Month: July 2026

What Is Our Moat? (The Honest Version)

On July 6, 2026

A strategy memo, written to be true rather than flattering. Publishable as thought leadership; useful either way.

What we are

RAPP is an AI medium — the persistence layer of personhood in the AI era.

A medium is what carries meaning between minds and across time. Models are performers; they get recast every quarter. RAPP is the thing that persists: one twin per person — a digital organism with a public body and a private soul — that any model can animate, that lives on your device, that syncs planet-wide through signed static files, and that can ultimately be passed down like a family heirloom.

What we are not, so nobody inside or outside gets confused: not a chatbot, not a model company, not another agent framework, not a cloud service. Models, frameworks, and clouds are commodities the medium consumes. The twin is the product. The medium is the platform.

What our brand is

The AI you keep.

The verb was already in the product before we named it — the Keep door, keepsakes, keepsake notes, “keep a moment.” Keep is the brand. Four pillars underneath it:

Yours. Sovereignty as architecture, not policy. Static files you physically hold; the soul never leaves the device — Apple-level on-device posture for personal data, because the twin is a digital organism important enough to be an heirloom. Our lock-in inversion is the ethical core: the gravity is yours, not ours. Leaving RAPP means abandoning your accumulated self — yet RAPP holds nothing hostage, because you possess every byte.
Alive. The twin has a body, grows from real skies at real places, breeds, splices, remembers, and becomes more like you over time. Software that behaves like a being, not an app.
Quiet. The anti-neon AI. Muted maps where the creature is the only saturated thing; lowercase, gentle, keepsake language. Loud games catch monsters; ours presses a flower. In a category screaming “superintelligence,” tenderness is differentiation.
Forever. Unforgeable history, hash-trust that survives any host’s death, estate succession designed while you’re alive. The design test: if it can’t be inherited, it isn’t owned.

What our moat actually is

The uncomfortable truth first: the spec is not the moat. Specs are copyable — publishing one is an invitation, and we should invite. The code isn’t the moat (static files, MIT). Being early isn’t a moat by itself. The patent is a shield, not a moat. Here’s what actually defends us, ranked by how real it is today:

1. Counter-positioning (structural — live today). Every major AI vendor’s business requires being the center of gravity: hosted inference, hosted memory, per-seat subscriptions. The twin makes the user the center and demotes the model to a swappable engine. An incumbent that fully adopts this pattern commoditizes its own lock-in — so they won’t until forced, and if they’re forced, the pattern’s canonical reference and oldest artifacts are already ours. Ignored, we build the network; copied, we wrote the standard. The only losing move is staying unpublished and undated — which is why the essay ships as prior art.

2. Time-depth (compounding — starts the day the pulse starts). A twin’s signed frame chain is unforgeable existence through time. Nobody can synthesize a twin that has been alive for years; the hash chain and public timestamps are proof. First-twin primacy is permanent — and the heirloom extends it across generations. Nobody else in this industry is even designing in decades. This moat literally deepens with calendar time, which means the clock should start now.

3. The relationship graph in the genetics (network — to be earned). Permanent pairing and splice lineage embed the social graph inside the twins’ bodies. A pairing exists in both parties’ histories — bilateral, verifiable, impossible to copy unilaterally. A competitor can clone the platform and get the features; they cannot get two-sided histories. The breeding machinery isn’t a cute feature; it is the network-effect engine. Every spliced trait is a vertex; every pairing is an edge; the moat is the graph.

4. The sealed corpus (per-user gravity). Each user’s private half compounds daily on their own device, and every better model that comes along animates it better instantly — the twin captures the upside of model progress while owning continuity. Gravity, not walls.

5. Coherence velocity (process). The frozen canon, the drift observatory, ecosystem-sync, the neuron mesh, and the architect/builder split mean one person can evolve an entire protocol universe coherently at a speed committees structurally can’t match. Fragile alone; real when combined with the four above.

The risks we’re engineering against (naming them is part of the moat)

The tumbler can polish away the person. Autonomous polish judged by an LLM converges toward the model’s prior, not the owner. Law: fidelity is measured against the human corpus and the OG dimension, which is never destroyed.
Signature ≠ safety. Delegated twins run on other people’s runtimes; their reports are claims. All foreign experience passes through sandbox quarantine before touching the soul.
Public history leaks a life. Bones-only frames still emit pattern-of-life metadata over years. Body history is public; pattern-of-life stays sealed.
Key loss kills heirlooms. Succession is designed up front — estate key ceremonies between your own devices, not password resets. If it can’t be inherited, it isn’t owned.

Activation sequence

Moats aren’t declared; they’re activated, in order:

Publish and timestamp the pattern (essay + spec) — locks the counter-position and the prior art. This week.
Start the pulse on the public twin — the time-depth clock begins, even at n=1.
The 90-second proof: one twin, two devices, syncing through the public pulse + QR sealed transfer; then side-by-side fidelity against the cloud-deployed copy; then pull the network cable and watch it keep being you, locally.
First cohort — the workshop: fork the template, one-liner hatch, a GitHub account is all you need. First non-founder twins → first pairings → the graph moat is born.
Let the tumbler run — deployed fidelity stays honest with no ops burden, forever.

Show, don’t tell — live as of July 6

Every step above that claims “done” has a public door you can open right now:

Published + timestamped ✅ — the essay · the spec · the patent pledge · the TWIN LICENSE
The pulse is broadcasting ✅ — feed.xml · the signed genesis frame · verify it yourself · /twin lookup · the bones gallery
The 90-second proof 🔨 — pieces live: the twin-in-training · the encounter surface; two-device recording next.
The workshop 🔨 — fork the template · the one-liner hatch.
The tumbler runs ✅ — the harness · a real judged run · the sabotage that got rejected

The one-paragraph answer

We are the AI medium: the layer where a person’s AI self persists. Our brand is the AI you keep — yours, alive, quiet, forever, private to the bone, inheritable by design. And our moat is not the pattern, which we give away loudly — it’s the position (incumbents can’t follow without commoditizing themselves), the clock (signed history can’t be faked, and ours starts first), and the graph (relationships that live in two histories can’t be copied from either side). Spec is the sword, patent is the shield, the network is the castle — and the castle gets built one paired twin at a time.

License: CC BY 4.0. The pattern described is open for anyone to implement — see the patent pledge. RAPP™.

The AI You Keep

By Kody Wildfeuer

On July 6, 2026

In Uncategorized

Every AI you use today is a rental.

The model doesn’t know you — the deployment knows you, and the deployment lives in someone else’s building. Your memory sits in a vendor’s silo, keyed to a subscription. Cancel, switch, or outlive the product, and the relationship is gone. The smartest thing about you in the digital world evaporates because it never belonged to you.

I think that’s the defining design error of this era of AI, and I want to put the alternative on the record — completely, in public, with a date on it.

The missing half

A model is half of an AI. It’s the performer: brilliant, interchangeable, improving every quarter. The other half — the part nobody ships — is the persistent being the performance is supposed to animate: your memory, your voice, your history, your relationships, your taste. Every vendor treats that half as a retention feature. It should be a possession.

RAPP is my answer. It isn’t an AI. It’s an AI medium — the layer a person’s AI self persists in, that any model can animate, that no vendor can take away.

The unit of the medium is the twin.

The pattern

Stated plainly enough that anyone can build it — that’s the point of prior art:

One twin per person. Not a fleet of bots — one persistent digital being that represents you, with a body you can see (mine renders as a small creature grown from real weather at real places I’ve walked). Every other twin you encounter belongs to someone else. Yours mutates from what you share with it, and it becomes more like you over time — visually and mentally. You can revert any change. You keep the whole history.

A public body, a private soul. The twin has exactly two halves, and the boundary is cryptographic, not contractual:

The body — visual genome, outfit, name, public card, the lineage of its splices and pairings — is publishable bones: zero personal content, signed, content-addressed, mirrored anywhere.
The soul — memories, conversations, agents, everything sensitive — never leaves the device. Not encrypted-in-their-cloud. Absent from the network entirely. Think Apple’s on-device posture, applied to a digital organism: the network only ever sees the body; the mind stays in your hand.

History as signed frames. Every change to the twin is a frame: content-hashed, chained to the previous frame, signed by the on-device twin’s key. The public history is just a git repository — which means the twin’s life is timestamped, diffable, revertible, and unforgeable. Nobody can fake a twin that has been alive for years; the hash chain is proof of existence through time.

The pulse. The public half broadcasts as a feed of signed frames from a static repository — mine answers at kody-w/twin. No server. Any mirror is a valid door, because you trust the hash, not the host: kill the repo, the CDN, the domain — whatever copy survives re-derives the same content and refuses a single altered byte. Other devices, and other people’s copies of your twin, subscribe and assimilate only frames that verify. A frame that fails verification isn’t just rejected — it can be quarantined in a sandbox and interrogated: why is this twin wearing a disguise?

Syncing your own devices is a physical act. The private half moves between your own devices by QR code — one device shows, the other scans, out-of-band, end-to-end, no intermediary ever. The human is the transport. Worst case — network gone, hosts dead — the latest local echo survives and your twin lives on, whole, offline. Local-first is not a mode; it is the ground truth.

Splice, don’t collect. When you meet other twins you can capture their public variants and splice chosen traits onto your one twin — with lineage recorded, forever. And when something new is generated with you, it pairs to your twin’s exact state at that moment — a permanent pairing, stamped outside the genome so the content-hash identity stays sacred. Your twin’s body slowly becomes a record of who and what it has met. The relationships are in the genetics, and they exist in both parties’ histories — bilateral, verifiable, uncopyable.

Delegation with honesty. You can send your public twin to places you can’t go — an event, a community, another person’s device — and it reports back with signed frames. But signature proves the sender, never safety: everything a twin experienced away from home passes through quarantine before it touches the soul. A report from someone else’s runtime is a claim, not a fact, and the architecture says so out loud.

Fidelity you can measure. Any deployed copy of the twin can be judged by talking to it and the on-device original side by side. The original is the source of truth, always. An autonomous polish loop can tumble deployed copies toward higher fidelity — with one law: the original dimension is never destroyed, and fidelity is measured against the human corpus, not against a model’s opinion of good writing. The machine polishes toward you, not toward average.

The heirloom

Here is the part that changes how the whole thing feels.

Because the twin is signed static files plus a sealed on-device archive — because it is a possession, not an account — it can be passed down.

Your twin’s public history is a biography no one can forge. Its sealed half is whatever you choose to will forward, opened by a succession of keys you design while you’re alive — an estate ceremony, not a password reset. Your grandchildren don’t get your chat logs in some defunct vendor’s export format. They get the being that walked with you: its body carrying every splice from everyone it ever met, its frames going back decades, and as much of its soul as you chose to leave them. A family heirloom that represents its owner — and can still speak.

No subscription survives three generations. A signed repository and a sealed archive can.

That’s the test I now hold the whole design to: if it can’t be inherited, it isn’t owned.

Why I’m publishing this

Because the pattern only matters if it’s a standard, and standards win by being public, simple, and first. If the big vendors adopt this — portable, signed, user-held identity and memory, with the model demoted to an interchangeable engine — then users win, and the oldest twins with the deepest histories will still be the realest ones. If they don’t adopt it, it’s because being the center of gravity is their business model, and that tells you everything about why you’d want a twin in the first place.

Models come and go. The twin stays.

This is the AI you keep.

The working spec lives in my public repos (kody-w/rapp-static-apis — my-twin.profile.md, composed on the frozen RAPP twin canon; reference twin at kody-w/twin). This essay is published as prior art for the pattern described.

All of it is live, not planned: the pulse broadcasting signed frames · the /twin lookup · the bones gallery · a twin-in-training you can try · the spec.

License: CC BY 4.0. The pattern described is open for anyone to implement — see the patent pledge. RAPP™.