# Codex Brief — Dunaversity Initial Prototype (v0.2 · 2026-07-21)

**REVISIONS 2026-07-21 (override anything below that conflicts):** (1) Taxonomy v1.3.4: the Six Elements — Realms, Actions, Resources, Media, Sources, Actors. "Source" replaces "Presence" everywhere; all agents are Actors; Ki is the universal Actor. (2) Old UI "Elements" and "Artifacts" are now **Media**; Records and Badges are Media, never Resources. (3) **No Portals**: a Scene is Realm Media presented in place; drop `create_portal`. (4) **Onboarding**: one-time link + inviter-set Secret Code; invitee enters Code Name + Secret Code + sets own password; NO email or mobile anywhere; joining auto-enrolls Kinship Duna AND Dunaversity. (5) **One vector store** with graph-resolved access; Drops are logical scopes. (6) Add `inspect` as a first-class Action on any Element (UI affordance + Ki). (7) Add dual-Source press-and-hold as a confirmation mode stub. (8) Launch frame: Kiduna 1.0, Aug 10; invite-only; no Guests active.

You are building the first working prototype of **Dunaversity** — the first organization on Kiduna, the agentic internet. This brief is self-contained; if a Kiduna Kit zip is attached, treat it as reference and this brief as controlling for scope.

## What you are building, in one sentence

One Flutter codebase proving the whole loop: **a Catalyst creates a course in Studio (desktop layout), a learner takes it in Live (mobile layout), and identity, permissions, money, and records carry the weight between them** — with all external effects simulated and labeled.

## Stack — non-negotiable

- **Flutter** (Dart), one codebase, two adaptive layouts: **Studio** (≥ 1024px: desktop/laptop) and **Live** (phone). Same state, same data, same Field — different renderings.
- **Flame** only as a stubbed Scene host (one placeholder Scene with enter/exit through a Portal; no gameplay).
- Local-first: **SQLite (drift)** for relational state; an **in-memory graph layer** (typed nodes/edges, serialized to SQLite) as the permission authority; a simple embedding-free "vector store" stub (keyword retrieval is fine) namespaced per Wisdom Drop.
- **LLM adapter interface** (`KiModel`) with two implementations: `ScriptedModel` (deterministic, for demos/tests) and `ApiModel` (OpenAI/Anthropic key from env). All agent behavior goes through this adapter.
- Everything money and chain is **simulated, labeled "SIMULATED" in the UI** — a visible execution-mode chip. Never fake a real payment.

## The one architectural law (do not violate)

**Probabilistic proposes; deterministic decides.** Every state change goes through a typed **Action** executed by one `ActionService`: `enter_realm · create_realm · update_realm_identity · update_stance · create_wisdom_drop · add_wisdom · run_research · resolve_qa_flag · set_classification · set_program_structure · name_luminary · send_invitation · assign_role · submit_contribution · accept_into_record · integrate_item · define_badge · publish_realm · enroll · complete_movement · issue_badge · record_contribution · create_portal · enter_scene`. Each Action declares actor, source of authority, target, required permission, confirmation level (**Autonomous / Confirmed / Deliberate / Governed**), and writes an immutable **Record** row. The UI control (tap vs press-and-hold) expresses the level; it is never itself the permission. **The graph answers every permission question before any content is fetched.**

## Domain model (nodes; keep it this small)

`Source` (Moto, Matt, Aashik, Paul — switchable at login only) · `Realm` (types: Organization, Program, Community, Scene-ref) · `Role` (Catalyst, Wizard, Creator, Member — realm-scoped) · `WisdomDrop` (name, purpose, default classification, attribution) · `WisdomItem` (origin: generated/imported/external; classification: public/private-to-realm/personal/secret; acceptance state: raw/accepted/integrated; movement placement) · `Badge` (definition + issuance) · `Offering` · `Record` (append-only) · `Wallet` (FROST-sim per member, Squad-sim per Program) · `LedgerEntry`. Pre-seeded state: **Kinship Duna** (Genesis Organization), **Dunaversity** (second duna), Ki's stance text, treasury rules (lineage 30% initial: 20/5/3/2 · 18% ongoing: 12/3/2/1 · 3% Kiduna Club · admin minimum 20%/$50K-floor), four Sources. **Nothing else exists.**

## Ki

Ki is the interface. A persistent conversational HUD on both layouts (chat; voice optional/stub). Ki's replies are grounded ONLY in Wisdom the current Source may access (graph check first), plus system state. Ki greets first on first login, from zero: it names the two Realms and the Source's roles, and asks what they'd like to do. Ki never discloses private/personal/secret content across permission lines — enforce in the retrieval layer, not the prompt.

## Build milestones (in order; each independently demoable)

**M0 — Skeleton + seed.** Login as one of four Sources; Field view with exactly two Realm Elements; Ki greets from zero; enter/leave Dunaversity; Records viewer (every Action visible with actor/authority/timestamp).

**M1 — The floor path (Aashik, Live-first) — the first target; if this works, the machinery works.**
Aashik on the phone layout: tells Ki "I want to make a course: how to be a cricket fan" → intent restated → name/handle (uniqueness check) → one Confirmed tap → draft Program with defaults (template Stance, one "Fan" badge, open enrollment). Next, in Studio layout: one Researcher run (via `KiModel`) lands generated artifacts with source lists into an auto-created Drop; he records/types three segments; QA/QC flags one item (scripted), he keeps it; **press-and-hold publish** → the course appears in the public catalog (genesis namespace). Timer instrumentation: the Live creation path must be demonstrable in under five minutes.

**M2 — The learner loop (Matt, Live).**
Matt logs in (already a member; simulate the 100 USDC join as a prior LedgerEntry showing the full distribution: 30 lineage → 3 Kiduna Club → admin → treasury, every hop a Record). Ki-first arrival names what's here; he enrolls in a published course (one tap); moves through Movement I (reader view); completion issues a badge (simulated NFT: an id + timestamp on his Source); he records a voice/text contribution **classified private-to-the-Program before submit**; it appears in the Catalyst's contribution queue.

**M3 — The Catalyst's bench (Moto, Studio).**
Theme A–D core: declare intent → checklist Element pinned; identity through conversation (names proposed, handle checked, description drafted from a 3-question interview); Stance interview → versioned Stance artifact; **Wisdom Drops**: create named Drops, drag local files into a specific Drop (add-time card: Drop · classification · attribution), paste an external link (marked external), one Researcher run into a designated Drop; classification chips everywhere, four unmistakable treatments; structure proposals from actual Drops → pick → movement skeleton; contribution queue: **accept** Matt's testimony (Record) → **integrate** into a movement (Curator step, distinct); appoint a Creator (Role grant); elevate a Wizard with the scope checklist (exclusions rendered: no Stance, no treasury, no acceptance, no Luminary naming); define badges; pre-publish "what's public" preview; Deliberate publish.

**M4 — The money walk + the Scene stub.**
A "Month Close" button runs the deterministic distribution: treasury remainder → Programs pro-rata by Compute consumed (development + learning, metered per `KiModel` call at fixed sim rates) → Catalyst payback first → split rule through the Program's Squad-sim wallet (Moto/Luminaries/contribution pool). Render as a step-by-step walk, every hop a Record. Plus: one Flame Scene behind a Portal in Mastering Agency — enter, walk, exit, permissions unchanged.

## Out of scope — do not build

Real payments, chains, or wallets (simulate; label) · $KIDUNA (USDC-denominated sim only) · forums/voting · Express/TV · federation · real KYC (Matt's veteran badge is seeded data) · account creation (four seeded Sources; login is selection + passphrase) · notifications infrastructure (in-app only).

## Design language (minimum viable fidelity)

Dark espresso ground; Avenir-class sans body, display serif headers; sky-blue interactions; restrained mint for state; **gold exclusively for Deliberate acts** (press-and-hold ring). Four classification treatments must be instantly distinguishable. Money renders as facts (meters, ledgers, walks) — never gamified. If the Kit's `_ds/colors_and_type.css` is attached, derive tokens from it.

## Acceptance = three recorded walkthroughs

1. Aashik: couch → published Cricket course (Live ≤ 5 min creation, Studio same-day publish), every step producing Records.
2. Matt: join-ledger inspection → enroll → Movement I badge → private contribution submitted.
3. Moto: Drops → structure → acceptance+integration of Matt's testimony → Wizard delegation → Deliberate publish → Month Close walk paying back 1,400 sim-USDC then splitting.

Definition of done per milestone: the walkthrough runs on `ScriptedModel` with zero network; switching to `ApiModel` changes conversation quality only, never permissions or state transitions. Write widget tests for the ActionService permission matrix (every Action × every Role × both Realms).

## Working rules

Ask before inventing any noun not in this brief (the vocabulary is canonical). Anything ambiguous: implement the simplest version that preserves the architectural law, and log it in `DECISIONS.md`. Deliver as a repo with `README.md` (run instructions), `DECISIONS.md`, and the seed script.
