Collab OSCommons

← A Digital Pattern Language

Platform Recurringintelligencespace

Deliberate Release

Nothing leaves by accident. Each thing crosses because someone chose to send it, and everyone can see which side of the line it is on.

Where two parties share a surface or a bridge, holding the tension between openness that builds trust and material that needs protection to stay honest, the design obscures what hasn't been released, reveals the state of every item, and leaves the valve with the side that owns the thing. People can contribute and cocreate freely on the inside, and the place gains honest, dignified and equitable.

Context

Any system where two parties see some of the same things: a studio and its client, two communities on a bridge. It sits inside an unwritten Intimacy Gradient (Alexander 127, read for the screen). This pattern is the door between two rooms of that gradient, and the rule for who holds the key.

Tensions

  • Openness builds trust and multiplies value.
  • Internal texture (drafts, dissent, chaos) needs protection to stay honest, and some things (a person's details) need it to stay safe.
  • Each kind of thing carries a different risk ("an event is not a person"), and comfort is asymmetric between two sides.
  • Hidden: a platform gains when more is shared, so its defaults lean open.

Forces the design applies

  • obscure on reveal ↔ obscuredrafts, dissent and anything not yet released
  • reveal on reveal ↔ obscurethe visibility state of every item, at a glance
  • contract on expand ↔ contractthe default reach of anything new; it widens only by an explicit act
  • decentralize on centralize ↔ decentralizethe valve: each side sets what it sends, nobody sets it for the other

Solution

Nothing crosses by accident. Each kind gets a default chosen on purpose, release beyond it is an explicit act by the side that owns the thing, and the state (inside, waiting, released) shows on the thing itself.

The generative parameter is what is born private, and how fine the dial is. Collab OS releases one way, team to client: documents are born team-only, while assets have been born client-visible since 0101 ("team-only is the exception an author chooses"). TrustFlow releases both ways, per bridge and per kind, on three settings plus onward travel. People Stay Home is the dial at its strictest.

  draft   ── stays home ──┃
  event   ── I approve ───╋─▶ waits for your release
  notice  ── flows ───────╋──────────────▶
       state shown on every item: inside · waiting · out

Acts

  • Strengthens: contribute (people offer what they choose to send), cocreate (drafts and dissent can stay rough inside, because nothing leaks).
  • Weakens: share in its default-on sense: everything, to everyone, by one global switch.
  • Gap this surfaced: there is no act for consent or release, the person's choice about what crosses. TrustFlow names it ("consent, release, protect"), and it may be the act this whole cluster exists to invite.

Qualities it gives the place

HonestDignifiedEquitable

Refuses

  • Privacy zuckering defaults set against the user's interest, requiring expertise to fix
  • Deceptive defaults the default option is the one that benefits the platform, not the user

McLuhan check

  • Enhances: candor inside, and trust across.
  • Retrieves: the studio's back room, the drafts drawer, the letter you choose to post.
  • Obsolesces: the one global share switch.
  • Reverses into: a vault. Too much stays home and the other side sees a blank surface: Hermitage World's sitemap "sat like that from Sept 8 until Sept 19", because "two flags, and only one of them shows on the canvas". Or label theater, where the state shown is not the state enforced.

Required companion: the label is a promise, enforced where the data lives, not only drawn (honest). Collab OS found "Team only" printed against rows a client could read: "The promise is not being kept." A restrictive policy fixed it (0077).

Connections

Completes
none yet
Siblings
Bridges, Not a Hub, Meet Before You Flow, Summary, Not Data
Completed by
People Stay Home
Not yet written
Intimacy Gradient

Seen in

  • Collab OS (July note, then production): "private by default, explicit promotion to client-visible, with the visibility state always legible to the team (Basecamp's lock/eye)." Built as audience and visibility controls on documents, assets and surface items, because "a document whose audience you can't see at a glance is a document you will eventually paste into the wrong place." (The meeting-artifact publish model was "planned and skipped".)
  • TrustFlow (v2 prototype): "Per bridge and per kind, each side sets what it sends: flows freely, I approve each, or stays home." "New bridges default to asking."

Elsewhere

Precedents Alexander 127 Intimacy Gradient · Alexander 36 Degrees of Publicness · Basecamp's per-item client visibility (the source's 'lock/eye') · git: commits stay local until pushed · W3C ODRL permissions and prohibitions

In nature A cell membrane is selectively permeable: the cell sets what crosses, and different molecules cross by different channels.

Recurring. (Collab OS in production, TrustFlow in prototype). Both arrived at per-kind defaults on their own. Not yet grounded.