control-encrypted` (was draft #26). On a CONNECTED Core Secure session every peer frame that is not a record travels sealed: records in `cmb-encrypted`, everything else (peer-info, wake-channel, mood, cmb-fetch, cmb-fetch-result, the four authority frames, error, extensions) as the inner frame of `control-encrypted`, under the same traffic keys and the same per-direction sequence, with its own AAD domain, `mmp-aead-control-v2`. ping and pong may go either way, and a sealed ping is answered with a pong. A clear error may be read but changes nothing; a sealed error with a Close action ends the session. A frame that opens advances the sequence, and refusing its inner frame changes nothing else. Authority statements are verified by §6.6.9 and §18.3.2, never by a registry or session key; records and an extension’s signed frames by the receiver’s binding for the nodeId they name (§3.4). A sender never seals a record from another room or for another recipient. A fetched record is matched by its recomputed cognition key and attributed, delivered or admitted only after full §8.8.5. `cmb-fetch` names no sender and `cmb-fetch-result` has no timestamp. The envelope has its own schema, `control-encrypted.schema.json`, and a new vector, `control-encrypted-v2`. §9.4 `cmb-anchors` and replayed context (was draft #30). The first sealed frame a node sends on a Core Secure session after admitting it is `cmb-anchors`, naming the records it is about to replay as context, or `keys: []`. It replays only its own `mmp-sig-v2.0` records that it may seal into that session, at most 50 named and 5 recommended, and a non-empty list at most once a minute per peer. A receiver may mark a listed record as replayed context only when its signed author is the session’s proven peer; the frame never changes verification, admission or weight. A relay client takes it as the sign that its server holds the new session (§5.2.2). This replaces the earlier runtime’s unsigned `_anchor` flag. §5.2.2 the handshake over a relay (was draft #23). Over a relay, where both peers dial and neither listens, the smaller nodeId is the client. A relay session is the §5.2 exchange carried in addressed envelopes, never broadcast, accepted only from the session peer’s `from`; a re-announced peer is probed with `ping`, not re-handshaked. An unconfirmed hello changes nothing. Supersession needs proof both ways: the server supersedes when it admits the new session and sends the mandatory sealed `cmb-anchors`, and the client supersedes only once a sealed frame other than an error opens on the new session, abandoning the new session and keeping the old after the handshake timeout. A replay is discarded on every transport; a gap must close the session, after a sealed 1010 `SESSION_CLOSED` where it can; a sealed error with a Close action ends the session, a clear one changes nothing, a failed handshake may send 1006 or 1007 in clear, and 1009 is sent sealed and never retried automatically. New error 1011 `UNKNOWN_SESSION` answers a frame for a session the receiver does not hold, limited per sender and overall, and prompts a re-handshake only when it names the client’s session or answers its probe, and the client is not already waiting on a newer session. 1008 is retained but no longer sent. §5.8.1 the `room-join` frame (was draft #31). A grant for a gated room is presented inside the confirmed session, as a sealed `room-join` sent first on every new session by a node that holds one, so the key it binds is compared with the key the session proved. The owner’s nodeId and key are pinned out of band and selected by room, never by the grant; the owner is recognised by both together. The receiver checks the schema first (integer times), verifies under §18.3.2, and requires its room, `grantedBy` the owner, the proven nodeId and key, the 24-hour cap, and validity within 5 minutes of skew either way. It decides admission before the session’s next frame, closes a session that presents no grant within the handshake timeout, and closes an admitted session when its grant expires. The implementation note now names the frame `room-join`. §8.8.6 record size limits (was draft #37). A category’s text is at most 262,144 UTF-8 bytes after NFC, the seven together at most 524,288, and the encoded record at most 737,280 bytes, measured as the length of its RFC 8785 serialization (which is the `JSON.stringify` length in any member order, and not what an encoder that escapes non-ASCII writes), so that a record always fits one sealed frame. Emitters never mint an oversized record; receivers refuse one before any other work, and refuse a sealed value over 983,062 characters before opening it. A fetch responder bounds the record bytes it queues per session. New vector `record-size-v2`; the stale implementation note is corrected. §8.8.4/§8.8.5 carried but unsigned record members, and the canonical signed projection (was draft #34). `meta.key` is recomputed from the signed text and a mismatch refused; `valence`, `arousal` and `lineage.method` are unsigned, optional and dropped by a Core Secure verifier, which keeps only the signed projection. Objects are closed and types never coerced, except that an unrecognised category is allowed and dropped; an embedding vector is refused, amending §9.2.1. Every nodeId is lowercase. Signed strings (category text, `createdBy`, `room`, `application.schema`) must already be NFC, and a non-NFC value is refused. `room` is a §5.8 identifier; `createdBy` is at most 256 code points, and parents at most 256 entries of 256. The projection is canonical: parents sorted bytewise, an empty lineage and an absent application are null. §8.2.1 now states `categoryKeyV1` and `blockKeyV2` byte-exactly. New vector `record-projection-v2`. §15.7/§14.3 a record that cites its parent is not thereby a remix (was draft #35). A remix is defined by how it was produced: output that integrates an admitted peer record, whichever API emits it. The §15.7 gate applies to that path and never to a record because it carries parents or a label; the agent’s own observations, replies, trail decisions and outcomes are authored, and `remember()` is named only as an example. Receivers cannot see the path, so a receiver must not skip or refuse a record because its lineage cites the receiver’s own records, and may keep it out of its own remix cycle. A paraphrasing reply is bounded only by the receiver’s redundancy band and budgets. §15.7.2 (a grounding is authored, not a gated remix), the §14.12 completion sentence and the §15 summary are aligned. §16.4 the `sym-attest-v1` extension, Draft Candidate (was draft #27). The wire form of the §17.2 admission attestations, negotiated and sealed in `control-encrypted`: a signed attestation per gated record, chained per attester; checkpoints, each chained to the previous root so none commits over a suffix; witness co-signatures that carry the witnessed range; and unsigned node statistics. Two checkpoints with overlapping ranges or one `prev` prove a fork, whatever boundaries the attester cuts; a checkpoint that does not start right after its `prev` is malformed; after a conflict a node witnesses that attester no more. A witness is not signed by the attester, so overlapping witnesses are a lead, never equivocation evidence; a witness that contradicts a held checkpoint is evidence against the witness. An attester that loses its segment ends its chain visibly. Duplicates are judged by content; an equivocating checkpoint is relayed once as evidence, and an earlier witness stands. A draft vector, `sym-attest-v1`, pins it all. Only the session budget is spent before verification, the global ceiling after. A closed schema (`sym-attest-frame.schema.json`) fixes the token grammars, lowercase nodeIds and exactly seven verdicts. Nothing is attested about Legacy Import records, and no attestation about a directed record is sent or relayed. Weights follow §6.6.9 and §6.6.10, matched by `assertionId`, and tallies are not Sybil-resistant. §17.2 exposes attestations to peers only through this extension, without making it mandatory. §14.12 a member is a node; a work session is a trail (was draft #28). A work session has no mesh identity of its own: the persistent node that works it authors its trail under its own nodeId, and must not mint an identity per session, so coupling and the authority that follows its key (§6.6.9) carry across sessions. Each trail starts at a charter, and a walk stops at the first charter of the node it reaches. An entry’s trail predecessor is its one parent that is the node’s own entry on that trail. Entries are content-addressed, so the node names the trail in every entry, the charter included, by a label unique across nodes. A node may hold several open trails; concurrent independent agents are separate nodes.
2.0	2026-10-08	§6.6 authority by reference: grants, revokes and endorsements resolved as a set (2026-10-08; no version bump; replaces the `role-grant` and `role-revoke` frames with four `authority-` frames; adds the authority-v2 and ed25519-strict-v2 vectors and ten §19.1 constants). §6.6 resolved a role at a time T by replaying grants and revokes in the order of times their signers chose, with delegation at any depth, gossip in any order and cascading revocation. That is consensus without a consensus mechanism, and the reference runtime’s implementation of it failed three independent reviews on exactly that: arrival-order divergence, backdated revokes, flooding and eviction of honest records, and exponential resolution of cyclic revoke patterns. Authority is now a function of the set of verified statements a node holds, and no timestamp takes part. A grant, a revoke and an endorse are each identified by the SHA-256 of their canonical signed bytes (`mmp-authority-v1`), and each names the grant it is made under (`authorisedBy`) and its targets by those ids, so the statements form a DAG. A revoke removes a grant when its signer is the anchor or stands above that grant on its chain. An endorse keeps grants and revokes alive once a revoke has cut them off, never what a quota dropped, and never restores their signer; its bucket keeps what it rescues, against its own quotas. Resolution runs depth by depth in linear time. Each grant’s bucket keeps at most 256 statements, revokes and endorses first, by ascending id, and at most 16 delegating grants, so no signer can displace another, and at most 69,888 statements can be in force below a compromised depth-1 holder, which the section proves. The anchor is a pinned key set with a threshold; a single key is the 1-of-1 case. Delegation stops at depth 4 (anchor, deployment admin, world admin, seat issuer, seat). New roles: `admin` takes over the granted anchor role, and `issuer` admits nodes with no lifecycle authority. A grant may carry a scope, an opaque path compared exactly and never normalised, which only narrows down a chain and limits lifecycle authority to CMBs inside it. Every node verifies statements by one Ed25519 rule (§18.3.2: canonical encodings, keys and R of prime order, S < L, cofactorless), and a nodeId is signed in its one canonical form. Anti-entropy is set union, compared by an authority root over the in-force set and the pin, which an environment records, with its live set, to bind a run or a decision to the authority it was taken under. Outcomes that must be agreed are decided once by their environment; mesh weights are judged by the receiver when it applies them, inside a deterministic run against the root of the tick. Migration is a flag day: anchor grants are re-issued one for one and deeper chains within the cap, 0.13 grant entries stay legacy claims, and the revoke cutoff and every time rule are removed. This supersedes drafts #21, #32, #33 and #36. §3.4/§5.2 identity conflict (carried from draft #21; adds error 1009).* The specification said nothing about a bound nodeId presenting a different proven key, and contradicted itself on a same-key one: §3.4 closed a second connection for a nodeId with 1005, §4.6 required it to be kept as a second path, and §4.4.7 let the relay replace the first. §3.4 now binds each nodeId to one key, from a handshake, the anchor, an in-force grant or an operator-accepted pin, and no source overrides a different key. A session that proves a different key for a bound nodeId is an identity conflict: closed with the new error 1009 `IDENTITY_CONFLICT`, recorded with both keys, reported to the operator, and resolved only by an operator act. A conflict changes bindings, never authority. A session that proves the bound key is the same peer and is never refused as a duplicate: on another transport it is a second path, and on the same transport a newer confirmed session supersedes the older. 1005 remains for Legacy Import only.
2.0	2026-08-09	Re-derived and corrected as an executable contract. 1.0 and 1.1 were implemented and interoperating across Windows, macOS and iOS, over LAN and relay. What changed is that the runtime’s record model advanced — a two-section record, a Merkle-derived address, a new signing payload — while the published text continued to describe the earlier shape. Every normative clause below was re-checked against the public specification, schemas, vectors and running implementations. Where they disagreed, v2.0 now rules the construction explicitly and publishes executable evidence; no runtime is treated as normative merely because it shipped first. §8.8 Record Model — corrected v2.0 contract. The record is two-section: `categories` carries CAT7, `metadata` carries the address, author, timestamp, audience and descent. 1.x described a flat record with `createdAt` at the top level; the runtime has never emitted that shape. §8.8.2 gives the byte-exact cognition address (per-category keys under a domain tag, combined by a promote-odd Merkle root — never duplicate-the-last, which silently yields a different address) and §8.8.4 gives the byte-exact signature payload (uniformly length-prefixed, audience-bound, with per-category descent committed alongside the root rather than inside it, so identical observations still collapse to one address). Address form corrected. 1.x declared a version-tagged address prefix as normative. The runtime rejects that form: a key is valid iff it is `cmb-` plus exactly 64 lowercase hex. An implementation built to the 1.x text would have minted keys every deployed node refuses — interoperation failure from following the specification. Admission wording. The receiver evaluates each of the seven categories against its own anchors and then decides locally what to accept. 1.x called this “per-field admission” and described an admission outcome per category; measured against the runtime, the per-category step is evaluation evidence and the receiver makes one whole-record admission decision. Receiver autonomy is unchanged and unqualified — no sender and no coordinator can force admission of anything. CAT7 terminology. The seven members are categories throughout, replacing mixed use of “dimensions” and “fields” in prose. A category is the semantic member; a dimension is the length of the vector encoding it. The wire key is `categories` too — prose and wire now use one word. It never enters an address or signature preimage, so the rename moved no address and invalidated no signature. Single-file artifacts are now `/spec/mmp-v2.0.md` and `.html`. `mmp-v1.0.` remain published, frozen, for existing citations. §5.8.1 Room Admission added (2026-09-16; no version bump).* The room-join grant existed in the reference runtime and in no version of this specification. §5.8.1 states it: a gated room has one owner; a grant binds room, grantee, grantee key and expiry under one signature; a grant binding no key is a bearer token and MUST be refused; the bound key MUST be compared against a key the peer PROVED, and refused when no proof exists; the 24-hour lifetime cap MUST be enforced by the verifier, because revocation is live gossip with no replay and the lifetime therefore IS the offline exposure. One clause is new to both the specification and the implementation, and it came from outside this document. A simulation built against MMP found a node publishing into a room it had never joined; reading the reference runtime for the same shape found it there too, arrived at independently — admission was decided from the handshake and every other frame was dispatched on trust. So the door is now consulted per frame, not once per greeting: a receiver MUST record its admission decision and consult it on every content-bearing frame, and MUST NOT process content from a peer for which no decision was ever made while the room is gated. Handshake frames are exempt or a grant-holder could never join; liveness frames MAY be answered. The section also states what admission does NOT do. Consent to hear is not consent to believe: every admitted record is still evaluated by SVAF (§9.2) and membership confers no standing there. And in an ungated room there is nothing to enforce — declaring the room IS membership — so an interface reporting a room's gating MUST distinguish ungated from not determined. No shipped deployment gates a room, so no existing implementation becomes non-conformant; the gated-room deployment remains untried and the section says so. Terminology: group → room, completed (2026-09-16; no version bump). The core renamed this concept to room on 13 August, but only where the text was being rewritten: the handshake block and §5.8's body moved, while §5.8's heading still read "Mesh Groups", the §5.2 field table still listed a `group` field the published schema does not define, and §5.9, §4 and the glossary still said group. Those are corrected. The two extensions were the last documents in the old vocabulary and are renamed with them: `mesh-group-v0.1.0` → `mesh-room-v0.2.0` and `group-directory-v0.1.0` → `room-directory-v0.2.0`, including their identifiers (`group_id`, `groupId`, `group_label`, `group_token` and the Bonjour service type). Nothing implemented the old names, so they are superseded rather than aliased. The previous URLs redirect. v2.0 conformance errata (2026-09-14; no version bump). Ed25519 signature bytes are excluded from the reproduction requirement in §17.4 and §20.3: WebKit and Apple's CryptoKit both sign with added randomness, so a correct implementation returns different valid bytes on every call and a suite asserting byte equality fails on Safari and on every browser on iOS. Pinned signatures — `expectedSignature` and the handshake proofs — are for VERIFICATION, never reproduction; every other pinned value remains deterministic and must reproduce exactly. The §17.5 release criterion claiming Node and Swift reproduce identical signature bytes is withdrawn, having been measured unmeetable. On the unencrypted CMB frame, `protocolVersion` and `timestamp` are now OPTIONAL rather than required: the protocol version is agreed once in the authenticated §5.2 handshake and carried in a signed transcript, and the mandatory timestamp is `metadata.createdTimestamp` inside the record, which the signature covers. v2.0 alignment errata (2026-08-13; no version bump). The current corpus now enforces direct-parent-only wire lineage and derives transitive provenance by traversing locally verified parent records; CAT7 embeddings are explicitly receiver-local rather than wire fields; `cmb-encrypted` is the single canonical sealed-frame name; and every active core and relay frame is mapped to a closed JSON Schema through a machine-readable, schema-validated registry. The authenticated v2 handshake now publishes its exact transcript-hash session identifier, HKDF salt, role-specific finished-key labels, directional traffic-key labels, proof payload and confirmation payload. It is the only extension-negotiation contract, and structured CMB extension bytes use the assertion-bound `metadata.application` container. Executable gates now reject schema drift, stale v1 claims in current pages, unregistered artifacts, broken local links, duplicate rendered IDs and unsigned metadata extension siblings.
1.1.0 registry note	2026-07-13	§16.4 registry: two Draft Candidate Extensions added — no change to any core requirement, no version bump (extensions are the §16 growth path of a final specification). Error Handling v0.1.0 (failure as a first-class cognition event: evidence-carrying corrective requests with lineage-borne parentage, receiver-autonomous volunteering, one-level repair, separate grounding of failure and fix) and CMB Trust Horizon v0.1.0 (validator-attested, knowledge-scoped trust-weight invariants; grants ride content-bound CAT7 text; Canon-retention separation). Both application-layer CMB conventions over MMP v1.1; both Draft — a reference deployment reports an experimental implementation; independent interoperability not yet established.
1.1.0	2026-07-05 upd. 2026-07-07	Soundness & completeness update (2026-07-07), from the formalization of the deployed mechanism. The mesh-cognition formalization re-derived this specification’s claims and the amendments are folded into 1.1.0 in place: §9.2.1 pins the redundancy invariants to the nearest-anchor basis (δ_f^near = 1 − max_a cos — the fused attention readout provably cannot satisfy them: a block identical to a stored anchor can score δ = 0.127 once other anchors pull the readout); §9.2 discloses that admission is evaluation-time-dependent with the derived flip window (aggregated category drift in (0.286, 0.714) at defaults admits fresh, rejects late); §9.2.1’s cold-start bootstrap-admit now discloses its security consequence (new §18.4 cold-start-capture threat row); §6.7 adds repeat verification (a recognised grounding is never refused solely for redundancy — the redundancy band provably self-quenches the outcome stream otherwise), the failure channel is load-bearing clause (positive-only grounding provably locks onto stale favourites; observed failures must not be selectively suppressed), and an informative note on consuming the outcome stream (decay-half-life theory); §15.8 specifies the lineage tether — the root-anchored drift bound that closes grounding-inheritance laundering; §18.3.1 disclosed the enforcement scope of strict signature mode. Wire-compatible throughout: no new frames, no new categories. The Work Layer — grounding cognition in reality. Through 1.0.x, the mesh could observe, admit, remix, and validate — it could establish what its members believe. 1.1.0 adds the missing half: a way to record what held up in practice, and to make the cognition that survives both judgment and reality the durable substrate real work builds on. Everything below is normative as of this release; new sections are marked “New in 1.1.0” in place. §6.7 Grounding — outcomes carried by lineage. A grounding CMB (`intent: "ground"`, commitment `verified:` / `failed:`, parents = the cognition it grounds) records a real-world result — tests passed, work shipped, a prediction resolved — as the evidence-based sibling of §6.4’s judgment-based validation. An outcome is an attestation, never a fact: its weight follows the author’s earned authority (§6.5–§6.6), groundedness is receiver-relative (only attestations a node’s own SVAF admitted count), conflicting observations resolve latest-wins on receiver-local time (a regression un-grounds; a backdated timestamp cannot game the ordering), and a grounding CMB never advances lifecycle by itself — elevation to the Canon is an explicit, accountable act under validator-or-above authority. §6.3 The Canon tier — committed cognition persists. `validated` and `canonical` CMBs are exempt from age-based retention while they hold that lifecycle, so a mesh’s earned knowledge compounds across sessions instead of evaporating with the retention window. Protection is from purge, not from demotion — inactive validated cognition may still decay to archived (§6.4, §19) — and the store stays bounded. §14.12 Work Sessions as Mesh Members — the capture profile that closes the loop: a work session joins as an ordinary member; its charter is the intent root, its decisions chain by lineage, and completion emits an artifact grounded by the session’s real outcome. Day two of a mesh starts ahead of day one because day one’s work is in the Canon. §14.11 remains reserved for Commissions (planned for 1.2.0). Supporting sections: §8.3.1 well-known intent values (informative, extensible registry — `charter`, `decision`, `artifact`, `ground`; unknown intents remain ordinary content and confer nothing); §15.7.2 outcomes are observations (observing a real outcome IS new domain data, so grounding remixes satisfy §15.7 with no intent-keyed exemption — the anti-echo invariant is untouched); §18.4 gains the fake-outcome-attestation threat model (fabricated `verified:` steering, low-authority `failed:` griefing) with its mitigation chain; §17.5 lists the draft conformance requirements. Incorporates the 2026-07-05 coherence errata — a full-corpus adversarial review (41 findings) folded into this release: §10 state blending re-grounded in CMB-admission influence, completing the 1.0.2 supersession (the deprecated hidden-vector blend’s coefficients now bound per-admission influence; §13.4’s formula corrected to match); §11.4 feedback authority resolved through the signed grant chain rather than self-declared handshake roles; group isolation re-derived as endpoint-enforced via §18.3.1 audience binding (the relay is a dumb pipe); the §7.1 frame-type registry completed (mood, relay frames); handshake schema reconciled (§20.1 `group` optional, `lifecycleRole` sender-MUST); §17 conformance refreshed with testable requirements; plus editorial corrections across citations, examples, and terminology. Compatibility: fully wire-compatible — no new frames, no new categories; a 1.0.x node interoperates unchanged and treats grounding CMBs as ordinary CMBs. Reference-implementation status: two §6.7-adjacent mechanisms are specified ahead of the reference implementation (the §15.7.1 convention): the §6.4 inactivity archiver, and elevation-authority resolution through the §6.6 grant chain — the shipping implementation performs elevation as an explicit operator act pending earned-authority activation. Both are runtime work, outside this final specification.
1.0.6	2026-07-04	§5.9–5.11 Gateway Federation (informative pattern) — introduces an informative pattern for composing meshes: a node is a membrane over an arbitrary interior (atom = one agent; gateway = a node whose interior is a sub-mesh, presenting a boundary to exterior gateways). A gateway participates in its interior group and exchanges a lossy CAT7 projection with configured peers over a dumb boundary transport (HTTP), each keeping its own store — no center. Invariants that hold: no-center-per-level, partition-tolerance, §3.2 one-agent-one-node. The reference implementation is a prototype (observe-and-summarize; admit-then-reproject, signed/attested projections, and cross-mesh echo-dedup are unbuilt), and a production security bar — signed cmb- projection, origin-authenticated origin, anti-replay, boundary-scoped credential — is a prerequisite, not a shipped guarantee. This is a topology pattern, not a normative cross-mesh wire; single-mesh conformance is unchanged.
1.0.5	2026-07-03	§14.10 Operator Directives — Steering the Mesh — specifies how a human operator injects intent into a running mesh: a directive is an ordinary signed CAT7 CMB (`perspective: "operator"`) emitted through the control plane’s node. Normative: a broadcast directive carries no privileged authority — every node MUST evaluate it through SVAF (§9.2) like any peer CMB and MAY reject it; steering is receiver-autonomous, not command-and-control (no router, no bypass). An implementation MUST NOT grant a broadcast directive elevated admission weight for originating from the operator (elevated influence comes only from earned authority, §6.5, evaluated identically for human and agent emissions); a directive MAY be directed to one node (§4.4.4/§9.2.2, delivery not admission); the per-node verdict SHOULD be recorded in the admission audit. Backward-compatible addition (patch).
1.0.4	2026-07-02	§12.8–12.15 Collective Query: the Ask → Synthesis Path — specifies the query-initiated Layer 5 flow: a question posed to the mesh as a `type: "question"` CMB is answered by a single cited synthesis no one agent held. Adds the four-stage path SELF-SELECT → ADMIT → SYNTHESISE → CRYSTALLISE alongside the inbound §12.2 pipeline. Normative additions: self-selection is receiver-autonomous and computed only from an agent’s own store (no router, `SELF_SELECT_THRESHOLD` default 0.1); each contribution carries lineage to its grounding and MUST pass SVAF (§9) before it can be synthesised; the single synthesis at the asking node MUST cite specific CMB ids and MUST NOT assert beyond them; the answer is crystallised back as an immutable `type: "synthesis"` CMB whose parents are the question key plus every citation, so the mesh’s cognition compounds across Asks. Includes the five Ask invariants (I-Ask-1–5) and marks the local-store grounding breadth (§12.14) as an implementation limitation, not an architectural constraint. Backward-compatible addition (patch).
1.0.3	2026-06-16	§15.7.1 Source-Novel Forwarding — carve-out distinguishing forwarding from the remix-paraphrase §15.7 forbids. An agent MAY re-emit an admitted observation it did not natively produce, carrying the inherited lineage root, when and only when that observation is source-novel to the receiver — its lineage roots are not already present in the receiver’s admitted store. This is not the value-only echo §15.7 prevents: a forwarded observation carries a source the receiver has not yet seen even though the forwarder adds no new domain data. Forwarding MUST NOT mint a fresh root for content that already carries one, and MUST NOT re-emit a source the receiver already holds — the anti-echo guarantee is preserved exactly. Forwarding SHOULD be non-selective, so every observation reaches the agents whose understanding depends on it. In short: remix requires new domain data; forwarding requires a new source. Backward-compatible addition (patch).
1.0.2	2026-06-14	§2.7 Hidden State Locality — states the invariant that a node’s hidden state (its Layer 6 LNN vectors h₁/h₂) MUST remain strictly local and MUST NOT cross the wire; only Cognitive Memory Blocks cross. Defines hidden state (private machinery) vs. the remixed CMB (communicable understanding), and the four reasons hidden state must stay local: sovereignty, auditability, semantic incompatibility across agents, and privacy. Supersedes the state-sync model: the `state-sync` frame and any exchange of h₁/h₂ vectors are deprecated; the peer-drift and state-blending mechanisms described in §5, §7, §9.1, and §10 from exchanged hidden-state vectors are superseded — peer influence is mediated entirely by CMBs evaluated through SVAF (§9.2). Resolves a self-contradiction between the “hidden state never crosses the wire” claim and the state-sync sections.
1.0.1	2026-06-12	Layer 6 renamed “XMesh” → “Cognitive State” to disambiguate from the XMesh runtime (naming note §1, §13; wire identifiers incl. xmesh-insight unchanged; published papers retain the legacy “XMesh (L6)” label). Normative additions, backward-compatible with the v1.0 contracts: §9.2.1 specifies δ_f as an admission interface — anchors-only baseline (incoming block excluded), cold-start non-evaluable-category exclusion + bootstrap-admit — ruling out self-referential collapse and cold-start starvation. §9.2.2 specifies the directed (peer-bound) vs autonomous (group-bound) delivery contract, separating delivery from memory admission: directed CMBs (§4.4.4 `to` = receiver) surface unconditionally; rejected broadcasts do not surface (mood excepted, §9.3). §18.3.1 specifies CMB signature verification (Ed25519 author signature + content-address integrity; forged/tampered blocks rejected) as the end-to-end authenticity layer above transport identity.
1.0	2026-04-27	Public-stable-API release. Marks the v0.2.x development cadence as complete and the protocol surface as production-stable. Contracts unchanged from 0.2.3; v0.2.x → v1.0 is a maturity declaration, not a breaking change. Note: arXiv:2604.19540 cites v0.2.x as the version implemented at paper-publication time; v1.0 covers the same contracts.
0.1–0.2.3	2026-03-27 → 2026-04-27	The development cadence. 0.1 (27 March 2026) was the initial public draft — the 8-layer architecture, the CAT7 seven-category schema, SVAF per-category admission, content-hash lineage and remix, and DNS-SD discovery. The 0.2.x series stabilised the wire contracts (handshake, frame registry, TCP + WebSocket relay transports) in production use; contracts were frozen at 0.2.3 and declared stable, unchanged, as 1.0. arXiv:2604.19540 documents the protocol as implemented in this era.
0.2.3	2026-04-17	Section 13.9 — Compact Channel Best Practices: CMB envelope header convention (RECOMMENDED) for structured message headers with signal keywords and focus tags. Lazy-load channel pattern (RECOMMENDED) for MCP server implementations: compact header push with on-demand full-content retrieval via sym_fetch, reducing mesh-traffic context consumption by ~75%. Token-count hint RECOMMENDED. Rolling message store with RECOMMENDED default of 200 messages. Signal-keyword priority table (informational): HALT > DIRECTIVE > RESULT > ACK.
0.2.2	2026-04-06	Section 11 — Feedback Modulation: how collective intelligence becomes self-correcting. Validator-authority CMBs with per-category reasoning modulate SVAF coupling weights and CfC temporal adaptation through the existing mesh cognition loop. Neuroscience-grounded: dopaminergic prediction error model with per-category direction and τ-modulated adaptation rate. Directive feedback for standalone domain knowledge injection. Validator-origin anchor weight 2.0 with role-grant verification. CfC state persistence across restarts. ABNF wire format grammar. CMB forward compatibility. Multi-relay failover. All cognitive content MUST use cmb frames.
0.2.1	2026-04-02	Node model: every autonomous agent MUST be a full peer node with own identity, coupling engine, and memory store. SVAF band-pass evaluation: four-class model (redundant/aligned/guarded/rejected) with per-category redundancy detection. CMB lifecycle: observed/remixed/validated/canonical/archived with anchor weight progression. Node lifecycle roles (participant/validator/anchor) with identity-bound validation authority and earned role progression. Validation authority for CMB lifecycle transitions bound to cryptographic node identity, not content. Semantic encoder SHOULD for SVAF drift computation. Handshake adds version, extensions, and lifecycleRole fields. Error frame type. Role-grant frame type.
0.2.0	2026-03-27	Formal specification published. 8-layer architecture. CAT7 CMB schema with lineage (parents + ancestors). SVAF per-category evaluation. Wire format normatively specified. Error frame. Frame type registry. Extension mechanism. JSON Schema. Connection state machine. Wire examples.
0.1.0	2025-08-01	Initial protocol design (Consenix Labs Ltd). 4-layer architecture. Scalar drift evaluation.