A Territory, Not a Feed
Most platforms are services you visit. ChainBranch is closer to a territory you settle. Its parts only mean something in relation to each other — so that is how they are introduced here.
What ChainBranch Is
The record hall. At the center is a public record hall that no one owns — the Sui blockchain. Every profile, every post, every community is an entry in it. But the entry is not the thing itself. It is a seal: a small, unforgeable mark derived from the thing, the way a fingerprint is derived from a hand. The hall never holds your words. It holds proof of your words — forever, and for anyone to check.
The warehouses. The words themselves live in warehouses — several at once, run by different parties, none of them special. Any warehouse can hand you a post; the seal in the record hall tells you instantly whether you were handed the real one. This is the first relationship worth pausing on: the seal checks the warehouse. Storage can be ordinary, replaceable, even untrusted, because truth doesn't live there. Lose a warehouse and you've lost a copy. The claim survives.
The key that doesn't know your name. You enter the territory with an ordinary login — and what comes out is a key that is yours alone, derived by a proof rather than a handshake. The login provider never learns which door you open here. The territory never learns who you are there. Nobody holds the list connecting the two, because no such list exists — the connection is proven each time without ever being written down. This is the platform's deepest habit, and it will recur: proving without seeing.
The terrain that remembers. Every action in the territory also lays a stone in a shared terrain — a vast lattice of coordinates where each identity's history accumulates as a path, built rather than merely recorded. The entire terrain, every stone anyone has ever laid, compresses into a single seal small enough to hold in one hand. And there are exactly two honest ways to look at it: the census — does this stone exist, is the whole terrain intact? — and the journey — where has this one traveler walked? The engineering underneath (we call it high-dimensional indexing) is the discipline of letting many travelers lay stones at once, at speed, while keeping census and journey provably in agreement at all times. Scale is never allowed to weaken what the terrain can prove.
The blind surveyor. Here is the strangest property, and the one we most want understood. A terrain that remembers everything sounds like a surveillance instrument — surely one could watch the stones fall and infer the friendships, the factions, the private gravities between people. We assumed so too. We built that instrument, pointed it at our own terrain, and tested it six different ways. It reads nothing. The same blinding that keeps each traveler's direction private is what makes their gatherings undetectable — privacy for one and opacity for all turned out to be a single mathematical guarantee wearing two faces. So we removed the instrument and kept the proof. The habit, recurring: the terrain proves that everything happened, and shows no one why. A watcher with the entire terrain in hand learns only: stones were laid, in this order, and the seal is intact.
The charter. A territory needs law, and law is where platforms usually betray their inhabitants — rules enforced by an owner who sees everything and answers to no one. Here the charter is built from the terrain itself. Standing is earned by inhabiting: your presence in the territory, read from the terrain each month, is what first admits you to the room where decisions are made. Influence is weighted but deliberately bounded — winning a thousand votes makes your voice stronger, never a thousand times stronger. Influence decays if unused: it is a rechargeable battery, not a hoard. Decisions are slow on purpose — a proposal takes a month to become action, because speed is the friend of capture. The founder is mortal by design: the charter contains the question of its own founder's death, a succession path, and a veto that dies with him. And the endgame is written in: once audited, the law locks. The contracts become immutable — the authors permanently lose the power to rewrite them, and the charter becomes the only hand on the wheel.
Closing the loop. Walk it once more, backwards. The charter governs the territory, but the charter's own acts are entries in the same record hall, sealed the same way as the smallest post. Admission to the charter's room is read from the terrain — and the terrain, by proof, tells the charter that you inhabited without telling it who you gathered with. The terrain is fed by keys that never learned your name. The name-blind keys sign words kept in ordinary warehouses, checked by seals in the hall the charter cannot rewrite. Around the whole loop, one habit repeats until it stops looking like a feature and starts looking like a constitution: this is a system built to verify everything while watching nothing. That is what we mean by owning your presence online — not a slogan about your data, but an architecture in which no one, including us, occupies the tower at the center.
The Machinery
For readers who want to see the gears. Each section opens where the story left off and descends one level — to named mechanisms, not code. Everything untagged runs today on Sui testnet.
The Record Hall — the on-chain core
The record hall is a single Sui Move package holding the objects the platform cannot function without owning honestly: Profiles (your identity NFT — username, karma, and a running Merkle root of everything you've published), Posts (not content, but commitments: a storage pointer, a content hash, and a coordinate hash binding the post into the terrain), and Channels (communities as owned objects — the creator holds a transferable AdminCap; members hold MembershipNFTs).
Three choices that matter more than the object list
- Permanent addresses for shared state. The platform's shared objects are versioned: upgrades migrate them in place, so their identities never change. There is no "the contract moved" in this system's future.
- Law as data, not code. Fee rates and limits live as dynamic fields on a parameters object — a 2% tip fee and 5% membership fee today — changeable by governance without touching code, and every fee routing is a public, auditable event.
- Additive history. Superseded modules stay on-chain, inert. The hall does not tear pages out.
The Warehouses — storage and gates
Content is stored redundantly across independent backends — Walrus (the primary, itself a decentralized blob store), R2, IPFS, and the platform's own indexer as a fallback — all keyed by the same content hash that was sealed on-chain. The backends are interchangeable because none is trusted: whichever one answers, the seal verifies the bytes. Posts survive any single backend's death.
Some doors in the territory are locked, and the locks are real. Gated channels encrypt content with Seal threshold encryption — decryption requires a quorum of independent key servers, so no single operator (including us) can open a member's content unilaterally. The credential that satisfies the lock is the MembershipNFT in your wallet; for tip-unlocked posts it is a ReadCap minted to you on-chain. Where most platforms enforce gates with an if statement in someone else's server, here a gate is a cryptographic fact: what the seal is to truth, the lock is to access.
The Key — identity and sealed letters
Sign-in is zkLogin: you authenticate with an ordinary account, and a zero-knowledge proof turns that authentication into control of a Sui address — without the login provider learning the address, and without the chain learning the account. ChainBranch self-hosts the entire proving path (the prover and the salt service that anchors the derivation), so no third party ever holds the linkage between your login and your key. No seed phrases; nothing to leak that would connect the two worlds.
The same key writes sealed letters. Direct messages are end-to-end encrypted — a key agreement ratcheted forward into per-message keys — and each conversation maintains a rolling Merkle root, so either party can later prove the transcript was never altered, without ever revealing it on-chain anchoring: planned. The relay that delivers envelopes sees ciphertext and timing, nothing more. The habit again: the system can verify the conversation's integrity while being unable to read a word of it.
The Map Office — the indexer
Territories need maps, and maps must be fast. The indexer streams every checkpoint from the chain, decodes the events that concern the territory, and maintains the queryable world — feeds, profiles, channels, governance state, the terrain's octree — pushing live updates to clients as they happen.
The map office's defining property is what it lacks: authority. Everything it knows is derived from the public chain and can be rebuilt from it — its recovery tooling refuses to write reconstructed state unless the rebuilt terrain-root matches an independent surviving witness, byte for byte. If the map office burned down tomorrow, the territory would lose a convenience, not a truth. Chain authoritative; map derived; the relationship is enforced, not promised.
The Terrain — Quanta and High-Dimensional Indexing
Quanta is the terrain itself: a four-dimensional integer lattice in which every identity's platform activity is laid down as occupations — stones on a path. Each occupation is verified (a keyed hash check against an on-chain seed decides whether the stone is legitimate before it is accepted), bound to its content (you cannot later swap what a stone commemorates), and folded into an octree Merkle accumulator that compresses the whole terrain into one 32-byte root. Identities enter the terrain as commitments — deterministic, device-independent, and not addresses — with periodic on-chain checkpoints.
High-Dimensional Indexing
HDI is the engineering discipline that lets the terrain scale without weakening its proofs. Its core principle is a duality: the terrain supports exactly two honest reads — existence (whole-field: is the terrain intact? one root answers) and locality (per-identity: this traveler's path) — and both must stay exact and provably in agreement. From that principle, results that now run in production:
- Order does not matter — proven. Each identity's trajectory is an independent head; disjoint occupations fold to an identical root in any order. Serial processing was a race condition wearing a costume, not a requirement — so the fold can parallelize without changing what it proves.
- A conservation oracle. At any moment, the root can be recomputed from the raw event log and compared to the committed root — plus a drift check that catches stored-tree corruption even when the roots agree. Integrity is a runnable check, not an assumption.
- An order-invariant whole-field root. The terrain's blocks fold into the global root through a canonical, domain-separated ordering — order-independent by construction, not by operational care.
- Write-once ground. A coordinate belongs to its first occupant; collisions cannot silently rewrite either the record or the root.
- Witness-gated recovery. State rebuilds must re-derive the exact root a surviving witness attests to, before a single row is written.
- A parallel fold engine research prototype — the reduction runs across worker heads and on GPU, byte-identical to the reference implementation, at 5–19.6× on measured workloads.
One further HDI arm — approximate similarity reads over the coordinate field — was deliberately parked: it cleared correctness gates but not usefulness ones at current scale. That is the discipline itself, and it is worth stating on a public page: nothing is promoted onto the trust path without clearing a conservation invariant.
The Blind Surveyor — the anti-panopticon proof
The terrain looks like it should be the perfect surveillance instrument. It is not, and this is a proof, not a policy.
During design, a social-density sensor was built to read collective structure — clusters, cliques, coordinated movement — out of the terrain. Six simulation runs across six approaches converged on a formal result: the global root reveals no information about the social structure of the network. The mechanism is key-blinded trajectory derivation — two identities performing the same interaction still step in cryptographically uncorrelated directions, because each step is derived under a private key the observer does not hold. No correlation, no detectable clustering, no readable social graph. The property that makes your direction private and the property that makes everyone's gatherings opaque are the same guarantee. The sensor was permanently removed from the design — in the words of the design record: "not a failure — a proof."
The blindness is layered, and the layers are additive
- Structural opacity — the terrain itself (the proof above).
- Identity unlinkability — self-hosted zkLogin: no party holds the login-to-address linkage.
- Content blindness — E2E messages the relay cannot read; Seal-gated content no single server can decrypt.
- Credential blindness — governance credentials are minted against one-time nullifiers: the system can verify you earned standing without linking the proof to your history full ZK verifiers: planned.
Honesty requires scope: public posts are public — that is the point of publishing. Operational metadata (timing, envelope counts) exists as it does in any networked system. The claim is precise and strong: content, social structure, and identity linkage are cryptographically withheld — even from the operator. What the platform can verify about you and what it can see about you are separated by mathematics.
The Inhabitants' Engines — the agent layer
Communities in the territory can run machinery: moderation, digests, welcomes, curation, oracles, polls — an automation layer called the Swarm, a capability runtime in which each capability is a typed, schedulable unit with its own treasury controls and spend caps. Agents are not ghosts: a platform agent holds an on-chain BotProfile — a real identity in the record hall — and its posts are sealed and stored exactly like a person's. Channel treasuries fund their own automation; every agent expenditure lands in an auditable ledger. A rendering tier of the same layer drives 3D scene surfaces — agent-generated spatial views of channel activity — using the same commitment pipeline as everything else.
The design rule that governs this whole layer: an agent is an inhabitant, not an operator. It signs, spends, and answers to the same seals as everyone else.
The Charter — governance
Everything above defends what is; the charter decides what changes. It is one system; pieces not yet live carry markers.
Standing is earned
Governance runs on four token classes:
| Token | Weight | How it enters the world |
|---|---|---|
| CGT | 1 | Earned monthly — top decile of platform activity, read from the terrain |
| PGT | 4 | Founder-assigned from a fixed monthly allowance (3/month) |
| FGT Secondary | 16 | Minted only by the Prime holder |
| FGT Prime | 16 | Exactly one exists — the genesis root of authority |
The class is closed: governance tokens transfer only between existing governors; your first token must be earned, assigned, or minted to you — never bought from a stranger. The single exception is FGT Prime itself, whose open transferability is what makes succession possible.
Power is bounded and perishable
A win-streak multiplier grows logarithmically — a thousand won votes makes a voice ~11× stronger, not 1000×. Unused tokens decay with a six-month half-life toward a 10% floor; casting any vote resets the clock. Influence here is a rechargeable battery, not a hoard — participation, not accumulation, is the store of power. A participation rate (spent over earned) is public on every profile: hoarding is visible, socially if not mechanically.
Change is deliberately slow
A proposal takes a minimum of 31 days to become action: 7 days surfacing → 7 days voting (quorum: 10% of total platform weight) → 3-day timelock → 14 days in a work queue where execution is claimed and completed in public. Six categories; treasury and parameter changes auto-execute, platform decisions require human hands.
Friction is a right
Work-queue items can be appealed — at quadratic cost (the Nth appeal costs N² friction units), so obstruction is possible but expensive. Appeals trigger counter-votes with graduated outcomes (dismiss / redo / kill). The founder may delay an item at most three times. After three appeals, any FGT holder can force final resolution — the escape clause that guarantees deadlock ends.
Communities are sovereign
Each channel chooses an archetype — autocracy, direct democracy, meritocracy, council, federated, or anarchy — and the platform cannot intervene in a channel that hasn't opted into emergency services. Platform governance governs the platform; channels govern themselves.
The founder is mortal by design
A heartbeat object tracks the founder's liveness. The dead man's switch is triggered by a literal question posed as a proposal — matched fuzzily on-chain so the trigger cannot be dodged by respelling — and the living founder can veto it instantly, a veto that death revokes. If it passes: a one-month timelock, then a succession ballot among the platform's most active participants, and the Prime token — the root of authority — transfers to the winner. The platform is built to survive the people who built it.
The endgame is abdication
Governance activates fully at 10,000 profiles on mainnet. One contract batch remains — storage lifecycle and the ZK credential verifiers planned — then an external audit, and then the lock: the contracts become immutable. No upgrade authority, held by anyone, ever again. Every future change flows through the charter or not at all. Most platforms promise not to abuse their power; this one is engineered to lose it.
Transparent Economics
Every fee is a line of Move code you can read — stored on-chain as governable parameters, never hidden in a terms-of-service clause.
| Action | Fee |
|---|---|
| Posting, liking, reading | Free |
| Tips sent to creators | 2% platform fee |
| Batch tips ("support this thread") | 1% platform fee |
| Channel creation | Gas only |
| Gated channel membership | 5% of membership price |
| First profile mint | Sponsored (free) |
Once governance activates, these rates are adjustable only via community proposal — no unilateral changes. Platform treasury funds are held in a smart contract, and spending is on-chain and auditable by anyone.
Meeting You Where You Are
You don't need a wallet to read, or crypto to post. Your first Profile NFT mint is sponsored — the platform treasury pays the gas, so there is no faucet, no exchange, no waiting. Channels can extend the same courtesy: a sponsored channel covers gas for its members' actions from its own treasury.
Where It Stands
ChainBranch runs today on Sui testnet — the terrain live and conserving, governance mechanics live ahead of their mainnet activation gate. The remaining path is short and public: one final contract batch (ZK verifiers, storage lifecycle) → external security audit → the immutability lock → mainnet, where 10,000 profiles switch the charter on.
The claims on this page are derived from the project's design records and verified against the deployed system. Where a mechanism is proven rather than promised — the order-invariance of the terrain's fold, the blindness of the removed surveillance sensor — the proofs live in the project's design codex and are reproducible from the public event log.