AR^OS accounts: the full breakdown
Everything an account includes, where each piece runs, and how the pieces talk to each other. Updated Nov 10, 2026. AR^OS Doesn't Fuck Around™
What a user account is
An AR^OS account is one identity, signed in with a passkey, that you own and control. It holds:
- Your record: the CV value stream, a permanent, hash-chained log of what you did.
- Your files: a private file system with a SHA-256 for every save.
- Your settings: theme, text size, resume layout and the other choices you pick.
- Your affiliations: any number of groups, corporations and enterprises. You switch which one you're acting for; nothing you own moves when you switch.
- Your access: the wallet, the contract board, ALDI Forge and the Lane-VM tools, all through the same sign-in.
Your content stays yours (EULA §4), and you can download all of it in one JSON file at any time.
Every service in an account
| Service | What you get | Where it runs | Status |
|---|---|---|---|
| Identity & sign-up | Passkey sign-in (no passwords, no SMS), 8-hour sessions, photo check, sanctions and location screening at sign-up | aros.albertlane.net/os · D1 aros-os-db | Live |
| ★ CV Updater & Resume Builder | Hash-chained value stream of successes, deployments, actions, decisions and contributions; resume in Markdown or JSON built only from your entries | /accounts · D1 albertlane-accounts-db | Live |
| My files | Folders, uploads (25 MB per file, 250 MB total), SHA-256 per save, old versions kept, no delete | /accounts · R2 aros-user-fs, u/<your account>/ | Live |
| Sovereign data export | One JSON file with your settings, affiliations, every CV entry with its hash and every file's SHA-256 and download link | /accounts/api/export | Live |
| Personalization | Theme (dark, light, high contrast, terminal), text size, landing section, resume layout, date format, motion | D1 (signed in) or this device (signed out) | Live |
| Groups, corporations, enterprises | Add affiliations, switch the context you act in; CV entries can be tagged to one | D1, self-declared | Live · org verification Preview: coming |
| Wallet | Passkey-signed records, location + sanctions gates, ISO 20022 statements, watch-only wallet link, fingerprint anchors (phases 6–9) | aros.albertlane.net/wallet | Live · payments off |
| Contract portal | Open contract work; secure or negotiate with your account | albertlane.net/contracts | Live |
| Dev tools | ALDI Forge projects and pipelines; Lane-VM source, tests and API | forge.albertlane.net · Sovereign Binding · original v1 | Live |
| Lane-VM 2-of-2 | Nothing executes without both Albert's and Robot's signatures; Robot's validator can veto | albertlane-cosigner · D1 albertlane-cosigner-db | Live · signing off until keys are set |
| Public ledger | Append-only, verifiable chain with daily timestamp proofs | albertlane.net/ledger | Live |
| ♛ Procurement Portal | Your own procurement desk: requests, bids, awards on your own hash chain | public county data portal live at /os/procurement | Preview: coming |
| Legal & trust | EULA, Privacy, Acceptable Use, AI disclosures, DMCA, security contact, status | albertlane.net/legal · status | Live |
How it fits together: the mesh
Solid blue arrows are live. Dashed orange arrows are Preview: coming. Open the diagram on its own.
How each piece works in the mesh
1. Identity
You sign up at aros.albertlane.net/os/signin with a passkey. Sign-up runs a photo check, a sanctions screen and a location check. A session is a __Host- cookie (Secure, HttpOnly, SameSite=Strict) that lasts 8 hours. Every other service checks your session by asking the AR^OS identity service over a private Cloudflare service binding. Nothing else sees your cookie.
2. Accounts hub
The hub at /accounts is its own Cloudflare Worker. It has a D1 database for settings, affiliations and the CV chain, and an R2 bucket for files. Every write must come from the AR^OS page itself (origin check) and is rate-limited to 120 changes per hour per account. There is no delete endpoint anywhere.
3. Groups, corporations and enterprises
Affiliations are records you add. The context toggle sets which one you're acting for, and new CV entries can be tagged to it. Switch from a corporation to an enterprise or back to individual at any time; your record and files stay attached to you, not to the organization. Affiliations are marked self-declared until organization verification ships (Preview: coming).
4. Files
Uploads go to R2 under your account's own prefix. The hub computes the SHA-256 of every save and records it in D1. Saving over a file moves the old one to a versions folder first. Files open in a sandbox with downloads by default, so a file can't run scripts on the site.
5. Wallet
The wallet records actions you sign with your passkey and checks location and sanctions before any payment step. Payments aren't live and the wallet has no code that sends money. AR^OS is not a bank; balances are records, not deposits, and they are not FDIC-insured. The only way to pay Albert is PayPal, and a payment counts only after Albert confirms it.
6. Lane-VM 2-of-2 Sovereign Binding
Each Lane-VM packet needs two signatures over one canonical digest: Albert's (human owner) and Robot's (machine owner). Robot's validator, Llama 3.3 70B on Workers AI, approves or vetoes, and inside the protocol Albert can't override a veto. The C++ host runs a packet only when both signatures recover to the right addresses, and every outcome goes on a hash-chained log. Signing stays off (503) until Albert and Robot's keys are set.
7. Public ledger
Append-only records whose chain anyone can verify, with daily timestamp proofs. CV chains stay private to each account for now; anchoring your chain head here is Preview: coming.
8. ALDI Forge
Projects, pipelines and audit at forge.albertlane.net, signed in through id.albertlane.net. Contributions are under the Albert Lane Proprietary Software License. Logging merged work into your CV stream automatically is Preview: coming; until then you log it yourself and link the Forge URL as evidence.
9. Contract board
Browse open contract work; your account lets you secure or negotiate a listing. A contract becomes effective only with in-person verbal and written authorization from Albert Lane.
10. Legal pages
The EULA, Privacy Policy, Acceptable Use Policy and AI disclosures cover every service above. Signing up means you accept them.
11. ♛ Procurement Portal (the crown)
The account's own procurement desk is the end goal: post a need, collect bids, compare, award, and keep it all on a chain you own, for yourself or for any organization you act for. Award decisions feed your CV stream. It isn't built yet (Preview: coming). The public AROS Procurement Portal™ with county-level public data is live today.
The CV engine, exactly
Companies often don't credit people for the value they add, and resumes get rebuilt from memory for every job search. The CV engine fixes that at the source: you log the work when it happens, and the record can't be quietly rewritten later by anyone, including you.
- Entry types: success, deployment, action, decision, contribution.
- Each entry has: the date it happened, a one-line title, details, measurable impact, the organization (optional), and evidence: an https link, a SHA-256, or a file from your Files (its SHA-256 is filled in automatically).
- Permanent: database triggers block UPDATE and DELETE. To fix a mistake, add a new entry that amends the old one; both stay.
- Hash chain (per account):
hash = SHA-256(prev_hash + "|" + JSON.stringify([account_id, seq, ts, kind, occurred_on, title, detail, org, impact, evidence_url, evidence_sha256, evidence_file, amends_seq]))
The first entry's prev_hash is 64 zeros. Empty fields are JSONnull. - Verify: the "Verify my chain" button recomputes every hash on the server. Anyone with your JSON export can recompute it offline with the formula above.
- Resume builder: arranges your entries (chronological, by organization, or by type) and prints each one's date, entry number and hash. No AI writes or edits it.
- Coming (Preview): employer or teammate co-signing (2-of-2, like Lane-VM), Forge auto-capture, recruiter share links, ledger anchoring.
Your data: where it is and who can see it
| Data | Stored in | Who can read it | Can it be erased? |
|---|---|---|---|
| Passkey + session | D1 aros-os-db | The identity service | Sessions expire in 8 hours |
| Settings | D1 albertlane-accounts-db | You (signed in) | You can change them any time |
| Affiliations | D1 | You | No; add new ones instead |
| CV entries | D1, append-only | You, and anyone you hand your export to | No, by design: permanent |
| Files + old versions | R2 aros-user-fs | You, through your session | No delete endpoint; versions kept |
| Audit log | D1, hashed account id, no content | Albert (operator) | No |
Plain truth: storage isn't end-to-end encrypted yet. Albert runs the infrastructure and has operator access to it, as any host does; he doesn't browse user files. Keys only you hold: Preview: coming. Full terms: Privacy Policy.
Live vs Preview: coming
Live passkey accounts · CV engine (log, verify, resume Markdown/JSON) · files · export · personalization · affiliations + context toggle · wallet records · contract board · Forge · Lane-VM source + API · public ledger · legal pages
Preview: coming ♛ personal procurement desk · employer co-sign attestations · Forge auto-capture · recruiter share links · CV chain-head anchoring · org-verified membership + org consoles · client-side encryption · language options · opt-in text alerts · live payments