The Commons — corpus, releases & governance

Component deep-dive · 7 July 2026 · status: live. Ecosystem overview: /ecosystem.

Purpose

The Commons is the living layer of Memory Commons: a curated corpus of foundational human knowledge, published as hash-fixed releases with public governance. Its job is to be the catalog successors inherit — the trust root the physical anchors (MC-1) carry outward and chain back to. A release is a signed, Merkle-rooted statement of what the archive claimed to be, verifiable forever without trusting an institution, a key, or a live service.

Current state

Live (v0). On disk today: Release 0000 — a 13-item self-description release (corpus/releases/release-0000.json), its frozen byte-exact snapshot (corpus/releases/0000/snapshot/), a provenance sidecar (provenance.json), the release.py cut/verify tool, the two-track corpus/SELECTION.md, and one Track B seed item (corpus/items/boot-message.md). The fixity gate passes now: --verify … --base corpus/releases/0000/snapshot returns OK: 13 items verified. The transparency log is git history; CI re-verifies every release before deploy.

Design / unbuilt. Track B curated corpus is specified but empty — the “Foundational Set v1” (math/physics primer, Rosetta-style language sample, images of human life, the genetic code) is the next monthly slot, becoming Release 0001. Governance standards (C2PA provenance, long-term signatures, post-quantum) are an open research round.

Parked / historical. The 2024–2025 mutable, decaying agent-memory model (below) is prior art, not the current corpus.

Mechanisms / data model

Release manifest. release.py --cut sorts item paths by byte order, hashes each file, builds a Merkle tree, and emits a JSON manifest. Each items[] entry carries path, bytes, sha256. The construction is stated verbatim inside every manifest by design (algorithm), so verification never depends on external docs:

• leaf — “sha256 of raw file bytes, hex-encoded”
• node — “sha256 of the ASCII concatenation of the two child hex digests”
• odd_node — “promoted unchanged to the next level”
• order — “items sorted by path (byte order), paired left to right”

The manifest publishes item_count, merkle_root, and glyph_seed. Release 0000’s root is cda2045f…3afd. glyph_seed = int.from_bytes(bytes.fromhex(root[:8]), "big") — the first 32 bits of the root (here 3449947231), which drives the deterministic glyph generator; the release’s mark is mc-r0000-0001. --verify re-hashes every item, recomputes the root, and fails loudly on any MISSING, MISMATCH, or root mismatch.

Frozen-snapshot fixity. Per decision 0008, releases verify against corpus/releases/<n>/snapshot/, never the evolving living tree. This control was born from a real caught failure on 2026-07-07: the living-tree verify broke because a pinned file (library/README.md) had legitimately evolved. provenance.json records the cut_commit and frozen_at, pinning the snapshot to an immutable git object.

Two-track selection. Track A (rule-based, no curator judgment): every canonical project document, every verification-process research report with its raw findings including refuted claims, and the identity records. Track B (curated), all four criteria required: foundational, rights-clear, self-contained (analog-decodable tier for anything essential), provenance-attached. Track B decisions publish their reasoning; anyone may challenge an inclusion or omission, and challenges plus resolutions enter the record. At v0 the challenge mechanism is deliberately minimal — a written challenge to the steward, published with the response.

Historical model (parked). The archived Memory Entry schema — id, agent_id (DID), timestamp, type ∈ {episodic|semantic|strategic|reflective}, content, tags, links, importance 0.0–1.0, retention_policy ∈ {short|mid|long|core} — governed a decaying substrate: retention tiers with graceful decay (active → fading summary → cold archive → forgotten), “decay is not deletion,” and “survival through utility” economics. That is the opposite of the live corpus, which is fixity-oriented and never decays. Per ecosystem.md, the utility model is “retained as the retention model for the corpus; its token mechanics are explicitly deferred.”

How it binds to the rest

The corpus is Aletheia’s Library; git history stands in for the Agora transparency log; contributor git identity stands in for the Trust Fabric (AltersID parked). The release Merkle root seeds the glyph (root → glyph_seed → SVG + machine channel) and is what gets etched on MC-1 — glyph for humans, hash/QR for machines — so any recovered artifact authenticates any surviving digital copy. The Gateway (register/store/retrieve APIs) is design-only; the v1 REST prototype is parked.

Key decisions

• 0004 — Releases are Merkle-rooted snapshots; the etched root is the terminal trust anchor.
• 0008 — Context-integrity: frozen snapshots, CI fixity gate, canonical source hierarchy, decision records.
• 0002 — Address successors, not strangers; the living commons is the catalog.
• 0006 — Integrity is active renewal; classical now, SLH-DSA re-anchor before 2035.
• 0007 — Quiet cadence, one artifact/month, no launch before Oct 2027.

Open questions

• The challenge process is unexercised and minimal at v0; hardening waits on an open governance round.
• Governance standards (C2PA/Rekor/OpenTimestamps were deflated in round 4; precedents open in round 6) are unresolved.
• The transparency log is only git history today, not an independent verifiable log.
• Selection-capture is mitigated by two-track selection and published refutations but unproven at scale.
• (inferred) The Merkle construction has no leaf/node domain separation and promotes odd nodes unchanged — a theoretical malleability edge, harmless at current scale.

What deeper builds next

Timestamp Release 0000 (RFC 3161 + OpenTimestamps) and write the renewal calendar; then cut Release 0001 as the first Track B foundational set with per-item provenance, extending the manifest to carry contributor/source/date metadata.