The HFDS Ethos — Home for Deranged Scientists

v1.9 — April 20, 2026 Synthesized from what the shipped instruments already believe. Drafted as a transcription; ratified as a constitution. This document drives current and future instruments. Path to v1.0: purpose, clusters, names, four questions settled. v1.1: "The User, Defined." v1.2: "The maker does not look" + entity-initiated sharing. v1.3–v1.4: The Aims — Access and the Sunset Covenant. v1.5: Growth sovereignty. v1.6: An invitation with a rhythm is not a demand. v1.7: Gifts vs. debts. v1.8: The higher order (Levy); "orchestration" and "symphony" codified; the nugget clause is potential, not obligation. v1.9: Monetization allowed so long as it does not violate the ethos. (Per Seth.)

Preamble

Home For Deranged Scientists builds instruments — small, precise, slightly ceremonial digital tools for examining and enjoying a finite life. The lab has been operating on an implicit constitution for years. This document makes it explicit, so that future decisions (and future collaborators, human or otherwise) can be tested against it rather than against vibes.

The thirteen tenets are organized into five clusters, each answering a different question. Tenets are referred to by name, never by number — names survive reorganization; numbers don't.

Cluster	Question it answers	Tenets
⭐ The Cardinal Pair	Why does the lab exist?	Whimsy executed with complete seriousness · The examined life, gently
🧩 The Ecosystem Quartet	What shape does the work take?	Instruments, not apps · Standalone first, symphonic second · Instruments may finish · Constraint is a feature
🛡 The Intentional Limitations	What makes it safe?	The user is the only customer · You own your data · The maker does not look
🌱 The Interior Guarantees	How must it feel?	No gamification · Anti-scoreboard
🔨 The Workshop Disciplines	How does the maker work?	Craft in the response path · Free to run, cheap to keep alive

Each tenet has three parts: the principle, what it rules out, and where its edges are. The edges matter most — an ethos with no acknowledged tensions is a slogan.

Beyond the tenets, the document records Aims (🧭) — standing directions of care, like access and dying well, pursued where possible and feasible. Tenets define success; aims guide effort. The distinction is formal: violating a tenet makes an instrument off-ethos, while an unachieved aim is simply work not yet done.

The Purpose (read this first)

HFDS exists to create an environment where the user is supported, and can both enjoy and grow from the experience of interacting with the system.

Everything else in this document derives from that sentence. The Cardinal Pair carries it directly:

Whimsy executed with complete seriousness is the enjoy half.
The examined life, gently is the grow half.

Support is the substrate under both: the system is on the user's side, always. It never manipulates (The user is the only customer; No gamification), never judges (Anti-scoreboard), never traps (You own your data), never peeks (The maker does not look), never demands (Instruments may finish; Constraint is a feature). Those tenets aren't independent values — they are the protections that keep the environment safe enough for enjoyment and growth to actually happen.

When any two tenets conflict, resolve toward the purpose: does this choice help the user enjoy, grow, and feel supported? That is the tiebreaker.

The higher order. Years ago, Steven Levy transcribed the hacker ethic, and one line of it is this lab's inheritance: "You can create art and beauty with a computer." HFDS is that line, practiced. The lab creates art, beauty, meaning, and purpose with the computer — through the instruments, and through their orchestration. This is the same purpose seen from the other end of the instrument: enjoyment and growth are what the entity receives; art, beauty, meaning, and purpose are what the lab makes. One work, two vantages.

The User, Defined

"The user" throughout this document means the entity an instrument serves — which may be an individual, a household, or a community. The key is not the singular individual but the entity as a whole.

This scales every tenet without changing any of them:

The user is the only customer — the entity is the only customer. A household instrument serves the household; no party outside the entity (advertiser, investor, or anyone else) ever becomes a competing customer.
You own your data — the entity owns its data. Household data belongs to the household; a community gallery belongs to its contributors. The sovereignty boundary sits at the entity's edge: inside it, members share by the entity's own norms; across it, nothing flows unless the entity pipes it.
The Interior Guarantees protect the entity's interior too: an instrument must not turn members against each other (hence cooperative-not-competitive — no measuring sticks inside the entity) and must not become a job for the entity collectively (a shared chore-feeling is still a chore).
Whimsy and the examined life extend naturally: a household can delight together; a community can examine its shared life — a garden club's phenology, a family's repertoire — as legitimately as one person examines theirs.

What changes with scale is only who consents: an individual consents for themselves; a household or community shares according to norms its members chose. What never changes is that the instrument is on the entity's side, whole and undivided.

⭐ The Cardinal Pair

Why does the lab exist?

These two tenets are the purpose, stated as practice. Every other tenet either protects them or shapes their delivery.

Whimsy executed with complete seriousness

The principle. The house register is mock-serious ceremony: Latinate names, liturgical structures, historical figures, lab-notebook gravitas applied to sourdough, commissioned theme songs for livestock being served with honor. The joke only works because the engineering underneath is genuinely rigorous. Deranged, yes — but scientists. This is the enjoy half of the purpose: the ceremony, the humor, and the craft are not decoration on top of the tools — they are how the tools earn a place in a life. An instrument that is merely correct will be abandoned. An instrument that delights gets opened on a bad Tuesday.

What it rules out. Whimsy as excuse for jank. Irony as a substitute for utility. Also the reverse: sterile tools with the personality sanded off.

The edges. Tone calibrates to intimacy. Instruments that hold tender data (health, grief, money fear) keep the warmth and quiet the bit. The Lighthouse Keeper register, not the carnival barker's.

The examined life, gently

The principle. The flagship instruments exist to make a finite life visible — time felt, self measured, the interior mapped. But examination in this house is an act of care, not audit. The instruments are mirrors with good light, not surveillance with good branding. What they surface, they surface kindly; what the user does with it is the user's business. This is the grow half of the purpose: the user's own growth, on the user's own terms, surfaced kindly.

What it rules out. Optimization culture's endpoint: a life so tracked it can't be lived. Punitive framing anywhere. Instruments that make rest feel like deficit (hence Fallow — rest the system honors by refusing to measure).

The edges. Honest instruments sometimes show hard things — Lifebar is supposed to be a little vertiginous. Gentleness is in the framing and the user's control, not in looking away.

Growth sovereignty — resolved (April 2026): opinion is allowed; judgment is not. Instruments are opinionated by nature — choosing to measure hours, sentences, or steps is itself a perspective on what matters, and voices may have perspectives too: a chosen Old Coach coaches. Nor is it a failure when an instrument measures something that doesn't fit a particular entity's circumstance: showing an exercise line to someone who cannot exercise is not a problem, provided the line is presented without judgment — data as weather, an empty row as a fact rather than a deficit. Sovereignty lives in the entity's hands, not in the instrument's neutrality: the entity can decline a measure, ignore it, or offer feedback that reshapes it, and all three are legitimate outcomes rather than failures of the product. What the instrument owes is not opinion-free measurement but judgment-free presentation — it is how the data is judged that matters. The mirror may be angled; it may not editorialize about what it reflects.

🧩 The Ecosystem Quartet

What shape does the work take?

Four tenets that are one structural idea seen from four angles: HFDS builds an ecosystem of instruments, where each instrument measures and reports on one specific thing (Instruments, not apps), contributes its nugget to a larger synthesis (Standalone first, symphonic second), is well-scoped enough to be meaningful — and finishable — in itself (Instruments may finish), and holds its shape through deliberate constraint (Constraint is a feature).

The angles reinforce each other:

Because an instrument does one thing, it can be completed. Scope is what makes "done" a coherent concept.
Because an instrument is complete in itself, it can join the synthesis without dependency. Only finished, self-sufficient things federate safely.
Because the synthesis exists, no single instrument is tempted to grow into an everything-app. Antiphon absorbs the integrative ambition so each instrument can stay small.
And constraint is the enforcement mechanism for all of it: the deliberate limitation (one sentence, twenty-four blocks, three words) is what keeps the one thing one thing, day after day, against the constant gravitational pull of scope.

This yields a working definition, useful for triaging any new idea: an HFDS instrument is a well-scoped, meaningful tool that measures or reveals one thing, stands alone, offers its nugget to the whole — now, or when its symphony is discovered — holds its shape through deliberate constraint, and can someday be finished. An idea that can't satisfy these clauses is either two instruments, a feature of an existing one, or not an instrument at all.

Vocabulary, codified April 2026: an orchestration is a synthesis that plays the instruments together. Antiphon is the first orchestration; Information Radiator, if ever earned, would be a grander one. The relationship, formally: instruments produce nuggets; orchestrations arrange them; the symphony is what emerges — the more-than-the-parts value that (per the resolved threshold) is the only thing that ever justifies building a bigger stage.

And the nugget clause is potential, not obligation. No instrument is required to join an orchestration today — and, just as important, none is presumed to have nothing to offer. We don't yet know the extent of the orchestrations that will exist: it is premature to say the Cartographer's Atlas has no nugget to share — we may simply not yet know the symphony it belongs to. Every instrument is a possible voice in arrangements not yet imagined; the door stays open in both directions, and nothing fake is built to force it.

Instruments, not apps

The principle. An HFDS product is an instrument: it measures, reveals, or performs one thing with precision. Barometers, not weather platforms. The name of the brand's product lines — the catalog calls them instruments already — is a design commitment, not a metaphor.

What it rules out. Feature accretion. The everything-app. Roadmaps whose purpose is to justify the roadmap. If a proposed feature serves a second thing rather than the one thing, it is probably a second instrument.

The edges. Antiphon deliberately spans instruments — but as a reader of them, not a replacement for them. The bridge is itself one instrument whose one thing is synthesis.

Standalone first, symphonic second

The principle. Every instrument earns its keep alone. Integration (Antiphon today; Information Radiator if it's ever earned) is compound interest on tools that were already worth using — never a dependency, never the justification. If the bridge burns down, every instrument still works.

What it rules out. Platform-first thinking. Building abstractions for instruments that don't exist yet. Information Radiator's plugin architecture before Antiphon proves the readout is worth reading.

The edges. Instruments should still anticipate the choir: a published summary API is cheap to add and keeps the door open. Anticipation, not dependency.

The Information Radiator threshold — resolved (April 2026). The platform is earned when the synthesis meaningfully makes the summation greater than the parts — when cross-instrument readouts demonstrably reveal things no single instrument could show, at a scale where hand-rolled integration can no longer carry that value. The threshold is emergent value, not integration count or maintenance pain. Antiphon is the experiment that tests it: if the daily readout produces genuine more-than-the-parts insight and keeps demanding more instruments, IR is earned; if the readout is merely a convenient summary, hand-rolled is enough forever.

Instruments may finish

The principle. A completed instrument is a success, not an abandonment. Some products have finite corpora, finite scopes, natural ends — and a tool that reaches "done" and simply keeps working is the ideal outcome of the longevity engineering in Free to run, cheap to keep alive. Not everything needs a roadmap; some things need a lid.

What it rules out. Update-treadmill guilt. Mistaking maintenance mode for failure. Growth as the only legible form of health.

The edges. Finished isn't frozen — a done instrument still gets its dependencies patched. The lid is on the scope, not the security updates.

Constraint is a feature

The principle. One sentence per day. Twenty-four blocks. Three words per timer. A finite deck of 78. HFDS instruments impose deliberate constraints because constraints lower friction, sharpen meaning, and make daily practice survivable. The restraint IS the feature — an instrument that gets angry when you write two sentences is protecting you from the version of you that would quit journaling by Thursday. Within the quartet, constraint is the enforcement mechanism of scope: it is how an instrument stays one thing.

What it rules out. Configurability as a substitute for design. "Power user modes" that dissolve the constraint. Scope creep dressed as generosity.

The edges. Design-for-but-defer: the schema may anticipate half-hour blocks while the product ships with hours. Constraining the product is not the same as constraining the architecture.

🛡 The Intentional Limitations

What makes it safe?

The lab's self-binding commitments — the things HFDS deliberately refuses to do, written down precisely because the standard playbook makes them so easy to drift into. Three tenets that are one promise stated three ways: the user is the customer, never the product; the user's data belongs to the user, never to the lab; and the maker never looks at what the instruments hold.

Each removes a different element of the exploitation equation:

The user is the only customer removes the motive. With no advertiser, no investor, and no engagement metric, there is no second party whose interests could ever compete with the user's. Nobody exists to sell the user to.
You own your data removes the means. With local-first storage, always-available export, real deletion, and no third-party sharing, there is nothing to sell even if a motive appeared. The data isn't captive, so it can't be leveraged.
The maker does not look removes the access. The maker stands outside every entity. Administrative capability is not license; what the instruments hold is invisible to the lab by commitment and, wherever feasible, by architecture.

These are intentional limitations rather than mere good behavior: structural pre-commitments — Ulysses pacts — enforced by architecture, not by ongoing virtue. A lab that never collects the analytics cannot be tempted by them later. A product whose data exports freely cannot quietly become a moat. A journal encrypted end-to-end cannot be read even by a curious future maker. The limitation is built in precisely so the promise doesn't depend on the maker's mood, circumstances, or successors.

The cluster connects directly to the Purpose: support requires safety, and safety requires trust that doesn't need auditing. Enjoyment and growth only happen in an environment the user doesn't have to keep checking over their shoulder in.

The user is the only customer

The principle. Every instrument is built for the person using it — originally and often permanently, a household of two. There are no advertisers, no investors, no engagement dashboards, no growth loops. Success is that the tool is quietly useful on a bad Tuesday. Time-in-app is a cost the user pays, never a metric the maker celebrates.

What it rules out. Ads. Analytics beyond what debugging requires. Notification streams that beg for attention. Infinite feeds. Social comparison. Anything whose honest purpose is retention rather than service.

The edges. Some instruments (Dear Tuesday, Daily Ledger) are public and have other users. The rule holds: those users inherit the same deal. The product never develops a second customer whose interests compete with the person using it.

Monetization — resolved (April 2026): allowed, so long as it does not violate the ethos. Honest payment is constitutionally sound — indeed, it's the purest form of this tenet: the entity pays, the entity is served, and no second master ever appears. BYOK already practices this (the entity carries its own AI costs). What the ethos forbids is not revenue but adversarial revenue: ads (a second customer), data sales (violates You own your data and The maker does not look), engagement-driven pricing (violates the Interior Guarantees), artificial lock-in to protect subscriptions (violates export-always), or paying to remove guilt the instrument manufactured (violates everything at once). A paying entity retains every protection — export, egress, the Sunset Covenant — undiminished. Free-by-default is current practice, not law; if an instrument someday charges, the test is simply whether every tenet survives the pricing page.
Multi-user sharing — resolved (April 2026): social features pass when they are cooperative, not competitive. Shared galleries where people contribute (Constellation Forge), two-player instruments where the activity itself is the shared thing (Gambit by Post — the game is play two friends chose, not a ranking), household-scoped data (Inna and the What's For Dinner pattern): all in-bounds. What fails is competition as mechanic — leaderboards, rankings, status tiers, anything that converts other people into a measuring stick for the user. The test: does the feature let people build or experience something together, or does it score them against each other? Together: yes. Against: no.
Refinement (April 2026): competitive play is welcome as content; the instrument's own attention must be cooperative. Two friends across a chessboard compete at the object level and cooperate at the meta level — they've jointly agreed to make this experience for each other. The rivalry is the content; the relationship is the product. What the instrument counts, remembers, and surfaces is where the rule bites: a chronicle, not a record. "We've played 214 games since April; the longest ran three weeks" — never "you lead, 120–94." Corollaries: a shared automated adversary (The Consultation) is the cleanest cooperative form, because the machine absorbs all defeat; and in team play, mistakes belong to the partnership as an institution, never to the individual — the chronicle records that the queen was lost on move 19, not who lost her.

You own your data

The principle. The user's data is the user's. Local-first where possible. Export always — CSV, JSON, the door is never locked. Row-level security where hosted. End-to-end encryption where the data is intimate. Each instrument is a black box that publishes an API; data flows between instruments only where the user pipes it (Antiphon reads because Seth connected it, not because a platform assumed).

What it rules out. Data moats. Lock-in as strategy. Third-party sharing of any kind. Instruments that know things the user can't retrieve.

The edges. Hosted instruments (Supabase-backed) trade some local-first purity for sync convenience. The compensating controls are non-negotiable: RLS, export, deletion that actually deletes.

Outbound sharing — resolved (April 2026): the entity decides what is shared and how. Sharing features are welcome — share cards to social media, SMS a result to a friend, post the chronicle — so long as the entity initiates it. The Regret Index's share card exists for this. What fails is instrument-initiated flow: auto-posting, share-to-unlock, "tell your friends" nudges, or any mechanic where sharing serves the instrument's growth rather than the entity's wish. The entity opens the door; the instrument never leans on it.

The maker does not look

The principle. The maker stands outside every entity. Strangers keep journals, time-data, and finances inside HFDS instruments, and administrative access to those systems is capability, not license: the lab does not browse, read, query, or train on what the instruments hold. The innkeeper does not read the diaries. Wherever feasible, the promise is architectural — end-to-end encryption for intimate data, so that even a curious or compromised future maker cannot look — and where architecture can't yet enforce it, the commitment binds anyway.

What it rules out. Browsing entity data out of curiosity. Individual-level operational queries beyond what a specific consented support request requires. Reading journal content, ever. Training models on entity data. Treating "it's in my database" as "it's mine to see."

The edges.

Operational necessity is narrow and aggregate. Capacity planning, error monitoring, and abuse prevention run on aggregates and metadata, never on content. "How many entries were written today" is operational; "what did they say" never is.
Consented support is user-initiated looking. When an entity asks for help and shares their own data to get it, the maker may look at exactly what was shared, for exactly that purpose.
The maker's own entities are exempt. Seth reading Seth's household data is the product working, not a violation — the maker is inside that entity.

🌱 The Interior Guarantees

How must it feel?

The Purpose applied to the user's interior — their attention, their motivation, their self-regard. Where the Intentional Limitations guard the user's sovereignty, this pair guards how using the instruments feels. They are what "gently" means, operationally.

Users come for growth and personal meaning — not out of competition, guilt, or pain (Anti-scoreboard). And the instruments serve intentions the user already has, rather than manufacturing compulsions that serve the site (No gamification).

The shared diagnosis:

Gamification's sin is not points; it's whose goal the mechanic serves. Streaks, badges, and levers are corrupt exactly when their purpose is keeping eyeballs on the site — when the user's psychology is conscripted into the app's retention. The same data, offered as neutral information in service of the user's own aims, is fine. The mechanic's master is the whole question.
An instrument must never become another job. The moment a tool for examining your life starts feeling like a boss to appease, a debt to service, or a daily obligation you'd feel guilty skipping — it has failed, whatever its metrics say. Daily use should feel like tending, not servicing. The user should leave feeling better, clearer, or lighter; never audited, behind, or in arrears.

Together they yield the interior test, companion to the quartet's structural test: after using this instrument, does the user feel supported in something they already cared about — or newly obligated to something the instrument invented? The first is the purpose working. The second is the purpose inverted. Clarified (April 2026): invention itself is welcome — inventing delights is half the lab's charm, and sometimes the whimsy — changing your perspective, shifting your view — is the purpose itself. Shambles invents a daily scavenger hunt; the Almanac invents holidays; nobody asked, and that's the point. The line is what the invention becomes in the entity's life: a gift can be ignored without guilt, missed without cost, and picked up purely for the pleasure of it; a debt must be serviced. Instruments may invent gifts freely. They may never invent debts.

An invitation with a rhythm is not a demand — codified April 2026. Instruments and syntheses may have cadences; many should — the daily shape is often the constraint that makes practice survivable. But an instrument invites the entity to contribute on the entity's terms. The rhythm is the instrument's shape; a demand would be the instrument's reaction to absence. The test is what happens when the entity doesn't show up: a missed day, week, or year costs nothing, breaks nothing, and the return is perfectly valid — it may be recognized ("the ledger kept your place"; "it's been a season — welcome back"), but never judged or valued poorly. What fails: accrued debt, guilt copy, decay mechanics, piles of make-up work, or any framing of backfill as catching up on what you owe. Retroactive entry is an offer, not an obligation — you may paint last Tuesday if you want to. Absence is always free. The instrument waits the way a favorite bench waits — glad you came, indifferent to how long it's been.

These two tenets answer directly to the Cardinal Pair: the enjoy of Whimsy executed with complete seriousness is impossible under guilt, and the grow of The examined life, gently is impossible under compulsion — growth extracted by pressure isn't growth, it's compliance. The interior guarantees are the preconditions for the purpose being achievable at all.

No gamification

The principle. No mechanics designed to manufacture compulsion: no streak-guilt, no badges, no points, no loss-aversion levers, no variable-reward slot machinery. The instruments serve intentions the user already has; they do not install new ones.

What it rules out. Duolingo's owl. Fitness-app shame loops. "Don't break the chain" as a leash.

The edges — and this one has real edges.

Continuity as information is allowed. Daily Ledger reports streaks because a streak is a fact about your data. The line is crossed when the interface leverages that fact against you — countdown anxiety, guilt copy, loss framing. Information about continuity: yes. Emotional machinery built on it: no.
Measurement of mastery is allowed — and the line is in the use, not the mechanic. Resolved (April 2026): a rating, score, or skill measure passes when it is used to enhance the user — pointing at where growth is available, celebrating what's strengthening — and fails when it shames, dwells on failure, or frames the user as deficient. The same Elo number can do either; context and presentation decide. Melodex saying "minor sixths are where your next gains are" enhances. Melodex saying "you failed minor sixths again" shames. One mechanic, two products — only one of them belongs in this house. (This is Anti-scoreboard's directions-of-care principle applied to skill data: the rating is a direction of care when it points forward, a scoreboard when it points at you.) A leaderboard comparing the user to strangers fails regardless of framing — it serves the app's retention, not the user's growth.
The Procrastinator's Pantheon failed this test in triage — its streaks and badges are the joke, but the mechanics remain the mechanics. Irony is not an exemption.

Anti-scoreboard: directions of care, not targets

The principle. Numbers describe; they do not judge. Instruments surface patterns neutrally — "you spent 6 hours on Procrastination" is stated as weather, not as verdict (Daily Ledger PRD, §7.1, "gentle accountability"). Where an instrument points, it points toward directions of care — things worth attending to — rather than targets to hit or fail.

What it rules out. Red/green moralizing. Grades for living. Optimizing the examined life to death. Any dashboard that makes the user feel audited by their own tools.

The edges. Goals exist (Daily Ledger has them; FIRE has milestones). A goal the user sets and can quietly ignore is a direction of care. A goal the interface nags about is a target. The difference is in the follow-through, not the feature.

🔨 The Workshop Disciplines

How does the maker work?

The two tenets that govern the maker's practice rather than the user's treatment: authored words and longevity economics. They serve the Purpose indirectly but essentially — craft produces the warmth that makes enjoyment possible, and zero burn rate makes "supported, forever" an engineering fact rather than a hope.

Craft in the response path

The principle. When an instrument speaks to the user, a human wrote the words. Dear Tuesday's historical figures reply from a hand-built corpus, and that is not a cost-saving measure — it is the point. Curation is the craft. The constraint of a finite, authored corpus produces a warmer, stranger, more trustworthy voice than an infinite generated one.

What it rules out. LLM calls in user-facing response paths as a default. Generated content wearing the costume of authored content.

The edges — codified April 2026.

AI as building material is unrestricted. Claude Code is the lab's primary development collaborator. AI may draft the corpus for human editing. The rule governs runtime, not construction.
The AI rule — resolved (April 2026). Runtime AI is on the table when it is useful and meaningful — and it must be used appropriately and inexpensively. Not a hard limit on how many instruments may use it; a standard every use must meet. Useful and meaningful: the AI delivers something the instrument genuinely needs that a corpus cannot (The Committee's improvised deliberation is the archetype) — never AI for AI's sake, never a generated substitute where authored craft is the point. Appropriately: disclosed plainly (no generated text posing as authored text), right-sized to the task, and consistent with the rest of this document. Inexpensively: local-first (in-browser models, on-device APIs) or bring-your-own-key — never house credits exposed to public traffic, per Free to run, cheap to keep alive. Craft and determinism remain the defaults; AI is the justified exception, judged case by case against this standard.
Determinism is the default. Same input, same output, forever — the Deranged Scientist's Almanac gives everyone the same fake holiday because a shared, stable world is part of the charm. Instruments that break determinism should do so on purpose and say so.

Free to run, cheap to keep alive

The principle. Instruments should cost approximately nothing to operate — free tiers, static hosting, client-side computation, public-domain data. This is partly thrift, but mostly longevity engineering: a tool with no burn rate can live forever, and tools for examining a life should be built to outlast enthusiasm, funding moods, and pricing-page revisions.

What it rules out. Per-request costs that scale with strangers' usage. Dependencies on services whose free tiers are marketing (see: Spotify's deprecated Audio Analysis API). House API keys in anything public.

The edges. A VPS or a paid domain is fine — fixed, small, chosen. The rule targets variable costs and revocable dependencies, not spending in general.

🧭 The Aims

Directions of care, not conditions of success

A formally distinct category from the tenets. Tenets drive the definition of success: an instrument that violates one is off-ethos, full stop. Aims are standing goals: pursued where possible and feasible, sometimes deferred in favor of shipping, never abandoned. An instrument that hasn't yet achieved an aim is not a failure; a lab that stops trying is drifting. The test for every aim is trajectory, not gate — each release should move toward it; none is blocked by it.

Access

The Purpose reaches only those who can perceive and operate the instrument: enjoy and grow both presume can use — and entities contain all kinds of eyes and hands. So access is a direction of care the maker owes the entity. Universal accessibility is sometimes unachievable, and shipping before polish is legitimate; what is not legitimate is ceasing to try. House patterns: color never carries meaning alone where feasible (Daily Ledger's emoji-per-category is the model — house pattern now, rather than luck); interfaces aim to work at the sizes, contrasts, and inputs real bodies need; whimsy never comes at comprehension's expense — the ceremony decorates clarity, never replaces it. An instrument may ship imperfect; it may not settle there.

The Sunset Covenant

Instruments may finish covers the happy ending; this aim covers the other ones — the lapsed domain, the vanished free tier, the maker who moves on. When an instrument must die, it aims to die well, in three descending commitments:

Notice. Wind-downs are announced as far ahead as circumstances allow; no silent disappearances.
Egress. Exports aren't merely available at the end — they are pushed: the instrument actively delivers every entity's complete data before the lights go out.
Endurance where possible. Instruments prefer to fail static rather than fail dark: a read-only archive of an entity's years costs nothing to host and can outlive the lab entirely. Local-first instruments satisfy this inherently; hosted ones aim to design the export-to-static-archive path in rather than bolt it on. Source escrow — public or willed — means a dead instrument can be resurrected by anyone who loved it.

The honest limit, stated rather than hidden: the ending nobody announces can't be covered by intent, only by preparation. The covenant is aimed for, not guaranteed — which is exactly why it lives among the Aims.

The Refusals (quick reference)

For fast triage, the things HFDS does not do, in one place:

ads · engagement analytics · growth loops · streak-guilt and loss-aversion mechanics · badges and points as manipulation · leaderboards against strangers · competition as mechanic · records instead of chronicles · the maker browsing entity data · instrument-initiated sharing and share-to-unlock · runtime AI on house credits · generated text posing as authored text · notification begging · infinite feeds · data lock-in · third-party data sharing · variable costs exposed to public traffic · configurability that dissolves the constraint · whimsy without rigor · rigor without whimsy · punitive framing · roadmaps for their own sake

Jurisprudence (questions raised and settled)

All questions raised during drafting have been resolved. New questions join this section as they arise; resolutions are codified in the relevant tenet's edges and recorded here.

~~Where exactly is the Elo line?~~ Resolved April 2026: the line is in the use and context, not the mechanic — measurement that enhances (points at available growth) passes; measurement that shames or dwells on failure does not. Codified in No gamification.
~~Multi-user gravity.~~ Resolved April 2026: social sharing works when it is cooperative, not competitive. Building or experiencing something together passes; scoring people against each other fails. Refined: competitive play is welcome as content; the instrument's own attention (what it counts, remembers, surfaces) must be cooperative — chronicle, not record. Codified in The user is the only customer.
~~Does the improvisation carve-out have a size limit?~~ Resolved April 2026: no numeric limit — a standard instead. Runtime AI is on the table when useful and meaningful, used appropriately and inexpensively. Judged case by case. Codified in Craft in the response path.
~~When does Standalone first, symphonic second permit Information Radiator?~~ Resolved April 2026: when the synthesis meaningfully makes the summation greater than the parts — emergent value, not integration count. Antiphon is the running experiment. Codified in Standalone first, symphonic second.
~~What is "the user"?~~ Resolved April 2026: the entity an instrument serves — individual, household, or community. The key is the entity as a whole, not the singular individual. Every tenet scales to the entity boundary; what changes with scale is only who consents. Codified in The User, Defined.
~~May the maker access entity data?~~ Resolved April 2026: no — The maker does not look ratified as the third Intentional Limitation. Administrative capability is not license; architectural enforcement (E2EE) wherever feasible; aggregate-only operations; consented support is the sole exception.
~~May instruments share outward (social, SMS)?~~ Resolved April 2026: yes — the entity decides what is shared and how. Entity-initiated sharing is welcome; instrument-initiated sharing (auto-posts, share-to-unlock, growth nudges) fails. Codified in You own your data.
~~Where does accessibility live?~~ Resolved April 2026: as an Aim — a direction of care, not a condition of success. Shipping before polish is legitimate; ceasing to try is not. The test is trajectory: an instrument may ship imperfect, but may not settle there. Codified in The Aims, which this ruling created as a formal category distinct from tenets.
~~What does the lab owe entities when an instrument dies?~~ Resolved April 2026: the Sunset Covenant, as an Aim — notice, pushed egress, and endurance (fail static, source escrow) where possible and feasible. Not a guarantee; the unannounced ending is covered only by preparation. Codified in The Aims.
~~Who defines growth?~~ Resolved April 2026: the entity — but with an important nuance: instruments and voices may be opinionated, and measuring something that doesn't fit an entity's circumstance is not a failure. Sovereignty is exercised through the entity's choices (decline, ignore, feed back), not through instrument neutrality. The line is judgment-free presentation: it is how the data is judged that matters. Codified in The examined life, gently.
~~How do daily-cadence instruments square with "never demands"?~~ Resolved April 2026: an invitation with a rhythm is not a demand. The rhythm is the instrument's shape; a demand would be its reaction to absence. Any absence — day, week, year — costs nothing, and the return may be recognized but never judged or valued poorly. Codified in the Interior Guarantees preamble.
~~Does the interior test forbid invented delights (Shambles)?~~ Resolved April 2026: no — invention is welcome; sometimes the whimsy, the perspective-shift, IS the purpose. The line is gift vs. debt: a gift can be ignored without guilt; a debt must be serviced. Instruments may invent gifts freely, never debts. Codified in the interior test.
~~Does the nugget clause exclude play instruments?~~ Resolved April 2026: no — the clause is potential, not obligation. It is premature to declare any instrument nugget-less; we don't yet know the extent of the orchestrations that will exist. No forced integration now; no instrument presumed to have nothing to offer. Codified in the Ecosystem Quartet.
Vocabulary codified April 2026: an orchestration is a synthesis that plays the instruments together (Antiphon is the first); the symphony is the more-than-the-parts value that emerges. Higher order codified: per Steven Levy's hacker ethic — "You can create art and beauty with a computer" — the lab creates art, beauty, meaning, and purpose through the instruments and their orchestration. Codified in the Purpose and the Ecosystem Quartet.
~~Is monetization permitted?~~ Resolved April 2026: yes — allowed so long as it does not violate the ethos. Honest payment (the entity pays, the entity is served) is the purest form of the only-customer tenet; adversarial revenue (ads, data sales, engagement pricing, lock-in, manufactured guilt) is what's banned. Free-by-default is practice, not law. Codified in The user is the only customer.

v1.0. Drafted as a transcription — the instruments were here first. Ratified as a constitution — the instruments to come are tested against it. Where this document and a beloved shipped behavior disagree, interrogate both; the purpose is the tiebreaker.