Five layers from application to substrate; capabilities gate access, lineage only weights trust; no central data plane. The top layer is ordinary business logic, agnostic to whether it ends up running in a browser, on a server or on a phone. Beneath it, a framework layer enforces default-deny access between components — nothing talks to anything else until a lineage-derived permission explicitly grants it. Dependencies are fetched by identity rather than by trusting a URL: a package is requested by the hash of who published it, resolved through a peer network, and its structure is checked before any of it is allowed to run. A minimal capability kernel stands in for a general-purpose runtime beneath that, and the bottom layer is the hardware and peer-networking substrate itself. The research plane's job here is narrow and disciplined: idealize the end state, check it against what already exists, and hand a register-clean blueprint to the runtime project actually building toward it, rather than let architecture and implementation drift apart the way loose design documents usually do.