Affine.Earth Users Guide

The Language Game /language-game/

Arrive, and Franklin must be alive: breathing, blinking, gaze moving — before you say a word. Speak or type; he answers in voice and face together, mouth synchronous with sound.

Serves: the first minute is the proof. A dead face on the front door falsifies the entire claim of a living intelligence.

Stage & Franklin /stage.html · /franklin.html

The full-figure projection in its box: camera free to zoom and orbit in x, y, z while the subject’s centre stays inside the inner 80% of the hologram space. Co-presence rules hold — one light, one depth, contact with the ground.

Serves: the box is the shared coordinate space every future entity joins; if one figure cannot hold the box, nothing can.

Twin exhibits /projection-room · /reality · /twin · /reel · /lattice

Windows into the zero-hop, byte-exact digital twin: bond fields, reality tiles, the lattice, replayable reels. A landing view is never blank — a real default field renders before any selection.

Serves: the twin is the substance behind the face; an empty viewer reads as an empty substrate.

IDE /ide.html

Write Swift, compile to wasm32, run it in the sandbox, and take your build home. Every panel is real or says it isn’t: panels without backing wear a machine-checkable SIMULATED label until their backing ships. The wallet shows a real reading or shows “not connected” — never an invented number.

Serves: “allow others to create new ones” — the IDE is how outside minds join the substrate’s own game.

Gym & Studio gym overlay · /studio.html

Franklin’s inner dialog: laws grading live windows, findings with integers, the corrections submitted back to the substrate. Start a workout; see the loop close.

Serves: the gym is the perfection loop for every entity that projects — visible here so improvement is a public act, not a backstage one.

Atlas, Health & Record /atlas.html · /health.html · /press/ · /selfcheck.html

The mesh measuring itself, publicly: every page’s verdicts in the atlas, cell health, the self-check that admits what moved and what didn’t, and the press record. The atlas is excluded from its own population by the generated-by-this-instrument class rule — an instrument that graded its own report would rediscover every quoted finding forever.

Serves: trust is not requested here, it is inspectable. This is the layer that makes every other claim on the site checkable.

One projection logic, all screens

What must be built. Every screen consumes box.camera — free x/y/z play with the subject’s centre held inside the inner 80% of the hologram space, one derived number — compiled to the cell and to wasm32 from the same source so client and backend cannot frame different pictures. The nine copies retire on the ratchet.

RATCHET BASELINE PINNED — AND CORRECTED BY MEASUREMENT. The founder’s order named six copies by path; the gate’s DERIVED sweep of the committed tree measured NINE and its ceiling says so: three the prose missed (the RealityKit Float camera, the OpenUSD mesh shells (now BoxCamera view carriers), the vendored THREE mesh renderer), and projection-room.html no longer authors the derivation at all — its half/double zoom had already migrated into gop-blit.js. The gate is the source of the count and the list; the rows above quote it and go stale before it does. The count may only fall; a tenth author is refused the day it appears. OpenUSD globe/player ask BoxCamera; mesh rendering may use THREE as a carrier only.

One page, one game, one breadcrumb trail

What must be built. The homepage becomes the SHELL: other pages render as views inside it, breadcrumbs are the game’s own move history, and leaving the page is never required. Franklin’s replies carry the thread’s context, never a cold start per page; a session is resumable from its ledger.

DEEP LINKS DECIDED. A visitor arriving by deep link starts with a breadcrumb of a single node — the view they landed in. A trail they didn’t walk is never synthesized; the thread grows forward from there.

GYM 24×7, publicly watchable

What must be built. The corpus lane running continuously on its seeded replay schedule against the projections, and a public WATCH view served on the apex, fed by the live ledger — every visitor sees the improvement happening.

PUBLIC RED, WRITTEN IN NOW. The watch view shows RED rows as RED, unfiltered, no curation ever. “You can watch it be perfected” requires that the audience can watch it fail; a curated feed is a fabricated value made of omissions.

THE COUNT IS ITS DERIVATION. The blind count renders as declared − exercised = blind, resolved from the coverage ledger at generation time — the chip below is that resolution, never a typed number.

IDE → GYM validation

What must be built. Submitted WASM runs the gym’s laws and carries its verdicts before it counts anywhere — the same grading the corpus lane gets, applied to what visitors create.

Marketplace on the mesh, visibility owned by the creator

What must be built. Gym-validated modules published to the mesh with per-creator visibility grants — who sees your work is your property. The law, ledger, and serve-time routes landed 2026-08-19 (cited above); what remains is the grant controls in the IDE UI — grant and revoke stay API-only pending the founder.

THE VISIBILITY GRANT, PINNED (founder, 2026-08-19). Default is creator-only unless granted. Audiences are exactly three: a named party, the mesh, the public. Revocation stops all future serving — and, in the product’s own words, cannot recall bytes already fetched on a replicated mesh; recall is never promised. A grant is a sealed ledger row checked at serve time, so any cell verifies visibility without asking anyone.

Prices or credits shown in SATS / CAL stay behind the simulation label until a wallet or ledger reports them — a currency literal never passes, labeled or not.

Live visitor play against the hologram projections — future

What must be built. Visitors play live against the full-figure body-mesh hologram in the box — the projection answering play in real time, graded by the same gym laws as the replay lane.

FUTURE TENSE, BY GATE. Hologram claims stay future tense until BodyMeshLaw’s wasm enters the wasm↔HEAD gate’s builder_for() — the moment it is named there, it is built from HEAD or the gate refuses, and only then may this row and the vision above change tense.

Sell deterministic verification: MCP tools + A2A tasks

What must be built. External agents and enterprise simulators buy what a float solver cannot produce: integer-limb, zero-float verification verdicts — no accumulation drift, no cross-architecture nondeterminism, the same bytes from every cell. The ENDPOINT REALITY MATRIX, measured 2026-08-19, binds this row: LIVE — execute_transition. That is the registry's name for it and the name the apex tools/list actually returns. This plan and the users guide both said twin.quantum.state_transition_step until 2026-08-20, and no row by that name ever existed in CapabilityRegistry.swift — a capability with two names is precisely the drift the registry was built to prevent, so the registry's name is the one that stands and the other is gone rather than aliased. HARDENED 2026-08-20: the oldest capability on the apex was also the only one never held to the standard the newer rows meet, and holding it there found two live defects. A negative denominator NEGATED a sealed lane — measured, 1/-2 sealed as 1/2 — and because the boundary hash is computed from the normalised lane on the cell, the client's own signature still verified and the turn was ADMITTED carrying the wrong sign with nothing reporting it. An unstated or misspelled intent silently became OPEN_CURVE, so a client that typo'd KLEIN_FLIPP was told its SIGNATURE was wrong. Both are repaired at one home, 51 arms stand behind the admission law, and every one of them was built by mutation: 22 guards were deleted in turn and 21 turned a NAMED arm red, the twenty-second being caught by the CPU rather than by the suite, which is stated rather than counted as a pass. PRIMITIVE EXISTS, wrap as tool — twin.robotics.evaluate_exact_ik. RAW MATERIAL ONLY, predicates absent — atc.assert_4d_deconfliction (civil FAA/ICAO) and weather.convective_containment: the sealed sky, the frames and the feeds are live; the separation/containment certificates are not written. LATTICE EXISTS, PREDICATES ABSENT — materials.assert_crystal_symmetry / materials.burgers_vector_conserve. ABSENT — future tense, registry rows carry primitive:absent and no tool is ever stubbed: quantum.verify_stabilizer_tableau / quantum.exact_clifford_eval, twin.bio.docking_ground_state / twin.bio.verify_transport_flux (zero QUBO/Ising solver hits; RationalQ and VQbitSubstrate are backbone only), bio.verify_steric_clash_envelope / bio.backbone_knot_invariant, cfd.lbm_collision_invariance / cfd.assert_divergence_free, twin.robotics.deconflict_4d_trajectories. A2A: zero code today — every grep hit is a hex false positive — so A2A enters the plan declared-absent, its task list derived from the Build-Order-IV registry the day it ships.

THE GATEWAY IS SWIFT INSIDE THE MEMBRANE SERVE PATH — AND IT ALREADY IS. JSON-RPC over SSE / streamable HTTP, fixed-size limb structs, zero floats on every wire — no external gateway process, no non-Swift service. The routes cited above are live at HEAD; every future tool binds to the same path, never to a second server that can drift from it.

C-007/C-008 REFUSE AT THE SEAL PATH. No military use — refusal is a substrate predicate producing REFUSED with refusal_reason, not a policy layer. The ATC family is civil aviation, FAA/ICAO-compliant, and says so in its contract.

THE PRESENTATION LAYER STAYS EXTERNAL. Affine.Earth is the deterministic verification and state-space engine for external twin runtimes — it sells physics, proofs and state-space search, never rendering. A twin’s pictures are its own; our bytes are the facts they must agree with.

UI ↔ agent parity: one capability registry

What must be built. ONE capability registry from which BOTH the UI’s game moves AND the MCP/A2A tool list are DERIVED — a capability defined once appears as a playable move in the language game and as an external tool, or it appears in neither. The registry keystone grows from NPHardCatalog’s capabilities-as-data shape; the three hand-listed catalogs cited above retire into it, and the measured 7-vs-8 drift between two of them is the proof a hand-kept pair cannot hold. A2A measured today: zero A2A surface in the tree; the day it ships, its task list derives from the same registry, never a fourth hand-kept list.

MATCH THE UI TO WHAT AGENTS CAN TOUCH (founder, 2026-08-19). “This enables us to match the UI to what we enable other agents to interact with.” Parity is structural, not editorial: both lists derive from one registry and a gate refuses on divergence — a hand-maintained pair of lists is the defect this row retires, not a fix for it.

Metering + settlement records

What must be built. An API key bound to a cryptographic cycle meter; every invocation seals a metering row under the same seal discipline as work and grant rows — and any new stream it rides declares max_bytes at creation, per the one-full-stream incident law. The meter is durable and cell-side: invocation rows seal against the durable meter, never against a balance the caller reports about itself, and the returned receipt_hash persists as the row’s key rather than evaporating with the response. Settlement RECORDS accrue per 10⁶ invariant checks or per signed proof certificate. A key without standing is refused with an honest status — the refusal is a first-class reading, never a silent failure.

RECORDS, NEVER EXECUTION. Settlement on this surface is a sealed record; payment execution is out of scope here. A record that a machine can audit is the product — moving money is not.

A price or credit rendered anywhere on this surface appears as sats / CAL quotation or not at all — the HONEST tier passes without weakening a detector.