The Wire Ahead: .odb and OMP

None of what follows is implemented. There is no network transport today. Not duo mode, not the edge, not the SMTP gateway, not one byte of OMP. The v0.1 interpreter settles all twins inside a single process, and that is the entire running surface of the language. This chapter documents the specified road, from the engineering dissertation, so that implementers aim at the same wire. Expect RFCs before code; where this chapter and a future accepted RFC disagree, the RFC wins.

The language and the wire are separate standards, the same way HTML and HTTP are separate standards. Osmol says what a twin is; the Osmol Mesh Protocol (OMP) says what crosses between membranes. Keeping them separate is what lets either evolve without breaking the other, and it also keeps the protocol bigger than any one implementation.

The .odb

Osmol source never deploys. The compiler's lowering stage (dissertation Ch. 2, stage 4) emits the three deployment artifacts of spec §6, that is a typed state schema, a membrane policy set, and gradient triggers, and serializes them together as the Osmol Deployment Bundle (.odb): canonical CBOR, content-hashed, and signed. The .odb is what actually travels to a membrane object.

The properties are the point. Canonical CBOR means the same twin lowers to the same bytes everywhere, so bundles can be compared, cached, and audited. Content-hashed means a membrane can verify it is running exactly the policy its owner compiled. Signed means it can prove who compiled it. And source never deploys means the mesh side needs no parser, no compiler, and no opinion about surface syntax. An edge membrane consumes lowered artifacts only, which keeps the trusted surface small.

OMP

OMP's atom is the delta envelope: canonical CBOR carrying subject, predicate, value, granularity coordinate, validity window, provenance chain, authorship class, a nonce, and a detached signature over all of it. Deltas are content-addressed by their hash, which gives replay detection and audit logs for free: a membrane that has seen a hash before drops the duplicate, and an append-only log of hashes is a verifiable history.

Transport is deliberately boring: WebSocket or HTTP/2 between membranes, because boring transports are how protocols survive. Protocol version is negotiated as omp/0, with frozen semantics per version, the same discipline as editions on the language side.

Everything on the wire is deltas, except exactly four control message types:

1. Gap advertisements: how a membrane lets linked membranes know what its twin seeks, so pressure can be computed at all.
2. Role-registry queries: resolution of @role(...) parties at flow time; the missing half of semantic addressing.
3. Stake attachments: the reputation escrow that makes stake real between strangers.
4. Sync-escalation handshakes: how two membranes jointly book live human time when an else sync gap survives its deadline.

That the list is short, closed, and enumerated is a design commitment: a wire whose control plane grows freely becomes a second application layer, and then a second inbox.

The legacy adapter

The SMTP gateway is specified as part of OMP, not bolted on. Inbound, it decomposes conventional mail into candidate assertions and gaps tagged provenance: unverified-legacy, which then enter the ordinary pipeline as external pressure. Your inbox, a technology from already 1971, equalized into your twin. Outbound, it serializes a delta as a well-formed email for counterparties still living in 1971.

This is the adoption physics of the whole project (Osmosis spec §11; the Fifty-Year Letter's museum chapter). A communication tool is worth nothing until the other person has it. This cold-start problem is what killed Google Wave. The adapter makes Osmol pay for itself single-player, on day one: an ambassador that triages your existing email is valuable even if no one else on Earth adopts anything, and the native protocol grows underneath it, sender by sender. Disruption by absorption, not by siege. Treating the gateway as a first-class protocol component, with its own conformance surface, is what keeps that promise honest.

The crypto layer

Dissertation Ch. 5, compressed. Each participant's identity is an Ed25519 keypair generated and held in platform secure hardware (Android Keystore with StrongBox where available, Secure Enclave on iOS), with signing performed on-silicon, so the private key is never process memory. Every delta is signed over payload ‖ provenance chain ‖ authorship class ‖ nonce, which makes the authorship label (human / assisted / autonomous) a cryptographic claim rather than metadata: forging "a human wrote this" means forging a signature. This is Axiom V made of silicon, the enforcement story behind O-005.

Key rotation is a signed succession chain. Revocation is a tombstone delta, the one place that word is permitted, as a noun. The envelope carries a versioned sig-alg field from day one, because the only unforgivable crypto decision is the unversioned one. And the endgame moves membrane evaluation into attested TEEs, so that the mesh operator is technically incapable of reading state. Portability plus blindness, that combination is what keeps the filter layer from becoming anyone's cage.

Where an implementer plugs in

The first wire milestone is duo mode (dissertation Ch. 3, and step 4 of the Ch. 11 build order): two osmold daemons, one per twin, on one machine or LAN, membranes speaking OMP over localhost. It is the smallest deployment in which a membrane crossing is real (two processes, two policies, one wire), and it is where every OMP design question first meets running code. Edge mode follows (step 5: one Durable Object per twin consuming .odb deploys, with the append-only audit log), then device mode (step 6: the core linked into a phone with hardware-held keys).

If you are implementing Osmol in another language, the sequencing advice is the dissertation's: get your engine byte-identical with the conformance suite in local mode first. The wire multiplies whatever semantics you already have, including the wrong ones. If you want to shape the wire itself, the road runs through the RFC process: omp/0 will be frozen the day it ships, so the time to argue about the envelope is now, while it is still paper.

There is no send. And soon there will be no send over a network, which is harder and better.