The house that deeds build

How a house grows from a week

The private floor has four rooms and a bench for each family member. Play is deliberately small:

1. A member taps one of 12 fixed tiles: fed the ferment, cleared the plate, cooked, watered, swapped a spool, made something, fixed something, read, helped someone, tidied, exercised, answered a card. One tap, under ten seconds, one immutable record.
2. Each tile grows its own room. Ferment care and cooking grow the kitchen, printer care and making grow the workshop, reading grows the library, care for people and place grows the commons. The floor plan becomes a truthful portrait of what the family actually does.
3. A brick is permanent and capped at five per member per day; extra taps spark and fade, so enthusiasm still shows without corrupting the house as a record.
4. Candles are presence without surveillance: a member's candle burns for about four hours after they act, visible to family only.
5. The hearth at the center is cooperative. It lights if anyone logged a deed today, one flame for the whole family, and there is no leaderboard anywhere, even privately. Nothing decays, nothing nags, and a dark hearth relights with one deed.
6. Each bench also carries that member's turn cards, real decisions waiting on a real person, each with its stated default so silence runs the default and the card says so. Answering by tap is recorded as attested, which is a different rank of proof from machine-verified, and the floor says which is which.

What a stranger cannot do here, by construction

The public view is safe the boring way: the dangerous surface does not exist. Five absences, each structural rather than filtered:

1. No member has a free-text channel anywhere in the game. The entire tap vocabulary is the 12-tile enum, so a name, a clock time or a place cannot be expressed, not merely caught later.
2. No public API exists. This page is compiled static HTML; there is nothing to call.
3. No name exists in storage or code, only opaque member slugs. The name map lives in one private environment variable on the family app and the public compiler runs with that variable deleted from its own process before any other line executes.
4. This page has zero input surfaces: no form, no comment box, no fetch. The stranger-to-member channel is not forbidden, it is nonexistent.
5. No account creation exists. Entry to the private floor is by minted per-member keys, never a shared password, so the append-only record stays honestly attributed.

On top of the absences, the compiler that emits this page refuses unknown fields, out-of-vocabulary strings, non-integer counts and any timestamp finer than a date, and its selftest forces every one of those refusals to fire against poisoned records before the tool counts as a gate. The emitted bytes are then swept again on disk. A page that cannot pass does not ship.

Light your own hearth

One family plays this. There is no community behind this page, no waitlist and no sign-up, and it would be overselling to imply one. What there is instead: the pattern, small enough to rebuild in an evening, published so a second household could exist without asking us anything.

The rules that make it work, in the order they earn their keep:

1. Deeds are an enum, not text. Decide the tile list on paper with your family; the software treats it as the entire vocabulary.
2. Every member gets their own minted key. A shared login would corrupt an append-only attributed record forever, so it is the one thing never to shortcut.
3. The record renders the house. Nothing on the floor may light unless a stored record licenses it, and every drawn thing carries its raw number beside it.
4. Growth only. Bricks never decay and nothing on the floor shames anyone; a cold hearth relights with one deed. If your household runs on gentleness, make that a mechanic, not a policy.
5. The public view is a compiler, not a mirror. Emit day-grained integers and enum tokens through an allowlist that refuses everything else, prove the refusals fire before trusting it, and compile at a fixed time daily so even the update instant carries no signal.

The one-evening build order: a static login-gated app on your own hosting, a blob store, one POST endpoint that accepts a tile from the enum and mints the timestamp server-side, one GET endpoint that folds the log into rooms, a page that draws it, and the public compiler with its refusal gate and selftest. Cut the drawings if the evening runs short; never cut per-member keys and never cut the gate.

Federation is a hyperlink. If you build one, put your own public page on your own domain and link it wherever you like, including at us. There is no shared backend and no network to join; two honest pages that link each other are already a federation.

What this has not earned yet

1. Play. As of 2026-08-07 no deed has ever been logged. The game mechanics above are built and selftested, not lived with; whether the tile tray is still joyful to tap after week one is exactly the kind of claim this page refuses to make in advance.
2. Deployment. The private app waits on its hosting link, a human step done deliberately by hand. Until then the floor exists only on the family's machine, and this page says day zero because that is what the record says.
3. The daily compile. Tonight's compile was run by hand. The fixed-time daily job is the next evening's work, and until it exists the freshness chip above is the only freshness claim made.
4. A second household. Everything here runs for exactly one family. The copy kit above is an offer, not evidence of adoption; the honest count is one, ours.
5. The full roster. Two adult keys exist tonight. The remaining family keys are minted but their links are deliberately not handed out until the public gate has been watched firing and this live page has been read by an adult first.