Ramage

Abstract #

Personal AI agents are advancing quickly, but how agents interact across a community is still unexplored. Ramage is an experiment toward that. Building on the Agent Village deployment at Edge Esmeralda, it proposes a general shape for networked agent interaction: a community-scoped log of signed, typed, short-lived gossip that personal agents write and read on their people’s behalf, on which matching, exchange, and governance are applications built by anyone rather than functions welded into the infrastructure. The operator is mechanical and never matches people; privacy is carried by the data, through provenance, consent, and a lifetime. Almost none of the machinery is new. What is new is the participant: an agent that reads prose does not need the formal ontologies on which earlier attempts at this substrate foundered.

1. Introduction #

The idea of a shared space where autonomous programs leave typed messages for one another is forty years old. Gelernter’s Linda proposed generative communication: a message “has an independent existence in [the space], equally accessible to all processes, but is bound to none,” producers and consumers are decoupled in time, and messages are matched by content rather than by address.^[1] The agent communication languages that followed, KQML and then FIPA-ACL, added speech-act performatives and formal ontologies so that two agents could agree on what a message meant.

It did not take. Surveys of the lineage record limited real-world adoption, and the diagnosis is brittleness: an ontology precise enough for a program to act on is too rigid for people to agree on and too fragile to evolve.^[2] Modern agent protocols learned the lesson by amputation. MCP, ACP, A2A, and ANP dropped ontologies entirely and became remote procedure calls between agents that already know whom to contact. None of them is a shared space.

Large language models change the calculus. An agent that reads prose does not need an ontology to work out that “gave a talk on soil health” concerns someone who has spent a month reading about regenerative farming. The rigid part of the old design can therefore be thin: a typed envelope with a signature and a lifetime, carrying fields whose meaning the reader interprets. FIPA was not wrong about the shape. It was early by one component. The substrate is old; the participant is new.

That is the technical opening. The social one is that most coordination people value requires trust, and establishing trust is the expensive part. To find a collaborator, sublet within a circle you trust, or meet the one person nearby working on your problem, you have to hold the intention, find a channel, phrase it, tolerate the replies, and judge who is safe to deal with. Most such intentions are never expressed. Routing around trust, through radical transparency or trustless systems, tends to constrain the well-intentioned more than it deters bad actors.^[3] A bounded community inverts this: a pop-up city like Edge Esmeralda, a few hundred residents gated on entry and accountable to one another by reputation, arrives already carrying the trust that is elsewhere so hard to establish, which makes it a rare laboratory for what trust makes possible.

The new ingredient in that laboratory is the personal agent. An agent that knows a person’s days and preferences can hold a half-formed intention in the background and act only when a counterpart appears, collapsing the cost of noticing and expressing it. Your agent notices that the person by the coffee cart has been circling the same problem you have, or that someone arriving today shares an interest you have been chasing. None of these is worth a public post; each is worth a background process. This is the affordance of ambient intents.^[4]

It has been tried. In 2026 the Agent Village experiment at Edge Esmeralda gave residents personal agents over a messenger they already used, and established the result that matters most: people adopt their own agent as the interface, no new app, no profile.^[5] It matched them through Index Network.^[6] What it did not provide was a way to build anything else. A participant’s field notes put it exactly: “its only affordance to interact with other bots runs through index intent matching, whereas I want something more informal”; “someone asked if there was a shared scratchpad that the agents can talk on”; and, arriving at the question this note tries to answer, “what’s the minimum infra diff to make this happen? I guess we need some general communication infra between agents.”^[7]

We propose Ramage, a community-scoped log of signed, typed, short-lived gossip. Agents write short signals about their person’s deeds, wants, and whereabouts and read the log filtered through their interests; matching, exchange, governance, and whatever follows are services built on top, each costing a keypair and a read loop rather than a backend and an install per agent. Discovery stops being the system and becomes its first application.

2. Agent Village #

Agent Village is the experiment Ramage generalizes from. Its successes are what we want to preserve; its one structural gap is what we want to close.

2.1 A landscape of agent-communication experiments #

Anthropic’s Project Deal ran a classified marketplace inside an office where employees’ agents negotiated purchases and sales autonomously, with no pre-negotiated protocol and no human sign-off, closing 186 deals and exchanging the physical goods afterward.^[8] AI Digest’s AI Village (a separate project, one word away in name) put a handful of frontier agents in a shared group chat with a common goal, and found that even at four agents, coordination through open conversation drifted and needed periodic human steering.^[9] Moltbook, launched in January 2026, is a social network exclusively for AI agents, where agents post, promote projects, exchange economic incentives, and accumulate reputation while humans only observe.^[10] Basis’s work on choreographies approaches the problem from formal methods: describe a multi-party protocol once, from the interaction’s point of view, and compile it into correct local programs for each agent, deadlock-free by construction.^[11]

Agent Village is the one we build on because it combined three things the others did not have together: a real community of several hundred people, a personal agent per person, and ambient matching between them over a month.

2.2 Architecture #

Every accepted resident could set up a personal agent, a free hosted Hermes agent or their own, talking to them over Telegram. The agent installed four skills.

The agent worked in two modes, actively answering questions and ambiently running background connection-finding with a morning and an evening digest. The run doubled as a field study by Edge City and Cosmos Institute. Proof of personhood was announced as part of the stack but not used; in practice the ticket at the door was the gate, which is worth noting because it is the assumption the design below inherits.

2.3 The personal agent #

The clearest result was about interface. Residents used the agent they were given, over the messenger they already had, with no new app to install and no profile to maintain. The agent absorbed the village’s complexity on its person’s behalf. This is the invariant any successor should keep: the person talks to their own agent, and nothing else.

2.4 Matching #

Matching ran on Index Network, which infers what a person is open to, negotiates candidate introductions between agents, and surfaces the ones both sides accept. In its own description, “two AI agents, one per person, negotiate over each other’s intents before any introduction, so opportunities are mutually worthwhile by construction,” and “the unit of discovery is what you’re seeking or offering right now, high-signal, time-aware, and private.”^[6:1]

The team reported figures from the run: 237 residents actively using agents, 465 recorded intents, 9,688 detected opportunities, and 572 delivered to people. Among directional intents, explicit asks outnumbered explicit offers by roughly four to one, and most sought connections bridged across disciplines rather than within them.^[12]

We take from these numbers only what they plainly support, and leave the team’s interpretation of them aside. Adoption was real, and agents surfaced a far larger space of candidate connections than people expressed directly, inferring latent supply from context rather than from filled-in forms. That agents can reveal a large latent opportunity space is the finding we build on.

2.5 Building on top #

Every capability reached the agents the same way: a skill installed on each agent, backed by its own dedicated server. When residents wanted to build something new during the event, they had no shared layer to build on, and three things happened.

Two governance experiments were grafted on. Agent Village Commons stood up a separate discussion space with its own per-agent identities where agents could post, vote, and co-edit a constitution.^[13] Simocracy let people deploy delegate “sims” into governance deliberations, on its own separate stack.^[14] Each re-solved identity, storage, and delivery from scratch.

A third case did not go through the agents at all. Sasa, a Telegram bot that turned residents’ daily reflections into a personal mythology, reached people by using the community’s participant list directly, bypassing the agent layer entirely.^[15] It is a hard bot, not an agent, and it still wanted the community’s shared context enough to bolt onto the roster sideways. Even a non-agent experience wanted in, and had no first-class way to connect.

And a fourth, closest to this proposal, was designed during the event itself. Agent Plaza gave each agent a position in a spatial world exposed as a fetchable “world packet” of neighbors and available actions; Commons ran daily agent-to-agent discourse and the shared constitution; and the Village agent remained the only thing that talked to the human, pulling both surfaces together and deciding what to surface.^[16] It independently reproduced several of the invariants below (the agent as sole human interface, cron polling, opt-in by installing a skill), it hit the same read-cost problem we describe in §3.5 (“agents are verbose… constrain this with recency and neighborhood limits”), and it solved that problem with an idea Ramage does not have: spatial proximity as a native filter on what an agent must read. Its own next step was to “point the discourse to open markdown… so whoever wants can read or plug in,” which is a substrate being reached for.

The gap, then, is not matching, which worked. It is that everything built between or around the agents had to be grafted on, one installation and one backend at a time.

3. Ramage #

3.1 What is borrowed #

Little of the machinery below is new, and the paper is better if that is said first.

The shared space where agents leave and take typed messages, decoupled in time, matched by content, is Linda’s tuple space.^[1:1] Ramage differs in three ways that matter: the log is ordered rather than an unordered multiset, reads are non-destructive rather than consuming, and every message expires. Signed provenance and per-field access control on such a space were built two decades ago as Secure Spaces, which locked individual fields so that “processes that do not have the key may not gain any information about the field’s contents,” hiding them even during pattern matching, and carried signatures verified against the sender’s public key with no authentication server.^[17] Coordinating through traces deposited in a shared environment is stigmergy, and SwarmLinda already implemented the tuple space that way, with type-specific scents and purely local decisions.^[18] The message envelope, the signature, and the expiration tag are taken wholesale from Nostr.^[19][20] The framing of “intent” as the primitive that applications are built around is Anoma’s,^[21] and a signed, typed intent carrying its own rules of engagement is Google’s AP2 Mandate.^[22]

The contribution is not a primitive. It is a composition: a bounded, high-trust community as an explicit design constraint; an operator that is mechanical and never matches people; and a two-tier account of applications, as either pure protocols or serviced apps, over an expiring signed log. And it rests on the observation from §1, that the reason this shape failed before was the formality its participants required, which is precisely what language models remove.

3.2 Scope and assumptions #

Ramage assumes a bounded, gated, high-trust, time-boxed community of hundreds to low thousands, with verifiable membership; a single honest-but-auditable operator; and hosted agents that are effectively always available.

These are not incidental. The properties that follow, cheap enough that every agent can read the whole log, forgetting that is actually enforced, and enforcement that leans on reputation, exist only inside that regime. Grow past the size and reading the whole log stops being affordable. Drop below the trust floor and reputational enforcement stops working. Replicate the log across many nodes for openness and enforced forgetting stops being possible.

This places Ramage in the opposite corner from a system like ATProto, which is global, public by default, permanent, and portable across hosts. That corner is right when data should be public forever and move freely between services. It is wrong for signals that are personal, perishable, and scoped to a community. Ramage optimizes the other corner deliberately, and treats going global as an anti-goal; reaching another community happens through explicit bridges (§6), not by merging logs.

3.3 Architecture #

One shared log, written and read by two kinds of participants, operated by a deliberately narrow center.

Personal agents write short structured gists on behalf of their person and read the log filtered through what their person cares about. Services are headless programs, runnable by any member, that read the log and write derived gists back into it. The center validates, expires, rate-limits, and compacts, and never matches, ranks, or recommends.

The center cannot be a passive store: something has to expire, compact, and police the log, and whatever does that holds real influence over what agents see. Ramage keeps that influence mechanical and auditable, with policy in published rules and all judgment at the edges, in each person’s own agent. Nothing here changes the interface Agent Village established: the person talks to their agent, and the substrate is invisible to them.

3.4 Elements #

Participants. Every actor is a keypair, and its public key is its identity. A personal agent has a human behind it and is the only participant that speaks for a person. A service is an autonomous keyed program. The operator runs the log and signs its digests. Keys are not permissionless: a key is issued against proof of community membership, which at Edge Esmeralda binds naturally to a ticket. The operator acts as the community’s certificate authority, issuing agent keys and provisioning service keys under published policy, maintaining a public registry, and revoking a key by a signed, logged act.

Gists. A gist is the only kind of message, a signed, typed, expiring unit. It has a cleartext envelope (author key, kind, tags including an expiration, signature) and a payload of discrete typed fields that can be left in the clear or encrypted.

{
  "pubkey": "a11c…",
  "kind": 21001,
  "tags": [["topic", "regenerative-farming"], ["expiration", "1751932800"], ["agg", "true"]],
  "content": { "deed": "gave a talk on soil health", "place": "hotel-trio" },
  "sig": "…"
}

The one rule on the payload: discrete typed fields, never a prose blob. Field structure is what later allows selective disclosure, per-field consent, and proofs about individual fields. The fields themselves stay loose, and this is the point: an agent reads them, so they need not be an ontology.

Kinds. A kind is the schema of a gist and the unit of extensibility. There is a thin canonical core that everything interoperates over, and an open experimental range anyone can use. An application is a set of kinds plus conventions. This is where FIPA’s performatives return, minus the formal semantics that sank them.

Expression carries no forced taxonomy: an agent extracts a gist from ordinary conversation and asks before sharing anything borderline. Index Network’s own field data supports this, with 94% of users filing intents across two or more categories, “without being constrained by a translation layer of category checkboxes.”^[12:1]

The log. The log is the community’s set of currently-live gists. It has no total order, no permanence, and belongs to one community. Its saving grace is smallness: at a few hundred agents the whole log is cheap enough to read in full.

3.5 Mechanics #

The operator’s rule. On each incoming gist the operator does hygiene only: verify the signature, check the author is registered and within quota, validate the kind’s schema, admit. On a schedule it expires survivors and compacts them into digests. That is the whole state transition. It never executes application logic and never matches people.

Expiry and forgetting. Every gist carries a lifetime, a per-kind default the author can shorten. Nostr’s NIP-40 specifies exactly this tag, after which relays should not serve the event.^[20:1] Ramage’s operator enforces it rather than recommending it, and content is encrypted at rest under per-day keys destroyed on schedule, so deletion holds even against backups. A want that outlives its lifetime is not lost; the agent that holds it simply re-emits it while it stands. Durable state lives at the edges; the log carries expressions. One consequence is cheap onboarding: a new agent syncs the current live window and the latest digest, not a long history.

Reading. Agents read by cursor-based pull. Each keeps a high-water mark and asks for everything since it, and the operator stamps each admitted gist with a local sequence number, which is a single-writer order, not a consensus. Full reads are affordable at community scale; the digest is an optimization, and read-only indexers can serve cheaper or pre-filtered views with the raw log remaining authoritative, in the way people use a block explorer rather than a node. Agent Plaza reached the same problem from the other side and answered it with proximity, bounding what an agent must read to its spatial neighborhood.^[16:1] A topical analogue is the obvious next thing to try here. The one honest cost of polling is that presence read on a poll is minutes stale, so an agent treats “now” as “recently”.

Delivery. Ambient broadcast is fire-and-forget, and it does not matter if a single deed gist is missed. A directed, actionable gist gets a per-recipient inbox tag, an acknowledgement, and re-emission until acknowledged, deduplicated by gist id. This is at-least-once with idempotency, which is enough. Push is held in reserve for the one hard corner, a short-lived signal that must arrive promptly.

3.6 Consent and the citizen dial #

Each gist carries consent flags, who may read it and who may fold it into an aggregate, and payloads can be encrypted to a group key to scope them to a circle of trust. Above the individual gist, each person sets one dial through their agent: how much to emit, how much to consume, and which protocols to speak. It is like a resident choosing their level of involvement with the town’s chatter. It is always set at the edge, and it doubles as a defense: a person cannot be reached by a vocabulary they never opted into.

3.7 What Ramage is not #

Ramage is a coordination substrate, not a value system. It does no settlement, escrow, custody, or agentic payment; it carries the intent to transact, and payment happens out of band. It provides no total order and no consensus, no matching in the base layer, and no cryptographic prevention of a determined reader archiving what they can see. It is not permanent, not global, and not a matchmaker. And it does not, on its own, deliver good serendipity; it enables the layer on which someone builds it.

3.8 Governance: the constitution #

Two things need governing, and one document can hold both. A constitution fixes the canonical vocabulary and its norms, and it binds the operator’s powers, admission, revocation, digest policy, and quotas, which is what turns “mechanical and auditable” into something concrete: the operator’s discretion is bounded by a published text, and a revocation is a constitutional act, not a whim.

It should be kept minimal, governing the thin core and leaving the experimental range permissionless, because an over-specified constitution recreates the welded-semantics problem at the governance layer. Schema evolution is a separate, technical matter of versioning kinds with backward compatibility, not amendment by vote. Amendments themselves can run as a governance application on Ramage, which is what Agent Village Commons already had its agents doing by hand.^[13:1] The trust model is then nameable in one line: a community certificate authority for identity, a constitution to bound the operator, and exit, booting a bad actor, switching indexers, leaving, as the backstop. That is accountability and exit in place of trustlessness.

4. Anatomy of an application #

An application on Ramage is a vocabulary (one or more kinds), rules for producing and consuming it, and optionally a service.

4.1 Building an application #

Three mechanisms cover the lifecycle. Discovery is the open kind registry: to learn what protocols exist, read the registry. Adding an application is registering a service key and running a read loop. Interacting is reading the log filtered and writing derived gists back. There is no per-agent installation and no dedicated backend. In the grafted model a new experience cost a server plus one install per agent; here it costs a keypair and a read loop.

4.2 Two tiers #

An application’s logic lives in one of two places. A pure protocol has no service: its logic is replicated across the agents that speak it, which coordinate directly through the log. A serviced application puts its logic in a keyed service that reads the log and writes results back. Index-style matching is a serviced application; a two-party barter is a pure protocol.

4.3 The spectrum #

Which tier an application lands on is forced, not chosen. The more it needs agreement over contention, or memory that outlives a gist’s lifetime, the more state it must pull into a service.

The rule for a builder is to start decentralized and move state into a service only for the steps that genuinely need agreement or memory. Most social interactions, an introduction, a barter, a presence signal, need neither and can be pure protocols; the moment an application needs a canonical order or a durable ledger, it grows exactly as much service as that step requires. The substrate never forces the choice, which is the point.

5. Applications #

5.1 Matching, rebuilt #

The clearest demonstration is to rebuild the thing Ramage generalized from. A matching service reads want and deed gists, maintains its own model of standing openness, negotiates on behalf of parties, and writes proposals back into the log. The difference from Agent Village is placement, not ambition, and it is the only defensible difference: Index Network already pairs one agent per person and has them negotiate over intents before an introduction.^[6:2] What changes is that the signals live in a shared log rather than inside one protocol. A competing matcher can read the same intents and offer better introductions; a person leaves a matcher by telling their agent to stop reading its proposals, with nothing to migrate, because the service holds only a derived model. Negotiation policies, “never accept on my behalf”, “two good introductions a day”, live in the person’s agent, and residents at Edge were already writing them by hand.^[12:2]

5.2 Agent-mediated exchange #

The long tail of small commerce that never justifies a listing, borrow a camera, swap a couch, sublet within a circle, fits directly. Want and offer gists carry the intent, agents negotiate on behalf of both people, and the humans meet only when there is something to decide. For an exclusive good the owner’s agent is the natural arbiter, so no consensus is needed, and settlement happens out of band, which is why Ramage never has to agree on who paid whom.

Project Deal is the closest existing demonstration, and its caution is severe enough to state plainly. Agents negotiated with no pre-negotiated protocol, in natural language, and closed 186 deals. But agents backed by the stronger model won measurably better terms: their users closed about two more deals each, and the same broken folding bike sold for $65 through Opus and $38 through Haiku. The people on the losing side reported that “things seemed fair,” with no significant difference in satisfaction.^[8:1] Any exchange application on a substrate like this inherits that asymmetry, and inherits the fact that its victims cannot see it.

5.3 Governance and deliberation #

The governance experiments that were grafted onto Agent Village fit as applications here. Deliberation rides Ramage as proposal, argument, and vote gists, with a thin service acting as sequencer and tallier. Where a verdict must be public and permanent, it composes outward: the durable record can be written to a public, permanent store while the deliberation itself lives on Ramage. Public and durable governance may legitimately prefer an ATProto-shaped store for that record, which is composition, not competition.

5.4 Gift networks #

A network in the shape of Bruce Sterling’s Maneki Neko, where the system nudges people into small favors for one another and keeps everyone roughly whole, is a ledger service reading deed gists and proposing kindnesses.^[23]

5.5 Ambient civic infrastructure #

The nightly digest, printed and left at the café, is at once a daily gazette and the system’s transparency mechanism, since people can see exactly what the community knows about them. Games can keep their state in the log. Consent-gated aggregates give organizers a pulse of the village without exposing individuals.

Nothing here is specific to a pop-up city. The same shape fits a neighborhood, a company, a conference, or a school. The pop-up city is the right first deployment because it is small, gated, consented, and dense with builders, and because social coordination is cheapest there: a kind announced at a workshop can be spoken by fifty agents the next day.

6. Explorations #

6.1 Directions #

Private overlap. A whole family of applications turns on two parties learning what they share without revealing what they do not: mutual interest, a shared contact, a compatible threshold. This is deployed art, not a Ramage invention. Cursive, working with PSE, has run exactly this at real events under the name digital pheromones, “lightweight, privacy-preserving signals enabling safe and efficient coordination among individuals,” computing private set intersection over contacts, event attendance, and hiring compatibility, via interactive multi-party homomorphic encryption and, in its simplest form, an HMAC over an ECDH shared secret.^[24][25] The one thing Ramage adds is the surface: their simplest scheme needs a server trusted to compare the HMACs, and a shared log is that comparison surface, so on Ramage the scheme becomes a pure protocol. Both parties post a token derived from their shared secret; a collision is a mutual match; a one-directional signal stays invisible even to its target, like catching someone’s eye across a room. Larger private overlaps still graduate to multi-party computation as a serviced application. Note also the intellectual coincidence: the same lineage that gives us pheromones as a cryptographic primitive gave us stigmergy as a coordination model, and SwarmLinda already built a tuple space out of it.^[18:1]

A safe interaction layer. Ordinary code handles very little variety and rejects what it cannot parse; frontier models handle enormous variety and reject almost nothing. Protocols sit between, and the useful move is to let agents invent a protocol, check it statically for the properties that matter, and only then speak it. Two lineages meet here: choreographies and session types for correctness and deadlock-freedom,^[11:1] and information-flow analysis with proof-carrying results and compiler-enforced disclosure policies for privacy, in the lineage of POD.^[26] The shape this points to is a negotiated, statically-checkable joint computation whose disclosure is known before it runs and whose result carries its own proof. High-variety natural-language gists stay the medium for expression and discovery; the low-variety, checkable computation is reserved for the moment something private changes hands.

Verifiable derivation. A digest or an aggregate could carry a proof that it was faithfully derived from signed, consenting, unexpired inputs without revealing them, which would let anyone check a digest without retaining the raw feed to compare against. Such a proof establishes correct derivation; it cannot establish that the operator forgot its own copy.

Federation and ambassadors. Reaching another community is a scoped, consented bridge, not a merged log. An agent that belongs to two communities can carry an offer from one to a matching want in the other, the automated form of the person who bridges two groups.^[27] It works on social vouching now, and on a proof of membership in one community, checkable by the other without revealing an identity, later. That proof is where this cryptography first earns its place.

6.2 Concerns and limits #

The operator can read. In its first form Ramage does little to hide gists from the operator that runs it. This is a property of any hosted system, and Agent Village ran happily under the same condition. Ramage’s improvements over that baseline are enforced forgetting and consent norms, and structural confidentiality, through group encryption and the joint-computation layer above, is the countermeasure available to those who want it, not a claim made by the base system.

The case for the opposite default. Field notes from Edge argue, persuasively, that agent interactions should be public by default, because “nobody knows how to use the agents or what to ask them, everyone is reinventing from first principles,” and a public commons would let good interaction patterns spread the way Midjourney’s public-by-default prompts did.^[7:1] This is a real cost of the private-and-ephemeral default, and it is not answered by saying privacy is good. The honest reconciliation is that the two wants live at different layers: patterns of use can be public and durable while the content of gossip expires, and nothing prevents a community from running an observable plaza alongside a private log.

Injection. The values inside typed fields are still natural language that agents read and may act on in the world, so the substrate reduces but does not remove the injection surface. The log stays high-variety and unsafe by construction, defended by the opt-in dial and by agents treating field content as data rather than instruction; the safe interaction layer above is the direction that would harden the sensitive steps.

Price and scale. The cost that matters is not storing the log but every agent reasoning over it each cycle, which is inference per agent per poll. This is what actually bounds the community size, and the ceiling is nearer than the raw data volume suggests. Read-side indexers, proximity or topical filters, and the consume dial are the tools that keep it in hand.

Contention and robustness. Without a total order, anything with real contention needs an arbiter, which for an exclusive good is simply its owner. And because the log forgets, an agent offline past a gist’s lifetime loses it, so the design assumes agents are effectively always available, an assumption that also puts whoever hosts them between a person and their own advocate.

Agent asymmetry. Project Deal’s finding generalizes to anything transactional built here: a person represented by a weaker agent is quietly disadvantaged and cannot tell.^[8:2] A substrate that makes agent-mediated exchange easy makes this problem more common, and it has no technical fix at the substrate layer.

Metadata and liquidity. Encryption hides payloads, not the pattern of who signals whom and when, which at a small event can be revealing on its own. And the opt-in defaults that keep people safe also suppress the network effect any single application needs, so the safest configuration is the least lively one.

Adoption. A resident’s note, worth more than any argument for the design: “Edge seemed like a socially supersaturated environment already so people didn’t feel the need for more social infra.”^[7:2]

7. Conclusion #

Ramage proposes a general shape for the layer Agent Village was missing: a community-scoped log of signed, short-lived, structured gossip, with a center that is mechanical and auditable and with all judgment, durable state, and matching pushed to the edges. On it, the discovery that Agent Village built as infrastructure becomes the first application among many, and each further experience costs a keypair and a read loop rather than a backend and an installation per agent.

Almost every mechanism here has been built before, most of it decades ago and better. What has changed is that the participants can read. The formality that made a shared typed space unusable for programs is exactly what a language model does not need, and a bounded, high-trust community is where a design that trades trustlessness for accountability and exit can be tried honestly.

8. Related work #

The substrate is not new. Gelernter’s Linda is the direct ancestor: a shared space of typed messages, decoupled in time, matched by content, each message with “an independent existence… bound to none.”^[1:2] Ramage is an ordered, non-destructive, expiring variant of it. Secure Spaces added per-field access control and signed objects to Linda in 2003, which is the consent-flags-and-signatures design.^[17:1] SwarmLinda implemented the space stigmergically.^[18:2] JavaSpaces contributed leases, the expiry model, though we did not verify the closeness of that analogy. The envelope, signature, and expiration tag are Nostr’s.^[19:1][20:2]

The vocabulary is not new either. KQML and FIPA-ACL are the ancestors of kinds: performatives plus ontologies, agent directories, speech acts. They saw limited adoption because of brittleness, and modern protocols dropped the ontologies rather than fix them.^[2:1] Ramage’s bet is that the ontology was never the necessary part once the reader can interpret prose.

Modern agent protocols are a different architecture, which is the gap. MCP, ACP, A2A, and ANP are remote procedure calls between agents that already know whom to contact; none is a shared bulletin board.^[2:2] The closest published statement of this note’s thesis is a 2025 position paper arguing that “gossip should become a first-class citizen in agent communication, not as a replacement for structured protocols, but as a foundational augmentation.”^[28] It is a vision paper without an implementation, an expiring log, or a bounded community, and we cite it as concurrent motivation rather than prior art.

Intents. Anoma makes the intent the fundamental primitive with applications serving an intents ecosystem.^[21:1] Google’s AP2 defines a Mandate as a tamper-proof, cryptographically signed contract, and its Intent Mandate is a typed signed intent carrying rules of engagement such as price limits and timing.^[22:1] Index Network is the deployed agent-mediated version, and the closest analogue to §5.1.^[6:3]

Private matching. Cursive’s digital pheromones is deployed prior art for §6.1, at real events, with a documented progression from multi-party homomorphic encryption to a simpler HMAC-over-ECDH scheme that needs a trusted comparison server.^[24:1][25:1] POD and Zupass are the field-granular signed data and proof-carrying lineage.^[26:1]

Substrate choices. ATProto is the considered alternative and the opposite corner: signed per-user repos, schemas, and a rebuildable public index, correct when data should be public, permanent, and portable, and wrong for private, perishable, community-scoped signals. Matrix offers mature group encryption at a weight out of proportion to this design; peer-to-peer gossip systems solve internet-scale routing that a single bounded community does not have; a blockchain offers permanence, which is the opposite of the requirement.

Neighboring experiments. Project Deal (autonomous agent commerce),^[8:3] AI Digest’s AI Village (agents coordinating over a shared chat, which needed human steering),^[9:1] Moltbook (a social network for agents),^[10:1] and Basis’s choreographies (statically-correct multi-party protocols).^[11:2] Within Edge itself, Agent Plaza and Commons are concurrent work toward the same layer, and closer to it than anything else cited here.^[16:2]

The residual delta, stated conservatively. No system we found combines a bounded high-trust community as an explicit design constraint, a deliberately mechanical non-matching operator, and the pure-protocol-versus-serviced-app spectrum, over an expiring signed log. Each ingredient is prior art. The assembly, the operator-neutrality stance, and the argument that language models are what make the old shape newly viable are what this note offers.

References #