**Note** from Bead: Wedtech Beads 2026 07 08 · [canonical source](https://redfish.acequia.io/guerin/.agents/9d343253-c279-47ac-a066-cc31ce505782/2026-07-08/notes/08-origins-and-scopes.md) · session 2026-07-08 · discussion: Talk: Wedtech Beads 2026 07 08
Grounding for the slide at [slide-origins-and-scopes.html](https://redfish.acequia.io/guerin/.agents/9d343253-c279-47ac-a066-cc31ce505782/2026-07-08/artifacts/slide-origins-and-scopes.html). Surveyed live from the workspace on 2026-07-08.
## Three rings ### 1. Outside every origin (local machine only, never served, never synced) - `sites/.credentials/`: per-domain tokens and key material (57 files today: per-origin JSON creds, JWTs, `_netrc`, a signing key). Sits beside the origin folders, inside none of them. A leaked origin cannot leak the keyring. - `sites/.ai/`: the global, agent-agnostic instruction layer shared across all origins (START-HERE, conventions, beads protocol, chat conventions, skills like bead-sync and capture-shared-chat). Instructions for agents working the whole mirror, addressed to no single origin. - `.claude/` memory: the assistant's persistent memory, deliberately outside the namespace entirely. ### 2. Origins (each its own authentication scope) The local `sites/` folder mirrors ~50 origin folders, each named by its domain. Each origin is a separate Bearer-token scope on its server (Nephele hosts: waldo, stigmergic, gsd, simtable, redfish; plus HostGo cPanel domains and others). Examples in the talk's orbit: - [redfish.acequia.io](https://redfish.acequia.io/): carries its own served `.ai/` (agent-agnostic docs at the origin: START-HERE, beads, conventions, glossary) and `skills/` (substrate skills readable by URL: beads, webdav-context, sketch-ux, EULA-compliance). This is how a remote or browser agent bootstraps: GET the skills, no filesystem needed. - [simtable.acequia.io](https://simtable.acequia.io/): incidents and people spaces (Old Fire STAC lives here). - [waldo.acequia.io](https://waldo.acequia.io/): course spaces (gsd-vis-2487), separate credential realm. - [stephenguerin.live](https://stephenguerin.live/): home-node origin, live bead runtime. ### 3. Inside an origin: parciantes, beads, and sidecar-scoped reads - Parciante spaces: `{origin}/{parciante}/`, for example [redfish.acequia.io/guerin/](https://redfish.acequia.io/guerin/), each with its own `.agents/` bead base and `apps/`. - Beads can be placed in **different domains/origins**, and that placement is a governance decision: scope times blast-radius times revocability. A course bead lives on the course origin; an internal strategy bead stays on an origin that is not synced publicly; an incident bead lives on the incident's origin. - `.acequia-access.json` sidecars split read scopes **inside** an origin, with origin-based authentication doing the coarse split **between** origins: - Default: everything requires a Bearer token for that origin. - `{"read":"anonymous","recursive":true}` opens a subtree to the public (reads only; writes always need the token). - Nearest sidecar wins: a public tree can carry a private carve-out (`{"read":"authenticated"}` in a child), and `denyPatterns` excludes secrets from a public tree. - The sidecar is a dotfile, invisible to anonymous listings.
## Why this matters for the talk The three demo apps are public leaves (`read: anonymous` sidecars) growing from authenticated origins, built by agents whose credentials live outside every origin. The split is what lets one workspace serve public demos, internal strategy, client spaces, and course material without any of them bleeding into the others. This is the governance half of "acequia components": the component model is URIs plus verbs, and the scoping model is origins plus sidecars.
## Open questions - [ ] Which origins earn a box on the slide? (Current pick: redfish, simtable, waldo, stephenguerin.live, plus a "~45 more" tail.) - [ ] Show the browser-singleton PUT arrow crossing into an origin on this slide, or keep that on the hydrants demo beat?