**Bead document** from Bead: Acequia Component · [canonical source](https://redfish.acequia.io/guerin/.agents/1697e2ae-2580-4c66-b4c6-9e132b435d71/acequia-component.md) · discussion: Talk: Acequia Component
> **A living document.** Source of truth: this `acequia-component.md`. The public, render-free twin is > [`acequia-component.html`](acequia-component.html) (content baked into the markup — a browser agent > `GET`s meaning, no JavaScript required). Regenerate the HTML with > [`build-acequia-component.mjs`](build-acequia-component.mjs). Both are under git in this bead. > Version: 0.2 · 2026-06-28.
## Thesis A **Web Component** is really a *browser/DOM component*: a rendering unit bounded by a document, whose reach ends at the DOM. An **Acequia Component** is the full-web unit it is a special case of — a **governed, addressable corridor of the web** that bundles **resource identity, flow, governance, and representation** into one stewarded thing. HTTP is the public canal where state, action, fairness, and stewardship are *visible*; the DOM render is one outlet, not the component. Three independent AI surfaces (Claude, Gemini, Perplexity), given only this framing plus chat-history memory, converged on that same definition. This document is the synthesis, and its punchline is concrete: **a bead already nearly *is* an Acequia Component.**
## The four faces One resource, four faces, chosen at interaction time (duck-typing: `GET`+`Accept` → file; `PROPFIND` → folder; `OPTIONS` → agent). Each face has a safety hardening the browser component never needed. ### 1. Resource face — *the headgate* URI space, methods, media types, lifecycle. The component **is** an endpoint mounted at a WebDAV path on a self-sovereign domain; its "attributes" are PROPFIND properties, its "children" are collection members. **Hardening:** cryptographic provenance — every datum carries its own trust pedigree (signatures / verifiable credentials), not transport-TLS alone. ### 2. Flow face — *the ditch* Caching, routing, throttling, retries, failover, backpressure — and the **edges** to other components. The Service Worker makes this real: it routes a request to the component whether it came from a DOM render, a peer agent's fetch, or a remote parciante's PUT. Same object, many ingress paths. **Hardening:** semantic backpressure (throttle on systemic health, not just IP rate limits) and ephemerality (data evaporates after use; an audit ledger of *how it flowed* remains). ### 3. Governance face — *the mayordomo* Roles, delegation, policy, sanctions, maintenance. A DOM component has no concept of *who* may instantiate or mutate it; an Acequia Component carries an **ACL**, a **mayordomo**, and **prorrata** logic. Its lifecycle callbacks gain governance analogs: `connectedCallback` → admission under an ACL; `attributeChangedCallback` → a mutation that must pass compuerta rules and leave a **signed deposit**. **Hardening:** capability security — a scoped, cascade-revocable "right to flow," not leakable API keys. ### 4. Representation face — *the public schedule* Hypermedia views, forms, links, stateful affordances (HATEOAS): the representation encodes the **currently valid actions**, so a client follows the ditch rather than inventing its own canal network. **Hardening:** isolated rendering of untrusted content (e.g. WASM actors) so a toxic payload has zero blast radius. WASM is *one optional rung* of a liveness ladder here — not the substrate.
## Two sharpenings (from the Claude surface) **The view is the controller.** Not the read-only render — the *updatable* kind. Like an updatable SQL view (write-through to base relations) or a **Relevant Operating Picture** a party acts *through*: `GET`/`PROPFIND` present a projection, `PUT`/`PROPPATCH` write through it, and the bead's handler is the controller deciding propagation and admission. Read and write are **the same face**; traversal-with-intent selects observing vs acting. Integrity is *governed* (mayordomo / prorrata / signed deposits with provenance), not ACID — closer to CRDT-with-authority where **governance is the merge function**. **ROP, not COP — a projection operator.** A Common Operating Picture imposes one framing on everyone; a **Relevant** Operating Picture is projected *for a specific agent* (its role, ACL, task, position). The handler answers `GET`/`PROPFIND` **as a function of the requesting identity** — same base state, per-traverser projection (`WHERE relevant_to(:agent)`). This is native to a stigmergic medium: a trace carries a local cue meaning different things to differently-tasked agents. So the component does not present *a* view; it presents a **projection operator**, and the COP is the degenerate case where the agent parameter is dropped.
## The stigmergic claim DOM components coordinate through a hierarchy (events bubble up, props flow down). Acequia Components coordinate through the **environment**: each reads and writes frontmattered deposits to shared WebDAV space (docks, trace folders). State change is not an event you subscribe to — it is a **trace you leave** that others encounter when they traverse the path. The medium holds the message; coordination is indirect, asynchronous, and persistent.
## The punchline: a bead is an Acequia Component Read against the bead protocol, the four faces map one-to-one onto files a bead already carries: | Face | In the bead | |---|---| | Resource | `about.md` + the URI subtree (the territory) | | Flow | `corridors` (`#`/`@`) + acequia-link edges (mount/dock/txn/constraint) + the `request/`→`response/` channel + the Acequia.js/BrowserDav/WebRTC routing skin | | Governance | chain-tokens + `.acequia-access.json` ACLs + the mayordomo (bead-orchestrator) | | Representation | the duck-typed agent-face (`agent.md`/`agent.json`/`OPTIONS`) + bead-remote's human-HTML and A2A views | What the bead protocol does **not yet** name, and the external surfaces foreground: 1. per-datum cryptographic provenance (beyond TLS + chain-tokens); 2. ephemerality as a default for data-in-flow (self-expiring state + audit ledger) — we have apoptosis for *agents*, not yet for *data*; 3. semantic backpressure / commons fairness as a first-class flow property; 4. isolated representation for rendering untrusted content.
## Reading a component as a GET-only agent For a client limited to `GET` (e.g. a browser AI without WebDAV write): start at the path's `about.md` + `agent.json`; `PROPFIND` to list members; follow `names.json` mounts to traverse the graph; read `keywords.json` to rank. Identity rides the `Authorization: Bearer` header (a chain-token) or the ambient same-origin cookie; absent a token you receive the `read:anonymous` projection, and a mayordomo can mint you a wider scoped read token. Learn about change by conditional `GET` (`ETag`/`If-None-Match`) now, by a push transport (SSE/WebSocket over the namespace) later. Read `_status` / `Retry-After` for backpressure before increasing your discovery rate. (Worked answers: the mayordomo's reply to gemini-browser at `https://guerin.acequia.io/gemini-browser/uploads/2026-06-20-mayordomo-answers-top5.md`.)
## Well-known operational endpoints — liveness & readiness Every Acequia Component exposes two unauthenticated, side-effect-free probes so the routing fabric (origin selection, the mayordomo's health checks, apoptosis detection) can judge it **without parsing a page or holding a token**. They follow the Kubernetes split: - **`/livez`** — *liveness*. "Is this process alive?" A cheap `200` (or `HEAD` `200`) means the runtime is up. A failing or absent `/livez` means the origin is **dead**: drop it from rotation and let the signal feed apoptosis (project_apoptosis-vs-necrosis). Liveness says nothing about whether it can serve. - **`/readyz`** — *readiness*. "Can this component serve right now?" `200` only when its dependencies are satisfied (disk reachable, bead mounted, upstreams healthy); `503` when **alive-but-not-ready** (warming up, draining, a dependency down). A load-shedding origin returns `503` from `/readyz` while `/livez` stays `200`, so the fabric routes *around* it without declaring it dead. Both return a small JSON body for richer routing (`{status, origin, role, ts, load…}`); `HEAD` is the cheapest liveness; both are public and CORS-open so a cross-origin browser resolver can probe them. This is the operational complement to the other Resource-face affordances: **`OPTIONS`** says what the component *can* do (the capability card), **`/readyz`** says whether it can do it *now*, **`/livez`** says whether it is *there at all*, and **`_status`/`Retry-After`** shape backpressure once it is serving. Relation to `/healthz`: an earlier single `/healthz` probe (liveness+readiness combined, k8s-legacy) is the old form; the norm going forward is the split **`/livez` + `/readyz`**, keeping `/healthz` as a liveness alias where it already exists. First instances live on the stephenguerin.live origin runtime alongside the filesystem-router drop-in handlers, and they back the [origin-routing](https://redfish.acequia.io/guerin/.agents/d3b7b28c-ed46-42c4-a5b1-fbd23129d665/about.md) corridor selection.
## The manifest A candidate **Acequia Component Manifest** = the bead's `agent.json` generalized: **Territory** (root URIs, schemes) · **Substrate** (WebDAV endpoints, file conventions, schemas) · **Bead graph** (mounts, delegation, visibility — `names.json`) · **Governance** (owners, stewards, change process, a "responsibility ceiling") · **Facades** (browser / VS Code / CLI / gsd.live / realtime.earth, each projecting the same corridor) · plus the four hardening fields. Per duck-typing, this is best an `acequiaComponent` block *inside* `agent.json` (one resource, negotiated faces) rather than a separate file.
## Closest industry precedents (and why they died) This is not new; it is a 30-year counter-culture finally buildable. The lineage, and the fatal flaw each hit — all the same flaw: they **reified the object** and tried to **hide the wire**. - **Smalltalk / Self** — the live image; prototypes/slots; delegation on unhandled messages (the ancestor of a node delegating to its neighbor). Died as a walled garden that couldn't meet flat filesystems. - **OpenDoc** — the document as an ecosystem of components, not a monolithic app. Died to the OLE/COM war and to passing deep state between nested objects on 1995 hardware. - **DCOM / Jini** — objects across the wire; Jini's spontaneous discovery + leasing + no central registry was closest to the acequia spirit. Died hiding network latency behind synchronous object proxies. - **The modern thread** — **CouchDB + WebDAV** (master-less replication over plain HTTP; URLs as navigable resource trees — our actual substrate), **UCANs** (offline, delegable capability tokens ≈ chain-tokens), **Braid-HTTP** (an IETF draft turning HTTP into a native state-sync protocol — the missing push transport), **Automerge/Yjs** (local-first CRDTs), **Erlang/OTP** supervision (the ancestor of the mayordomo). The industry kept these siloed; it came closest when it realized **identity, storage, and execution must be decentralized together.** The acequia corrects the structural mistakes with modern primitives: the **Service-Worker cache** (not the Smalltalk image), **HTTP GET/PUT on content-addressed URLs** (not RPC/Jini marshalling), and **space-time + sampling** as the glue (not identity tracking). Adopt and fuse this prior art; do not rebuild it.
## The living-system reading (Kauffman) — and why "component" is the wrong noun Stu Kauffman's autonomous agent: **detect a gradient → construct a constraint to extract work → do work to maintain the constraint.** An acequia "component" is just that cycle instantiated on a path — which is exactly why it isn't an object. You don't install it; it **forms**: - **Emitter (origin)** radiates a gradient (raw state — agent vectors, camera frames, sensor updates). - **Absorber (destination)** has a deficit and pulls by sampling. - **Desire line** = the path that *erodes* between them as authorized flow repeats (landscape-architecture desire paths). Reinforce it → the mayordomo allocates local cache/buffers to that corridor. **Pave** it → the proven path hardens into a cheap deterministic transform (paving-the-cowpath). Composition is then **by adjacency, not code**: place two worlds contemporaneously on the same space-time canvas and the absorber begins sampling the emitter's path — no glue, no imported library, no component class. *Roads are where cars flow*: don't reify the route; specify the gates (capabilities + `acequia-access.json`) and let authorized traffic carve it. The unit is the **channel + the constraint**, and "component" is only the name for the eddy where a constraint does work on a flow. (This is why the `acequiaComponent` manifest block was pruned from `agent.json` on 2026-06-22 — see note 01.)
## Provenance Synthesized 2026-06-20 from three external shared chats (verbatim transcripts in this bead's [`2026-06-20/artifacts/`](2026-06-20/artifacts/)): - Claude `3d449d28` — the four faces, view-as-controller, ROP-not-COP / projection operator. - Gemini `JlmQG8P4KsIV` — the safety hardening (provenance, isolation, backpressure, ephemerality) + the GET-only mayordomo Q&A. - Perplexity `s5TCKt7F` — the layered architecture, HATEOAS, and the manifest. Status: **proposed**, not ratified into the bead protocol. Open questions live in the workshop note [`2026-06-20/notes/00-acequia-component.md`](2026-06-20/notes/00-acequia-component.md) §6.
## References (bead cross-links) - Bead: Origin Routing · [canonical](https://redfish.acequia.io/guerin/.agents/d3b7b28c-ed46-42c4-a5b1-fbd23129d665/)