02 · Philosophy & Design Principles

#Aims and reasoning

#Why this project exists

Most people's complaint about social media is not that any single feature is bad. It is a diffuse sense that the medium makes them worse — more anxious, more performative, more status-conscious, more drained — even when they use it for something they value. The common explanations treat this as a content problem (moderate harder), a willpower problem (use it less), or an incentive problem (the company sells attention). Each is partly true; none explains why the same pathologies recur across platforms with very different content, business models, and intentions.

TalkCo starts from a different premise, and the premise is empirical rather than ideological: the pathologies are structural. They emerge from a small set of design ingredients that almost every platform shares, and they appear even in deliberately minimal designs — even in simulations populated entirely by agents with no profit motive (§02b). If the harm is structural, the only durable remedy is also structural: do not build the structure that produces it, and encode that refusal where it cannot be quietly reversed.

#What social media actually is — and why it breaks us

Strip away the branding and mainstream social media is a publishing machine: it makes every person a broadcaster to a general audience. Three properties follow from that single fact, and it is their fusion that causes the harm.

• An influence machine. Broadcast at scale, ranked for reach, lets attention be manufactured, bought, and weaponized — by advertisers, PR firms, lobbyists, and state actors. The mechanics that surface a friend's post surface a coordinated campaign just as readily, and ranking-for-engagement structurally favors outrage: even minimal simulated platforms amplify the most extreme voices ([LarooijTornberg2025]), bending public perception toward conflict. This harm is civic, not merely personal.
• A hierarchy machine. Attention attracts attention; small early advantages compound into winner-take-all concentration through preferential attachment ([Barabasi1999], [Salganik2006]; §02b).
• An identity machine. A general audience reshapes how people form and validate a self — the subject of the next section.

Apart, each is survivable. Fused — civic influence, social reach, and personal identity routed through one ranked public scoreboard — they produce the status treadmill people describe. TalkCo's task is to separate publishing from ranking, from influence-for-hire, and from public scoring.

#The tyranny of the single profile

Consider the most basic thing a mainstream platform asks of you: one "main" account, a single profile that is supposed to be you. Your closest friend, your manager, your family, an ex, and ten thousand strangers all see it. To exist on the platform is to collapse every context of your life into one performance for all of them at once. This is a wellbeing failure — you are permanently on stage before an audience that should never have shared a room — and a privacy failure — one fully linked identity is trivially surveilled and weaponized.

This is not a flaw in having a profile; it is profile-based identity, profilicity, implemented in its most damaging configuration: a single profile, a mass audience, a public score (the underlying account of identity is in §02b). The implication is precise, and it rules out the obvious counter-move. TalkCo does not try to escape profilicity toward some "authentic self": a broadcast medium produces self-observation by construction, and a platform that sells authenticity is usually just performing it. The tractable variable is not the profile but the conditions under which it is observed. TalkCo changes three of them:

1. Audience: small and known, not mass and anonymous. Discovery is relational — invite, introduction, following — so the observers are people you know and communities you have chosen. (§03, §06.)
2. Identity: fragmented by context, not flattened. Distinct, audience-appropriate profiles per channel and per introduction-context — contextual self-presentation without context collapse and without deception. This works with the grain of profilicity, in which a profile is already addressed differently to different audiences (§02b). (§03, §04.)
3. Feedback: qualitative, not scored. No public counts or built-in amplification; broadcast reactions are visible to the author, not to other viewers. Visible prior ratings causally biased later ratings in one experiment ([Muchnik2013]). Author-private feedback removes that tested public cue; its broader effects remain hypotheses to test (§02b).

#What we are not trying to abolish

The target is not hierarchy as such. Differential influence arises in any interacting group and is not, in itself, harmful (§02b). TalkCo removes only its manufactured form: concentration produced by amplification rather than by relationship, and identity-validation rendered as a public number. Endogenous, relational status is left intact; the feedback loop that inflates it is what we cut.

The profilicity ↔ authenticity tension is therefore a standing evaluative lens, not a problem we claim to have solved. Every proposed feature is tested against one question: does it re-introduce a visibility → popularity feedback loop?

#Healthy influence is relational, not ranked

Research-backed decision: TalkCo does not try to make every person equally influential. Some people will matter more in a channel because they have history, competence, care, or responsibility there. That kind of influence is healthy when it remains local, contextual, reversible, and legible as relationship rather than rank (BurkeKraut2016, Zimet1988).

The design accepts relational influence: influence carried through replies, invitations, introductions, explicit following, remembered judgment, and trusted stewardship inside a bounded context. It rejects influence that travels as a public score. Standing in one context must not become a portable reputation number attached to the person everywhere.

Research-backed decision: TalkCo should not promise authenticity, a "real you," or escape from performance. The narrower claim is context restoration: people can present themselves appropriately to known audiences without reducing every expression to one public profile or one competitive scoreboard. "Genuine pretending" remains theory vocabulary; user-facing language should say contextual expression, audience-appropriate presence, or context restoration (MarwickBoyd2011, Hogan2010, LiChoShenKong2023).

#The hostile client is part of the threat model

An open, forkable system cannot assume that everyone uses the official client. A determined participant can run a modified client, automate requests, export what they can decrypt, or share material with an outside crawler. Treating that as a solvable client-integrity problem would either fail technically or pull TalkCo toward app-store attestation, device exclusion, and locked-platform behavior.

Privacy must depend on scoped disclosure and accepted authority, even when a recipient uses a modified client. Copying and external aggregation remain possible once information has been disclosed.

#Design principles

These follow from the diagnosis. They constrain what kind of thing to build; the section docs work out how.

1. The discipline of omission. A feature is never added merely because it is possible. In an open, forkable system, antisocial behavior cannot be made impossible — so the prosocial path is made the path of least resistance (the protocol default and the default client), such that re-introducing harmful dynamics requires deliberate, costly effort. Values are encoded into what is easy, not only into what is permitted, and especially into what the protocol never makes conveniently enumerable.
2. No metricized second-order observation. Reach and worth must not share a public number. No public follower, like, vote, karma, or virality counts as competitive signals. Broadcast feedback stays author-private. Coarsening an aggregate does not remove its influence on later viewers; public popularity labels remain outside the default design.
3. Relationship-based discovery; no algorithmic amplification. People find people through people. The system does not optimize a feed against user behavior, provide a global discovery surface, or make the social graph easy to crawl. Where ordering is required, prefer user-declared priority to behaviorally inferred ranking.
4. Contextual identity by default. Audiences are scoped (channels, introduction-contexts); composing is always to a context, never to "everyone." Context replaces both circles and quantified "closeness."
5. Finitude over infinity. Design for a bottom — bounded, completing views ("you're all caught up") — rather than infinite, variable-reward streams. (§06, §07.)
6. Care-centric over status-centric. Given a choice between a mechanic that fosters warmth and one that fosters ranking, choose warmth — and never render contribution as public standing.
7. Consent and reversibility as the spine of safety. Connection is consensual; personal blocking is easy and emits no explicit block notice; future disclosure can be withdrawn within the selected access model. Removing global reach and built-in amplification limits opportunities for amplification-based harassment. Abusive contacts, stalking, and other insider harms still require direct controls (§08).
8. Pragmatism over dogma. These principles are empirically supported hypotheses, not articles of faith. Where the evidence is uncertain or counterintuitive, the design should be tested against TalkCo's own ruleset before major mechanics are committed (§02b).

#Protocol and architecture

#Principles become boundaries at specific layers

Removing a popularity counter from the screen is insufficient if the backend still ranks by it or exposes a global graph. The implementation boundary includes queries, identifiers and exported metadata. SQLite/FTS5 are local persistence/search candidates; encryption and recipient descriptors protect reaction delivery. Neither choice alone enforces the social goal (§06, master research table).

Client-integrity signals can be evaluated for narrow abuse controls; they cannot be the privacy foundation. The threat model and limitations follow RFC6973, ActivityPubSpec, RFC9309, PlayIntegrity and OWASPMASVSResilience. Concrete component variations are owned by §10; the hypothesis tests are owned by §02b.

#Open Threads

1. Temporal design scope. Temporal design is a register lever, not yet a fourth remedy axis. Decide where ephemeral-vs-permanent scope belongs: channel default, post-level override, or both.
2. Trusted-connection health checks. Define opt-in, aggregate checks for trust, safety, support, context confidence, and attention pressure without engagement instrumentation or person-ranking. (Connects to §12.)