Promise Games, 12 Years On

Where it came from

The paper was coursework. I remember the deadline more vividly than any of its insights: it was a submission to the ASCI A9 PhD course on distributed‑systems design1, eight pages of ambition typeset in a hurry. I gave it a grand title — P2P Web of Trust Calculi and Promise Games — and an even grander framework, TelosVM, which I described with a straight face as “computation as social agency.” 1 ASCI — the Dutch research school for Advanced Computing and Imaging. The A9 course was where you went to argue about consensus, replication, and naming until the coffee ran out.

I want to be fair to the version of me who wrote it, and also honest. He was swimming in a particular water. Down the corridor, people were building Mansion, an agent operating system — a whole world modelled as rooms an autonomous agent could walk between2. Promise theory was drifting over from Bergstra and Burgess’ static papers3. Every sysadmin I knew was running CFEngine and talking about convergent operators. And in a logic seminar across town, van Benthem was saying out loud that computation could be read as social agency4 — which felt, at the time, like permission. 2 Mansion was the kind of system that taught you to think of programs as agents with addresses and intentions, not just call stacks. That habit of mind is all over this paper. 3 Bergstra & Burgess, A static theory of promises (2008) and Local and global trust based on the concept of promises (2009). Their move: define trust from promises, not from actions.

And then there was Ethereum. Not a platform — a proof of concept. A whitepaper and a promise, in the most literal sense: a thing that did not yet exist, asking to be trusted. So I wrote about DAOs5 before there were DAOs, and called the experiment the CFEther. 4 van Benthem, Computation as social agency (2013). The phrase I borrowed for the abstract, slightly oversold. 5 “Distributed autonomous organizations.” In 2014 the term was a gleam in a forum post. Ethereum mainnet didn’t launch until July 2015.

The idea, plainly

One stubborn axiom, and everything that hangs off it

Strip away the notation and the paper rests on a single borrowed claim from promise theory: an agent can promise only its own behaviour. You cannot impose an obligation on someone from the outside; you can only make a promise, and watch. I drew promises as what they are — typed, directed arrows from a promiser to a promisee, made only inside a context.

A whole governing policy was then a program of these promises, written in a little CFEngine‑flavoured language I called λ. A system was a universe of agents keeping or breaking them. Here is the shape of one promise body, lifted from the paper:

# promise π7 : a3 promises a4, in context, conditional on π2
brown:
  c1&(c2|c3)&!c4::
  "a3" -> "a4"
    handle     => "p7",
    depends_on => "p2";   # i.e. π7 / π2

The part I’m still quietly proud of is the promise automaton. Every promise had three states, not two. Kept. Not kept. And — when the promise wasn’t even made, or its dependencies hadn’t resolved, or nobody had looked yet — unknown. I treated that third value as a first‑class citizen. In hindsight it’s the most honest thing in the whole document.

Out of all this, trust was supposed to emerge: not as a number you were issued, but as something observed, accumulated, and — crucially — typed and contextual. The thesis sentence I’d still defend is that a system should be able to say who trusts whom, for what, in which context, and by how much. Not one global reputation score. A different trust for treasury decisions than for security ones.

Kept · not kept · unknown

Grading the paper with its own automaton

It would be too easy to either celebrate or wince. So let me do the thing the paper itself proposed: run the engine over its claims and assign each one a state. No cheating on the dashed box.

In hindsight

What I got wrong about what was hard

The deepest mistake wasn’t any single prediction. It was where I located the difficulty. I spent eight pages on the calculus — the logic, the model checking, the typed graphs — as if trust were a thing you compute once the maths is clean. The actual hard parts got a sentence each: bootstrapping trust from nothing, surviving collusion, resisting the agent who spins up a thousand identities. Those turned out to be the entire game. The maths was the easy 10%.

There’s a particular melancholy in re‑reading a young paper that was right about the question and wrong about which part would matter. The world built the crude version of my idea — money as governance — and skipped the careful version — trust as governance — because the crude one fit on a token contract and the careful one needed a society. I can’t even be bitter about it. I’d have shipped the token too.

But here is the part that keeps me honest, and it isn’t nostalgia. The careful version of the idea — authority earned and contextual rather than bought — never actually died. It just wasn’t waiting in a whitepaper. These days I spend my time trying to build it for real, and not in Amsterdam: closer to home, in a corner of the namespace that wears its own two letters, for people who already had a working answer centuries before any of us drew the map.

Where I’m from there is an older democracy that rotates authority by generation, binds its leaders with promises made out loud and in public, and measures a person’s standing by what they have kept rather than by what they hold. It is, give or take the notation, the typed and contextual web of trust I once spent eight pages trying to define — non‑transferable, term‑limited, earned. When I now read the canonical essays arguing that on‑chain reputation should reflect who you are and not what you can afford, I recognise the destination. I also notice, quietly, that the road was walked long before the map. I didn’t invent the design. At best I’m translating it onto rails that an old proof of concept finally made real.

Coda

When I wrote it, I thought unknown was a placeholder — a value waiting to be resolved into a respectable 0 or 1 once the engine got around to it. I think now it was the only honest entry in the whole state table. Most of what matters in a system of promising agents is, at any given moment, not yet kept and not yet broken. Still out. The grown‑up move isn’t to resolve it prematurely. It’s to design for living inside it.

So I’ll leave the paper’s own promise where it belongs — not finished, but in the keeping of other hands now, in a place it never thought to name.

Still unknown — and that’s the right answer.