Most protocols are actually products
A lot of things get called protocols now. Most of them are products with APIs. A real protocol has a higher bar. It defines primitives that survive independent of any single product using them, and it makes behavior verifiable without trusting any one implementation.
For a trust protocol specifically, the bar is even higher. The primitives have to be auditable, portable, and durable enough that a relationship recorded under one product remains meaningful under a different product built on the same protocol.
Three first principles produce a protocol that clears that bar. Rhiz Protocol was built on them. This article explains what they are and why each one is load-bearing.
First principle: event sourcing as the state model
Event sourcing stores state as an append-only log of events rather than as a mutable database. Every state change is a new event. The current state is a projection over the event history.
For a trust protocol, this is not an implementation detail. It is the only way to make trust verifiable.
- Consent is auditable. Every consent event, with its exact scope and its exact timestamp, is recorded. You can prove what was agreed to, when, and under what terms.
- Relationship changes are replayable. You can reconstruct the graph as it existed at any prior moment. That matters when a dispute involves a relationship that has since changed.
- Migration is clean. Moving between projections is just a matter of replaying the log. The log is the source of truth.
- Attack surface is smaller. You cannot silently mutate state without leaving an event behind. Silent rewrites are not possible.
Mutable databases can reach some of this with significant additional infrastructure: audit logs, soft deletes, versioned columns. But the complexity compounds, and the guarantees are weaker. Event sourcing gets you the guarantees for free, at the cost of learning a different mental model.
Rhiz Protocol treats the protocol_events log as the authoritative state. Every projection, from profiles to graph reads, is derived from it.
Second principle: markdown-first storage
A trust protocol stores a lot of profile-shaped data. Who someone is. What they are working on. What they have consented to. The format this data is stored in is not a cosmetic choice. It shapes who can read it and how durably it survives tools.
Rhiz chose markdown-first.
Markdown is dual-readable. A human reads it as prose. An agent ingests it as context without lossy format translation. A renderer displays it with light formatting. All three pathways work on the same source of truth.
Markdown also travels well. It does not depend on a proprietary schema. It survives tool migrations. It is diff-friendly in Git. It is easy to audit. It is simple enough that a protocol can commit to it as a storage format across decades of product change.
This is why the profile_md field on node_profiles_person is not a convenience. It is the canonical personal profile. The Prescient Report a member receives after their Voice Awareness Session is markdown. Their agent reads that same markdown. Any sovereign brand that wants to build on Rhiz reads that same markdown.
The alternative, storing profiles as normalized rows in a SQL schema, produces a different protocol. Rows do not travel. Rows do not agent-read. Rows require schema evolution for every new field. Markdown does none of that.
Third principle: cohort rooted identity
In Rhiz, every Connection is rooted in the cohort in which it was formed, under the terms consented to at that time. There is no such thing as an un-rooted Connection.
This is the primitive that makes the trust edges mean something.
- Reach-based platforms treat an edge as a symmetric follow. Rhiz treats an edge as a verified, consented relationship with cohort context.
- Network spam cannot compound in Rhiz because there is no reach to exploit. You cannot forge a cohort context you did not participate in.
- Trust edges carry the terms they were created under, so you can enforce the consent boundaries at every downstream read.
Cohort rooting is also what lets agents reason about trust. An agent that inherits your Connections inherits them with cohort context attached, which means the agent can reason about which edges are appropriate for which kinds of outreach. A reach-based graph cannot provide that signal.
This principle is the main reason Rhiz does not build on Nostr or ActivityPub as-is for the core trust layer. Those protocols optimize for broadcast and discovery. Their edges are reach-shaped. Rhiz could interoperate at the publishing edges, but cohort rooted identity needs different primitives at the core.
How the principles compose
Each of the three first principles is load-bearing, but they also compose:
- Event sourcing is what makes consent verifiable. Consent is what makes cohort rooting meaningful. Cohort rooting is what makes the graph edges trustworthy.
- Markdown-first storage is what keeps all of this human-readable and agent-readable. Event logs that are not dual-readable produce brittle protocols. Markdown profiles keep the system transparent to both sides.
- Without event sourcing, markdown-first would be lossy. Without markdown-first, event sourcing would be auditable but inaccessible. Without cohort rooting, the other two would describe an event log of broadcasts.
The three principles together produce a protocol with primitives any sovereign brand can build on.
What this gives sovereign brands
Partners building on Rhiz Protocol get:
- A verifiable event log for all trust-relevant actions.
- Markdown-first profiles that their product and their members' agents can both read.
- Cohort rooted identity primitives so that Connections inside their brand carry real meaning.
- Mission-agnostic positioning. The protocol does not impose a vertical; it provides primitives.
The Rhiz Collective is the first brand built on these primitives. More will follow.
Where to go next
- Read the spokes on event sourcing, markdown-first storage, and sovereign brands for depth on each principle.
- Partner surface for brand-level integrations with the protocol.
- The Rhiz Collective hub for the first product built on these principles.
A protocol is a set of invariants. The three above are Rhiz Protocol's.