The Wayne Desktop: a keystroke that can be refused

The Wayne Desktop: a keystroke that can be refused

The operational problem

Most software answers a click by doing the thing. The click is the authorisation, the action is the receipt, and by the time anyone asks what happened, the only record is the effect itself. That is tolerable when the act is small and reversible. It stops being tolerable the moment a click can spend money, change a running configuration, or reach a machine that someone else depends on.

The usual fixes make it worse. An approval queue bolted onto the side becomes a second place where state lives. A dashboard that can only read is honest but inert — it cannot be the surface where work is authorised. And a surface that quietly retries, queues, or "optimistically" shows an action as done has told its operator something that was not measured.

The question underneath is narrow: what does a keystroke become?

The Wayne intervention

It becomes an envelope. Your device holds a signing key that never leaves it — generated non-extractable inside the browser. Clicking a control does not run anything; it mints a signed, content-addressed, short-lived object that says who minted it, from which surface, for what, and until when. The host then admits or refuses that object through a fixed wall of named doors, and every refusal carries the question that would clear it.

Two properties follow, and both are checkable rather than promised:

The surface proves itself. The host signs the manifest of the bundle it is serving. The desktop re-fetches every listed file, re-hashes it in the browser, and compares. A single changed byte is REFUSED — not warned about, not ignored. The same check runs from the command line and in CI.

Admitted is not applied. An admitted intent is a decision on the record, not an effect in the world. Nothing minted on this surface has run anywhere, and the desktop says so in its own Membrane window rather than leaving the reader to assume otherwise.

Skins sit on top of that: a skin repaints the whole surface and names the operating contract it carries into every intent — a reference the host records with the decision, never an executable. One ships the default look, one is a dense HUD for running a small business (the leading line states the number: net dollars, or hours per week), and one is a documented template to copy. All three are signed in the same bundle as the code, so an unsigned skin is a 404.

Engine specifications

• Surface: an installable progressive web app served by one edge worker. Nothing is installed on

the operator's machine; it verifies itself on arrival.

• Device identity: Ed25519, generated in the browser, private half non-extractable, stored in the

browser's own key store. Pairing is an operator act on the desk — an automated seat cannot pair a device, and a revoked key can neither mint nor read.

• Intent envelope: canonical JSON, content-addressed by SHA-256 over the act, single-use nonce,

explicit expiry with a 24-hour ceiling — an intent with no expiry is a standing grant, and standing grants are how out-of-band authority returns.

• Admission: fourteen named doors in a fixed order (parse, kind, disposition, required fields,

enums, time, nonce, address, device, signature, origin, params, classification, spend). Every refusal returns the door that refused and a populated question.

• Bundle integrity: an Ed25519 closure over the manifest of every served file, re-hashed in the

browser and by a command-line verifier; one mutated byte exits non-zero.

• Refusals that are features: an executable, a path or a command line anywhere in an intent's

parameters is refused; a replayed nonce is refused; an intent minted by a stale bundle is refused with "reload the surface"; anything with a budget is refused as NEEDS_HUMAN.

• Delivery: continuous integration on a self-hosted runner — identity firewall, unit and contract

tests, a scan for anything that should not ship, then staging, an end-to-end suite against the live staging deployment, then production and a smoke check. No API token is stored anywhere in the pipeline.

What has not been established

• No intent has ever been applied. There is no accept path below the host. Every claim about

effects is therefore NO_SIGNAL, and the surface prints that rather than implying otherwise.

• No local agent, no operating-system-wide hotkey, no screen OCR. The desktop is a web surface: its

accelerators work while it has focus, and it reads the screen never. A local agent that would serve the identical bytes at loopback is specified and unbuilt — roadmap, not feature.

• No model answers inside the desktop. Generation intents are refused at the spend door by design,

because this release admits no metered spend at all.

• No second factor. An intent classified for the largest lane must declare a human key, and the

host then refuses it as NEEDS_HUMAN, because that factor is not deployed.

• Browser coverage is measured, not assumed. Ed25519 in the browser is feature-detected at runtime;

where it is missing the surface refuses to mint rather than substituting a weaker signature.

Receipt: the desktop itself, at https://desktop.waynecolt.com/ — open it, then open its Closure window and watch it re-hash the bytes it is made of.