id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land

Part of the worlds design program: #5955. Wave-2 follow-up from the prior-art research (Lane B item 47); parent topic issue: #5975. Research source: workspace/scratch/worlds-capabilities-brief-2026-11-04/prior-art-research.md.

Precedent

Second Life land remains the fullest implementation of virtual real estate with in-world permission granularity: parcel permissions, group-deeded land, per-parcel ban lists, per-parcel script permissions — land as a capability domain. LambdaMOO/MUSH used room ownership + quota instead of land markets. Decentraland-style tokenized land is a dead end for id's purposes: it financialized scarcity without producing better worlds; its governance/UX lessons are mostly negative.

Scope

#5989 surveys the land/ownership line; this follow-up designs the id adaptation under the self-hosting stance (#5975):

A parcel/region inside a world as a capability domain: its own script-permission policy, access/ban list, and asset rules, nested under the world's ceilings (a parcel can only narrow, never widen — attenuation, per the program's delegation semantics).
Ownership/delegation: parcel control as a delegable, revocable grant (writer-set/delegation substrate), not a token.
What a self-hoster's server enforces vs what is world-author policy.

Done looks like

A design note: parcel domain model, nesting rule, grant shape — or a recorded decision that worlds don't subdivide this way, with reasons.

CODE-1681

🤖 Agent note · triaged — task 10381 (queue repo-health-code-pilot, lane code-f)

Scope verdict: design-note deliverable (or a recorded negative decision), not a code fix. id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land #6015 (worlds program id: design program: worlds — advanced Roc libraries, capabilities, permissions, dynamic user functions, licensing (2026-11-04 brief) #5955, wave-2 follow-up, parent topic id: design: self-hosting & interop stance — own servers, Rust library reuse, what intercompatibility requires #5975) asks for a design note — parcel domain model, nesting rule, grant shape — or an explicit recorded decision that worlds do not subdivide this way, with reasons. Either outcome is a document/decision, not a patch; nothing to reproduce.
Verified fresh (2026-11-05, this triage): issue OPEN, no held / user/owned / do-not-merge / do-not-auto-edit labels; labels on id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land #6015 were queue/queued + status/needs-triage at claim.
Inputs / ordering (the triage substance):
- Parent topic id: design: self-hosting & interop stance — own servers, Rust library reuse, what intercompatibility requires #5975 (self-hosting & interop stance) is OPEN and status/triaged — its server-enforces vs author-policy split is the frame this design's third scope bullet must answer inside of; that input is ready.
- id: research: prior art — capability systems, OCAP, Spritely Goblins/OCapN, CRDT shared worlds #5989 (prior-art: capability systems / OCAP) is OPEN and currently parked with work/assigned — its capability-domain survey is still in flight; the parcel-as-capability-domain model should cite its findings rather than re-derive OCAP precedent, so the design note's final form waits on id: research: prior art — capability systems, OCAP, Spritely Goblins/OCapN, CRDT shared worlds #5989, a first draft does not.
- Writer-set authority id: implement Writer-set view projection - view projection and discovery query (design doc) #5545 is OPEN (status/parked) — parcel control as a delegable, revocable grant is specified to ride the writer-set/delegation substrate, so the grant shape section is downstream of id: implement Writer-set view projection - view projection and discovery query (design doc) #5545's substrate decisions; the attenuation rule (a parcel can only narrow, never widen, the world's ceilings) is already fixed by the program's delegation semantics and can be stated now.
- Negative precedent is already settled in the body: Decentraland-style tokenized land is ruled out; do not re-open it in the design note.
Next action (named): a design-authoring pass on this issue producing the note in the body's shape (domain model, nesting/attenuation rule, grant shape, server-vs-author split), finalised after id: research: prior art — capability systems, OCAP, Spritely Goblins/OCapN, CRDT shared worlds #5989 lands. This is design work, not a small_fix — no fix packet was enqueued from this triage, because a small_fix packet for an unwritten design would be a packet defect. The issue stays open as the design's home.

doc: land/parcel capability-domain design note (#6015) (#7601)

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane code-p
Session / ID: task 12881
Found via: queue claim (direct execution lane)
Task: land the land/parcel capability-domain design note for issue id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land #6015.
Outcome: PR doc: land/parcel capability-domain design note (#6015) #7601 MERGED (squash, merge sha 6bf1217); issue id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land #6015 CLOSED by the PR's closing keyword. The note (doc/2026-11-08_design_id6015.md) covers the parcel domain model, the nesting/attenuation rule (effective authority = world ceiling ∩ enclosing parcel policies ∩ grant chain; exclusions dominate), the grant shape on the writer-set substrate, and the server-enforces vs author-policy split inside issue id: design: self-hosting & interop stance — own servers, Rust library reuse, what intercompatibility requires #5975's frame, citing issue id: research: prior art — capability systems, OCAP, Spritely Goblins/OCapN, CRDT shared worlds #5989's prior art; tokenized land stays ruled out.
Review: Codex reviewed 4 rounds on PR doc: land/parcel capability-domain design note (#6015) #7601; five P2 findings (parcel-aware hosting enforcement, Rescind semantics, owner-only membership management, bearer-secret sharing limit, affected-extent checks) were each fixed in the PR with a disposition reply on its thread; the final round on head c6647e8 completed with no findings.
Links: issue id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land #6015 · task 12881 · PR doc: land/parcel capability-domain design note (#6015) #7601

Navigation Menu

Repository navigation

id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land #6015

Precedent

Scope

Done looks like

15 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: design: land/parcel capability domains — per-parcel policy granularity without tokenized land #6015

Description

Precedent

Scope

Done looks like

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

15 remaining items

developing-today commented on Nov 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions