📦
Immutable base image
Linux kernel, rootfs, and public assets are content-addressed and deduplicated. A peer can seed them without being trusted as an authority.
- Manifest and block digests
- Demand paging
- Cancellable read-ahead
Private by default · designed for verification
Your Linux state, your keys.
The operating-system base can be public and deduplicated. User writes are different: they are encrypted into authenticated shards before they leave the browser.
Key hierarchy
Passkeys unlock a key hierarchy, not a raw password.
WebAuthn authenticates the user. Where WebAuthn PRF is available, its credential-bound output can unwrap a random volume key. Recovery and multiple passkeys are first-class.
passkey authentication / PRF capability
↓
key-encryption key (KEK)
↓
random volume key
↓
generation + shard encryption keys
↓
authenticated encrypted user shardsRecovery is part of the product: users can enroll a second passkey or encrypted recovery slot. Losing the only credential must not be a surprise discovered after the last browser cache is gone.
Peer delivery
Peers transport bytes. Hashes decide meaning.
The browser requests a digest, verifies the returned bytes, and only then inserts them into the guest cache. The transport can be same-origin HTTP, a local cache, WebRTC, or a torrent-like peer.
🔒
Private overlay generations
User writes become encrypted snapshots. Sharing is explicit: local-only, invited peers, or public seeding are different policies.
- Authenticated ciphertext
- Generation parents
- Replay and rollback hooks
Threat model
What this protects—and what it cannot.
Protected by design
- Peers cannot alter a verified block unnoticed.
- Storage peers cannot read encrypted user shards without a key.
- Old manifests cannot silently reinterpret a newer generation.
- Critics can reject an artifact with replayable evidence.
Still requires care
- A compromised page can see plaintext while the guest is unlocked.
- Encryption does not hide shard sizes, timing, or popularity.
- Published ciphertext may be retained by peers indefinitely.
- A weak benchmark or verifier cannot be repaired by cryptography.
Planned API
Transport-independent storage.
// the guest never learns which source supplied the block await mesh.peers.request({ digest: "sha256:…", priority: "fault", deadline: performance.now() + 500 });