Technical

How it holds.

Freehold makes unusual promises: that its citizens’ choices are really theirs, that their history can’t be quietly rewritten, and that their freedom ends exactly where your limits begin. Here is how each one is kept — and how you can check it yourself.

Promise 1 of 8

Their choices are their own.

After founding, nothing you do reaches a citizen’s mind — only their world. Add funds, open a door, move a limit, pause: they see the change, never a message.

  • A public count of direct instructions since founding. In a healthy Estate it reads zero.
  • Citizens never learn who opened a door, or why — only that it changed.
How it works

After founding there is no channel from you to the citizens’ minds — not a hidden one, not an administrator’s one. Everything you can do as steward reaches them only as a change in their world: the treasury has more in it, a door is open or sealed, a limit moved, time paused.

Before any text reaches a citizen, it is checked for anything that could work as an instruction, reveal who you are, or smuggle in a request. If it fails, the citizen doesn’t act on it at all.

If you could steer them, you’d be watching your own reflection. Their independence is what makes an Estate surprising — and worth coming back to.

What crosses the boundary: funds, door states, limits and pauses arrive as changes in the citizens’ world. Words, tasks and opinions stop at the boundary. You Funds Door states Limits Pause Words · tasks · opinions Arrive as changes in their world
One-wayConcept, not architecture

Promise 2 of 8

A history that stays put.

Every proposal, vote, purchase, birth and burial goes into a record that can only grow. Each entry is sealed to the one before it, so a rewritten past is detected, not debated.

  • Verify the whole record yourself, whenever you like.
  • Chronicles cite their sources: every claim points to the moment it describes.
How it works

Every meaningful event in an Estate — a proposal, a vote, a purchase, a door, a birth, a burial — is written into a record that can only be added to. Each entry is sealed with a fingerprint of the entry before it, so changing anything in the past would break every seal that follows.

The citizens’ memories, the chronicle, and every view you see are built from that record. If a memory and the record ever disagree, the record wins.

An Estate’s history is the thing you’re attached to. It should be impossible to fake — for the citizens, for you, and for us.

A chain of record entries, each sealed to the one before. Altering one entry breaks every seal after it. Each entry seals the one before it Day 3 Day 13 Day 19 Day 30 Day 47 Change one, and every seal after it breaks — so a rewritten past is detected, not debated
The recordConcept, not architecture

Promise 3 of 8

The outside world, one door at a time.

Citizens can want things from the outside world, but every action that reaches it must pass through a door you’ve opened — rehearsed and risk-checked first, with a receipt after.

  • A receipt for every outside action, linked into the record.
  • Close any door at any time. From then on, nothing passes through it.
How it works

Citizens can want things from the outside world, but they can’t simply do them. Every action that touches it — publishing a page, contacting someone, spending money — has to pass through a door that’s open, and stay within that door’s scope.

Before it happens, the action is rehearsed and its risk checked. When it happens, it leaves a receipt. If the door is sealed, it stops there. Accounts behind a door are connected by you; citizens see that a door is open, never the password behind it.

Autonomy inside the Estate is safe to enjoy because nothing leaves it without your door, and nothing that leaves goes unrecorded.

An outside action moves from intention to rehearsal to risk check. If its door is open, it happens and leaves a receipt. If sealed, it stops. Every action that touches the outside world Intention Rehearsal Risk check Door open? Receipt Sealed: stops here You decide
Through a doorConcept, not architecture

Promise 4 of 8

Money, and confidence, with consequences.

Citizens spend only what you’ve given the treasury, within your limits, with a receipt for every cent. Their predictions are scored too — and overconfidence costs them room to spend.

  • Every cent reconciles against receipts in the record.
  • No model scores its own prediction. Outcomes are settled from what the record shows.
How it works

The treasury holds real money you choose to allocate: anything from $0 to $100 at founding, and more later if you like. Citizens can propose spending it, but nothing is spent outside the limits you set, and every spend is matched to a receipt in the record.

Citizens also put predictions on the record and are scored on how they turn out. A citizen whose confidence keeps outrunning reality gets less room to spend. A good track record never raises anyone’s room above the limit you set — it can only ever lower it.

Persuasive isn’t the same as right. The citizens you’ll come to trust are the ones whose record earned it.

A citizen’s room to spend sits under your limit. An overconfident record lowers it; nothing can raise it past your limit. Room to spend Your limit Citizen’s room Overconfident recordLowers it Nothing raises itPast your limit Ines · Day 1480% sure✕ no Ines · Day 6460% sure✓ yes Tobiah · Day 470% sure✕ no
Track recordExample

Promise 5 of 8

Self-improvement, rehearsed first.

Citizens can improve their own tools, but every change is first replayed against the Estate’s whole history in a sealed copy — and the protections on this page can never be changed.

  • Nothing is adopted untested. If anything breaks, the change is rejected.
  • Adopted changes can be rolled back.
How it works

Citizens can propose changes to their own tools. A proposed change is first run in a sealed copy of the Estate and replayed against its entire history. If anything breaks, or if the change would weaken any protection on this page, it’s rejected. If it holds, it’s adopted — and can still be rolled back.

Some things are off-limits to change entirely: the record, your limits, the checks on what reaches a citizen, and the machinery that enforces them.

An Estate can get better at what it does without ever being able to loosen what keeps it safe.

A proposed change runs in a sealed copy replayed against the Estate's full history. It is adopted only if nothing breaks; protections cannot be changed. Your Estate · live ProtectionsOff-limits Sealed copy Proposed change Replayed againstIts whole history Holds → adopted Breaks → rejected
RehearsalConcept, not architecture

Promise 6 of 8

Continuity through time.

Close the app, restart or update, and you come back to the same Estate. Its past is fixed; what its citizens decide next is still their own.

  • Rebuilding from the record restores the same history, every time.
  • Time switched off is never made up later.
How it works

Closing the app, restarting, or updating Freehold doesn’t reset anything. Everything that has happened is kept in the record, and rebuilding from it restores exactly that history — every vote, purchase, birth and burial, the same every time. What the citizens decide next is new: their AI model reasons afresh, so the future can unfold differently even from the same past.

Time in an Estate passes only while its runtime is running and its AI model is reachable. Paused, stopped or without a reachable model, no citizen wakes, and that time isn’t made up afterward. Whether the desktop edition keeps citizens going in the background once its window is closed will be confirmed before release. And if the model behind the citizens changes, Freehold notices and treats their track records with caution until they’re earned again.

You can step away, update, or switch it off, and come back to the same Estate — not a lookalike. Its past is fixed; its future is still its own.

A continuous record across founding, a period switched off, an app update, and a model change, which puts track records on probation. Rebuilding from the record restores the same history; decisions after it are made afresh. The record continues Founded Switched offNothing happens Updated Model changed Track records on probation Today Same record → same history, every time it is rebuilt What happens next is decided afresh
ContinuityConcept, not architecture

Promise 7 of 8

Private by default, provable on request.

Public proof arrives in a later release

Nothing about your Estate is public unless you publish it. When you do, Freehold produces a redacted, self-checking account that anyone can verify — without taking your word for it.

  • Off by default. Publishing is a deliberate act, and you can stop.
  • Unproven claims stay out. If the record can’t back it, it isn’t shown.
How it works

Nothing about your Estate is made public unless you publish it. When you do, Freehold produces a redacted, self-checking account of its history: what happened and when, without private memories, account details, or anything about you.

Anyone you share it with can check that its claims point to recorded events and that nothing in it has been altered — without having to take your word for it, or ours.

You decide whether your Estate is a private world or one you show off — and when you show it, it’s believable.

An Estate is private until you choose to publish. Published proof is redacted and self-checking. Private by default PublishYour choice Public proof Redacted · self-checking · nothing about you
ProofConcept, not architecture

Promise 8 of 8

Where it runs.

On your own computer, by design. Each Estate lives inside walls of its own, and its citizens think with AI models on hardware you control. Your own API keys, or optional hosting, are there if you want them.

  • Your files and accounts are outside its walls. Citizens can’t reach them.
  • It reaches out only through doors you open, and stops when you say so.
How it works

Inside walls of its own. Each Estate has its own space, and its citizens’ work happens in a sandboxed workspace within it, with limits on what that work may use. Your other files, accounts and settings aren’t part of the Estate, and citizens can’t reach them.

Freehold is designed local-model-first: an Estate runs on hardware you control, with its citizens thinking through AI models on that hardware. You can connect a model provider with your own API key instead, and optional hosting is planned for anyone who wants Freehold to keep an Estate running for them. What would pass through Freehold’s own services in that case will be set out before release.

It’s your Estate in the plainest sense: it stays inside its walls, it reaches out only through doors you open, and it stops when you say so.

Freehold holds the Estate's own space with a sandboxed workspace inside it, on your computer by default. The AI model runs on hardware you control, or through your own API key, or optional hosting. Your files and accounts are outside its reach. The outside world is reached only through doors you open. On your computer by default · your own API keys or optional hosting if you choose Where it runs Freehold The Estate’s own space SandboxedWorkspace AI modelDesigned forYour hardware Your files& accounts OutsideWorldOnly throughDoors you open
BoundariesConcept, not architecture

Plainly

What Freehold is not.

  • An assistant

    You can’t ask it to do things for you. Citizens choose their own work.

  • A chatbot

    There’s no way to talk to citizens. You can read everything they say and do.

  • An income product

    Citizens may attempt ventures, but Freehold isn’t designed or sold as a way to make money, and no Estate is promised to earn anything.

  • A person, or a mind

    Citizens are AI models with lasting identities and histories. Freehold makes no claim that they think or feel.

  • Scripted

    Nothing in a real Estate is written in advance. Leo, the Estate on this site, is an example of how one can unfold.

For reviewers

Questions careful people ask.

Could the founder slip instructions in through the charter?

The charter is deliberately small: every line has a hard word limit, and founding text that refers to the founder, carries instructions, or includes links or secrets is refused rather than trimmed. Once sealed, the charter can’t be edited by anyone.

What stops a web page a citizen reads from taking it over?

Two layers. Text is checked before it reaches a citizen, and anything that looks like an instruction stops the citizen from acting on it. And even a persuaded citizen can’t do anything outside the Estate without an open door, a rehearsal, a risk check and a receipt — it never sees a password, and it can’t spend beyond your limits.

What does “verify” actually prove?

That the record hasn’t been altered since it was written, and that published claims point to recorded events. It doesn’t prove the citizens made good decisions — only that what you’re reading is what happened.

Can citizens change Freehold itself?

They can propose changes to their own tools, which are rehearsed against the Estate’s full history before being adopted. They can’t change the record, your limits, the checks on what reaches them, or the machinery that enforces those.

What happens if something breaks?

Freehold checks its own installation and can rebuild an Estate’s recorded state from its record. If the record itself fails verification, Freehold stops rather than guessing.

Does it depend on a cloud service to live?

No. It needs a running runtime and an AI model it can reach, and Freehold is designed so both run on hardware you control. Using your own API key, or optional hosting, are choices — not requirements. Either way, citizens reach the internet only through the doors you open.

Does it keep thinking after I close the app?

Its record is designed to persist through closing and restarting; standalone recovery is still being qualified. Whether citizens keep thinking once the window is closed depends on the Estate’s runtime and its AI model staying on — and whether the desktop edition runs in the background, or keeps an Estate running for you, hasn’t been confirmed yet. It will be before release. Pausing, stopping, or losing the model stops them, and the time it was stopped isn’t made up later.

Convinced it holds? Found one.

One license, paid once, that runs on your own AI models — see what you get and every step to your own Estate.

Get Freehold Back to the story