Eleven layers.
One boundary that holds.
This is the long-term technical direction of EmotiLink OS. It is not a delivery checklist: the first build implements only what the first use case requires. The discipline is that nothing built first should foreclose anything built later.
- Principle
- Start small enough to execute. Build strong enough to extend.
- Constraint
- Raw personal data never crosses the privacy boundary.
- Consequence
- No core rewrite when ZK, consensus and oracle arrive.
Everything about this architecture follows from one line.
On the private side, data. On the public side, proof. Every layer exists to keep that separation true as the network grows.
- 01DeviceRaw signal
- 02Local engineWASM · AI · consent
- 03Emotion stateSigned · encrypted
- Raw data stops here04ZK proofProperty, not data
- 05OracleValidated · consented
- 06ApplicationActs on the proof
Device to consumption, layer by layer.
Select a layer to read what it does and when it arrives.
- DeviceRuns on the person's own hardware
- Privacy boundaryWhere data becomes proof
- Network layersDistributed verification
- ChainProofs and references only
- ConsumptionAuthorized applications
User device / browser
The starting point of the infrastructure
Everything begins where the person already is. No new hardware, no new account to become the product of.
- The device is the first point of the infrastructure, not a collection endpoint.
- Web2 is the entry, acquisition and interaction layer — it is deliberately not the storage layer.
Six environments. None of them allowed to do another's job.
Most privacy failures are not cryptographic failures. They are architectural ones — a layer quietly taking on a responsibility it was never supposed to hold.
- Web2
- Entry, acquisition, interaction and application access. Deliberately not the storage environment for anyone's sensitive data.
- Local engine
- Local processing, consent-based collection and signal preparation, on the person's own device.
- Web3 / decentralized storage
- Protected, encrypted storage of sensitive data where storage is genuinely required.
- ZK / privacy layer
- Proofs that let a property be verified without revealing the data behind it.
- Blockchain
- Proofs, references, hashes, verifiable states, events and on-chain execution. Never raw personal data.
- Oracle
- Makes authorized states and proofs available to authorized applications.
Blockchain records what must be verifiable. It records nothing that is readable about a person.
A set of capabilities, not a monolith that must ship at once.
Each capability versions on its own timeline against a stable interface. Trust Engine v1 becomes v2 without the oracle noticing; Behavioral Intelligence reaches v3 without a migration.
- 01
Local intelligence
On-device inference and preparation
- 02
Consent
Scoped, live, revocable authorization
- 03
Identity
The longitudinal state
- 04
Emotion state
The point-in-time state
- 05
Behavioral intelligence
Patterns across signals and time
- 06
Trust
Scoring, policy, enforcement
- 07
ZK privacy
Verify a property, reveal nothing
- 08
Validation
Integrity before reliance
- 09
Consensus
Agreement among participants
- 10
Oracle
Authorized states for applications
- 11
Security
Protection and response
- 12
Interoperability
Web2 ↔ Web3 ↔ AI
- 13
Governance
Auditing, compliance, ethics
One state change. No rigid dependencies.
When an Emotion State is created it is published, not delivered. Components subscribe to what concerns them, and a new capability can be added later without any existing layer being modified to know about it.
Emotion state created → event bus → fan-out
- Trust engineRe-scores the session
- Behavioral analysisUpdates the pattern
- Risk analysisChecks the threshold
- AnalyticsAggregates, never identifies
- OraclePublishes the proof
- ApplicationsAct, under authorization
If your application can act on a proof, it can integrate.
We are working with a small number of teams whose products would be better if they knew less. The oracle surface opens in Phase 4 — the design conversations start now.
No tracking pixel on this page · Consent before signal · Always