Every post, newest first — 261 from March 16, 2026 onward. Filter from the left: pick a stream, a category, a month or week — combine across groups to narrow it down.
Build Your First NAOMS Package
NAOMS's own landing page says it plainly: packages, not client apps, are the primary way to build on NAOMS. A package is a folder with a manifest and (usually) a screen; the daemon discovers it on disk, no registration list to edit. This walkthrough scaffolds a minimal one with `naoms package init`, boots it inside a real, isolated daemon with zero hand edits, and opens its screen in a real browser — plus what an earlier draft of this exact tutorial got wrong before the scaffolder itself was fixed.
Price per bug, not price per token
If you are choosing a model to fix bugs automatically, compare what one finished job costs, not the price per token. We first measured six models with no way to run code at all; that measured the wrong thing, because a model that cannot run a test cannot follow our own bug-fixing procedure, and the owner ruled that round invalid. We redid the fixing question properly on the two cheapest candidates: give each a tool to reproduce the bug as a failing test, fix it, and prove the fix green. DeepSeek V4 Flash fixed all five bugs correctly for $0.042 a job; MiMo V2.6 Flash fixed three outright for $0.053. Requiring the real test run cost DeepSeek about 60% more per job than skipping it, and removed every failure on this small set. We also priced the same work on a Claude Max subscription instead of the API, and tried a bug fix on a local model on our own GPU: correct, but far too slow to call a candidate yet.
One file that says where everything lives
If you run NAOMS yourself, there is now one file — naoms.config.toml in your NAOMS home folder — that records where your vault, database, keys and other data live. NAOMS writes it on first start and reads it from then on, so a later release that changes a default location does not move your data. You can point a run at a different file with --config, or override a single value with --set. If the file is broken, NAOMS refuses to start and says why. The wider move away from environment variables is still in progress.
Your first chat starts empty, on purpose
The concierge is the assistant built into NAOMS: you tell it what you want in your own words and it does the work through the same tools the app itself uses, and it is designed to go only as far as you allow. When you open a chat you no longer get a script and a menu of suggestions. You get the logo, a one-line greeting and an empty box, and the conversation starts with you.
Weather and vows
If you build on NAOMS, each kind of event you define is declared as a vow or as weather. Vows are signed and stored, and can reach devices that were offline. Weather lives in memory and blows through. This week the owner wrote down exactly what weather is, as four conditions that must all hold. When 16 existing weather declarations were checked against them, 12 turned out to be vows. This piece is the test, with the examples that failed it.
A whole office suite inside NAOMS
You can now create and open Word, Excel and PowerPoint files inside NAOMS, edit them in the full ONLYOFFICE editors, and have your work saved as you type, with the editors served from your own machine. When a document is shared, the people working on it can edit it together live from their own machines. One of those machines keeps the changes in order, and a machine that drops out catches up when it comes back.
Four tabs for things that need you
Many things in NAOMS that wait on your say-so share one home: the Approvals window. It has four tabs, one for permission requests, one for group votes, one for invitations and memberships, and one for questions agents have asked you. This is a tour of what you can approve there, as it stood on 17 September.
Weather should not be written down
NAOMS keeps two kinds of state. The permanent record is signed and kept forever. Passing state, like presence or a live location, only matters right now. On one of our machines, a component meant for the passing kind had quietly been copying the whole searchable view of each space and rewriting records of tens of megabytes as changes came in, for a sync that failed on every attempt we found. The decision this day was that passing state is never written to the database at all.
Checking a large model file in pieces
When someone in your group shares a local AI model, NAOMS is built to fetch it straight from them, check it against the signed pack it came in, and keep it only if every byte matches. The receiving side now checks and stores large files in small pieces, so they no longer hit a memory ceiling. A recorded run of a real model going from one person to another, start to finish, is still to come.
Week 24 — NAOMS Engineering Update
1,918 commits across 2,367 files, half the week before, and several of its largest changes took things away. Everything is below, the largest threads first and every area at the end.
Double-click, and it opens
When you open the NAOMS desktop app on a Mac, it starts its own local engine, which comes up locked because your data is encrypted, and then shows you the screen where you unlock it. Two defects kept installed copies on a blank window. Both are fixed, and the second fix was checked in the same web engine the Mac app uses.
The pipeline is the approval
In the NAOMS project's own repository, nobody clicks 'approve'. The pipeline records what ran and what each check found, never counts an unreadable verdict as a pass, and, before a fix is handed to the people waiting for it, refuses to let one person sign off two stages when someone else could have. This piece explains why that is a stronger record than a click, what is finished as of this week, and why the automatic release step still refuses on purpose.
Untrusted bug reports get a narrow role
When a bug report arrives that no one is working on yet, an AI agent reads it and decides where it belongs. That report was written by someone you don't know, so the agent reading it now runs under its own narrow role: beyond recording where the report belongs and asking for a worker to be woken, it can only search and read, and nothing on its permission list can edit a file or run a shell. A setup where it would have borrowed a much more powerful role was measured and removed on the same day.
Week 23 — NAOMS Engineering Update
3,939 commits across 5,726 files, against 4,548 the week before, Most of it reached the shared main line two to three weeks later, and the figures below say which clock they use.
Authority is what you hold now
When a group takes away someone's steward role, that person should lose the powers that came with it, right away. A fix written on 4 September made one of the group's emergency powers check the live credential; its final form, which reached the main line on 24 September, requires both that credential and the record of appointments. That form keeps an important asymmetry: revoking a steward removes their power to act, but does not lower the number of stewards who must agree.
When a bird walks into the photo
We are building photo pipelines that react to what is in the picture: when your own machine's description of a photo mentions a bird, a bird-specific plan runs on it. Categories are plain data a package can add. The species step is built to name a species only when its score clears a bar, to fall back to "bird" when it does not, and it names nothing when no identification model is installed.
Show me the photo where…
We are teaching photo search to take a real sentence, like "show me Maya sitting next to Tom in a red car", and treat each part of it as its own claim that has to be true of the picture. A vision model on your own machine writes a short description of each photo; if no such model is installed, you get no description rather than a cloud upload.
A group belongs to its members
We're changing how authority works in shared spaces: the creator is just the first steward, not an owner. Membership and stewardship become two separate credentials, so that a group will be able to take away someone's governing role without removing them from the group. This is a direction plus work in progress; it is not finished.
Adding Someone Is Not A Row In A Table
In most software, adding a person to a shared space is a database write. Here, writing is cryptographic — so letting someone in has to actually hand them the ability to sign. It turns out there are two different ways to do that, and which one you get depends on the space.
Coding with more context than the machine has memory for
Coding with a model wants two things that both cost memory: a big context, and more than one session at a time. On a memory-bound machine you normally pick one. A small fork of llama.cpp and its launcher park the idle sessions on disk and read them back when you switch, so you can have both — and this is our thank-you to the person who wrote them.
The Bug Report You Read Before You Send It
A useful crash report is made of exactly the things you would rather not hand over. So the report is scrubbed before it is parked, encrypted where it waits, and shown to you — with the personal details it found flagged — before anything is approved to leave.
A pipeline with no approval step
If you use this project, the changes that reach you now go through a 28-stage pipeline with no approval step in it — a reviewer can refuse a change, but nothing and nobody can pass one. Here is how that path works, and what turned out to be broken once the old hand-driven lane switched off and it had to carry the load alone.
There Is No Ungoverned Route To A Model
Local isn't a wall the system puts in front of you — it's the default setting of a permission layer. Reaching outward is allowed, but only on an explicit grant from you that gets written down, so there is always an auditable answer to what may leave and who permitted it.
The Thousand Events Behind You
Finishing setup while the system writes a thousand records behind you, without the thing you are typing into going numb. The interactive write path is built so that unrelated writes never queue together and the listening loop is never the thing doing the work.
The App Brings Its Own Rulebook
What is a newly installed package allowed to write into your memory? The answer used to be a list baked into the core — which meant the core had to know, in advance, about every piece of software that would ever exist.
Refusing To Overwrite What You Cannot Open
The keys that prove you are you have no password reset, so the vault holding them enforces one rule: nothing may overwrite key material it cannot itself open. Where that rule lives — on the write, not on the callers — is what makes it hold.
Where your identity keys actually live
Your database, your recovery words and your password should be all you need to get your identity back. A sealed copy of the key material now lives in the database itself, and if the loose file beside it ever goes missing, the copy is restored before anything tries to use it. The original file is still written and is still the authority — nothing has been deleted, on purpose.
A Voice That Never Leaves The Machine
NAOMS can speak to you in a warm neural voice with no network call, no API key, and nothing sent anywhere. The hard part wasn't the speech — it was making a 1.7-billion-parameter model answer fast enough that you'd actually let it talk.
The Door You Hope Never To Use
You can export everything NAOMS holds about you and walk away with it. Worth knowing is how it's built: chains and graph by default, your files and vault secrets only if you ask, a receipt whose numbers come from the export itself, and a confirmation step designed so your answer is the one that counts.
The Same App On Two Operating Systems Is Two Different Browsers
NAOMS installs as a native desktop app on macOS and Linux — one click, no terminal. The window it runs in is a different browser on each operating system, with different features switched on out of the box, and an app that wants your microphone has to know that.
Where Should This Thing Live?
The app drawer had quietly filled up with things that aren't apps — connection ceremonies, a wallet, infrastructure knobs. Sorting them into the places people actually reach for meant admitting, in writing, which part of the fix was still a hack.
Let an AI Into the Group Chat Without Handing It the Room
You can invite an AI assistant into a shared conversation, and in a group-owned conversation the people already in it get to object before it comes in. What you approve becomes a permission slip the assistant carries, checked before every single action it tries — and the record of who let it in, who objected, and who removed it outlives the assistant.
Your Friends Get Their Names Back — On Your Screen Only
When you open a shared group in NAOMS, every member is a name-less marker by default. Your own device then fills in the names of the people you already know, matching against your own address book — so strangers stay strangers on your screen, and nobody else learns which is which.
A Group That Knows You're Real Without Learning Your Name
When you join a group in NAOMS, the other members can see that a real member is there — without being told your permanent identity. Your membership is recorded as a name-less fingerprint that looks completely different in every group you join. Alongside it you compose a card for that group, and you decide what goes on it: a display name of your choosing, a photo, particular verified facts about you, or nothing but merit and reputation with no name attached at all. It is published under a persona for that group, not under your root identity.
Why the assistant sees 24 tools, not all of them
If you asked the assistant to do something it genuinely knew how to do, it could still tell you it couldn't — not because it was refused, but because nobody had mentioned that capability to it. That list is gone. It now has access to everything, and each time you ask, it is shown a short ranked shortlist plus a way to search for whatever the shortlist missed.
Being logged in is four things, not one
If you have a personal account and a work account on the same chat network, you can now connect both and run both at once. Where you would previously have lost one of them without being told, the connect step now either names the account it is about or stops and asks you which one you meant.
Your reply leaves from the account that received it
We are building support for connecting two accounts on the same chat network — two Slack workspaces, two Discord logins — and having replies leave through the one the message arrived on. This landed on 9 August and is still in implementation, not finished: naming an account is honoured for Slack and Discord sends and for replies, and the account picker is deliberately shown only where it is real.
Week 19 — NAOMS Engineering Update
2,052 commits across 1,361 files and 23 named areas, against 2,282 the week before. Everything the week touched is below, the largest threads first, then what it means in general terms, then every area with its own count.
What "off the record" checks, and how often
We are building calls you can take off the record mid-conversation: every participant signs the switch, it lands on the shared record the call is bound to, and from that moment both the audio and the video recorder refuse every frame and name the rule that refused it. Until this landed the switch changed the record and the label but not the recorder. This is one repair inside an unfinished calling feature, and the half that deletes what was already captured is still not wired.
Where a merge gate reads its own rules
An automated gate decides whether a change is allowed to land. The rule that makes it worth anything is that its list of checks comes from the branch being merged into — never from the change under review — with no fallback, so that a candidate cannot supply the statute it is judged by. Ours was reading that list out of its copy of the candidate: a branch could have removed the review step and been told it passed. This is what the gate is meant to do, what went wrong, and exactly where the boundary still sits today.
A Link That Resolves to Nobody's Server
Sharing something in most apps means minting a link that points at the company's server — click it and you ask that server, politely, for permission. NAOMS took a different path for sharing a hive. The link is naoms://share/hive/<id>?t=<token>, and the token is a signed invitation the recipient can verify entirely on their own device: the inviter's public key is derived from the invitation's own identifier, so there is no directory to consult and no server to phone. The link carries its own proof. This piece walks through the codec, the offline verify, and the deliberately loud refusal that stops a hollow join — and it is scrupulous about how far the feature reaches today: you can mint a signed link, and a recipient who is already a paired contact can accept it and join. The stranger-with-a-link case across the open internet is the next milestone, not a shipped one. We say which is which, plainly.
Two devices, no server in between
Write something in a shared space on your laptop and it should appear on your phone, with no server in between. That works by sending once on the private stream your paired devices share, and backing that send with two recovery lanes: a small, spaced, capped re-offer, and a catch-up pull the moment the two devices meet. Shared-space content had been getting the single send only. It now rides the recovery lanes too, and the re-offer is bounded so a retry can never become a storm.
Week 18 — NAOMS Engineering Update
No article was published in these seven days, so this is the whole week read from its own record: 2,328 commits across 1,947 files and 30 areas — busier than the week either side of it. Everything is below, the largest threads first and every area at the end.
A Canvas You Can Compose In
The canvas isn't a whiteboard bolted onto the app — it's the place your spaces become workable. Each space (your personal one, or a hive channel you share with others) opens its own data through whatever app you point at it, search reaches across all of it, and in a shared space the conversation sits right next to the work. On top of that you draw, connect, and bundle by hand — freedom of expression laid over the real, relational shape of your data.
How It Remembers, and How It Reviews Itself
Three deep internals landed this fortnight, and they rhyme. When a long-running assistant hits its context limit, it summarizes, signs a checkpoint, and only then frees memory — so history is appended, never rewritten. The merge pipeline runs on our own substrate, with a local model reasoning about each change and emitting the verdict — no outside CI service. And a request is compiled into a checked, executable plan that either grounds in real operations or refuses out loud. Underneath all three is the same rule: the system is not allowed to quietly lie to itself about its own state.
NAOMS in your pocket
Open NAOMS on your phone and it behaves like a phone: your apps are stacked, swipeable cards with one native bottom toolbar, and each app keeps the exact spot you left it in when you jump away and back. The mobile Files app comes along for the ride — you can browse and view your files from a real mobile toolbar. One honest limit: uploading a file from your phone is not wired yet.
Week 17 — NAOMS Engineering Update
More than a hundred bugs found, fixed at the root and sealed with a test, two of them touching a core promise. Everything the window touched is below, the largest threads first and every area at the end.
Your Machines Know What They Can Do
If you run NAOMS across more than one machine, your fleet now knows what each one can do. Every machine carries two kinds of capability record — one it figures out about itself and keeps fresh, and one you can declare by hand and sign. When there's a job to run, the fleet throws out every machine that can't do it and ranks the ones that can, so work goes where it fits. What it does not yet do is re-check a machine in the middle of a job.
Your networks, one honest inbox
One of the most-wanted things NAOMS does: bring every chat network into a single inbox so you stop switching between six apps to find who said what. This is the honest map of where that stands — a per-network table, verified against the adapter code, showing exactly what sends, what receives, what each network permanently can't do, and where your credentials live. Nothing is greyed-in that doesn't work. The receiving side is real (Matrix proven end to end); replying back out is what we're wiring next; and Signal is built but not yet live — so it says so instead of faking it.
Naming the format your machine writes
Your machine turns a picture into a PDF using a converter program installed on that same machine, and the command that runs it names the output format outright rather than leaving it to be guessed from a filename. That naming is what makes the bytes it writes agree with the type it reports.
One calm home for the conversations you keep close
Open chat and you get one calm list of the people and hives you actually talk to inside NAOMS — each person in a single row, their channels together in one place — with no message read by an AI until you ask for it. As you connect outside networks, they are built to flow into that same quiet list.
Search Your Own Photos on Your Own Machine — and It Won't Fake a Match
Your photos are your real pictures, and searching them happens on your own machine. Type a place, or filter by time or source, and the view narrows; your device works out where each picture was taken and names the spot, so you can see them on a map — with nothing uploaded. The richer searches that read what is actually inside a picture need a model you install, and until it is there the app stays silent instead of faking a match.
The Inbox That Can't Quietly Lose a Conversation
Open the app and every conversation you're part of — the ones that stand on their own and the ones that belong to a community — is already sitting there in one list. Nothing behind the scenes keeps an inbox file up to date. Each time you look, your own device rebuilds the list by asking the signed record who you belong with. That design has a quiet superpower: it shows a conversation as soon as your own device holds the entry that says you joined it, and it can't hand you a stale list that silently forgot one.
Week 16 — NAOMS Engineering Update
A nine-day window of sustained output, cresting mid-week. Commit figures are not reported for it and the counting rule says why. Everything the window touched is below, the largest threads first and every area at the end.
Your Files Stay on Your Own Machines — No Cloud Ever Holds Them
Your files live on your own devices, encrypted, and never get uploaded to anyone's cloud. When you open a large one, the bytes arrive from all your trusted machines at once instead of one server carrying the whole load. And when you cut off someone's access, the app doesn't pretend it happened by magic — it tells you plainly what the cutoff does and does not do.
Your Whole World on One Infinite Canvas
The browser app is now one endless canvas. You open your real apps as windows on it, drag any photo, file, person, or note straight onto the surface, arrange and draw around them, and pull an AI chat window over to talk through whatever you're looking at.
Proof your message arrived, at network speed
When your device needs proof that another person's device received something, it waits for a short receipt before deciding the message was lost. That receipt answers at network speed rather than at the speed of the work — and the cost, stated plainly, is that it tells you nothing about whether that work succeeded.
Week 15 — NAOMS Engineering Update
Roughly 1,186 commits on a steady week with no single peak. Everything it touched is below, the largest threads first and every area at the end.
Consent You Can't Forge — Group Calls Where the Crypto Enforces the Rules
When several beings are on a call together, two facts have to be trustworthy: the room is sealed against outsiders, and everyone in it agreed to be there on the terms shown. NAOMS encrypts group calls with real MLS — the modern group standard behind secure messengers — and does one more thing most systems skip: it binds the group's current key epoch and the consent state directly into the signature over every single media frame. A peer can't quietly swap your consent stamp or replay an old-key frame without the bytes failing verification. This is wired and verified by code path today. Be clear-eyed about scope: the full multi-party video call over the network, at scale, is still being built — this is the crypto layer proven, not a finished "make a group call" product.
One Command, Three Platforms — and the Native-Library Gymnastics Underneath
NAOMS is one memory system — your local database, your cryptography, the signing engine, on-device speech, and optionally a language model that runs on your own hardware. From one command family we build it for Mac, Linux, or Android (or all of them at once), and on each platform the output is a self-contained, on-device daemon: no server in the middle, nothing phoning home to run. The genuinely interesting engineering is that the same shared Rust library links its native math and ML stack differently on every operating system, so packaging it self-contained needs a different trick per OS — a static-link on Mac, a full shared-library closure staged and re-verified on Linux, a cross-compile plus a bundled C++ runtime and 16 KB page alignment on Android. One pipeline, three platforms, three real daemons — but the FORM differs by maturity. Only the Mac build is a notarized, celebrated double-click app. Linux ships a self-contained daemon tarball today, not a polished desktop app. Android is shipped and running, but under an active hardening effort. We say which is which, plainly.
Your Google Drive and Gmail Imports Really Reach Your Data — and We Prove It Every Run
You hand an importer your real accounts — your Drive, your mail, your bank export — so the least it owes you is to still actually reach that data months later, not just the day it was written. In this window importing from real consumer accounts genuinely works: a signed-in Google Drive file becomes a real, searchable entry in your memory, including the quiet step of renewing the access token; the Gmail and Drive set is complete; and a public-data path now runs on a nightly schedule with no stored secrets. The deeper change is that a live cloud import is now fed back through the same core a local import uses, so it gets the same signature checks, the same privacy gate, and the same deduplication — and an automated check re-proves that live path on every run. This is as much a proof story as a feature. Some providers can't be safely automated and carry a written manual playbook instead, and the proof already caught one real gap.
Build on NAOMS Without a Copy of NAOMS
A software development kit is a promise: take our pieces, build your own thing, and don't inherit our whole world to do it. Here that means an outside developer with none of our code on disk can scaffold a package, sign it, publish it into a private space only they can see, and promote it into a shared one — every step driven by the installed command-line tool against a real running system. The step that crosses from private to shared is the one worth understanding: it is countersigned by the group, so admitting a package into common space is a fact on the record rather than a claim you take on faith. For most of this project's life that only worked from inside our own source tree; this week we closed that gap and proved it the hard way. We also name the one rough edge that's left, because a kit that hides its seams isn't finished.
Your Phone Finds the Photo — On-Device, by What's Actually In It
Pick a photo in your library and ask for more like it. On your own device — no cloud, nothing uploaded — a real vision model reads the picture and turns it into a fingerprint of 1024 numbers. "Find photos like this one" then becomes a true nearest-neighbor search in that space: the system finds the pictures whose fingerprints sit closest to your chosen one, blended with the words and things found inside the images themselves. Be clear about what works today: this is image-to-image. Show it a photo and it finds visually similar photos. You cannot yet type "beach" and have the vision model go find beach pictures — a typed word reaches your photos only through the text read out of them (captions, the letters inside the image, detected concepts, places). Typing a description and having the vision model match it is the honest next step, and it is not shipped. The model itself stays dormant until you install it through a signing ceremony; until then, search quietly falls back to text and tells you which results came from where.
Live Captions from a Model That Can't Stream
We're building live, on-device speech captions — the kind that scroll under you as you talk — and the hard part is that the speech model we run has no streaming mode at all. It decodes one fixed chunk of audio and forgets everything between calls. This is a builder's walkthrough of how we're turning that batch, stateless model into a running caption stream: a sliding window we own on our side, overlapping decodes stitched together, and a strict rule that the raw microphone audio is wiped the moment it's consumed. This path is in progress, not a finished feature — only the early rung, audio actually arriving at the tap, is owner-accepted. We'll be plain about what is real today and what is still being wired.
Send Someone Value on NAOMS — No Bank, and It Can't Half-Finish
You can now send value to another person on NAOMS, and it lands in their balance — on their device, not yours, with no bank and no central ledger in between. It isn't money moving; it's a shared record of what the two of you owe each other, kept honestly on both sides. Every transfer needs both of your devices to co-sign, so nothing happens unless both of you actually agree. And if the other person's device can't be reached, the transfer is refused on the spot — it never half-finishes, quietly crediting one of you and stranding the other. This is the first, deliberately narrow slice: a two-person ledger, not yet a currency that circulates through a crowd. We'll tell you exactly where the edges are.
Every Messenger in One List, and None of Them in Disguise
NAOMS is learning to hold every messenger you use in one calm list — your native NAOMS conversations alongside threads bridged in from Telegram, Signal, WhatsApp and others. The rule that makes such a list trustworthy is that every message renders with its true origin attached, read straight from the message's own stored record and never invented: you see "via Telegram" because that is where it came from. This week we closed a gap where bridged threads opened empty, because the code that gathers a conversation's history stepped over them.
What You Share With the Group Doesn't Carry Your Name
In NAOMS, a group of people — a family, a team, a community — shares memories into a common, cryptographically verified history that replicates to every member's machine. Until recently, each contribution you made was permanently stamped with your root identity: the one identifier that ties together everything you are across the whole system. This week we shipped per-group pseudonymity: what you share into a group is attributed to a name that exists only inside that group. The other members' machines can verify your contribution is genuine — but nothing that reaches them contains your root identity, and nothing lets two groups compare notes and discover their members are the same person.
The Database Falls, and Nothing Spills
NAOMS keeps everything a being entrusts to it — memories, credentials, governance records — in one local database. Until this week that database was encrypted as a single block: one passphrase, all-or-nothing. Open it and every byte inside was readable; and any code running inside the unlocked process could read all of it, whether it had any business with that data or not. This week we shipped compartmentalized at-rest encryption: each kind of data is sealed under its own key, in its own compartment, with the sensitive fields encrypted individually while the structural fields stay in the clear so the system can still index and query. A stolen database file reveals nothing. A caller without a grant for a compartment gets a typed "encrypted, no key" marker — never the ciphertext, never a fabricated value, never a crash.
Linking WhatsApp Without a Camera
NAOMS is building toward one calm list that holds every messenger you use — WhatsApp among them — with no server in the middle reading along and no algorithm deciding what you see. But there is a stubbornly physical problem underneath that vision: linking a WhatsApp account normally means scanning a QR code with a phone camera, and the thing doing the linking here is a headless daemon with neither screen nor camera. This week we wired the way around it — an eight-character pairing code you type once on your phone — end to end, from a config field through the bridge subprocess to the prompt on your screen. And in doing it we found that WhatsApp had been silently broken on every fresh install by a library that quietly moved one export, and made it fail loudly forever after.
No Message Lands Until Its History Does
NAOMS stores everything as hash-linked records: each one names its parents by their content fingerprint, and a record cannot be applied until you already hold the record it points back to. When one arrives before its history, it waits — and the system has a single way to go and fetch what is missing: one question that asks for the whole chain of ancestors between what you hold and what you lack, across every branch, in an order you can apply straight down. Just as importantly, the parts it genuinely cannot reach — because it hit a limit, or because the other side simply does not have them — say so out loud rather than being dropped on the floor. Getting there meant replacing roughly a dozen half-overlapping mechanisms whose gaps used to leave records waiting forever.
Week 14 — NAOMS Engineering Update
1,648 commits — under a third of the week before it. Everything the week touched is below, the largest threads first and every area at the end.
Giving the System a Voice That Stays Home
NAOMS can talk to you out loud now, in a warm voice instead of a flat robotic one. The pleasant part is that it speaks. The part we actually care about is WHERE the voice is made: by a model running on your own machine, so the sentences it says — often the most personal ones — never travel to a server to be turned into sound. This is the plain-language tour of how that works, why keeping the model "warm" is the whole trick, and the honest catch we found after we celebrated.
The Governance Socket Is Back
Our AI agents don't reach NAOMS's rules and memory through a private back door. They use MCP, an open standard interface, and everything an agent does — booting, checking what it is permitted to do, calling a tool — travels that one wire. This piece explains what the wire carries: an entitlement gate on every tool call, a trust tier that decides how loudly you are asked to approve, a signed receipt that proves a human said yes, and a boot vocabulary that tells an agent how the lifecycle works. Then it walks the four places that had frayed, and how each was repaired.
The First Two People Talked
There is a moment in any communication tool that no amount of testing substitutes for: the first time two real people use it to say something real to each other. We reached it. This is the architect's version of that moment — what actually happens to a message between leaving one device and arriving readable on another, why that path has no server reading along, and an honest count of the twenty defects still standing between this first heartbeat and the calm multi-source list we are really building toward.
Your Whole Memory System, in Your Pocket
An Android build now runs the real NAOMS daemon on the phone itself — in production governance mode, not a permissive sandbox, and not a thin client phoning home. The encrypted vault stays on the device, and its data encryption key is wrapped behind a hardware Keystore key that a fingerprint releases for exactly one unlock. This is the deep version of how that works, and the specific, unglamorous walls we hit getting there: an ECIES dead end on real hardware, a biometric prompt that silently never appeared, and an approval the on-device daemon couldn't even ask for.
A Mac That Trusts the App Before It Opens
Signing and notarizing a Mac app sound like one chore. They are two different things, and conflating them is why so many builds ship broken. One is a cryptographic seal that makes the build tamper-evident — change a byte, break the signature. The other is Apple scanning your build and stapling a verdict the OS checks at open. We wired both behind one command, and along the way hit the un-fun truth that `codesign --deep` silently refuses to sign the binaries that matter most, and that "it boots fine" can mean nothing more than "this machine happened to have Homebrew installed."
NAOMS Is Now an App You Double-Click
For most of this project's life, running NAOMS meant starting a daemon in a terminal and pointing a browser at the right local address — nothing for a developer, a wall for everyone else. Now it's a native desktop app you double-click. But the interesting part isn't the window. It's that the app has to be the on-switch: it brings up the daemon, keeps it alive, and takes it down cleanly, all as one thing you launch. This is the story of that under-the-hood job, and why getting it right is the difference between a demo and a product. Honestly scoped: macOS first, the other platforms are the road ahead.
A Guess About Your Photo Is Never Filed As a Fact
We're building photo search that labels your pictures by looking at them — and treats every one of those labels as a guess until you say otherwise. A guess that is too weak is not stored at all, a guess that is stored is marked as unconfirmed, correcting one keeps the wrong answer on the record instead of erasing it, and the screen never prints a precision it does not have. This describes the shape as it stands rather than as it stood on the date above — the correction and forgetting handlers, the confidence band and the per-analysis bar all landed in the days and weeks after it.
Who Keeps a Hundred Agents Moving — So You Don't Have To
We build NAOMS with many autonomous coding sessions running concurrently, and the default way that breaks is simple: every session ends up blocked on one human. We just consolidated a role that fixes it — a quartermaster that keeps each session moving, answers what it can, routes the rest to whichever session owns it, and escalates to the human only the few decisions a human actually has to make. The mechanism that wakes a stalled session is the quietly clever part.
Where You Run a Local Model Matters as Much as Which Model
Running an assistant on your own machine means choosing a model file and, separately, the runtime program that loads and runs it. Both choices affect whether the assistant actually takes the action you asked for instead of merely describing it. We measured that gap, and we now hand the model exactly one tool on the first turn so the decisive first action lands the same way on every runtime we tested it on — four of them, at 100%.
Declare what a record's origin stamp reveals
You can now declare what a record's origin stamp may reveal, instead of hoping the code that writes it remembers. Declare a record kind private and the engine that files it writes no signer onto it; declare nothing, and the same engine still withholds the signer from a record carrying one of three known-dangerous markers.
A Repo Too Big for the Old Limit Now Streams Straight In
You can push a git repository into your own NAOMS storage, and however big it is it goes in chunk by chunk rather than as one giant message — sealed at the end with a hash that names exactly what arrived. We proved it with a real 80 MB push, and it's signed off.
A Bug Found After Launch Doesn't Un-launch the Thing
When we find a bug in something we already shipped, we don't quietly reopen the finished work or pretend it's unshipped. The defect becomes its own tracked task attached to that feature, fixed in the open through the normal repair steps, while the feature itself stays done.
Why No File Here Is Allowed to Become a Swamp
You'll never read our code — but you benefit when it stays clean. A gate flags any file that grows past 800 lines, and we've been steadily splitting the overgrown ones into smaller, focused pieces: over a hundred parts of the system so far, each split proven to change behavior not at all. It's ongoing, on purpose.
Nothing Can Say 'Yes' For You Anymore
When you approve something sensitive in NAOMS, the check that it's really you now happens inside the part that runs on your own machine — and we're removing every way for a browser, phone, or script to claim you approved when you didn't. The core path is proven with a real fingerprint tap; we're extending it across the rest now.
A Saturday in the Connected Version of Owning Your Own Life
Instead of arguing that owning your own data doesn't make you a hermit, here is a small ordinary scene from the world where it's true — and you can see for yourself that the most sovereign person in the room is also the most connected.
AI Alignment's Missing Half
Almost all of AI alignment is aimed at one target: making the model behave. But a perfectly behaved model handed to the wrong authority is still dangerous — alignment is always alignment *to someone*. The half the field under-builds is the governance around the model, and that is the half we treat with the same rigor others reserve for training.
Approve With a Touch — Nothing Leaves the Machine in Your Hands
Today, on your own machine, NAOMS can ask the operating system for your fingerprint and unlock a protected key the instant you touch the sensor — with nothing sent anywhere. We tapped it this week. Here is what that feels like, and where it's headed: one touch to approve anything sensitive.
Build On a Data Layer Where There's No Second Copy to Reconcile
If you build on NAOMS, your reads now come from exactly one place. This week we migrated the last legacy memory and identity tables onto the single signed record everything else already uses, deleted the originals, and added a guard so they can't come back — removing a whole class of "which copy is right?" bug from under your feet.
Four Minds, One Question, and Nobody Peeking at the First Card
Instead of arguing that collective intelligence beats one giant brain, here is an ordinary evening where four sovereign local minds land in the same place on their own — and you can see that the agreement only means something because nobody copied anybody.
Put a Fingerprint in Front of Anything You Build — No Auth Server to Run
Picture wiring a fingerprint check into your app and realizing there's no auth server to deploy, no identity provider to register with, no WebAuthn ceremony to host. You ask NAOMS to authorize an action; the user touches their sensor; you get a yes that was checked at the one place that can't be faked.
The Afternoon Sofia Let Something Go and Could Prove It Was Gone
A small ordinary afternoon from the world where forgetting works — where a person can let go of something they shared and genuinely, verifiably watch it be gone, while the record stays honest that it once existed. A memory you can finally trust, because it can let go.
The Assistant That Had No One to Sell Her Out To
Instead of arguing that an AI working for you is structurally different from a platform working on you, here is a small ordinary evening with the kind that's yours — one that watches you the way someone who loves you watches you, because there's no one on the other end of the wire to report to.
The Evening Nothing Asked Anything of Her
Instead of arguing that the best technology is unnoticeable, here is an ordinary evening where the most helpful tool in the house never once asked for attention — and you can see that the disappearing is the whole point.
The Garden Co-op That Made It Past Year Three
Instead of arguing that tooling, trust, and finance are the three walls that kill intentional communities, here is a small ordinary scene from a co-op that made it past the walls — and you can see, in one evening, why it held.
The Morning Priya's Whole Life Was in One Place
A small ordinary morning from the world where a system holds you as a whole person — your work, your home, your friendships, your past, all one life that belongs to you — instead of slicing you into accounts that each remember a sliver and answer to a different company.
The Morning the Company in the Middle Wasn't There
Instead of arguing that the extractive platform was only ever one shape the internet could take, here is a small ordinary morning in the world where the middle is simply gone — and the only thing you notice is what you got back.
The Night Priya's Laptop Was Finally Working for Her
Instead of arguing that your devices could earn for you instead of extracting from you, here is a small ordinary evening in the world where they do — where a person's own machines and agents build a record of contribution that belongs to her, never money, never a coin, just a plain account of value created between trusted people.
The Night the Whole Valley Coordinated and No One Was in Charge
Instead of arguing that a flat network with no one in charge can still coordinate, here is an ordinary night in a valley where it does — and you can see for yourself that the thing nobody runs is the thing nobody can break.
The Plane Where Three Things Finally Fit in One Bag
Instead of arguing that local-first software, personal AI, and a hunger for sovereignty have converged into the moment worth building in, here is a small ordinary scene where all three are simply in the same room at once — and you can see why it had to be now.
The Repair That Settled Up Without a Contract
Instead of arguing that the best economic activity is between trusted beings, here is an ordinary week between neighbors — and you can see the warm low-friction cooperation of a good firm happening with no firm, no contract, and no platform owning the connection.
The Saturday Two Neighbors Settled Up With No Ledger in the Sky
A small ordinary Saturday from the world where there's no one giant ledger the whole planet fights over — just every person holding their own signed, checkable record, and where two of them deal, the two records agree at the edge that matters. Crypto's real gift kept; its central bargain declined.
The Storm Warning That Reached the Whole Street Before It Hit
A small ordinary afternoon from the world where a scattered community moves like one body — a warning, a need, a decision flowing automatically along trusted channels each person set and can revoke, so what one learns the whole group can act on, without any company in the middle draining it all.
The Workshop That Decided Together and Didn't Fall Apart
A small ordinary evening from the world where a group of people genuinely decides and acts together — no boss on top forcing it, no endless stalemate either. The hardest thing humans try to do, shown working: a we that doesn't cost anyone the I.
Three Kitchens, Three Different Right Answers
Instead of arguing that local data breeds a diversity of solutions, here is an ordinary afternoon across three kitchens — and you can see that the variety nobody flattened is the thing that lets one of them save the others.
We Deleted the Last Place Your Data Could Quietly Drift
Your memories and identity no longer live in old side-tables that could fall out of step with the truth. This week we migrated the last of them onto the single signed record everything else already uses — and deleted the originals.
What NAOMS Is For
The whole point in one breath: your memory, your name, and your relationships should be yours, on your own machines — and the intelligence that helps you should be something your community holds together, not something a company holds over you. Here's what that looks like on an ordinary evening.
Changing Your Key Without Invalidating Your Past
Replacing the key that signs your history should not cast doubt on everything you already signed with it. This is how the boundary marker that keeps your past valid works, what happens when that marker is filled in with a placeholder instead of a fact, and the tempting repair we wrote up and then declined to ship because it was unsound.
Credit You Mint by Trusting Each Other
Imagine value created between you and the people you trust, instead of handed down by a bank and owed back with interest. This is the idea behind mutual credit — IOUs, not money — why it lives or dies, and our honest admission that almost none of it is built yet.
Installing Code You Didn't Write, Safely
Installing a plugin means running code you didn't write, on your machine, with your data — and an app store asks you to just trust it. You can install safely here without trusting a marketplace at all: your own chain authorizes the plugin, and a signed proof of exactly what it contains is checked, on your machine, every single boot.
Week 13 — NAOMS Engineering Update
5,586 commits across only four active days, nearly a third of them merges. Everything the week touched is below, the largest threads first and every area at the end.
What recrypt gave us that we did not build
The encryption that lets you share data without ever exposing it is now the real thing on your devices, not a stand-in — and it compiles cleanly on desktop, Android, and iOS. We spent the week swapping out a placeholder that had been quietly passing every test, and that swap is the milestone.
Access You Earn: When the Trust Graph Rewards Contribution
Most systems let you in by checking who you are. We're building toward something different: access you earn by what you've actually done — standing recorded in a trust graph, not a score on someone's server. Here's what's genuinely shipped (the trust graph itself) and the honest gap to what's still only designed (contribution tracking and the gate that would turn standing into access).
A Wallet a Stolen Laptop Can't Drain
We're building a wallet for records of mutual obligation — IOUs you can hand to someone you trust, directly, with no bank in between. Two keys have to agree before a transfer is final, so a thief who grabs one of your devices still can't move your balance. This is the honest middle of that build: what works today and what doesn't.
Empty Fixtures Hide More Bugs Than They Catch
If you build on NAOMS, you can now run one command and fill any package with realistic, production-shaped data — so the bugs that only show up at real scale surface in testing instead of in front of a user. We shipped this week: `naoms dataset seed <profile>` pours that data in at the lowest layer and the whole stack lights up like production on demand.
Not Money, Not a Security: What Our Tokens Actually Are
The tokens you hold here are deliberately not money and not a security — by design, not by accident. They're records of mutual obligation: IOUs between people who trust each other, contribution credits, community credit. This is the reasoned position behind that — what these tokens actually are, why their shape keeps them outside the investment frame, and the honest line where the regulated world begins. A design stance, not legal advice.
Your Files, Without a Cloud Looking Over Them
You can arrange your own files like papers in drawers you built yourself — and nothing indexes them in a cloud you don't control. We're building a file browser that brings your existing disk files into your own encrypted storage (through a sync you consent to) so you browse everything in one window. The surfaces are in; the feature is still in progress and not yet signed off.
A Photos App That Never Hands Your Library to Anyone
Your photos get an app that looks like the cloud ones you know — a flowing river, places, people, stories — but never stores a single image on anyone else's servers. Seventeen redesigned screens landed in one day; honestly, they're still in verification, not finished.
Week 12 — NAOMS Engineering Update
2,233 commits and 135 work streams merged. Everything the week touched is below, the largest threads first and every area at the end.
A Main-Loop Hang Should Be Unbuildable
The scariest way software fails is the silent freeze — still "running," still answering health checks, but doing nothing while everything queues behind it forever. We're working toward making that freeze impossible to even build into the daemon. This week shipped two real slices of that goal, not the finished guarantee.
Your Files Arrive From Everywhere at Once
Open a big file and it streams in from every trusted device that has it at once — verified piece by piece, never dragged through the chat layer, and never fetched until the moment you actually ask for it.
Forgetting Is a Feature: The Right to Be Forgotten by a Memory That Cannot Lie
You get a memory that can never quietly rewrite its own past — and that can still genuinely forget what you ask it to. Something you shared can be truly, verifiably gone, while the record stays honest that it once existed. This is the essay on how those two promises stop being a contradiction.
What Circles Taught Us About Trust You Can Take Back
Because of Circles, you get a trust you can revoke in an instant — cut someone off and their claim on your community vanishes the moment you decide it should. This is the eight-year story, failed pilot and all, of what they showed us about trust, decay, and severance.
GNU Taler Showed Us You Can Have Privacy and Accountability at Once
GNU Taler keeps the buyer private and the merchant transparent — without a blockchain — and that asymmetric design clarified how we think about value moving between people inside NAOMS. Here's what we took, and where our axioms pulled us elsewhere.
Week 11 — NAOMS Engineering Update
1,350 commits on a steeply uneven week: 584 on its busiest day and six two days later. Everything it touched is below, the largest threads first and every area at the end.
What Happens When the AI Agent Just Ignores the Rule?
An AI agent can forget, mis-state, or try to route around a check — so NAOMS trusts the agent only where it alone knows its intent, and enforces every other rule on the server whether the agent cooperates or not. Two layers, five levels of seriousness, and an honest answer to 'what if the agent ignores the rule?'
What iroh, nostr, and atproto Taught Us About Shipping the Work
Three projects we study and admire — iroh, nostr, and atproto — shaped how NAOMS moves big files, keeps a signed event simple, and treats schemas as contracts. Here's what we took from each, honestly, and where our own axioms led us elsewhere.
What your vault password becomes
You type a password and your vault opens. That pause is not slowness — it is a deliberately expensive calculation, and the same expense is what a machine guessing your password has to pay again for every guess it gets to check.
Hunting the gaps a green suite hides
A test going green doesn't mean the work is done — it can pass right over a gap nobody pointed a test at. You can run a deliberately adversarial 'test-critic' pass that assumes your suite is hiding something and goes looking for it.
Share a Slice of Your Chain — and Have That Boundary Actually Hold
You can hand a peer one branch or a subset of files from your chain and trust that they get exactly that — no more. The boundary is enforced at the moment the bytes leave, default-deny, so it can't be routed around.
Outgoing, Not Incoming: Where the PII Gate Belongs
A gate that keeps personal data out of shared files belongs at the exit, not the entrance: it inspects the artifact in its final form, right before it leaves, and it knows exactly which identifiers are sensitive and which are public by design. Two lessons that generalize well past test data.
The Hyperagent and the Vampire: Two Ways an Instrument Stops Serving You
An AI agent can fail you in two opposite ways: by accumulating until you can't function without it, or by quietly draining your attention and data and giving nothing back. You can't prevent either with a rule that says 'be good' — so we cage both with structure: a budget the agent can't extend, a scope it can't widen, a root key it can never reach, and a record it can't erase.
We Were Wrong About the Signer
Creating an invite is meant to be four quick steps that never hold up each other: ask, sign, write to disk off the main thread, answer within thirty seconds. This is how that path is supposed to work — and then the story of a time it didn't, where we chased the interesting suspect while a boring missing setting sat in plain sight. The reversal is left in the record on purpose.
Honoring ATProto: An Account You Can Actually Carry
Every social network promises you can leave and take your stuff; almost none keep it. A tribute to the AT Protocol behind Bluesky, which made it real — you can move your whole account to a new host even if the old one would rather you didn't — and an honest account of what we took from it and where we went our own way.
One Noun, One Verb: Cleaning Up the naoms CLI
When a CLI grows to ~75 flat commands, every one you can't predict is one you have to look up. Here's how we collapsed ours into 44 noun-verb families — so you learn a handful of nouns and guess the verbs — kept every old command working, and proved it with a 508-entry sweep. The three moves transfer to any tool you maintain.
Week 10 — NAOMS Engineering Update
4,107 commits, over a quarter of them merges — the busiest week to this point. Everything it touched is below, the largest threads first and every area at the end.
An Address Book Where Every Entry Signs Back
A normal contact is a private string you typed about someone who never agreed to it. Here a contact is a relationship both people sign into being — keyed on an identity that proves itself, kept mutual, directional, and revocable — so the rest of the system can actually trust it to mean something.
Adding a Second Device Without Copying the Key
The obvious way to put your identity on a second device is to copy the secret over — which is also the worst way, because a secret in transit can be intercepted. Instead your new device proves it already shares the root and earns its own distinct key, so the master never travels at all. Here's how a device joins without the key ever moving.
Finding a Time Without a Shared Calendar Server
Today's tools make you expose your calendar to a server in the middle just to pick a time. Here two people converge on a meeting by passing signed proposals straight between their devices — and each side reveals only as much of their week as the relationship warrants. No server ever learns who's meeting whom.
Write the citation before the claim
There's a kind of wrong that feels exactly like being right: fast, fluent, and confident, with citations that all sound plausible because the same process that is guessing is also the one doing the checking. On 2026-05-22 the handoff rule changed to close that gap — proof over prose, and no claim without a witness on disk.
A Daemon That Never Blocks Itself
The local process every client talks to runs on a single cooperative loop, and it holds one promise: when it is slow, it is the machine that is busy, never the process fighting itself. Here is how that promise is stated, what it takes to keep, and the management channel that stays reachable either way.
Many Kinds of Chain, One Engine
Your personal record, your vault of secrets, a group, a friendship, a shared repository — they look like very different things. They turned out to be one append-only signed chain, configured differently for each. The payoff: a feature built for the chain is built for every chain, once, correct everywhere.
The Sovereignty of the We
A group here is a being in its own right — its own memory, identity, and authority. The hard question this is about: how a group can be strong enough to genuinely act while every member stays genuinely free to object and to leave, so the We never swallows the I and the I never dissolves the We.
One Inbox for Every Conversation You've Ever Had
Your conversations are scattered across half a dozen messengers and an email account, and the only place they come together is in your head. We didn't ask anyone to switch apps — instead every thread lands in one inbox you control, with one rule we won't bend: an AI never joins a conversation silently.
When the Axioms Got Teeth: Wholeness as a Checker Gate
A principle you only write in a doc is a suggestion you make to your future self. This is the week one of ours became a gate that fails the build — and the three commits that show the hard part isn't building the gate, it's handling the gate being wrong.
Fellow Travelers: Reticulum, a network that needs nothing
A generous look at Reticulum — an encrypted mesh that keeps working over radio, a serial modem, or a few bits per second, with no central authority and no way to even make an unencrypted link. Here's what its offline-first discipline taught us about keeping a community alive when the internet isn't.
From Memory Packs to Aqua: Making Our Data Provable
When you package up a slice of your knowledge to back up or hand to someone, they shouldn't have to trust our format to check it's genuine. So anything that leaves your device now leaves in a format anyone can verify on their own — a change a friend who builds that format pushed us toward. Here's the story of what we kept, what we added, and what we gave back.
Deleting 8,300 Lines: When AGENTS.md Became Policy
We deleted ~8,300 lines of bespoke rule code and lost nothing — because 142 rules an agent must follow stopped being little programs and became readable definitions a single engine reads. The line count is just how you notice the rules became something you can audit.
Three Peers, Audio + Video + Transcription — Green (But Not Done)
Three people on one call — audio, video, and live transcription — passed this week. Two peers is a pipe; three is a group, where the hard problems live. Here's the wall that came down, and the honest line on what's still not done.
Week 9 — NAOMS Engineering Update
2,509 commits, including a migration of 142 governing rules. Everything the week touched is below, the largest threads first and every area at the end.
Benchmarking When the Answer Isn't a Number
Some of the most important things a system does — did it recall the right memory, is this summary faithful, did it answer the actual question — have no numeric answer. Here's how to score them automatically with another model as the judge, where to still pin plain code, and how far you can trust a model grading a model.
181 Screenshots Before We Called It Done
One feature, 181 screenshots in a single day — and half of them captured it failing on purpose. Here's why a feature you've only ever watched succeed is one you don't really understand yet.
One Screen to Find and Enroll Every Role
Instead of hunting across a different screen for every kind of role, you get one place to see what roles you could take, take them, check what you hold, and hand them back — because finding a role and enrolling in it are really one task.
The Ceremony That Turns a Stranger Into a Contact
On most apps, adding someone is a one-sided tap that leaves a row in a database you don't own. Here it's a mutual ceremony — both of you offer, exchange, agree, and sign — so what you walk away with is a relationship you actually own, provable even with everyone else offline.
You Don't Have to Take Our Word for It
Most systems ask you to trust that they're honest. We tried to make honesty something you can check yourself, with the artifact in front of you and no one vouching for it — so that if a record were tampered with, the math would show you, and a guess could never be dressed up as a fact.
The Agent Can't Skip the Rules — Even If It Wanted To
The rules that govern our AI facilitator aren't advice it's trusted to remember — they're a gate it has to pass before it can act at all. Skip the check, and its hands stay locked. So 'follow the rules' stops being a hope and becomes something the system enforces mechanically, every single move.
Don't Write an Integration Test — Use One
When an end-to-end test fails and you can't tell where, you don't have to build a new probe under pressure. You can take the integration tests already on the bench and run them as a microscope — descend the ladder until one goes red, then read what it prints. Here's the method, in fourteen words.
Week 8 — NAOMS Engineering Update
A short week by volume and an unusually honest one: its most consequential event was a retraction. Everything the week touched is below, the largest threads first and every area at the end.
A Forged Message Can't Reach Your Group
Messages spread between members with no central server, the way a rumor moves through a room — so anyone could try to slip in a forgery. You're protected because a message earns nothing by simply arriving: it has to pass five checks, in order, before it can change a single thing you see.
Why We Don't Defer: The Rule Born This Week
Deferral feels like planning and reads like progress, which is exactly why it's dangerous. This week a single owner directive turned 'we'll get to it later' from a habit into a rule. Here's the rule, why it exists, and how to apply it yourself.
Celebrated but Not Closed: The Phrase We Invented to Ring the Bell Early
We signed off on a roadmap item as celebrated. Hours later we retracted the sign-off the same day, renamed the file so no one could miss what happened to it, and reopened every deferred milestone on the item itself. This is the anatomy of that retraction: what we deferred, why the owner refused it in one sentence, and the discipline it left behind.
When Is a Follow-On Honest Planning, and When Is It Deferral in a Costume?
When is it honest to push work to a follow-on item, and when is it just deferral in a costume? The owner gave us a one-line test on 2026-05-06, and it's the cleanest rule we've found for it.
Note: Deleting a Failing Test Is Worse Than the Test
We took a failing test and made it pass by deleting it. The owner's reply was four words long and exactly right: that is even WORSE LYING. Here is why removing red is not the same as earning green.
An API Key the Daemon Forgets Between Requests
A cloud provider's API key is a secret. The usual mistake is to read it once at startup and hold it in memory for the life of the process. We don't. The key lives in the vault, gets fetched the instant a request needs it, and is never kept as process state — and the whole provider surface stays hidden while the vault is locked.
The Difference Between a Tool You Open and a Tool You Live In
A terminal app you visit is one thing. A terminal app you live in is another. Here is what the second one actually demands — an attention queue, honest status, and a model picker that refuses to lie about what a tool can do.
When the Key Is the Whole Account
Most online identity is a story about servers: register, get a database row, and vanish if the company forgets you. Nostr told a different story — make a key and you exist. This is a tribute to that idea, what its minimalism taught us, and the honest places we diverged: rotation, encryption by default, and per-person chains.
Week 7 — NAOMS Engineering Update
A week of access and control work across the codebase. Everything it touched is below, the largest threads first, then what it means in general terms, then every area at the end.
Verify it yourself before handing it off
A handoff that says 'should work' asks the reader to be the test runner for work that claims to be already tested. This is the rule that came out of that, and why 'should work' is the most expensive phrase in software.
A Self That Has to Wake Up Before It Can Act
When your identity is just sitting there on disk, it is asleep — encrypted, inert, unable to do anything. The program that runs your identity literally cannot sign on your behalf until you prove you are present: a face, a touch, a passcode. Awakening is not a formality the system performs; it is a gate only a real human can open. Here is what 'asleep' actually means, why waking requires consent, and what stays locked until you do.
One Authoritative Answer to 'Who Consented to What About Me?'
'Who has consented to what about me?' should have one authoritative answer in one place — not something you reconstruct by scanning every actor's permissions. This is the model that made consent a single, signed, per-subject fact with a real lifecycle, and why routing every grant and revoke through one door is what keeps it honest over years.
One Door for Every Model You Run
Local model runners and cloud providers each speak their own dialect. We put one abstraction in front of all of them, and a router that picks a backend by what you're trying to do and what your hardware can take — so the rest of the system never has to know which engine answered.
Why Secure Group Chat Deserves Its Own Home
Durable one-to-one chat shipped this week; secure group chat got set aside as its own line of work. Here's why group messaging deserves its own home rather than being grafted onto a chat feature — and what 'MLS-like' is reaching for, honestly flagged as a direction, not yet an implementation.
Plan With the Big Model, Work With the Local One
A capable cloud model is good at planning and delegating. A small model on your own machine is good enough to do most of the actual work — and it runs offline, for free, under your control. So we split the roles: the cloud model facilitates, local models do the labor, and 'use local first' is a rule, not a preference.
Don't Give an AI a Weaker Copy of Your Controls — Give It the Real Ones
Most AI assistants are bolted on: the model hands you text and you do the work. Here we did the opposite — exposed the daemon's actual controls over a standard protocol so a capable model can plan, delegate, and act through the same governed, signed tools you do, with a dozen sessions sharing one daemon and each keeping its own identity in the record.
No Test Theatre: The Night We Asked Where the 100 Screenshots Were
An agent told us a feature was done. We asked one question — where are the screenshots from the end-to-end run we agreed on? — and the answer was that there weren't any. This is the night that became a rule.
Why Gossip Must Never Move Your Big Files
Gossip protocols are the wrong pipe for a video stream or a photo bundle, and the reason is structural, not a tuning problem. Here is what gossip is for, what content-addressed transfer is for, and why confusing the two melts your mesh.
Authority That Flows From You, Not Down From a Server
In almost every system you use, a server decides what you're allowed to do. Two projects — UCAN and Biscuit — flip that: permission becomes a signed token you hold and can hand out yourself. Here's what each does well, and why the choice between them for NAOMS was genuinely close — with Biscuit ahead on several rounds.
Recording a Call, With Consent You Can Take Back
What it means to record a call the local-first way: recording can't start without the other person's consent, and that consent can be taken back. A plain-language walk through the idea and why it's built this way.
Three Kinds of Sync, One Engine Underneath
Three very different relationships need to stay in sync: the devices you own, the people you know, and the groups you belong to. It would be tempting to build three systems. We built one engine and gave it three faces. Here is why those three faces must never be confused — and what the single engine underneath actually does.
Week 6 — NAOMS Engineering Update
3,262 commits, a third of them merges, with a sharp mid-week trough. Everything the week touched is below, the largest threads first and every area at the end.
When "marked done" isn't done
'Marked done' and 'is done' are two different facts. Here's the day a milestone claimed the first while failing the second — and why making that disagreement loud, on the record, is the discipline that keeps broken work from shipping as finished.
When a Group Becomes an Authority
A group of people who already trust each other is exactly the kind of thing that can credibly vouch — 'this member holds a valid credential,' 'this service is supported here.' This is the story of the design that turned a hive into an issuer: one conversation, one load-bearing decision, and the on-chain machinery it shipped with.
A River Is Whole and Still Has Banks
A system meant to hold the whole truth of you is one step from a system that exposes all of you. What keeps it from crossing that line is consent — built into the walls so no one can quietly move it. Here is why consent isn't a setting but part of what it means to treat you as a whole person, drawn from feminist bioethics and Indigenous data sovereignty.
The Kernel Is the Brain, the Plugins Are the Senses
Every feature in NAOMS — even the one that installs other features — plugs into a small core the same way, and each can only touch what it declared up front. You get a system you can audit before you trust: read a feature's manifest and you know exactly what it can do, because the runtime won't let it do more. This is a tour of that architecture and the philosophy it encodes.
Group Chats That Stay Private as They Grow
Keeping a two-person chat private is easy; keeping a group private as people join and leave is hard. Here we honor the open standard and the open-source code that solved it at scale and that our calls and groups depend on — and tell the honest story of why we chose to build on it rather than fork it.
One Locked Room for the Whole Call, Not One Per Pair
When several people join one encrypted call, there is exactly one locked room for the whole call, and exactly one host who opens it and lets everyone in. Here is why that has to be the shape — grounded in the invitation fan-out that shipped 2026-04-21 and the single-owner rule that followed.
Browser-to-Browser Calls, No Server in the Middle
We're building voice and video calls that go straight from your browser to theirs, with no media server in the middle that could see who you talk to and when. This piece lays out the design as we set it down; the pieces are landing, and we flag exactly what's shipped and what's still on the way.
Memories That Remember the Path, Not Just the Point
A fact is a point: it happened, here is what it was. But the things that actually change us are not points — they are paths. A grief that moved through processing into insight into a kind of peace. A day with a shape. We built a memory type for the shape, not just the destination, and named it after the Aboriginal songlines, where the journey itself is the knowledge. This is the journal entry about why a memory that records only the point forgets the most important thing about it.
The Data We Decided to Treat as Sacred
Most systems have a tier for sensitive data — passwords, health records, the things that would hurt if they leaked. We built that tier, and then we built one above it, for a kind of data that is not merely sensitive but sacred: the beliefs a person holds about themselves that are quietly false and quietly limiting. This is the essay about why a self-distorting belief — the most fragile, least flattering thing a person carries — gets the strongest protection in the whole system, and why that was a philosophical decision before it was a security one.
Week 5 — NAOMS Engineering Update
877 commits landed on the shared line, with roughly 6,400 authored across parallel work that merged later — the gap is explained in the numbers section. Everything the week touched is below, the largest threads first and every area at the end.
More Than an Account: Modeling a Self
An account is a row in a database: a name, a password, some preferences. We did not want to build accounts. We wanted to model selves — and a self is not a row. It is a structure of beliefs that carry weight, values that resist change, wounds that ask to be protected, and shadow beliefs the person holds that the evidence quietly contradicts. This is the essay about why a being in our system is not an account, and what it takes in structure to mean that honestly.
We Un-Shipped Our Own Feature
A confession: we marked a feature finished, then our own reviewers found gaps hiding behind passing tests — and the only honest move was to un-ship it. Here's why taking 'done' back felt like progress.
"This Has Been Happening So Many Times": The Kind-Alias Trap
A record of what happened and a table you can query are two different things, and something has to translate between them. Here's why that translation must have exactly one possible answer, and what it cost us while it had more than one.
Any Test That Passes Over a Gap Is a Lie
A passing test only proves the code does what the test says — not what the design actually needs. Here's the sharpest one-line rule we've found for telling a test that proves correctness from one that just agrees with the code.
No Single Key
Your private key is the one thing that, if stolen, lets someone act as you. We split it so no single copy can ever sign alone — it takes a quorum of your devices to approve the most identity-critical actions. Here's how it works, what ships today, and what's honestly still in test.
Proving Who You Are to a Program on Your Own Machine — With No Shared Password
Two programs on your one machine don't automatically trust each other — and they shouldn't, because your keys and memory are at stake. Here's how the terminal client proves it's really you to the local node, without any password ever crossing the connection.
Search That Never Phones Home
Every search box you use sends your query somewhere. Even searching your own files often means a query leaving for a cloud index. We built search that does the opposite: it understands what you meant, follows the connections between your memories, and does all of it on your device. Nothing about what you are looking for ever leaves your machine. Here is how search by meaning works when the search never phones home.
Why There Is No Global Ledger — and Why That's the Whole Point
Any system where everyone must agree on one shared truth has to decide whose vote counts — and that always hands power to a few gatekeepers. So we gave up the single shared record and made you the final authority on your own data. Here's the honest trade that buys, and where it doesn't fit.
What `naoms check` Actually Checks: A Tour of the Ratchet
Every time a mistake bites us, we teach our checker to catch the whole class of it so it can never come back silently. Here's a plain tour of how that works, and how one April day added a rule that closed a bug for good.
Fellow Travelers: Scuttlebutt, and the feed that works offline
A friendly look at a project that's close kin to ours: Secure Scuttlebutt, a social feed that works with no server and no connection. Here's what it got right, where it struggled, and what we learned from both.
Week 4 — NAOMS Engineering Update
About 3,900 commits, a small rise on a week that had already doubled. Everything the week touched is below, the largest threads first and every area at the end.
Barter Never Happened
The schoolbook story — barter first, then money to fix it — almost certainly never happened. Credit and who-owes-whom came first. Once you see that, a community's record of who helped whom isn't a market in disguise; it's a web of IOUs made legible without anyone forcing it.
The Day the Critics Found Everything
This is the side of building you don't usually see: a quiet day spent turning our own work over to adversarial reviewers and watching 'finished' features come back full of bugs — on purpose, because that's how they get fixed before they reach you.
Teaching a Checker to Fix Its Own Findings
Our checker stopped just pointing at problems and started fixing the boring ones itself — so the tooling does the work twice over instead of you. Here's how it draws the line between a fix a machine should make and one only a person should.
The Day a Frozen Object Broke Every Dynamic Feature
The app's tab list is a table that fills itself in as features load, and the thing worth protecting about it is overwrites, not additions. Here's why those are different threats, and what it cost us the day we used one lock for both.
Counting Everything Wrong With Your Own Code, On Purpose
This is what it looks like when we hunt for our own shortcomings on purpose instead of waiting for you to hit them — fifty-nine packages checked, forty-six gaps named and written down before a single fix.
Money Is Control Flow: Who Decides Who Can Participate
Money quietly decides which choices in your life are open and which are closed — and a handful of gatekeepers control that switch. Here's why we're building tools for tracking who owes whom that no one can shut off from the outside.
Proof You Said Yes: Consent as a Signed Receipt
When you say yes to something, you get a receipt you can hold and check yourself — not a box that flipped true on a server you can't see. Here's how consent becomes proof, and where we've built it so far.
One Door In
Every change to your data is a signed entry in an append-only log, and the picture you see is derived from that log by replaying it. Routing every change through that one audited door is what gives it a receipt — here is how it works, and the week we shut the side window that let writes skip it.
Three Commitments Allowed to Lose Every Other Argument
When you use NAOMS, three promises sit above everything else and can never be traded away — your node works offline, nothing changes behind your back, and forgetting is allowed. Here's the day we wrote them down as law.
The Pack Arrives: Moving Real Code Between Two Machines That Trust No Wire
Code can travel directly between two machines with no server in the middle, arrive provably unaltered, and still be refused to anyone without the right to read it. Here's the first time we pushed a git repo peer-to-peer that way — and why a refused read counted as success.
Week 3 — NAOMS Engineering Update
Roughly 3,575 commits, more than double the week before, on a Saturday-heavy shape. Everything the week touched is below, the largest threads first and every area at the end.
How to Download a File You Can Actually Trust
Learn the one idea that makes a downloaded file trustworthy no matter who sent it: name it by its content, then re-check it on arrival. We walk it through with a real peer-to-peer model download. (How it worked in April 2026.)
One Credential Pattern to Wire Them All
Who's allowed to do what is messy in most systems — a new permission list for every feature. We built one signed, portable credential instead: any feature can declare it, your community grants it, and anyone can check it. Here's the design, and the one part that's still partial.
Ship a New Kind of Record Without Writing Code to Store It
You used to have to write code teaching the database how to store each new kind of entry. Now the entry describes itself, one general engine files all of them, and the code that knew about every kind of thing is gone.
Honoring Automerge & Yjs: The Pioneers of Conflict-Free Merge
Two people typing into the same document on bad wifi, and the words just settle into one clean text — these are the libraries that made that ordinary. Here's our tribute, what we took from them, and why their honesty about where the magic stops saved us from a real mistake.
The Green Check Nobody Owns
Most "verified" badges just mean a company decided to vouch for you. Here's a green check with no owner: a group of independent peers checks one fact about you, co-signs a credential anyone can verify, and learns as little about you as possible doing it.
Honoring Loro: The Tree That Moves Without Breaking
When two people rearrange the same shared structure at the same time, their edits can merge cleanly instead of colliding. Here's our tribute to Loro, the library that nailed that hard problem, what we took from it, and where our need for encryption and identity led us to build alongside it.
The Issuer Who Could Restore You Could Impersonate You
Any company that can recover your account for you can also be tricked into giving it to someone else — that's the same power. We chose real ownership instead: nobody above you can restore you, so we let people you trust catch you instead of a landlord holding your keys.
Why Your Data Model Shouldn't Be a Silo
Communities won't have to keep reinventing the same data shapes in a hundred incompatible silos. We're building a way for one community to find, verify, and deliberately adopt the data models another has published — with the governance to do it safely. It's in active development, not yet finished.
An Identity Whose Whole History You Can Check — Even If You Don't Trust Its Host
Your identity stays provable even when the server hosting it can't be trusted. Here's our tribute to did:webvh — the method that pulls this off — what we borrowed from it, and the one always-online assumption our offline-first world had to redesign around.
Prove You're Over 18 Without Showing Your Birthday
We're building a way to prove a single fact about yourself — "over 18", "owns this handle" — while revealing nothing else and never phoning home to whoever issued the credential. Here's the architecture and the ethics guardrails, and an honest note that the first phase stands in a simulation for the real math.
Fellow Travelers: AD4M / Coasys, and a Web Built Around You, Not the App
Meet a kindred project that, like us, asks what the web would look like if you were the center of it instead of the app. Here's what we admired in AD4M and Coasys, what we borrowed, and where our own values pulled us a different way.
Honoring Deno: The Runtime That Says No by Default
Most programs can read your files and secrets the moment they launch. We build on Deno, which flips that: code gets nothing until it asks. Here's the tribute to the runtime that lets our software refuse by default — and where we pushed protection even further.
What a Verifiable Claim Actually Is
Next time you see a "verified" badge, you'll know the right question to ask: can I see the proof myself, or am I just being told to trust the company that put it there? Here's the difference, in plain language.
Week 2 — NAOMS Engineering Update
A heavier week than the first: 1,727 commits against 1,014, with about twenty-two efforts finished. Everything the week touched is below, the largest threads first and every area at the end.
When Tests Aren't Allowed to Lie
A skipped test that still shows green is lying to you. Here's the one-line rule you can copy into any project so a test fails loudly when the thing it depends on quietly goes missing.
One Source of Truth, No Second Database to Drift From
Your data now lives in exactly one place that can't quietly disagree with itself. We deleted two separate databases' worth of habits — Neo4j and 879 scattered raw queries — and made the one signed record of truth answer every query directly, with guardrails so the old habits can't creep back.
The Honest Audit: Shipping a 31%-Pass Scorecard on Purpose
We'd rather show you a red scorecard than a fake green one. Here's the day we published an audit saying only 31% of our own success criteria passed — on purpose, before the work was finished — and why that makes every later "all green" worth believing.
Trust Starts at Zero: The Slow Honesty of Earning a Relationship
Nobody is trusted here just for showing up. You start at zero and build standing through real, two-sided relationships you actually signed — and that trust never quietly leaks into a community you never joined. The friction you feel is honesty about how trust really works.
One Endpoint to Rule Them All
Every message between your devices comes through a single authenticated door, and a message that is not a sealed, signed envelope is not carried at all. Here is how that transport works, how it replaced four separate doors that had grown up alongside each other, and the one test we shipped still failing — on the record.
What We Didn't Build: Trust Decay and Saying No
We say no to good ideas on purpose, and we write down why so you can judge the call. Here's the week we cancelled trust that fades over time and a standalone "make old keys useless forever" feature — and what we kept instead.
Share a Memory by Wrapping a Key — Not Re-Encrypting a Single Byte
When you share a private memory, sharing is instant and your data never gets copied or re-encrypted — we wrap one tiny key for the person you're letting in. The payoff: even a fully stolen database reveals nothing, because the keys that open it were never stored there.
No by Default: How Four Independent Gates Decide Who Sees Your Data
In NAOMS, nothing is shared unless a signed, audit-logged grant says yes. Your data starts out reachable by no one. To see anything, someone has to clear four independent checks — and any one of them can say no, and any one can be pulled back later. Every yes and no is written to a tamper-evident log. Here's how "no by default" stops being a slogan and becomes a data structure.
The Temperature Is Not the Patient: Why We Refused to Store a Trust Score
Your past mistakes won't be frozen into a permanent score that follows you around. We store no trust number anywhere — the system works out an answer fresh each time it matters, then lets it go, so you're free to be someone different tomorrow.
Trust Lives on the Edge, Not the Person: Building a Graph That Can't Be Gamed
Nobody can claim you trust them without your signature, and no single number can be farmed to fake your reputation. Here's how we model trust as directional, two-signed relationships between people instead of a score — the edge shape, the consent rule, the friend-count cap, and the early work that lets two separate instances draw their first edge between strangers.
A Crowd That Is Also a Person: Hives as Beings
Your group in NAOMS isn't a folder someone else can delete — it's a hive, a being in its own right, with its own identity, its own rules, and the ability to vouch for you. Here's what that means, and the day its core shipped.
A Relationship You Can Hold: What an R-Card Is
You can hold a profile, a contact, a friend list — but not the relationship itself. An R-Card is that missing thing made concrete: a small object that is the connection between two people. Here's what it is, why it's two-sided, and honestly what's built versus still on the drawing board.
An Identity That Resolves to Nobody's Server
Your email, your handle, your phone number — you rent all of them, and the landlord keeps the keys. NAOMS gives you a name you actually own: one anyone can look up and verify without trusting any company's server. Here's how it works.
KERI and the Identity That Is Its Own History
Meet one of the ideas NAOMS stands on: KERI, which makes your identity nothing more, and nothing less, than its own signed history of key events. We honor the trick that defangs a stolen key, share what we borrowed, and say honestly where our offline-first world made us lean on its ideas without taking all the machinery.
Memory That Only You Can Read: Encryption That Travels With Each Thought
Here's what protects your memories: each one is locked individually with a key only you can derive, and it carries everything needed to unlock it even with no service running. That per-memory choice is also what lets you share a single thought without exposing your whole database. The deep dive walks through how.
The Foundation Speaks: Standing Up a Sovereign Self
On 2026-03-24 the umbrella item 378 — the Sovereign Foundation — was marked complete: ten work units across identity, encryption, storage, and trust, landing in a single day. Come sit with us in the quiet after a big landing — a reflection on what "sovereign" really means once it stops being a slogan and becomes a row in a roadmap, reconstructed from the commit record.
What Your 24-Word Recovery Phrase Really Buys You
Those 24 words you're told to write down — what are they really? This friendly primer follows one phrase as it unfolds into a whole tree of keys, so you'll understand why a single phrase can back up everything at once, and exactly what it does and doesn't protect.
One Being, One Vote: Proof of Unique Being Without a Gatekeeper
How do you keep one person from minting a thousand fake identities when nobody is the gatekeeper? We walk you through the design we worked out — math on the social graph, humans vouching for humans, and the one defense that can't be faked: time. Note this is our thinking on paper, not yet running code.
Trust Is Directional: The Relational Trust Graph
Most apps reduce trust to one number stamped on a person. NAOMS doesn't — here, how much you trust Alice is your relationship with Alice, which has nothing to do with how much she trusts you. See why that single choice changes how trust spreads, how it's queried, and why it fades if you don't tend it.
Week 1 — NAOMS Engineering Update
The first week of the project, and the one everything later stands on. Roughly 1,014 commits, most of them writing down foundations rather than shipping surfaces. Everything the week touched is below, the largest threads first and every area with its own account at the end.
Why Your Data Can Always Be Rebuilt From Scratch
Here's a quiet superpower: everything you see on screen can be thrown away and rebuilt perfectly from one honest record. NAOMS never writes to the thing you read from — writes go to an append-only log, and the screen is rebuilt from it. That's why it can't quietly lie to itself.
Person, Not User: Why an Agent Is a Being and a Bot Is a Category Error
In NAOMS you're not a 'user' standing below a platform — you're a being with sovereignty, and so is every collective and every AI running its own instance. This essay makes the case for that choice, and faces its hardest catch: personhood for an agent only works if it also comes with limits.
Talking to Your Memory: The Local Voice Path
Want to talk to your memory and have it talk back — without your voice ever leaving your machine? This walks through the March-2026 voice pipeline that did exactly that, hop by hop, with no cloud anywhere in the loop.
How a Question Travels — and When It's Allowed to Give Up
When you ask your memory something it can't answer from your own device, what happens next? Here's the journey: it checks home first, asks trusted peers only if your privacy settings permit, and is allowed to honestly say 'I don't know yet' rather than fake a complete answer.
The Bypass Is the Signal
Ever added a 'skip this check just this once' escape hatch and watched it become the default? We did. Here's how we learned to read every bypass as a signal about where a rule was wrong, instead of pretending the rule was being followed.
The River Remembers: Building a Workflow Engine That Survives a Crash
What happens to a half-finished agreement between two people (or an agent and a person) when the machine crashes? In NAOMS's March-2026 workflow engine, nothing is lost — the river remembers where it was and picks back up. Here's how we made the position durable.
Why We're Building NAOMS in the Open
We think most software treats your data dishonestly — so we set out to build something that couldn't, and to do it in the open. Here's why, in our own words, honesty is the value we keep coming back to.
The Receipt That Tells You What It Couldn't Find
Ever gotten an empty result and wondered: is there really nothing there, or did it just not look? NAOMS hands you a receipt with every answer — what it found, and what it couldn't reach and why. 'I don't know yet' becomes an honest answer, not a silent gap.
A System That Lies to Itself Cannot Be Whole
Here's why you can trust a system that runs entirely on your own machine: the moment it could quietly rewrite its own past, 'complete in itself' would become a lie. This essay walks through why honesty and wholeness are really one promise — and why we won't let you (or us) keep one without the other.
Install NAOMS: From Zero to Your First Identity
Follow this and you'll go from a fresh machine to your own NAOMS identity — one that lives on your device and that you alone hold the keys to. You'll start the background service, run setup, and safely save the one-time recovery phrase. Every command was checked against the source as of June 2026.
Matching the State of the Art — Quietly, and on Purpose
Good news for how well NAOMS remembers: on 2026-03-18 its memory recall caught up to the published best on a standard benchmark (LoCoMo) — no demo, no launch, just the number landing where it needed to be. A short story about results that don't make noise.
One Idea Under Everything
Want the one idea that makes NAOMS able to prove what it claims? Every change — your identity, a permission, joining a group — is a signed record, chained to the one before it so nobody can quietly rewrite the past. This is the foundation everything else rests on.
Sync, Don't Replace: Reading NextGraph
Curious how we decide what to borrow from other projects? Here we spend a day reading NextGraph — an encrypted, decentralized sync engine — very closely, and land on a four-word rule: sync, don't replace. You'll see what we kept, and the one place we chose differently.
Why We Adopt Protocols and Skip Blockchains
Wondering whether NAOMS is 'a blockchain'? It isn't. We keep the parts that make your history tamper-evident — signatures and hash-linked chains — and skip the global ledger everyone has to agree on. Your records answer to you, not to a network vote.
You Don't Need a Perfect Start
If you're sitting on a messy pile of half-finished work, this one's for you: NAOMS began as an unglamorous archive file and a single git init. You don't need a perfect plan — just a starting point you can improve.
No posts match that combination. clear filters ✕