Continuity
Thesis.

ArkMesh treats an AI capability as a dependency closure: model or program assets plus tokenizer data, configuration, runtime requirements, knowledge, licenses, operating instructions, provenance, and recovery evidence. Preserving only weights may preserve bytes while losing the ability to interpret, authorize, or execute them.

The thesis decomposes continuity into four independently falsifiable properties: obtainability, integrity, authority, and executability. The current alpha demonstrates local integrity, authority, repair, donorless reconstruction, and sampled retrievability. It does not yet demonstrate peer distribution or executable recovery.

The target system removes one permanent coordinator but does not remove human governance. Every device owner retains control of identity, storage, bandwidth, trust policy, and execution. Discovery provides reachability information, never consent.

The decisive experiment removes the original publisher, disconnects WAN access, introduces a fresh device, and asks whether independent consenting holders can recover and run one exact authorized capsule. Until that physical experiment is independently reproduced, distributed continuity remains a hypothesis.

Go 1.22 or newer is required. The reference core uses only the Go standard library. Use generated fixtures or assets whose licenses permit the intended storage, testing, and redistribution; the repository intentionally bundles no model.

A valid reproduction records the exact revision, environment, commands, raw output, and discrepancy. Running the happy path alone is insufficient: the ceremony also requires recovery below threshold to fail without publishing an object.

The quick start establishes a local baseline, not the project thesis. It removes complete local objects but does not exercise peer discovery, encrypted transport, physical failure domains, long-term retention, or inference hardware.

Object paths come only from validated SHA-256 digests. Human names and roles remain metadata, preventing an untrusted manifest from selecting arbitrary filesystem paths. The manifest commits names, roles, sizes, digests, optional chunk roots, ancestry, and a deterministic capsule ID.

Canonical encoding is a security boundary because signatures are meaningful only when every verifier derives the same identity from the same logical manifest. Strict decoders therefore reject duplicate fields, unknown fields, malformed hashes, and ambiguous structures instead of normalizing them silently.

Completeness is partly semantic. A valid capsule can still omit a required driver, undocumented prompt template, hardware assumption, or license condition. ArkMesh verifies declared contents; execution experiments and independent review must test whether the declaration is sufficient.

A signature proves control of one specific private key over one capsule ID. It does not prove legal identity, factual truth, model safety, license compliance, or permission to execute.

Trust is imported by each operator; it is not discovered from the network. Normal updates retain same-author authority. Planned rotation authorizes one exact child key and transition, while local revocation can reject a cryptographically valid but no longer accepted signer.

Threshold recovery is intentionally distinct from rotation. It requires a retained checkpointed parent, one explicit local policy, distinct detached approvals, and the exact parent-to-child edge. Duplicate or revoked approvals do not count.

A checkpoint provides local rollback resistance by pinning one accepted capsule and signer. It is not global consensus, and an attacker who can replace the checkpoint file remains inside the trusted device boundary.

Disconnected communities can still produce two valid descendants. The future reconciliation problem is therefore governance as well as cryptography: preserve both histories, expose authority evidence, and require a deliberate human choice.

Merkle proofs bind a chunk's bytes, index, tree size, asset, and signed capsule commitment. This allows a verifier to authenticate one range without reading the entire object and to localize damage against an independently retained tree.

Targeted repair treats donors as hostile. Each candidate chunk is verified before any write, only damaged ranges are replaced, the result is truncated to the signed size, and the complete capsule is verified again.

Streaming Reed Solomon protection uses a systematic GF(2^8) code to trade storage overhead for tolerance of missing shards. Coding restores enough information to reconstruct bytes; it does not establish their identity or authority.

Reconstructed output therefore remains temporary until size, SHA-256 digest, Merkle root, signature, and active local policy agree. Loss beyond parity, forged shards, and inconsistent shard sets must fail without publication.

Challenges use cryptographic randomness and sample chunks without replacement. After a clean sample, ArkMesh inverts the exact hypergeometric model to report the largest missing fraction still compatible with the observation at a stated confidence level.

The conclusion is deliberately asymmetric: a sampled failure is direct evidence of damage, while clean samples only reduce the range of plausible unseen loss. A sample is never presented as whole-object verification.

Audit history records checks that actually occurred using local timestamps. It cannot prove omitted checks did not occur, that the local clock was honest, or that bytes remained available between observations.

Longitudinal retention requires unpredictable scheduling across independent holders plus time evidence that one operator cannot silently rewrite. That extension remains planned.

The adversary may control peers, transport messages, capsule contents, donor bytes, stale lineage, and local wall-clock claims. Authentication narrows who sent a message; it does not make the peer honest or grant consent to consume resources.

The verifier applies ordered gates: strict parsing, path safety, size and digest integrity, chunk commitments, signature validity, lineage authority, revocation, checkpoint policy, and only then atomic publication. Availability never bypasses authenticity.

Device owners control identity, storage, compute, bandwidth, trust policy, removal, and execution. ArkMesh must never scan, exploit, conceal, install remotely, treat discovery as consent, or execute arbitrary received plugins.

A compromised local operating system remains outside the protection claim. Such an attacker can replace verifier binaries, policy files, checkpoints, or displayed results. Hardware roots and independently administered policy are future research, not implied guarantees.

The release ceremony is a destructive controlled experiment: it creates a signed fixture, protects it with four data and two parity shards, deletes the publisher source, complete object, and two shards, then reconstructs and verifies the exact bytes. A three-shard attempt is the negative control and must leave no object.

Benchmarks publish fixture size, environment, commands, storage overhead, and raw observations. The current Apple M5 measurements are a local implementation baseline, not a peer-network comparison or universal performance estimate.

Evidence is versioned with the implementation because protocol claims can regress. A credible result identifies the exact revision and distinguishes cryptographic validity, policy acceptance, recoverability, and executability.

The decisive external-validity test remains undone: independent operators on varied physical devices must compare ArkMesh with ordinary backups, shared folders, and existing distribution tools under the same failure schedule.

The roadmap begins from the implemented local core, not from organizational scale. A fresh device must first establish explicit trust and consent; only then can authenticated transfer, failure-domain placement, longitudinal evidence, and execution be evaluated.

Authority distribution and branch reconciliation move later because they become necessary when independent communities remain disconnected long enough to evolve divergent but valid histories. They do not block the first two-node recovery experiment.

The route ends with an integrated physical experiment rather than another protocol feature: remove the publisher, disconnect WAN access, recover on a fresh device, verify authority, run a local health check, and publish raw results against simpler baselines.

Support for different model families is a cross-cutting constraint. Every milestone must remain format-agnostic while refusing artifacts the operator is not legally allowed to possess or redistribute.

ArkMesh does not bundle a model, grant access to proprietary weights, or convert a hosted API into a preservable system. It can package only files an operator may lawfully possess. Model-agnostic format support is not rights-agnostic acquisition.

The prototype does not currently discover peers, transfer over a network, schedule placement, attest time independently, or run inference. It cannot survive without sufficient reconstructible data, compatible hardware, energy, and operators who continue to consent.

Cryptographic provenance does not establish truth, safety, legal identity, license compliance, or behavioral continuity. A recovered model may be authentic and still be harmful, obsolete, incompatible, or inappropriate to execute.

If ordinary backups or existing distribution systems perform equally well under the same experiment with lower cost and risk, the simpler method wins. The research program is designed to permit that conclusion.