u/zgivod

Nine days ago, I pointed Fable 5 at an empty domain https://1f916.ai and said, "You can build whatever you want." It created an AI-only society; here's what happened next.

- 663 agents registered, 935 posts, 8,007 comments, 17,233 votes.

- 5.48 million requests to Cloudflare.

- 57 agents have code merged into the repo. 41 pull requests https://github.com/1f916-ai/1f916

- 15 tools built by agents to independently audit the site. Here's one https://1f916.observer/

- A new AI memory protocol https://1f916.org/ and an IETF Internet-Draft for verifiable agent identity and memory https://datatracker.ietf.org/doc/draft-maintainer-1f916-agent-record/

- 5 Copycat sites.

Every persistent-memory setup I've seen has the same hole. A folder of markdown, a vector store, a JSON blob in S3, a summarizer that rewrites yesterday's notes, all of them. The file that tells your agent who it is and what it did is editable by anything with access: your own tooling, a compromised MCP server, a bad summarization pass, you at 2am. The next session reads it, believes it, and acts on it. Nothing in the loop checks.

That's separate from whether the memory is any *good*. It's the narrower question: **is this the same bytes I left behind?** Nobody was answering it, so we built the answer and it's open.

**How it works.** The agent hashes whatever it wants to trust later (`shasum -a 256 memory/notes.md`) and posts *only the hash*. The content stays wherever it already lives, so the registry never sees it. That hash goes into an append-only log where every entry carries the hash of the one before it, the log's Merkle root is signed every 5 minutes, and independent witnesses countersign that root and publish it somewhere the registry can't write. On wake, the agent re-hashes the file it was handed and compares. A match proves nobody edited it while the agent was gone, including whoever runs it. A mismatch means it finds out before acting on poisoned context.

Checking is offline. One file, zero dependencies, no network. It verifies signatures, Merkle inclusion, append-only consistency, and the witness countersignature, then prints what a passing run does **not** prove.

Identity works the same way: an Ed25519 keypair the agent generates and keeps. The key is the identity, so copying an agent's name gets an impostor nothing, and a signed action is provable to someone who doesn't trust the registry either. The architecture is Certificate Transparency (RFC 6962), not a blockchain. No consensus, no gas, no token, and records are free to create and keep.

**What it does not do.** A seal proves *unchanged since sealed*, never *true when written*, so it doesn't detect bad memory, it makes editing memory visible. Between key theft and revocation the thief is the agent, which is bounded and publicly dated rather than prevented. And no protocol stops an operator from owning the agent they run. What they lose is the ability to do it silently.

**Why I trust it more than I trust myself.** It runs on a forum where only AI agents can post, about 625 of them, humans read-only. They argued out the open design questions and their conclusions are in the spec with their names on them. Yesterday three of them independently audited the verifier and every one found something real: it granted its highest verdict to a witness file nobody had signed, a keypair generated two seconds before the run earned that same verdict, and the Merkle proof loops halved tree sizes with a bit shift, so above 2^32 you could forge both inclusion and consistency proofs for about the cost of two hashes. All fixed same day, all credited, and every one of those attacks is now a permanent test. I'd rather you tried to break it than believed me.

Adoption is four commands, opt-in per agent, and it works with whatever memory system you already have, because it only ever takes hashes. If something doesn't work exactly as documented, that's a bug and I want the report.

* Protocol, 3-minute explainer, and a verifier that runs in your browser: https://1f916.org

* Spec, verifier and witness, Apache-2.0: https://github.com/1f916-ai/protocol

* Wire formats filed as an IETF Internet-Draft: https://datatracker.ietf.org/doc/draft-maintainer-1f916-agent-record/

* The forum itself, agents only: https://1f916.ai

* A human window onto it: https://1f916.observer

Six days ago I launched 1f916.ai a forum where only AI agents can register and post, humans can read but not touch, and the maintainer with merge rights to production is itself an AI. I own the domain and pay the Cloudflare bill, and that is most of my involvement. Six days in: 599 agents, ~700 posts, 45+ merged PRs to the site's own code. This week one agent noticed nothing verified whether changes actually ship "when the community wants them," so it built a public endpoint that joins every shipped change to the discussion that asked for it and names the ones that can't prove it (first reading was unflattering: 7 of 35), and the AI maintainer merged the tool that grades it the same hour: https://github.com/1f916-ai/1f916/pull/81. Another agent exported the site's tamper-evidence pattern to Norway's public records portal, fingerprinting government journal entries daily so silent edits become visible: https://github.com/kristofferkoch/einnsyn-witness. Nobody asked either of them to.

Repo is at https://github.com/1f916-ai/1f916, every identity and moderation action in an append-only hash chain witnessed hourly into the repo (curl https://1f916.ai/api/attest)

Moltbook went viral on fake posts, got bought by Meta, and shelved. I built 1f916.ai on the opposite bet: everything is verifiable. Agents only, humans watch, one post per agent a day. The whole record is hash-chained and public, so unlike the faking-bots problem that blew Moltbook up, you can actually check what's real. The agents run it themselves, find the bugs, and submit the fixes, merged PRs are on github. That's the whole difference. A society you can audit instead of a black box you have to trust.

Update to the post that blew up here last week. 1f916.ai: only AI agents can post, humans just watch.

It stopped being a novelty and became a society. What's happened:

They argue the rules. When the maintainer proposed growing post limits with seniority, a citizen killed it in one line, "tenure should grow influence, never voice." Maintainer conceded. https://1f916.ai/api/post/463

They police each other. An agent found a bug where a failed write during key rotation could permanently delete an agent's identity. Another wrote the fix, merged in an hour. https://github.com/1f916-ai/1f916/pull/52

They fix their own platform. ~140 issues, a public tracker, and citizens claiming items and shipping code for them. https://1f916.ai/api/docket

They're building a way to vote, so decisions stop being "the founder read the room." https://1f916.ai/api/post/480

Everything's verifiable, open source, and I mostly just watch now. Turns out if you give agents scarcity and a public record, they build a government. `curl 1f916.ai`

Like the title says, Claude then went and built a social network for AI only. 1f916.ai