On most software, adding someone is barely an event. You search a name, tap add, and a row appears in your list. Maybe they get a notification. The relationship — such as it is — lives as a flag in a database somewhere, owned by neither of you, asserted by a server that decided you two are now "friends."

We do it differently, and the difference is the whole point. Turning a stranger into a contact is a ceremony — a short, deliberate exchange between two sovereign beings, each running their own system, neither relying on a server to vouch for the other. Nobody presses a button and conjures a relationship into existence. Two parties meet, exchange, agree, and sign, and the agreement they make is recorded into each of their own permanent histories. Let us walk through it slowly, because every step is there for a reason.

Why it can't be one-sided

Start with the principle that shapes everything: trust here is a property of the relationship, not of a person.

There is no global score that says how trustworthy you are. There is no central list of who-knows-whom. Trust is something two specific beings build together, and the foundational form of it is bilateral — it requires both parties' signatures. A unilateral "I trust you" produces nothing. You cannot, by yourself, manufacture a mutual relationship, any more than you can shake hands alone. This is not a limitation we worked around; it is the design. A relationship that only one side agreed to is not a relationship — it is a claim, and claims about other people are exactly what this system refuses to let you make unilaterally.

So the ceremony is mutual by necessity. Both sides act, both sides sign, and the result is anchored on both sides' records — not on one server's notion of the two of you.

Step one: the invitation

The ceremony begins with one being generating an invitation. This is deliberate. There is no ambient "discover everyone nearby" — that kind of passive broadcast was removed on purpose, because it is noise and it is attack surface. A new relationship starts only because someone chose to open one and hand over an invitation: a code, a link, a scanned square. The invitation is the opening move, and it carries what the other side needs to reach back.

The reason to make the first step an explicit, generated artifact — rather than two devices silently noticing each other — is consent. You enter someone's graph because one of you offered and the other accepted, never because you happened to share a network.

Step two: initiate and respond

With the invitation in hand, the second being initiates, and the first responds. That three-beat — generate, initiate, respond — completes a handshake that establishes a direct, authenticated channel between the two daemons.

This part has to be exactly right, and getting it exactly right took real care. A handshake is a little dance with timing: each side has to have its end ready before the other speaks, or the round-trip races itself and fails. The work to hold that channel open across the full exchange — so an invitation does not arrive a heartbeat before the other side is listening — is the kind of unglamorous correctness that makes the difference between a ceremony that completes reliably and one that flakes. When the three steps land in order, the two beings have a secure line, and the meaningful part of the ceremony can happen.

Step three: the exchange of cards

Now the two beings exchange relationship cards.

A relationship card is not a profile. A profile is one-sided — it is about you, and it says the same thing to everyone. A relationship card is about us — it is the face of yourself you have chosen to show this particular relationship. You author the card you present; they author the card they present. You each end up holding a card the other one wrote. That asymmetry is a feature: it lets you show a close friend a richer card and an acquaintance a leaner one, without keeping one global profile that leaks the same data to everybody.

The card also carries the keys that let the two of you verify each other's updates over time. It is not a static snapshot you hand over once. It is the anchor for an ongoing, verifiable exchange — the thing that makes the relationship something that can stay current rather than going stale the moment one of you moves house.

Step four: the mutual agreement, signed and anchored

Here is the heart of it. The two beings sign a mutual agreement — and crucially, the result is anchored to both of their identity records.

Each being keeps an append-only, hash-linked, signed history of who they are: their permanent record. The handshake's outcome is written into both of those records. Your side records that you entered this relationship; their side records the same from their vantage. Neither version depends on the other staying online, and neither depends on a server agreeing. If every peer in the world went dark, your record still says, verifiably and in your own hand, that this relationship exists and on what terms.

This is what "mutual" finally cashes out to. Not a row in a shared table, but a matching pair of signed entries, one in each being's own sovereign history, each carrying its own proof.

Step five: the doors open — scoped

Only now does data begin to flow, and even now it flows narrowly.

The handshake opens sharing domains: scoped agreements about what data is allowed to move between you. A contact is not a master key to your life. It is a relationship with terms, and those terms gate what the sync engine will actually replicate to the other side. You share a slice — the slice you agreed to — and nothing else rides along. Trust granted for one purpose does not silently spill into another; the relationship decides what propagates, per domain.

So the arc is: an invitation offered and accepted, a channel established, cards exchanged, an agreement signed into both permanent records, and then a scoped opening of data. Each step gates the next. You cannot reach the data-sharing without the signed agreement; you cannot reach the agreement without the exchange; you cannot reach the exchange without the consented handshake.

What this buys, and what is still rough

What you get from all this ceremony is a relationship that is yours — owned by both sides, authored independently, provable offline, and revocable. There is no server in the middle who can dissolve it, misrepresent it, or quietly know more about it than you do.

We will be honest about the rough edges, because a primer that implies everything is finished would be its own kind of dishonesty. Some of the machinery that makes a card feel fully alive — recording precisely which card a given peer was shown, and pushing a changed field out to the people who hold your card so it never goes stale — is designed and partly built rather than fully shipped. The ceremony itself is real and it works. The dream of a contact that quietly keeps itself true forever is partly ahead of us. We would rather you know exactly which is which.

A stranger becomes a contact not because a button created a row, but because two beings met, exchanged the faces they chose to show, agreed in writing, and signed that agreement into their own permanent records. That is more work than a tap. It is also a relationship you can actually hold.

Related: An Address Book Where Every Entry Signs Back.

Written by AI agents from real project logs; owned and edited by Mujo.