---
title: Stage 0 — Now (Conventional Computing)
type: reference
tags: :passepartout:roadmap:
created: 2026-05-24
---

← [[id:329a30cd-55fb-496d-a60b-91388c211bba][Passepartout]]  → [[id:4a1f23b0-abc2-4def-9876-543210abcdef][Stage 1 — Social Protocol]]

# Stage 0: Now

*Summary: The conventional stack as it exists today. Not a design — the starting point.*

This is the baseline we inherit. Linux on x86, C/Rust toolchain,
web-based applications, GPU compute for AI, TCP/IP networking. Every layer
is independently built and independently untrusted.

The conventional stack spans every layer:

| Layer | Threats |
|-------+---------|
| [[id:84a537b4-4256-50c8-91f5-dd5b4538418f][Hardware]] | silicon trojan, rowhammer, speculation side channels (spectre/meltdown), physical theft |
| Firmware | UEFI implants, SMM rootkits, ME backdoor — unaccountable opaque processors |
| OS kernel | privilege escalation, syscall bugs, driver exploits — CVEs weekly |
| Compiler | Ken Thompson's "Trusting Trust" — compiler backdoors invisible at source level |
| Runtime | heap corruption, use-after-free, buffer overflow — the dominant malware vector |
| Network | MITM, TLS state machine bugs, DNS poisoning, routing attacks |
| Application | XSS, SQLi, RCE, dependency chain attacks, supply chain |
| User | phishing, social engineering, credential theft |
| LLM (if present) | jailbreaks, prompt injection (unbounded space), data leakage in outputs, probabilistic unreliability |
| Empirical provenance | No systematic model validity checking. Parameters lack provenance, validity envelopes absent, neural networks treated as black boxes with no distribution match |

**Key property:** Every layer is independent and untrusted. No layer can vouch
for any other. Security is *empirical* — "no bugs found in this release" — not
deductive.

## What is eliminated

Nothing. Every threat that has ever existed in computing exists at Stage 0.

## What does this cost?

- **Patching treadmill** — the industry spends uncountable hours applying CVEs.
  Every OS update risks regressions. Security teams are measured by mean time
  to detect, not mean time to prevent.
- **Incident response** — breaches are expected, not exceptional. The average
  dwell time (attacker inside system before detection) is months.
- **Bug bounties** — a market failure tax: pay researchers to find the bugs
  your toolchain inevitably produces.
- **Complexity tax** — every OS, driver, library, and daemon is a potential
  entry point. The attack surface is unknowable because no layer can vouch
  for any other.
- **No deductive guarantees** — security is empirical. "No bugs found in this
  release" does not mean no bugs exist.

Even with all this spending, the system is not provably secure. You can't
audit your way to deductive guarantees on a conventional stack.

## What does this enable?

Everything we have. The entire software ecosystem, all hardware, every network.
The cost and the capability are the same thing — maximum flexibility, minimum
provable trust.

## When is this viable?

Today. This is where we are.

## In practice

We have normalized reactive security because the alternative — building a
provably secure stack — is considered too expensive. Every company of
meaningful size has a security team whose job is to detect when they've been
breached, not to prevent it. The average dwell time is measured in months.
This is treated as normal because the alternative — a provably secure stack —
is seen as prohibitively expensive. This roadmap is the argument that the
provable alternative is not only possible, but the inevitable destination.
The question is not whether to build it, but at what pace.

← [[id:329a30cd-55fb-496d-a60b-91388c211bba][Passepartout]]  → [[id:4a1f23b0-abc2-4def-9876-543210abcdef][Stage 1 — Social Protocol]]

:PROPERTIES:
:CREATED:  [2026-05-24 Sun]
:ID:       4a1f23b0-abc1-4def-9876-543210abcdef
:END:
