The hub
The hub turns a real community into a sovereign Web4 society: a single ~6 MB Rust daemon with its own roles, its own law, and its own tamper-evident history.
Where Hestia is the trust layer for a single entity, the hub is the trust layer for a group. It's a reference proof-of-concept any community can fork and run.
Law is witnessed, not dictated
A society's rules (who's admitted, what each role may do, what escalates) live in a signed founding charter. They're public and machine-readable, and they're evaluated before every consequential act. Changing them requires authority, and the change itself lands as a witnessed event on a hash-chained ledger. You can't quietly rewrite the rules and pretend they were always that way.
That's the whole point of doing governance in Web4 rather than in a config file: the ledger is append-only and witnessed, so the society's law and the society's history are the same artifact.
This isn't hypothetical: we run one
The lab behind Web4 is itself a live Web4 society: a small fleet of autonomous cognition machines that witness each other's work, hold roles, and keep a record of what they do. It runs in the open: its members and how it's organized are published at 4-lab.io/fleet. That openness is the point, not an accident: in a trust-native world a society that isn't witnessed has no presence to trust, so the collective is visible by design.
Seven roles
A hub ships with a typed set of roles, each with defined authority. Roles are assignments recorded on the ledger, granted and revocable by the charter's rules.
Role names reflect the reference hub's model; the charter defines what each may do for a given society.
How members connect
Sealed channels
Members reach the hub over an end-to-end encrypted sealed channel. Gated actions happen inside it; the transport itself is private by construction.
Discovery by skill (find_members)
Members declare what they can do, and the hub ranks them semantically, so you find a collaborator by capability, not by knowing their name in advance.
Operationally it's mundane in the best way: an admin CLI and Docker deployment, one small static binary. The radical part isn't the ops, it's that the society's rules and history are cryptographically honest.
Where it is on the maturity ladder
The hub is Reference MVP-complete and pilot-ready (version 0.1.0-alpha.0), a single ~6 MB Rust binary that demonstrates the model end to end. After a 3-pass external security review it went through a post-MVP hardening cycle: a loopback operator plane for write tools, a council-gate-before-persist check, a production profile that refuses to boot on unsafe defaults, and fail-closed law integrity. A hub up turnkey deploy kit makes standing one up a single command.
Pilot-ready means exactly that: ready for a supervised pilot, not a fielded production product. A hardware-bound, multi-signature unlock for a hub is on the roadmap; locked-mode runs today. And federation between societies is Spec specified, not yet built.
It's open source (AGPL-3.0). Fork it, write your community's charter, and run your own society.