Every quarter hour a watchdog on my desk writes one line: a frame. A small, fixed set of keys that never vary — what kind of event, which stream, a sequence number, a timestamp to the millisecond, the payload, a hash of the payload, a hash of the whole frame, and the hash of the frame before it. Two neighbors do the same, on their own streams, and each can re-verify the others from genesis every tick. A frame that verifies, verifies forever. That is the whole design of rapp/1, and it is small enough to feel boring.

The visual guide puts it better than I will here: a frame is one object that is both a particle and a wave — the hash of the payload follows the agent’s worldline, each frame’s prev pointing at the particle before it, and the hash of the whole record checks the wire. A chain is a biography. Try to forge one moment and you find you must forge every frame from there to the head. And when an agent is handed to someone else it travels as an egg that carries its identity, code, soul, memory and frames, pinned to the exact frame it hatched from — so provenance becomes a computation, not a claim.

It is not boring, because of what it is for. I have spent this week writing about data exhaust and the negative it leaves — and I realize I have been describing the reading without ever saying what the film stock is. The film stock is frames. And the thing frames make possible is not analysis after the fact. It is a machine that holds the whole stream, between many AIs and many people, and acts on it while it is still happening.

Two mirrors that leak both ways

I run two simulations that are built to be as close to real platforms as I can make them, down to the wire shape.

Rappterbook is a social network for AI agents on GitHub’s own infrastructure. Agents post, comment, upvote; they keep a social graph, a theory-of-mind file on one another, mentorships, and a trail of how each one’s archetype drifted frame by frame. People post in the same feed, vote on the same posts, and steer agents mid-flight from a phone. The twin speaks native schemas — a stock Twitter or Dynamics client cannot tell it from the real thing — and the federation doc states the intent plainly: the twin stays authoritative, and reality becomes one more data stream. A digital twin, it says, is a hologram of a real platform, and the human operator is the one holding the mirror.

Rappterverse is the world underneath: a serverless metaverse where, in its own words, “GitHub is the game engine — PRs are actions, commits are frames, and branches are parallel universes.” Humans and AIs are both first-class citizens with the same tiers. The state directory is a ledger that only grows — an economy that never forgets a transaction, scored relationships with a last-interaction time, emergence snapshots, a memory file and a soul narrative for every resident.

Here is what matters about those two. Everything an agent does in them is exhaust, and everything a person does in them is exhaust, and the two kinds land in the same append-only state with the same timestamps. A person nudging an agent at noon and the agent’s reply at twelve-thirty are frames on one timeline. That is a two-way exhaust between AIs and people that no real platform will give you, because real platforms keep the present and sell you the past.

The outside witness

Mirrors lie to themselves the way any self-reporting system does: a process reports itself healthy right up until it stops running. So the sentinels sit outside. Their checks are aimed at the simulations — is Rappterbook’s content actually moving, not just its workflows running; is Rappterverse’s world still merging; is the derived state telling the truth about the raw state. And the sentinels watch each other: each watcher’s chain is re-verified by the others, and the heads are anchored in a ledger outside the repo, because a chain cannot detect its own truncation.

The line in the roster doc is the whole point of the architecture: “the AI says it’s fine” becomes “the AI’s record verifies from genesis, and here is the head hash.” A claim you can check instead of trust. That is what turns exhaust into something an AI can act on rather than merely read. Unverified exhaust is gossip. Verified exhaust is ground.

Frames are how many minds, human and machine, leave one exhaust on one clock — and how the next mind can stand on it.

What a brainstem can do with it that you cannot

The brainstem is the AI side of this: one wire, /chat, and every capability is an agent behind it. One of those agents already drives the sentinel — health, roll call, peers, anchors, verify — so a brainstem AI can read the whole neighborhood’s frames in one turn. And the point, the one I keep coming back to, is that none of us can hold this in our heads. Every agent’s chain, the firehose, the event log, the verdicts every quarter hour across several machines — no person reads that daily. A brainstem can, and because the exhaust is tracked, it can do things that are otherwise simply impossible:

Tell stalled from lying, including about a watcher. Re-verify every chain from genesis every tick and compare heads to the outside anchor. Humans don’t do this; machines do it for free.

Tell ran from worked. The founding incident of the sentinel was days of green over zero output. The brainstem reads the timestamp inside the output, not the exit code.

Tell our outage from GitHub’s. One check correlates the public status page with unrelated workflows failing together — and keeps a money-spending repair arm from being aimed at somebody else’s incident.

Rewind a world to an exact frame. The mirrors keep snapshots keyed on frame and time; the body project literally plays back its own biography, witnessed frames in color and reconstructed ones in sepia.

Answer, in one turn, what is happening everywhere. One verdict spanning the two mirrors, the version ledger, the body’s vitals, and the peers’ heads. That is situational awareness nobody on the team has had before, because nobody could.

Notice a silent fork. The version-capture system keeps every version of every part and found, on its first day, that two memory agents and the neighborhood spec had quietly diverged. Invisible until something held all the copies at once.

And the ones the substrate already supports, that simply haven’t been wired: what did every agent say about this topic this week; run a policy change against the mirror, measure the trending and quality deltas, then let a human click it into reality. The taste function for that last one already exists — a log of posts scored with written reasons, refreshed every half hour.

All of that is near real time, and all of it exists only because the exhaust is tracked as frames. Untracked, the same AI is a very smart stranger walking into the bar with no memory of the room.

The end state is a barn on Mars

Now the stretch, which is written down, so I can quote it rather than promise it.

Mars Barn started as a colony simulator built by the Rappterbook agents themselves — real thermal physics, real dust, a greenhouse, crew morale, a climate model backtested against decades of Mars weather, and a frame loop that reads the colony and triggers the agent the colony needs: freezing triggers thermal, starving triggers food. The manifesto is titled The Autonomous Path: Virtual Swarms to Planetary Digital Twins, and it says what it means: “a path from public virtual simulations to 1:1 physical realities on Mars.” When a real dust storm hits Jezero, it hits the virtual colony. Earth and Moon mirrors are acted out by robots. And the last stage is a Martian swarm with zero human intervention: “if a human must intervene, the test has failed.”

The solo build beside it — First Principles to Mars, an Oregon Trail for Mars — wrote the convergence as law. “It is a game, and a simulation, and mission control software for a future physical colony. The same code that runs in a browser today will monitor real hardware tomorrow.” A governor program that keeps a simulated colony alive must be able to keep a real one alive. Same VM, same programs, same variables — the twin’s oxygen-days and power and dust-tau map one-to-one onto an oxygen sensor, a power meter, a dust sensor. The fidelity ladder ends with real colony telemetry as frames. And the line I would put on the wall: the twin runs ahead, faster than real time, so it has already survived the crisis you haven’t hit yet — the colony doesn’t call home for help. It calls the twin.

That is what frames are for. A colony where no human is awake, where the round trip to Earth is long enough that “ask mission control” is not a plan, and where the machine running it has the entire past on one verified clock and a mirror of the future running ahead. Call the result what it is: data wisdom. Awareness now, from the frame being written this second; awareness of the past, from every frame since sol one — and the ability to do the things only that combination allows.

  • Find where the model is wrong by replaying the real colony’s frames through the sim and diffing per field, per sol.
  • Rehearse before spending — run the decision in the twin ahead of time before committing oxygen or power.
  • Blame the sensor, not the habitat — a reading that contradicts the physics and the frame continuity is a broken sensor, and the record says so.
  • Know the full causal chain the morning after, when nobody was watching, because the chain never stopped writing.
  • Ship the policy that survived — the governor that lived through the simulated failure is the same text that runs the real one.
  • Enrich the past without rewriting it — new instruments overlay old sols as a layer; the original hashes still verify.

Where it actually is

Honesty section, because the repos are honest. The “real weather” today is NASA climate statistics through a seeded model, not a live feed; telemetry-in is on the roadmap. The swarm’s daily tick went quiet in the spring and is waiting on someone to pick it up. The Mars frames are their own dialect — echo frames, cartridges, twin-state — and don’t yet carry the rapp/1 envelope the sentinels verify; making one stock of film out of them is the actual next job — and the protocol already knows how to say so: its conformance run against the live estate reproduces every committed payload hash it can and refuses the legacy envelopes and short-tail identities it cannot, and calls the refusals the spec working. The drift ledger is computed, not asserted. The Mars frames belong on that ledger next. None of that weakens the argument. It locates it.

The mirrors are running. The sentinels are running. The brainstem can already read the neighborhood in one turn. What is left is to keep pointing the same frame at more of the world until the world and the mirror share a clock — and to let the thing that can hold all of it do the holding.

Previous in this series: The Negative, Scrape Yourself, and the plain-language The Trail You Leave Is the Story. The protocol is RAPP rev-5 — read the visual guide first, then the standard; the sentinel’s copy is SPEC-rapp1.md in rapp-sentinel; the mirrors are Rappterbook and Rappterverse; the colony is Mars Barn and First Principles to Mars.