Dark Mode — Antidote, crystallized: the full loop (verify + get paid), revocation-by-cascade, and the verification API #97

Milestone: Dark Mode. The capstone counterpart to #95 ("Atlas, crystallized"): what Antidote is, now that we've given so much correct focus to the movement of data toward paying seekers. It serves every invented party except one — and that exception is the clean seam with Atlas. Durable home: antidote/docs/roles.md. Serializes intent; shape, not settled spec.

The seam: Antidote is the private back-end, Atlas is the public front

The public/private split maps exactly onto Atlas/Antidote. Atlas is public, discoverable, wide-open — looking at it installs anecdote, anybody can walk up, its contents are first-order queryable, residents get the extended reach. Antidote is the back-end serving the interested parties with signed, governed, verifiable records. Antidote is not for the public watchers — that role is Atlas's, already filled.

The parties Antidote serves

• The constituent — verify, and get paid (the heart).
  • Verify: Antidote is a verification API — by content-id search you can prove your answer went public, and where. The affirmative twin of the enforcement substrate (a missing receipt is the tell of stolen consent — ANTIDOTE.draft-0.md; this is the present receipt). You hold your own content-ids in your chronicle, so you never track anyone down.
  • Get paid: the entitlement ledger mirrors the verification data — every place a content-id surfaces in a used/sold report is a place its author is owed a share. Entitlement, not custody (Dark Mode — the aggregation "place above": archive-merge across lineage wings, as a POSITION not an operator #88's payout model): earmarked claims / vouchers (stuff that if picked up is worth something), never the payor's funds; fingerprint-gated pickup; Antidote tracks who's owed what and transmits nothing. Safe in the product because it's a ledger, not a bank.
• The seeker — the distillate. The reconciled, licensed, distilled datasets the cascade produces (Dark Mode — the cascade tier: containment distillation is Antidote's, not Atlas's (COMMON CONSTITUTIONs, the placement ledger, the default-hold boundary) #94), governed by declared COMMON CONSTITUTIONs.
• The operator — we take your archive away. Multi-tenant mailbox runners / Atlas owner-operators are backed by Antidote taking their archive off their hands (The Atlas-owned hearsay pile: provisioning, multi-tenant key management, lifecycle, and deflate-to-archive #91 deflate; Dark Mode — Atlas, crystallized: the socialization & discovery layer (anti-algorithm public square + ballot intake) #95's community-Wi-Fi backing). A careless or vanishing owner is covered by regular procedure if anyone was subscribed.
• The public watcher — NOT Antidote's party. Excluded by design; the public looks in on Atlas.

Revocation-by-cascade — the data-broker asymmetry inverted

Today, to purge your answer you must chase every holder, and even a willing void has to travel the gravel. Antidote dissolves it: the nonce-holder signs one revocation against the content-id, hands it to Antidote once, and the cascade propagates it downward on the heartbeat windows — each vat carrying the content-id ceases to attest it on its next re-sign, and the plaque erodes. Not deletion (copies can't be forced gone — honest); cease-to-attest, and verifiable because the revocation is signed by the same key that signed the original. Revocation and verification are the same content-id operation — stop attesting this vs. show me where this is attested. And because a share-punched (voided) copy keeps its pre-clip ballotId, even a shared meme can be revoked by presenting the original signature against the content-id.

The two aggregations — claim vs. derivative (resolving the report-artifact question)

We moved one aggregation to Antidote and left one on Atlas — and this is the seam:

• Antidote's is containment distillation — shape-based, COMMON-CONSTITUTION-governed, a licensed derivative dataset (Dark Mode — the cascade tier: containment distillation is Antidote's, not Atlas's (COMMON CONSTITUTIONs, the placement ledger, the default-hold boundary) #94). Only Antidote can do it (only it can determine a COMMON CONSTITUTION). The still.
• Atlas's is the ambiguous free-form aggregation we always knew it would have to do — label-based, shapeless (or shape-as-mask), discretionary, editorial. It produces not a dataset but a signed claim about what it saw — a report. Discovery, not distillation.

Should Antidote accept the Atlas report artifacts? Yes — as a fourth report kind, firmly on the claim side. A report is a signed artifact with a content-id and a constitution, so it enters through the same intake grammar (no new machinery, a kind not a subsystem) as a distinct, opt-in, public-record role — the archival twin of the runoff tray (the runoff holds unasked-for answers; the report archive holds publicly-made claims — the record of what was said, when, powering #95's diff/fracture-tracking). Two guards keep it honest: archived as a claim, never distilled as data (reports never enter the cascade), and archiving is not publishing (publicity stays the Atlas's choice; Antidote keeps the record so a fracture is provable, not to browse). Antidote is not for the public watchers holds.

Guards this adds

• Claim vs. derivative — Antidote distills license-governed answers; it only archives Atlas's free-form reports as signed claims.
• Entitlement, not custody — owed-share vouchers, never the payor's funds.
• Not for the public watchers — constituent / seeker / operator, never a public browsing surface.

Open questions

• Revocation-cascade cadence + the verification-API shape — the heartbeat-window timing a revocation rides down; the content-id search interface and its access gating (a constituent proving nonce-holdership to query their own reach); how the entitlement ledger stays consistent with revocations.
• The report kind's exact shape and the charter flag that opts a server into the public-record role.
• The payment platform's home — Dark Mode — the aggregation "place above": archive-merge across lineage wings, as a POSITION not an operator #88's money-layer note has this graduating to its own component; the entitlement ledger + fingerprint pickup is its seed.

Coupled / see also

• Dark Mode — Atlas, crystallized: the socialization & discovery layer (anti-algorithm public square + ballot intake) #95 (Atlas, crystallized — the free-form aggregation and the reports that stay Atlas's), Dark Mode — the cascade tier: containment distillation is Antidote's, not Atlas's (COMMON CONSTITUTIONs, the placement ledger, the default-hold boundary) #94 (the cascade tier — the distillate + the runoff tray), Dark Mode — the aggregation "place above": archive-merge across lineage wings, as a POSITION not an operator #88 (the place above; the payout = entitlement-not-custody model; the money layer), The Atlas-owned hearsay pile: provisioning, multi-tenant key management, lifecycle, and deflate-to-archive #91 (deflate — the operator offload).
• antidote/docs/roles.md (this, durable), ARCHITECTURE.draft-0.md (revocation cascade; the verification API; the report kind; guards 11–13), docs/offline-origin.md (the chronicle where a constituent holds their content-ids; the two punches), ANTIDOTE.draft-0.md (met-receipts; the missing-receipt enforcement this verification API is the affirmative twin of).