Agents are simple. The harness is the wallet.

Agents are simple. The harness is the product — and in CAPPZ, the harness is the wallet. Ten principles, six architecture diagrams, and how CAPPZ compares.

LIVE PATTERN · CAPPZ REPLICATOR

The middleware hub just became optional. Parties synchronize directly. Contracts, applications, data, and shared multi-master state bilaterally replicated, peer to peer.

  • 1 WHISPER (UDP BEACON · PAIRING CODE)
  • 2 PUBLISH HEADERS
  • 3 DISCOVER MISSING STATE
  • 4 SYNCOFFERED ↔ SYNCREQUESTED
  • 5 ENCRYPTED A2A BLOCKS
  • 6 HASHES VERIFIED
  • 7 HEADS CONVERGED
  • 8 HIGH QOS CHECKSUM DELIVERY · HASH-PRINT RECEIPT

REAL-WORLD DEMO

Two wallet copies, two tabs. Create an ISO 20022 payment in one and watch it verify and converge in the other.

Whisper to find. Connect to move.

Discovery whispers on the LAN; across firewalls, copies ask. Peers find each other by UDP beacon, a TX bid/ask rendezvous with a relay node, pairing code or wallet breadcrumbs, then move the same checksummed frames over TCP, QUIC, a WebSocket bridge, an outbound relay ladder (WebTransport, WebSocket, HTTPS keep-alive, long-poll) or a USB bundle; nodes pull missing bodies by content hash. No inbound port behind a firewall, no browser required.

  • UDP beacon
  • TX bid/ask
  • Pairing code
  • Member table
  • Transport
  • Runs on
  • NAT
  • Offline
  • TCP
  • Standalone node
  • Needs a reachable port
  • LAN
  • QUIC
  • Standalone node
  • NAT-friendly (UDP)
  • LAN
  • WebSocket bridge
  • Browser → local node
  • Localhost only
  • Yes
  • Relay ladder (WebTransport · WebSocket · HTTPS)
  • Browser or node → relay node
  • Outbound only
  • No
  • USB bundle
  • Anywhere
  • n/a
  • Air-gap

A read-only XRPL connector watches validated ledger headers and checks anchoring proofs itself — no hosted verifier, and it never submits transactions.

Borrowed from Bitcoin: the peer pattern. Left behind: proof-of-work and global broadcast.

# standalone Replicator edge node (Deno) git clone https://github.com/CAPPZ-ai/cappz-sdk cappz && cd cappz && npm install # CAPPZ_NODE_KEY (PKCS8 base64) / CAPPZ_NODE_PUB (raw hex): Ed25519 key that signs hellos, beacons and TXs CAPPZ_POW=<your POW> CAPPZ_NODE_KEY=<pkcs8> CAPPZ_NODE_PUB=<hex> \ CAPPZ_TLS_CERT=cert.pem CAPPZ_TLS_KEY=key.pem \ deno run --allow-net --allow-read --allow-write --allow-env --unstable-net \ packages/cappz-edge-node/main.ts --tcp 41441 --quic 41443 --ws 41442 --relay 41445

THE CAPPZ HARNESS

Agents are simple. The harness is the wallet.

Agents are simple. The harness is the product — and in CAPPZ, the harness is the wallet.

ACROSS COPIES AND CLONES

The harness travels with every copy — and syncs agent to agent.

The middleware hub just became optional. Every wallet copy or clone carries its own resident agent and exchanges encrypted blocks bilaterally, peer to peer. The chainlet layer carries lifecycle headers so each copy can discover missing shared state without holding the payload.

Transceiver unites Receiver and Transmitter. Wallets post SyncOffered asks and SyncRequested bids for contracts, applications, data, code, or models. Base prices are self-sent config records (0 CAPPZ today), priced flat, per KB or per MB. Deterministic matches pay the offerer before synchronized multi-master state or an atomic app upgrade moves.

Status: same-device and relay transport are live; cross-device direct transport is still pending. Open the Replicator →

Put the harness inside the wallet.

Most agents are a loop around a model with a handful of tools. The leverage is not in the loop — it is in what the loop hands the model on every turn, where the work goes, and whether an action may run. The CAPPZ Harness puts all of that inside the wallet: state, decisions, rules and permissions are notarized, HD-addressed events. The resident agent writes, the BPMN engine executes, the COPE principles chain decides, and every decision leaves a signed, replayable record. Context is assembled from the notarized graph cache rather than accumulated in a transcript, routed by where the data lives and who owns it, and disclosed in tiers so hundreds of skills cost almost nothing until they are needed.

The CAPPZ Harness — the wallet holds explicit state, COPE answers the per-turn questions, BPMN runs the work, and every decision ends as a notarized event. AX-57 · AX-74 · AX-97 · COPE

What every turn is built from.

Each principle is backed by something the platform already runs today.

The resident agent writes. The BPMN engine executes. The COPE principles chain decides. Every decision becomes a signed event.

Each turn is rebuilt from the notarized graph cache. No ever-growing transcript to compact, corrupt or restart.

The wallet declares its host — Local, Cloud or Auto — and work goes where the context already lives.

The cache-first skill graph answers "where is X?" without re-scanning files or documents.

The agent sees only the fact sheet for the current anchor — deal, tenant, route or page — at the visibility that anchor needs.

Skill card, then per-skill llms.txt, then full BPMN and schema on demand. MCP-compatible, not required.

Governing principles and scope memory attach to HD addresses, so summarising a conversation can never erase them.

Wallet tiers decide what goes where. Private threads stay in the user wallet; secrets never leave the browser.

A single graph-cache projection feeds the work queue, process viewer, operations dashboard and agent answers.

BPMN user-task gates and signed request/response pairs give allow / ask / deny — and every outcome is recorded.

Route by residency and trust, not difficulty alone.

Handing work between models is only cheap if the receiver does not have to re-read everything. CAPPZ hands off addresses, and the wallet decides where private work is allowed to run.

The receiving model reloads the whole conversation, and so does the model it hands back to.

The receiving model gets HD addresses and a scoped fact sheet, then resolves only what it needs from the graph cache.

Residency-aware routing — work goes where the context lives. Hand-offs pass addresses, never whole transcripts, so switching models does not mean re-reading everything. Wallet-host residency · PTW → POW → UPW

18 named models. One governed choice.

CAPPZ is model-independent. The title-bar picker writes the operator’s choice as a hash-sealed ModelSelected transaction; every app replays that same latest-wins record. Auto preserves both a cloud and local target, then routes from the selected primary slot.

Cloud · Lovable AI Gateway

Nine verified Google and OpenAI choices. Auto can keep one as the cloud primary or fallback.

  • Gemini 3.7 Flash google/gemini-3.7-flash · Google · fast
  • Gemini 3.1 Flash Lite google/gemini-3.1-flash-lite · Google · fast
  • Gemini 3.1 Pro (Preview) google/gemini-3.1-pro-preview · Google · premium
  • GPT-5.6 Luna openai/gpt-5.6-luna · OpenAI · fast
  • GPT-5.6 Terra openai/gpt-5.6-terra · OpenAI · standard
  • GPT-5.6 Sol openai/gpt-5.6-sol · OpenAI · premium
  • GPT-5.5 openai/gpt-5.5 · OpenAI · premium
  • GPT-5.4 Mini openai/gpt-5.4-mini · OpenAI · standard
  • ChatGPT (Instant) openai/chat-latest · OpenAI · standard

On this machine · Ollama / LM Studio

These starters seed the model wallet. Runtime discovery also exposes any other model installed on the operator’s endpoint.

  • Kimi K2 (Moonshot, open weights) kimi-k2:latest · open weights · local
  • Qwen 3 qwen3:latest · open weights · local
  • DeepSeek R1 deepseek-r1:latest · open weights · local
  • Llama 3 llama3:latest · open weights · local
  • Mistral mistral:latest · open weights · local

In this browser · WebGPU

Wallet-published browser models show download and local weight-custody status before execution.

  • Llama 3.2 3B (WebGPU) Llama-3.2-3B-Instruct-q4f32_1-MLC · WebGPU · local
  • Llama 3.2 1B (WebGPU) Llama-3.2-1B-Instruct-q4f32_1-MLC · WebGPU · local
  • Qwen 2.5 1.5B (WebGPU) Qwen2.5-1.5B-Instruct-q4f16_1-MLC · WebGPU · local
  • Phi-3 mini (WebGPU) Phi-3-mini-4k-instruct-q4f16_1-MLC · WebGPU · local

Visible, not enabled

These rows are deliberately disabled. They are not sent to Lovable AI Gateway and are not selectable today.

“We applied CAPPZ to Lovable, ChatGPT and Claude” describes the development environments where the discipline was forged. It is not the runtime catalog: ChatGPT is selectable now; Claude remains a visible, disabled bring-your-own-key entry.

Score after the question, not before.

The anchor and the question together decide how visible each fact is. Skills are disclosed in tiers so a large catalogue costs almost nothing until one is chosen.

Anchor-scoped visibility — the current anchor (here, a deal page) decides how much of each fact the agent sees. Scoring happens after the question is known, not before. Graph-anchored fact sheets

Tiered skill disclosure — the model sees a cheap map of every skill and pays for detail only when it commits. MCP-compatible, not required. SkillCard · llms.txt · AX-57

Rules at addresses. Gates on every command.

Instructions attach to the scopes they govern and are re-verified on each dispatch. Consequential actions are request/response transaction pairs with a signed, kept answer.

Rules live at addresses — when a turn touches a scope, that scope's rules load with it. They are resolved from the wallet each turn, so compacting a conversation cannot erase them. PrinciplesChainlet · AX-82

The command gate — every consequential action is a request/response transaction pair. Policy answers allow, ask or deny; the answer is signed and kept, never a throwaway boolean. AP-12 · BPMN user-task gates

CAPPZ Harness vs Jev.

Jev is TypeSafe's decision model for coding agents, described in a public September 2026 blueprint. Both put a typed decision layer beside the model. CAPPZ goes further by making those decisions durable, owned and governed.

  • DIMENSION
  • JEV (PER PUBLIC BLUEPRINT)
  • CAPPZ HARNESS
  • Decisions
  • Typed answers with probabilities, used within the session
  • Typed answers notarized as signed event transactions — replayable and auditable later
  • State after restart
  • Explicit typed chunk store inside the harness
  • State lives in the user's own wallet — portable across devices, works offline, outlives the app
  • Trust routing
  • File-sensitivity score picks first-party vs cheaper models
  • Routing by data ownership and residency, including fully local models (Ollama / in-browser) with no cloud hop
  • Policy
  • Programmable allow / ask / deny command policies
  • Allow / ask / deny plus hash-verified governing principles (COPE) on every action
  • Scope
  • Coding agents
  • Any domain — contracts and payouts (EBB), canon corpora (Bible Codex), supply chain, and code
  • Skills
  • Tool snippets first, schema on demand
  • Same tiering, plus skill ownership, versioning and royalty rails (fee-bearing bindings)
  • Multi-agent
  • Background reviewers share one retrieval pass
  • Shared projection plus agent-to-agent sync between sovereign wallets, with trust scoring
  • IP
  • Not stated
  • Anchored by issued US 11,645,632 B2

Jev's column is limited to what its public blueprint describes. The CAPPZ column lists shipped platform capabilities. The advantages are our interpretation. No speed or cost multipliers are claimed for either side. CAPPZ is not affiliated with TypeSafe. Source: Jev Engineering for Coding Agents (Sept 2026) — Independent synthesis of design notes by Diogo Almeida (TypeSafe); not affiliated with or endorsed by TypeSafe.

Build on the harness.