Four things changed this week
Four threads carried the week, and none of them touches the same code as another. Two had been standing in for themselves for months and became real. The other two are foundations — one for moving large files between your own devices, one for filling the system with data that behaves like the real thing.
Your shared data got real encryption
The re-encryption protecting anything you share is genuine cryptography rather than a stand-in, it is now the default, and it compiles on desktop, Android and iOS.
A wallet started saying plainly what it cannot do
Defining, minting and paying a record of mutual obligation writes real signed entries on one device. Moving it between two devices does not converge, and it says so.
Large files arrive from every device that holds them
Files move on their own plane, addressed by their contents, pulled in parallel from every trusted device holding a copy, and fetched only when you open one.
Any package can be filled with production-shaped data
One command pours a real-world-shaped dataset in at the lowest layer, so every surface above it fills the way it would in daily use instead of sitting empty.
The encryption that built cleanly for months without encrypting
The feature: re-encryption — handing someone access to something already encrypted, without anything in the middle having to decrypt it first.
Before: the surrounding work existed, ran, and passed its tests, but the transformation underneath it was a placeholder that performed no real cryptography at all.
Now: the real library sits under that path, is the default everywhere, and compiles from a clean checkout on desktop, Android and iOS.
The primitive itself is not ours, and the credit belongs where it is due. An outside project built proxy re-encryption on a modern post-quantum lattice scheme: a semi-trusted helper transforms a ciphertext sealed for one person into one only another person can open, and learns nothing in between.
The ordinary way to let a new person read your encrypted data is to decrypt it and encrypt it again for them. For a moment, somebody has to hold the plaintext. That moment is the whole risk, and this primitive removes it.
The helper doing the transformation is trusted only to do the work, never to be discreet, because it cannot read what passes through it. That is a different and much better position than trusting a service to look away.
That is exactly the shape this system needs, because the whole premise is that you should be able to share something without ever having to expose it. What this week's work amounts to is our side of that road — getting somebody else's hard, valuable library to actually run everywhere we needed it.
Why a stand-in survives for months
A component that compiles proves nothing about what it computes. The placeholder had the right shape: the right names, the right arguments, the right bytes in the right slots, and a clean build. Every signal the build emitted was green, because none of those signals asks whether the output is protected.
That is the ordinary way a stand-in survives for months. Nobody decides to keep it. It stops being visible, because the thing that would have made it visible — a test asserting what the cryptography does rather than that it ran — was never written, and the suite was only ever exercising the stub.
The honest description of that long stretch is a finished frame with the load-bearing piece missing. Roughly eighty percent of the work was genuinely there — the key-wrapping scheme, the routing, the call sites, the suite — around a middle that did nothing.
What the placeholder cost to find out
The first honest run did not go green. Pointed at the real library instead of the placeholder, the suite crashed and took the whole process with it: a serialization path inside the real cryptographic context could not survive being saved and reloaded.
That defect breaks key creation at the first step, and it had sailed through every passing run for months, because every passing run was the stub. A placeholder never has to survive a save-and-reload cycle. It was only ever pretending to hold anything worth reloading.
Nobody was misled on purpose. The suite was reporting truthfully on the code it ran, and the code it ran was the stub agreeing with itself.
Fixing the crash was the first of four moves. The serialization path was repaired so the real cryptographic context is carried and restored correctly, and the general flow stopped aborting on ordinary use.
Then the tests were de-theatred. Several had been quietly skipping themselves whenever the real backend was selected — passing by not running, which is the most flattering possible failure. The ones that had no business caring which backend they ran against were made to run against real cryptography.
One of those matters more than the rest. A safety property about what happens when the wrong key is presented had been asserted away by the stub. It now runs against the real library and is shown to fail closed, which is the behaviour anyone reading the name of the test would have assumed all along.
Flipping the default
Last, the selector that chooses between the two backends was flipped. The real, lattice-backed library is what you get by default; the placeholder is an explicit opt-out rather than a silent fallback, and the heavyweight native dependency is baked into the default build so an ordinary build links it.
After that flip, the same word — green — meant real key generation, real encryption, real decryption, and a real re-encryption round trip performed by the actual library. It had never meant that before.
Getting it onto the machines you actually use
Real cryptography that runs in one place protects one person. The closing stretch of the week was about reach: the same lattice-backed library now runs on a desktop, on an Android phone and on an iPhone, produced from a checkout that carries none of the private state any of our own machines happen to hold.
That last clause is the whole claim. Until this week the working configuration depended on things that existed on one machine and had never been written down, so it worked flawlessly for the person who set it up and failed for everyone else at the worst possible moment — on a clean machine, at the first thing they tried.
A result produced on a machine holding undeclared state is a fact about that machine. That is the part that transfers, and it is not really about compilers. It is the same reason a model-quality score, a benchmark number or a green suite has to be reproduced somewhere that never saw the setup before anyone is entitled to quote it.
The relationship with the upstream project runs both ways, which is worth saying. When a sharp edge turned up in how the library handled malformed input — a case that could crash the whole process instead of failing cleanly — the fix was written and offered back to the project rather than kept quietly in a fork.
A placeholder always builds. That is the entire problem with placeholders, and it is why the week's real milestone is the unglamorous one: real cryptography that reaches the phone in your pocket, and not only the laptop it was written on.
The caveat we are not going to bury
The backend has not been through an external audit. Cryptography that has not been reviewed by people outside the project is cryptography that has not been reviewed, however modern the underlying scheme and however carefully the integration was read by the people who wrote it.
We are shipping it as the default anyway, because the honest comparison is not against an audited backend. It is against a placeholder that protected nothing at all. That comparison is easy; it does not make the audit optional.
A wallet that names who bears the loss, and what it still cannot do
The feature: a wallet for records of mutual obligation — an IOU you hand directly to somebody you trust, with no bank in between and no chain the whole world has to agree on.
Before: a sign-off had been recorded for a path the code did not support. The screens were faithful to their design and the operations underneath them were not proven.
Now: on a single device you can define a token, mint it under its agreement, and pay it, writing real signed entries. Between two devices, the payee's balance is not credited, and the wallet says so.
A token here is whatever two people agreed it is. It might be an hour of work. It might be an honest IOU between neighbours over four eggs. It might be hours contributed to a community garden — and each kind carries the agreement that mints it, naming who may create more, how much, and on what terms.
The total you see only ever adds up tokens running the same agreement. Treating two different agreements as one obligation would be a quiet lie about who-owes-whom, and quiet lies of exactly that kind are the thing this design is most determined never to ship.
A completion claim is worth exactly as much as the path that was actually run. A sign-off recorded against a design, a screen, or a test that exercises a stand-in describes something other than the running system, and the gap between them widens silently, because nothing in an ordinary build ever asks.
The premise is older than software and has run whole towns: a shared running tally of who owes whom, settled between two people who already know each other, with both of them the only authority on whether it happened.
What is real, stated exactly
On one device, defining a token, minting it under its agreement, paying it and reading back its history runs end to end and writes real committed records. An integration test drives that whole sequence against a genuine on-disk encrypted database, and it passes: two passed, none failed.
The front end is faithful to its design rather than to a fiction. The send panel takes an amount, a choice of token, and a recipient by name, with a banner along the bottom for the case where a transfer needs a community treasurer's counter-signature.
The most important thing on that screen is a grey box most products would never print. It states the most you can lose if a transfer reverses, and it names the person who bears that loss: the payee, with no third-party guarantor standing behind the credit.
That is the design's spine rather than a piece of copy. There is no insurer here. If a transfer can reverse, the person being paid is told in plain words what they are risking and how much, because an uncomfortable truth beats a reassuring fiction every time somebody actually loses something.
Naming the loss-bearer at the moment of spending is the same instinct as refusing to round a balance or fake a timestamp. Nothing here is allowed to change value quietly, and a person about to take a risk is told what the risk is.
Two keys, and the parts still missing
When a transfer is meant to be final rather than provisional, one key is not allowed to decide it. The signature is split so that two keys must cooperate to produce it, and neither can sign alone — which is why a thief who walks off with one of your devices still cannot settle a payment.
Think of a safe-deposit box needing two keys turned at once. A thief with one key can turn it all day and the box stays shut, because the second key was never theirs. A final transfer here is that box, built out of mathematics rather than brass.
Two smaller protections sit alongside it. Every transfer carries a number that makes it usable exactly once, so a recorded payment cannot be replayed to drain you twice. Offline transfers carry deliberate caps and expiry, keeping the amount you can move while disconnected small enough to reconcile later.
The frontier is honest and it is large. Value moving between two devices and both ledgers agreeing is not met by the running path: the canonical route builds a record that does not propagate, and the co-present path is not wired. The two-key final settlement across devices, and the treasurer counter-signature, are in the same state.
Paying in person with no network at all is further out still — a research thread rather than a feature. The leading approach borrows the pattern short-range radio already uses on every phone, and early probes did get two devices swapping bytes with no network between them. That is a promising spike and nothing more.
Neither of the two protections above is a feature anyone notices working. That is rather the point of both.
What these tokens are, and what they are not
The design position is that these tokens are neither money nor securities, and that this follows from their shape rather than from a label applied afterwards. Three kinds exist: an IOU between two people, a per-person credit that accrues with time and participation, and a credit a community issues by a recorded collective decision.
None of the three has a central party selling an instrument to people expecting profit from that party's efforts. There is no order book, no price discovery, and no single fungible pot — the interface deliberately splits a balance into separate promises, one per person, rather than showing one speculative number.
The picture to hold is an IOU written on a shared notepad rather than a pile of cash. The notepad has no resale value and no price. Across everyone's pages the entries always sum to zero, and nobody sells you a page.
There is an architectural fact under that. The system was designed without assuming its users have ever touched cryptocurrency: no blockchain, no global consensus, no order book, and language that says credits, points, pending and final rather than anything borrowed from trading.
Where value does cross into the regulated, taxable world, that crossing is recorded as exactly that, with a reference to the outside event. The boundary is drawn in the open rather than pretended away, and this is a stated position rather than legal advice — a real determination belongs to jurisdictions, not to us. (Not money, not a security.)
We would rather show an uncomfortable number than a reassuring one, and this is the screen where that costs something. A person deciding whether to accept a payment is exactly the person who should be told what they stand to lose.
The economy that is mostly still a drawing
Underneath the wallet sits a much larger economic intention, and almost none of it is built. There is no ledger of balances, no credit limits, no settlement ceremony, and no working credit in any usable sense. What runs is one narrow primitive: recording that a contribution was made, and retracting it.
The direction is mutual credit — value created at the moment two trusting people transact, summing to zero across everyone, with no central issuance, no interest, and a credit limit in place of a loan. It inverts money as a debt owed upward into credit extended sideways. (Credit you mint by trusting each other.)
Three properties follow, and each inverts the centralised arrangement. Value is not handed down but comes into being between people as they transact. A positive balance earns no interest and a negative one costs none. And a member may run negative up to a limit.
That last one is the interesting inversion. Running negative is not a loan from an institution; it is an interest-free overdraft against your own future contribution, extended because the people around you trust you to give back.
What forty years of these networks say
Forty years of real mutual-credit networks carry a warning we have no right to ignore. They mostly died, and not because the ledger was wrong — the ledger always worked. They died of administrative burden, of balances drifting away from zero and pooling, and of thin participation where a handful of members do nearly all the trading.
We carry that history openly because it disciplines the ambition. Building the ledger is the well-understood part, and it is not the part that decided whether any of these networks lived.
The survivors survived because of people: human brokers holding a view of the whole network, watching balances, managing limits, and actively making matches happen for newcomers. That is a social function, not a protocol feature, and the open question it leaves is who plays it in a system with no company behind it.
Standing you earn, and the gate that is missing
A neighbouring position has the same shape. Standing you earn by contributing, rather than a credential you present, needs two mechanisms that are designed and not built: a meter that records who actually contributed, and a gate that turns standing into permission. (Access you earn.)
What exists underneath both is the trust graph itself, which is real and shipped. Trust is stored as directional edges between people, each requiring both parties to sign, capped so the signals stay scarce, and traversable with attenuation at each hop — and the system can explain why it computed the level it did.
The honest scorecard is three lines. Earned trust: shipped and tested. Earned merit — contribution tracking, domain-scoped standing, penalties that flow back along a vouch — designed, not in production. Earned access: not built, with no code path today from contribution to permission.
What this means, in plain terms
Most of what lands in a week belongs only to the thing it landed in, and is not worth a general reader's time. A few things transfer. These five were paid for by getting them wrong first, somewhere in this codebase, this week.
A green build says nothing about what the code computes
The re-encryption placeholder had correct names, correct types and a clean build for months, and the first run against the real library crashed the process. Every automated check was satisfied, because none of them asks what came out. When a component's whole value is its output, test the output — a passing build proves only the shape.
Real-shaped data finds what an empty screen hides
Every package can now be loaded with a dataset shaped like actual use. Small fixtures pass assertions and conceal what volume breaks: ordering, pagination, empty states, what a long name does to a column. Test at the shape and size of real use, because most failures are properties of the data rather than of the code.
When you do not know what was asked for, return nothing
A saved search with no rule yet was tempting to treat as a rule matching everything — vacuously true, and a catastrophe of scale wearing a logic identity. An empty smart folder now stays politely empty until a rule is added. The honest answer to "I have not said what I want" is nothing, never everything.
Never hold a lock across a call that can wait forever
Creating the first identity on a device signed inside an open database transaction. That reads tidily and is a latent deadlock: a stalled signature holds the lock while every other writer queues behind it. The signing was lifted out of that window. A blocking call made inside a held lock fans one stall out across everything that needs that lock.
Software replicates the ledger, not the broker
Mutual-credit networks have launched by the thousands and mostly died, with the ledger working perfectly throughout. The rare survivors kept human brokers who watched balances and made matches happen. When the record-keeping is the easy part, the hard part is the person who keeps things moving, and no protocol supplies one.
How much healthier is it than a week ago?
| Metric | This window | What it counts |
|---|---|---|
| Commits | 5,586 | Every commit in the window, 06-08 → 06-12 |
| Of those, merges | 1,919 | Merge commits |
| Of those, non-merge | 3,667 | Everything else |
| Active days | 4 | Days in the window carrying commits |
| Busiest day | 1,845 (2026-06-09) | Peak day; 06-10 fell to 1,407 and 06-11 to 784 |
Treat the commit figure as activity, not as features. It counts motion in the codebase; several separate efforts running in parallel produce a number like this without that many features arriving, and the busiest day of the window was a redesign landing surface after surface.
The window's shape is worth a sentence. Four days carried commits, and the volume falls away steeply after the peak — 1,845, then 1,407, then 784 — which is what a redesign landing in one wave looks like when the rest of the week returns to ordinary work.
Net lines of code are deliberately not quoted. At this volume the count is dominated by fixtures, generated files and dataset packs, which would make the number report the size of our test data rather than the amount of work. We report landings instead.
None of the figures above says anything about quality, and we would rather you read the landings than the totals.
One figure this week is worth more than any of the above, because it is a count somebody could have hidden and did not. A sweep of the new dataset packs reported 348 green and 122 red. The red are tracked openly, on the grounds that a test substrate concealing its own failures defeats the reason it exists.
the encryption under your shared data became real, became the default and began building anywhere; a wallet proved its single-device path and named the cross-device one it has not; large files got a plane of their own; and any package can now be filled with data shaped like production.
Four honest notes
The new encryption backend is unaudited. It is real cryptography and it is the default, and it has not been reviewed by anyone outside the project.
Value cannot yet move between two devices. Defining, minting and paying are real on a single device. The transfer that makes any of it useful is not built, and the economy around it is nearly all design.
The photos redesign and the file browser are both in verification. Real interactions sit behind real controls in each. Neither is finished, and neither has been signed off.
The main-loop guarantee is a direction, not an arrival. Two dangerous operations were lifted out of the loop this week. The check that would forbid the shape from returning is the destination and is not in place.
What changed, area by area
Below is the full week rather than the four threads above. Several entries are positions rather than shipped features, and each says which it is.
Per-area file counts are not available for this window under a rule we can reproduce, so these areas are named without a numeral rather than given an invented one.
The four threads, in detail
The real proxy re-encryption library replaced a placeholder and became the default, compiling from a clean checkout on desktop, Android and iOS.
The first run against it crashed on a save-and-reload path; tests that had been skipping themselves against the real backend were made to run; a wrong-key safety property now fails closed for real. A malformed-input fix was offered back upstream. ( When "it just builds" is the feature .)
Defining, minting and paying now write real signed entries on a single device, proven end to end against a real encrypted database.
The send, request and receive-in-person screens are built faithfully to their design, and the send panel names who bears the loss if a transfer reverses. Transfer between two devices does not converge; paying in person over a short-range radio link is a research spike. ( A promise two keys must sign .)
Files now move on a plane separate from the small ordered records that gossip, addressed by a hash of their contents so any holder is interchangeable and integrity comes free.
A download pulls from every trusted device holding a copy at once, and a file is fetched only when you open it, not when it is listed or mentioned. Cloning a repository across it, retiring a file's bytes, retiring the older fetch path and the full browser proof are all honestly still gated.
( Your files arrive from everywhere at once .)
One command now pours a real-world-shaped dataset into any package at the lowest layer, so every surface above it fills the way it would in production.
It composes over the single existing import path rather than reimplementing one, so it is idempotent and cannot drift from what production writes, and it reports an unknown profile as an error instead of silently doing nothing. Packs are versioned and their cache location is pinned in release builds.
( Empty fixtures hide more bugs than they catch .)
The surfaces still in verification
The file browser was rebuilt against its locked design after the first version was rejected as fake.
A name is now edited where it sits rather than in a floating box, a range selection follows the order your eyes see rather than the order storage uses, the inspector reports the total of a multi-selection, and a folder is a first-class thing you authored, recorded as signed events.
Search relevance on large libraries is still over-generous. ( What a Finder is, and isn't .)
Seventeen redesigned surfaces landed on 06-07 — the shell, the river, places, people, events in two layouts, stories, studio, sharing, editing and the shared-bundle view.
Sharing a photo here grants a specific person the ability to decrypt it rather than uploading it anywhere, and "forgotten" is a real revocation. The surfaces are faithful to their mock and the work is in verification, not finished. ( A photos app that never hands your library to anyone .)
Foundations underneath
Two operations that could freeze the daemon's central loop were moved out of its path this week.
Signing now runs in a lane of its own, so a slow or contended signature degrades to a slow signature instead of a stopped process, and the signing done when a device's first identity is created was lifted out of the database transaction that used to hold a lock across it.
The automated check that would refuse the dangerous shape outright is the goal and is not yet in place. ( A main-loop hang should be unbuildable .)
Adopting a package is governed by your own record rather than bought from a marketplace, and every package ships a signed companion record pinning a fingerprint of exactly what it contains, produced by a release ceremony needing two keys.
That fingerprint is recomputed from the code actually present on disk at every boot, before a line of the package runs; if it does not match, the refusal is written into your record as a signed event and nothing loads.
There is no separate tier for code we wrote ourselves — the hundred-plus features the system ships carry the same companion record and come up the same path, so the check is exercised constantly rather than reserved for strangers.
What that buys is a change of trust anchor: a marketplace can host a package and help you find one, and it cannot make one run, because the only thing that admits code to your machine is your own record and a proof your own machine checks. The third-party signing path is still being hardened.
( Installing code you didn't write, safely .)
The tool-call rate moved from about 38% to about 80% once the instrument measuring it was fixed.
The harness had been reporting zero calls while the system was in fact dispatching each call end to end and writing a real record of it, so a working path was being read as a failing model — the most expensive kind of wrong number, because it points the investigation at the wrong half of the system.
The rule we took from it is that a figure about a model's quality is a claim about the harness until the harness has been checked independently.
With that settled, a garbled prompt was repaired and the model's thinking mode became the default for the family we run; wider work on seeing what the model does mid-run stays open.
A permission check on shared files had shipped defaulting to allow where it should default to deny , and the fix landed this window.
Separately, a live authorization bypass in group invitations was found and closed, caught by a new automated source check rather than by someone noticing.
Positions published this week, with the state of the code
The design position that these tokens are neither money nor securities was written down in full this week, resting on their shape rather than on a label: no central issuer selling an instrument, no expectation of profit from anyone else's efforts, and no global tradeable ledger anywhere in the design.
Crossings into regulated value are recorded explicitly. It is a position, not legal advice. ( Not money, not a security .)
The economic direction underneath the wallet was set out along with the admission that almost none of it is implemented — no balance ledger, no credit limits, no settlement ceremony, with a contribution record the only primitive running.
The design forbids silent adjustment: where a limit is enforced, both the requested and the enforced value are recorded. ( Credit you mint by trusting each other .)
The trust graph that would let contribution earn access is built: directional edges between people, each signed by both parties, capped so the signals stay scarce, propagating with attenuation over a short number of hops, and able to explain the level it computed.
The contribution meter and the gate that would turn standing into permission are designed and not in production. ( Access you earn .)
Named, not claimed
NOT CLAIMED — single-device operations only.
NOT CLAIMED — real cryptography, unreviewed from outside.
NOT CLAIMED — both are real interactions still in verification.
NOT CLAIMED — two operations lifted out, no check refusing the shape.
NOT CLAIMED — the trust graph is built, the meter and the gate are drawings.
