Bringing a business onto the network

Three ways in

Proving the business is yours

Verification is domain control, demonstrated one of two ways. Both prove the same thing: that you can change what a name resolves to, which is the only evidence that does not depend on somebody's judgement.

1. DNS TXT record

   Publish the challenge token at _corners.example.com. Best for a domain you control at the registrar.

2. Well-known file

   Serve the token at https://example.com/.well-known/corners-challenge. Best when you control the web server but not DNS.

A business-registry lookup — an ABN, a company number — can be recorded alongside and raises confidence that the entity exists. It is not accepted on its own for anything that grants authority over a network segment or an administrative corner: existing and operating are different claims.

Branches, and the space above them

A company with branches has a problem the geography cannot solve: the Tokyo branch's address is Tokyo, and always should be, but it belongs to a company headquartered somewhere else. One parent cannot express both.

So branches carry a second relationship. Each branch is a corner in the town it actually trades in, and is affiliated to the company's corner. The company gets a space that gathers every branch's chat wherever they are, and each reader filters out the branches they do not want — the filter belongs to the person, not the room, so it follows them between devices.

Whether a branch feeds its chat upward is the branch's own decision, taken on the branch's corner. It starts sealed.

Using the directory you already have

Most organisations of any size already run an identity system, and being asked to maintain a second one is a reason not to bother. So you do not have to.

• Existing LDAP or Active Directory — the platform authenticates against a directory you already run. Nothing is copied here; the directory stays where it is and stays authoritative.
• Existing RADIUS — register your realm and the platform proxies to your server over RadSec, the same hierarchical arrangement eduroam has used across thousands of independently administered institutions for two decades. Authentication for your people happens on your infrastructure, and this network never sees your internal policy or your ACLs — only the routing decision.
• Hosted AAA — if you would rather not run it, the platform can. Your realm resolves against a directory here instead.

Whichever you choose, you confirm at setup that the access policy on your side is yours. The platform routes authentication; it does not decide who your employees are or what they may reach.

Self-hosting

The whole platform ships as a Docker Compose file: Postgres, a Matrix homeserver, the API, the orchestrator, git hosting, and optionally 389 Directory Server, FreeRADIUS, Postfix and Dovecot. It is designed to run on modest hardware — a small ARM box is a realistic target, not a compromise.

A self-hosted instance federates: your corners are reachable from here and ours from there, and people are addressed as handle@your-domain. Your reverse DNS is what tells this network that a person is running their own corner, and their name links there.

What it does not do

Payment processing, invoicing and crypto custody are not part of this. A watch-only wallet — you supply public keys, the platform shows addresses and payment requests — is the intended shape, so that nobody's money is ever held by somebody else's social network.