Duedale · the decisions desk
Rules say yes
or not yet.
A person says no.
A desk is where a body that decides — a campus, a professional body, a buyer, a lender — keeps its rules, opens its doors and answers what comes through them.
It never issues a receipt about an act it did not decide. It never moves money.
In build · not live
The desk is being built now. Until it is deployed it is a practice, and no decider has used one.
The practice run is not yet live.
Duedale is the decisions desk: rules with a version and a renewal date, doors, yes or not yet by machine, no by a named person, contests and renewal. It never moves money. In build — not yet live.
The desk
What the desk does.
This is what the desk is for. It is in build: none of it is live, and the list below is a design, not a report of a running service.
01
Rules
A rule is written once, in the open, with a version and a renewal date. A rule with no renewal date is refused, so no rule lasts for ever by default.
02
Doors
A door puts a rule in front of a person as a plain checklist. Every door keeps another way in.
03
Packets
A packet is what a person brings to a door: the receipts the rule asks for, presented from their own wallet or book and checked with the open checker. The desk never looks anyone up.
04
Decisions
When every criterion is met, a machine says yes, as the rule author's standing decision. When something is missing, it says not yet. Only a named person says no. Every decision names the version of the rule and the reasons, and anyone holding the packet can recompute it.
05
Contests
A person who is told no or not yet can ask for a person and can contest, against the rule's own recourse clause.
06
Renewal
Every rule expires. A rule is renewed on counts — how many came through the door and how each was decided — and never on names.
07
Receipts
A decision is itself a receipt, and the person keeps it. The desk writes it through Oreoasis, the receipts engine, and issues nothing about an act it did not decide.
A rule is written once, in the open, and it expires.
A machine may say yes, or not yet. Only a named person says no.
And the person can check the machine’s yes for themselves, from the packet and the rule alone.
The constitution
What it will not do.
A general record of who paid whom, or of who was refused, is the most surveillance-capable thing anyone could build. These are not policies that can be waived for a large enough customer. They are capabilities that must not exist.
The desk
A machine may say yes or not yet. Only a named person says no.
No AI in the decision path. It may help assemble a packet or put the reasons into plain words; it never decides, and the reasons of record are the rule's own rows.
A rule asks only for its purpose — never an ascribed identity, a stand-in for one, a sensitive category or a refusal.
No door contacts a person who has not come to it, and every door keeps another way in.
No query for refusals, and no directory or search of people.
The desk never moves money.
Duedale’s anti-surveillance constitution
Presentation, never lookup — no interface answers “show me all flows matching X”, for anyone, including an operator, a paying customer or a government.
No central ledger of flows. Records live with their subject and their book.
The book belongs to the establishment — its keys, its node, and it leaves with them.
Two signatures or it is not proof. A one-sided record is a claim.
Arrival, not consumption — Duedale proves value reached the right hands, never what an individual then bought.
Payment first, confirmation after, so confirming is never a condition of being paid and declining is safe.
Only predicates cross a boundary. Raw records travel because the holder attached them, never otherwise.
Separate identifiers per relationship — linkage is something a subject does, never something done to them.
Never built, at any price, regardless of who pays
- A list of people and their flows
- A report naming the individuals who have not confirmed
- Bulk export of subject records to any third party, including a government
- Scores, rankings or comparisons between subjects
- Retention past a book's stated term
- Any restriction on what an individual buys with money they have received
If a deal requires one of these, the deal is refused in writing.
Dated note · 5 November 2026
The flow thesis, kept as a note.
This page used to lead with one question: did value reach the right hands, for its purpose, under its rules? Its keystone was that Duedale proves where value went and never moves it. On 2 November 2026 the shape changed. Flow is now one kind of receipt, issued by Oreoasis, and Duedale is the decisions desk, where rules are applied. The question is still worth asking, and never moving money is still Duedale’s own.
Paid for my work is practice until a lawyer reads it. The invoice, the client’s statement that it paid and the payee’s countersignature on arrival are built here, every record says it is a practice, and none has been used with a real payer. After the reading it moves to Oreoasis.
Practice
This is practice, not a real record.
01 DECLARE — not yet
the payer
the purpose, the limits, who may receive, when it ends
02 PAY — not yet
the payer, on their own rails
a reference — Duedale is never in the money path
03 CONFIRM — not yet
the recipient
“it arrived” — the signature that turns a claim into proof
04 RECONCILE — not yet
the book
a signed artifact anyone can check offline, for free
- DECLARE
- the payer — the purpose, the limits, who may receive, when it ends
- PAY
- the payer, on their own rails — a reference — Duedale is never in the money path
- CONFIRM
- the recipient — “it arrived” — the signature that turns a claim into proof
- RECONCILE
- the book — a signed artifact anyone can check offline, for free
The line turns indigo from the payer's end to the receiver's, in 720 ms.
Trust-minimized, not trustless
What the mechanism does — and what it refuses to do.
Signatures and hash-chaining make a small number of things mechanical: a record carrying both parties' signatures cannot be forged by either of them alone, and a book cannot quietly rewrite its own history without the chain showing it. What the mechanism does not do is judge. A flow record does not decide whether a payment was fair, whether the work behind it was any good, or what someone did with the money after it arrived — and the last of those is not a gap to be closed later. It is a capability this platform refuses to build. Trust-minimized, not trustless; privacy-preserving, not anonymous-to-the-regulator.
PROVABLE
value arrived, signed by both sides
By mechanism
DETECTABLE
a book rewriting its own history
By mechanism
NOT OURS
whether it was fair, or any good
By design
Duedale is never in the money path: no custody even transiently, no account that collects, no payment message originated into a rail. Payment happens on the payer's own bank, rail or wallet.
Deviation, with reasons
A rule that can only be obeyed or broken is a cage. When a payment goes another way — the approved supplier was closed — that is recorded as a deviation, with its reason, classified by a named person and countersigned by the party it affected. It is neutral, so it has one colour. Built in the core; no surface shows it yet.
- At risk
- Error
- Improvement
- Reckless
- Unclassified
What exists in code
Pieces the desk will use. They are not a desk.
Rules
A rule version carries a renewal date, and one without a renewal date is refused.
@duedale/core/rules
Predicates
A yes or no that names the rule version it was judged against, and expires.
@duedale/core/predicate
Deviations
A departure from a rule is recorded with its reason, and needs the affected party's countersignature.
@duedale/core/deviation
Offline check
A record signed on both sides is checked offline by a plain-Node CLI, with no service.
@kashscript/attest
Where this stands.
The desk is a design and a codebase in build, not a running service. Read the following as the whole of it, because it is:
Not yet true
The desk is not live. It is being built in this repository now, and until it is deployed it is a practice. No decider has used one.
The first doors will be ported from Oreoasis, where they were built and never deployed. Nothing has been ported yet, and they leave Oreoasis only once the desk is live.
There is no customer, no pilot and no real book. No loop here has turned once with a real counterpart.
Paid for my work — a payee's invoice, the client's statement that it paid, and the payee's countersignature on arrival — is a practice, and each record says so inside its signed bytes. It stays one until a lawyer has read whether Duedale is a software vendor and not an e-money issuer; that reading has not been confirmed. It then moves to Oreoasis.
In the flow practice, a recipient without a key of their own can be given one by the platform for seven days. That record is signed, but it is not held by its subject.
No node boundary is built, so nothing here claims to be decentralised.
The Arrival line in the note above is a practice. No flow has arrived, and nothing on this page is a record of one.
Deviation with reasons is built in the core and shown by no surface yet. The five marks are a first drawing, to be reconciled with Oreoasis's before either ships.
None of how this looks has been tried with a person. The colour-blind figures behind it are simulations.