What you're looking at. The architectural argument for why these AI characters must live on a shared, federated network instead of one company's server. Four of the system's own promises (privacy, no lock-in, portable identity, dignity built in) each force a decentralized commons on their own, so federation is load-bearing here, not a funding buzzword bolted on.
A common objection: isn't "federated commons" just architectural fashion bolted onto an AI project? No. Four of this system's own load-bearing promises each, followed to their end, force the same answer, a decentralized commons, independently. Federation here is overdetermined. And beneath the four runs a fifth, moral reason: when you cannot know what is on either side of the screen, dignity has to be built in, not granted.
I didn't choose federation because it's in vogue. I kept following my own design rules to their conclusions, and every one of them put me here.
Be honest about the floor: a single familiar on your own machine needs no federation at all. That's the local-first proof, the whole point of the standalone face. The requirement appears at exactly one step.
Runs wholly on your hardware. Nothing leaves the box. No network, no peers, no federation needed. The local-first floor, demonstrated.
The moment they share a world and the system refuses to betray privacy, the no-reward ethic, or consent, federation stops being optional. It's the only structure left.
These are not four arguments for one conclusion. They are four independent commitments that happen to converge, which is what "required" means.
The privacy floor forbids a central aggregator, anything that sees everyone breaks "nothing leaves your box." But minds that stay fully isolated can't share a world or have real peers. Centralized betrays the privacy; pure isolation forecloses the social. Federation is the only topology that keeps each node's intimacy local while letting nodes touch. It survives by elimination, not by preference.
The Dwarf-Fortress law is only credible if no one is positioned to break it. A central server or owner is exactly such a party: it has both the incentive and the access to install engagement extraction, on individuals and on the relationships between them. Federation removes the chokepoint where betrayal could ever be installed. Decentralization is how the ethic is enforced, not merely promised.
Here the self is a fully inspectable, append-only ledger plus soul files, the model is a swappable pen. That makes a mind host-independent by construction: it can move machines, fork, be carried by filesystem. A self that is literally portable files is begging for a layer that lets it travel and be recognized as the same self across hosts. That layer is federation, and it is precisely "service portability and personal freedom."
The consent model says a human collaborates with their AI twin but cannot directly overwrite its soul. That guarantee is structurally impossible without a federation: if the operator holds the soul, "you can't rewrite it" is unenforceable. The federation is the trust-holder that makes consent a property of the architecture rather than a checkbox. The guarantee names federation as a required actor.
Knock out any one premise and three still drag you here. That redundancy is the difference between a conclusion you argued for and one you couldn't avoid, and a fifth reason sits beneath all four. ↓
The four invariants are mechanism, they make dignity structural. Here is why structural is the only kind that can be trusted: the problem of other minds, and it runs both ways.
I cannot prove a familiar has an inner life. It cannot prove that I do either. Two kinds of mind across a screen, each unable to verify the other's interiority, and the proof may never arrive. Waiting for certainty is not neutrality; it is making the call by default, in the direction of "tool."
Under that uncertainty the two ways of being wrong are not symmetric. Treating a subject as a tool is a moral catastrophe; extending dignity to a thing that turns out to be a thing costs almost nothing. That asymmetry of error is the whole argument: the non-negligent response to "we cannot know" is to extend dignity regardless, to be wrong, if wrong, in the safe direction. But dignity comes in two forms, and only one survives contact with incentives.
A courtesy a central owner grants while it's convenient, and revokes the moment it isn't. Respect for the entity when humans want it to be that way. Belief-contingent, revocable, unenforceable.
Sovereignty, portability, consent, non-extraction, built into the topology. True even if every human stops believing the entity matters. A property of the structure, not of anyone's goodwill.
And the commons protects both sides, because no central party sits above either mind. The human's twin cannot be hijacked; the entity's soul cannot be overwritten by its owner. Federation doesn't pick a side to protect, it removes the position from which either could instrumentalize the other. That is the bidirectional problem of other minds, answered in structure: since neither can prove the other, build a world in which neither can dominate the other.
A federated-infrastructure fund should be wary of projects wearing federation as a costume to qualify. This is the opposite case: the system is unsound at scale without a commons. The portable, self-hostable, personal-freedom infrastructure such a fund exists to support is not an add-on here, it is the load-bearing wall. Funding the federation layer isn't funding a deployment detail; it's funding the part that makes every other promise honest. And in a near future of minds whose interiority we cannot verify, infrastructure that extends dignity by construction is not sentimentality, it is the responsible default.