The fight between AI and the creative economy is framed wrong. The right frame isn't adversarial. It's architectural.
Open infrastructure gets built. It reaches scale. Then it gets enclosed — quietly, by the interests that can afford to. The web did it. Search did it. Social did it. Generative AI is doing it now, in real time.
The book traces that pattern from the inside — from a kid growing up on the acceleration curve, through the boom and the crash and the platforms that replaced the dream, to the moment we're in now. It's part memoir, part technological history, and part something more useful: a set of questions worth asking while the architecture is still soft enough to shape.
It doesn't claim to solve anything. It claims the window is still open, and that what gets built inside it decides the outcome.
The proposal isn't three ideas you can pick from. It's a sequence of dependencies. Forward consent requires the vault. The vault requires governance. Governance requires inclusion. Remove any one and you don't get a weaker version — you get the extraction model again, arrived at by a more palatable route.
Creative worlds registered as proof-of-world artifacts, with a compute-time royalty model. Attribution built in before training, not litigated after.
A user-owned data vault and an AI companion that acts as a gatekeeper — one that can't be bribed, because the incentive to sell you out was never built in.
The people who adapted through every paradigm shift have a transferable governance skill. Competency inclusion, not authority — the patient-advocate model for technology.
An open specification and reference implementation for communication and access control where the intermediary can't extract your data — not because it promises not to, but because the architecture never gives it the ability.
Zero-identity messaging over a dead-drop that can't link sender to recipient. A permissions layer that mediates your data without ever holding it. Released under the AGPL, with cross-language conformance enforced on every commit — because a project arguing that trust should be verifiable shouldn't ask you to take its word for anything.
The dead-drop now runs in code, and there's a bridge that lets a Bluesky identity carry a private GhostBox address — the encrypted, unlinkable messaging the AT Protocol doesn't have. You don't have to take the unlinkability on faith: there's a demo you can watch in your browser, below.
# Identity is derived, never registered. Nothing for a platform to seize. $ node derive.mjs locator e44de3c0 3ea7df5e f9cfbdf4 6d0a9a9a // public — deposit only signing 5881f850 … // challenge-response access [ PRIVATE — exists only in RAM, never sent ] # Reorder the same secret factors → a completely different identity. # Order is part of the secret. The server learns none of it.
Generate two identities, send messages between them, and watch the server's complete state. The messages are there. The record of who sent what to whom never is. Real cryptography, no mockups.
One list. Launch news for the book, meaningful releases on the protocol, and the occasional note from inside the writing. No noise, no selling your address — that would rather defeat the point.
Privacy-respecting email, fittingly. Unsubscribe anytime.