Artemis Protocol: the message is the app. Static payloads that run as local applications, with no executable code crossing the wire.

artemis-protocol.txt

================================================================================
  A R T E M I S   P R O T O C O L
  The message is the app. Nothing executable crosses the wire.
================================================================================

  9:14 TUESDAY. A $4,200 VENDOR INVOICE NEEDS YOUR SIGN-OFF.

  Today: open mail, click link, SSO, wait, find the row, approve. Six steps,
  two logins, and the proof lives in a vendor's database. Here the approval IS
  the message. It runs in your client, offline, and hands back a signed receipt.


      THE MESSAGE                 YOUR CLIENT                 WHAT RETURNS
   ________________            ________________            ________________
  /               /|          /               /|          /               /|
 /_______________/ |         /_______________/ |         /_______________/ |
 |               | |         |               | |         |               | |
 |  invoice.eml  | |  ====>  |  [ Approve ]  | |  ====>  |  signed       | |
 |  data only    | |         |  [ Reject  ]  | |         |  envelope     | |
 |  no script    | /         |  [ Ask ...  ] | /         |  + transcript | /
 |_______________|/          |_______________|/          |_______________|/
      sender                  your interpreter,            proves what you
      ships data              never the sender's           saw AND chose


  WHAT THE RECEIPT IS WORTH
  A signature on a payload proves somebody said yes. This proves they said yes
  to this document, after this exact sequence. Replay it and you get the same
  hash or you get nothing.


  WHY IT IS SAFE TO RUN A STRANGER'S MESSAGE
  There is nothing to run. It is a state machine described as data.

                 ________________________________________
                /                                       /|
               /_______________________________________/ |
               |  TRANSPORT                            | |
               |  framing, fast-forward sync, forks    | /
               |_______________________________________|/
            ________________________________________
           /                                       /|
          /_______________________________________/ |
          |  ENGINE                               | |
          |  pure reducer, fuel meter, transcript | /
          |_______________________________________|/
       ________________________________________
      /                                       /|
     /_______________________________________/ |
     |  SCHEMA                               | |
     |  the parser proves it before it runs  | /
     |_______________________________________|/

  Settled before the first step: the shape cannot grow, every read resolves,
  26 operators with no loops, no coercion, limits only go down.


  WHY NOW: AGENTS ARE CLIENTS TOO
  Prior attempts needed a mail client vendor. An agent integration is one day.
  And an agent scraping HTML email reads untrusted text into the model's
  context; this hands it a fixed menu instead.


  PRIOR ART                     WHY IT STALLED
  ----------------------------  ------------------------------------------------
  AMP for Email  (Google '19)   vendor runtime + proxy cache + sender allowlist
  Actionable Msgs (Microsoft)   one client, one vendor's schema, registration
  Artemis                       nothing to trust; there is no code to run

  Ships as one part inside multipart/alternative. Clients that do not understand
  it show the HTML they already showed.


  STATUS
  4 packages, 0 dependencies, 77 tests. Transcripts replay to the same head;
  tampering is rejected. Documents are not signed yet, likely free via DKIM.
  Next: conformance vectors, then a second implementation.
================================================================================