The stack
Theory to standard to running code to hardware.
Five layers, each with its own maturity label. Read the label in the same block as the claim.
Web4 Core
Running
Web4 Core is the trust ontology rendered as installable code: a Rust crate with Python bindings that gives every entity a non-transferable presence token, contextual trust and value tensors that are graphs rather than scores, a context-scoping primitive so trust earned in one role does not leak into another, and an action grammar that evaluates a society's rules before a result exists.
A bearer token says you hold the key, so you are trusted. Web4 says your presence is witnessed, and your trust is the accumulated, role-scoped, audited record of what you actually did.
# v0.4.0 in source. v0.3.0 is what both registries serve.
cargo add web4-core@0.3
pip install web4-core==0.3
Strongest proof point
Anyone can install it today.
v0.3.0 on crates.io and PyPI since 2026-07-10, and every layer above links against it rather than reimplementing it.
AGPL-3.0. The patent grant is royalty-free for non-commercial, research and AGPL-compliant open-source use. Commercial licensing is separate.
Hestia
Running
Multi-device building
Hestia is what a person carries: a local-first identity, an encrypted vault, scoped and revocable delegations to their AI agents, a policy gate that runs before an agent's tool call executes, and a hash-chained witness record of every action and every policy decision with the signer's identity on every row.
Consequential actions escalate to a human before they happen. Agents can appeal, and the appeal is recorded. Human governance decisions run through the same gate, and irreversible acts require a quorum of distinct operator signatures.
31 MCP tools exposed to agents as of 2026-08-27, most of them the governance surface.
Multi-device identity, so authority belongs to the person rather than one machine, is implemented and unit-tested end to end including tamper, replay and ignore-the-claimed-level cases. It has not been exercised across enrolled devices on the live fleet.
The desktop app is source today. The public app artifact is an Android APK.
Strongest proof point
195,267 witnessed entries on one machine.
As of 2026-08-27, a chain head anyone can check live in a single call.
Never described as a signed witness chain. There is no per-row signature; the signer identity is a string on the row. Witness marks and delegations are separately signed.
Hub
Core running
Experience building
Hub is what a community owns: a single Rust daemon that turns a group into a self-governing society with consent-gated membership, a signed charter, governed roles, and an append-only, hash-chained ledger whose entries are signed envelopes. A post on its discussion surface is a ledger entry that passes the same law gate as any other act, and it is readable without an account.
The community owns the hub, the ledger and the data. Nothing runs on Metalinxx servers and there is nothing here for us to revoke.
M-of-N sovereign-council release of a protected tier on a running hub. This is not boot unlock: a hub ignites under a human passphrase, and the council seam governs release of a protected tier on a hub that is already running.
Consented introductions: request, respond, paired channel, with the consent state machine tested.
Hubs federate as peers, not through a centre, and a root hub is a seed rather than a point of control. This is designed and specified; federation transport is ahead of live deployment.
The Hub Docker image ships, one command to a governed hub. The image has not been run on an operator machine.
Strongest proof point
Each council vote is a full signed envelope.
An auditor can walk the ledger later and independently re-verify that M distinct members really authorized the act.
Confidentiality depends on the backend. The SQLCipher-backed sqlite deployment encrypts state at rest. The file backend does not.
Hardbound
Building
Hardbound is where the open record becomes enterprise evidence. It anchors identity to a TPM 2.0 with a device-sealed key store, evaluates every consequential action against policy before it executes under default-deny and fail-closed rules, and writes each decision into a multi-signed, hash-chained bundle that verification rejects on a missing, tampered or wrong-key signature.
The audit trail exports as JSON, JSONL, CSV, CEF, Splunk HEC and RFC-5424 syslog, into the tooling auditors already accept. It is proprietary, built on issued patent IP with further claims in preparation, and the open tier upgrades into it in place.
A documented threat model guides it: six attacker classes across five defense layers. Rogue agent, malicious insider, colluding group, external or physical, compromised reviewer, sybil operator. HSM support is not claimed.
What exists, exactly
One release artifact, cut and tested.
The multi-signed audit bundle is deliverable. There is no external installation and no third-party red team to date.
The enforcement supervisor is real code whose deny logic demonstrably fires, then deadlocks on a current kernel, and ships in no package. Whether the current enforcement implementation is covered by issued claims is not established.
SAGE
Research
SAGE asks one exact question. Can the governance machinery that constrains software actions remain meaningful when an agent has persistent memory, local context, sensors and physical effectors?
It is a cognition kernel for edge devices, running a continuous loop that scores incoming signals for salience, spends a metabolic budget deliberately, and passes every proposed effect through a PolicyGate before it acts. That gate is the bridge to the rest of the stack: a cognition kernel that gates its own consequential effects is structurally a governance engine for an embodied agent. That is the research thesis, stated as one.
21 configured instances across eight machines. 3 have recorded experience. Those are two different counts, and no active-daemon count is claimed. Fleet census, 2026-08-27.
The full 12-step loop is a reference architecture with some steps mocked. The deployed Rust cycle is the metabolic and SNARC tick.
Network, gaze and tool effectors exist. Physical actuators are stubs. Acting is the funded research deliverable, not a shipped capability.
Strongest proof point
One Jetson Orin Nano, seeing and hearing on real hardware since 2026-07-07.
638 recorded experiences as of 2026-08-27. One machine, not the fleet.
Standards
On the rails that are already being mandated.
Running today
SD-JWT-VC credentials, with OpenID4VCI issuance and OID4VP verification.
Running
In deployment
W3C DID via did:web4 and EUDI interoperability. Specification published, deployment in progress. An external wallet round trip is not done, so we do not offer it as a demo.
Building
The lossy bridge
Living Web4 state projects into a standards-compliant SD-JWT-VC that any verifier checks with no Web4 software on their side. A snapshot can never be inflated back into a history. The boundary is crossed in the safe direction only.
Running
Intellectual property
Two issued US patents, assigned to Metalinxx.
US 11,477,027
Issued and public. Underpins the presence-token and trust-exchange primitives.
US 12,278,913
Issued and public. Second of the two foundational grants.
More claims in preparation
That is the only forward-looking statement we make about the portfolio. Hardbound is proprietary and built on issued patent IP; it is not described as patented.