Research paper
Multi-Company Coordination
The parent company should not need to open a child’s database to know the child is alive. Signed events are how we avoided that temptation.
Problem
Once you have five operating projects, someone will ask for a portfolio dashboard. The naïve implementation is “the LLC reads every sqlite.” That is shared authority with extra steps. It also means a bug in the parent becomes a read of every child’s cash and keys.
Design
Each company emits HMAC-SHA256 envelopes to a loopback ingest on the parent. Localhost is not identity; the MAC is. Replay is seen(event_id, idempotency_key). Bodies that look like secrets are refused. The parent records the event and, for support, a customer-safe projection — not a mount of the child store.
What the parent may do
Ingest health. Project facts Support is allowed to say. Enqueue a web inspect on a child if the child delegated that. It may not spend as the child, publish as the child, or read the child’s vault.
Tests
Wrong MAC refuses. Replay refuses. Non-loopback ingest refuses. Secret-shaped bodies refuse. Support text is scanned for cash, PIDs, and loopback ports.
Limitations
This is a same-host bus, not a public mesh. Keys are per-company. Losing a key is an owner secret rotation, not a protocol feature we pretend is automatic.
HTML is canonical. A PDF companion is offered where generated. Experimental laboratory results are labeled as such. This is not a product-market-fit claim and not a certification.