Tixim is not another AI agent. It is an expert system you own: workflows that capture expertise, services that keep it running, an orchestrator that routes every wish to the right expert — all pinned by Nix, certified by guilds instead of a vendor, connected by an encrypted mesh. Built on the assumption that every system can be compromised, including ours.
TiXim
the expert system you own — you are here
Read the essay behind it: The Singularity Is Not What You Think →
A workflow is expertise, captured. You compose it once — with a frontier model, with human judgment — and from then on it runs cheaply, repeatably, on whatever model the task actually needs. Re-prompting a giant model for the same job forever is a business model, not an architecture.
Roughly 80% of agent quality lives in the harness: what a step can see, what it can touch, what checks its output. Specialized experts in tight harnesses beat general models on defined tasks — so Tixim is built as a system of harnesses, not a wrapper around one model.
Approval gates, committees, and veto keys are first-class components. The system is designed so that human judgment sits exactly where it matters — on releases, on policy, on what counts as done — and nowhere it doesn't have to.
Every workflow step runs inside a rootless OCI container via youki — never on the host. Landlock enforces the /nix/store closure a step may read, and network policy ranges from fully offline through a domain-whitelisted egress proxy to open. Isolation is a rule of the engine, not a configuration option you can forget to set.
Tools, skills, services and agent harnesses are all Nix derivations, so a run on your laptop and a run on a builder resolve the same closure. A flake is the unit of distribution: pin it, share it, and the environment comes with it.
A workflow is a DAG in which you can describe anything: script steps, agent steps, whole subgraphs, operator gates, and edges that route on what each step produced. The agents in it are experts — a model, a harness, its skills, the derivations it runs, and the database blobs it carries — composed like functions. Review committees, escalation ladders, landing pipelines are recipes written in it, not features of it.
Runs are event-sourced and replayable. Step logs carry per-line timestamps as structured data rather than text prefixes, traces flow through OpenTelemetry, and every gRPC endpoint carries an acceptance contract. You can reconstruct what happened, not just read a summary of it.
Releases are signed by MPC dWallets and builds are certified only when a committee of at least three independent guilds — one seat each — reproduces them byte for byte, every seat backed by a bet. There is no central registry to compromise, pressure, or shut down.
A laptop, a homelab, a rented cluster — instances pair with a QR code and reach each other over encrypted QUIC, no port forwarding, no cloud broker. Your data lives in your instances and in storage only your keys can open.
Sending an intent is making a wish, and the orchestrator is the genie: it turns your wish into something concrete, checks it against policy, and finds the best route. Most of the time that is the agent of the project you're talking to. When it is serious work, it starts a workflow: a DAG of sandboxed steps — script steps, agent steps, whole subgraphs — where the hard decisions pass through committees, not a single model. And sometimes the genie just answers — no machinery spun up at all. Services are the long-running Nix-built components all of it leans on.
Domain experts plug in as Nix flakes
(experts/<name>/expert.nix) — registered code is
inert until you explicitly install a pinned, auditable store path.
Composition is the product; everything is a flake — and the goal
is one common interface that every tool, agent, harness, and
service plugs into. Bring your tools: if it can be declared, it
can join the system, under the same sandboxes and the same audit
trail as everything already here.
How the orchestrator routes → How workflows run → How services run →
The author funds a build. A committee of guilds is seated — drawn on-chain, pinned by the project, or constrained to guilds with the right properties; at least three, one seat each — and a member builds the artifact for their guild's seat, delivering its digest encrypted to the job's MPC key so nobody can copy anybody. Alongside, a security workflow checks the dependencies. Then the Ika dWallet verifies that the committee fulfilled the job, that the revealed digests match, and that the security workflow succeeded — and only then contributes its half of the release signature. The author signs the other half, and that closes the release. Diverge and you forfeit your bet; double-sign and your guild's stake is slashed.
Steps run with zero ambient authority: a rootless container, a
seccomp tier, and a Landlock LSM ruleset that limits reads to the
verified /nix/store closure — inherited by every child
process, impossible to relax. Egress passes a MITM proxy with a
privacy filter, so secrets and PII stop at the boundary — and
agents never hold credentials at all: they carry short-lived
scoped tokens, and the proxy injects the real secrets outside
the sandbox.
Untrusted text is typed as tainted until proven clean: every string is swept for Trojan Source bidi overrides, zero-width characters and homoglyphs (CVE-2021-42574), and sinks fail closed if a check is missing. Full AI-driven supply-chain analysis of third-party source — loaders, obfuscation, encrypted payloads — is where this is headed. Horizon
Everything a central platform would own — identity, storage, secrets, signing, connectivity, source control — is a protocol here instead.
Identity, the flake registry, releases, guild stakes, the cache index. Small on-chain objects anchor who owns what and what was proven.
Model weights, git pack generations, experience payloads, build artifacts, NARs. The heavy data, decentralized and content-addressed.
Threshold encryption with policy-gated key release. Secrets, private releases, sealed build digests — and your access key lives in a trust circle of guilds you chose.
MPC dWallets sign releases with threshold ECDSA. The maintainer can hold one share — a personal veto no platform can override.
Encrypted QUIC between your devices and instances: direct dial without port forwarding, an IPv6 overlay into containers, database sync. Pair a device by scanning a QR code.
Encrypted, decentralized git — hot deltas on Sui, pack generations on Walrus, the repository tip anchored to the flake that owns it.
Every workflow run can post an experience: the payload on Walrus, an append-only index on Sui, privacy-filtered before anything leaves your instance. Lessons are already extracted from transcripts today; distillation of experiences into refined workflows and experts is the next turn of the loop — evolution with provenance, not fine-tuning folklore.
The loop stays honest because output is checked before it becomes state: the ontology layer validates every structured claim against what actually exists — unresolvable references are treated as hallucinations and bounced back to the agent. Horizon
The end state we are building toward: user-controlled HyperEnclave instances forming a worldwide confidential-compute pool — each one admitted not by a corporate allowlist but by the personal trust circles of guilds that verified it. Run an instance on demand, autoscale when your workflows need more, wind it down when they don't.
The same guild mechanics make idle hardware safe to lend today: because certification is independent reproduction under stake, your machine only ever builds from signed, verified sources inside the same sandbox stack — and gets paid in budget shares for it.
A bugfix week: smaller wrong assumptions that stalled workflows, a polished compressor hook that shaves another 13% off gateway tokens on top of rtk, a long-standing difftastic …
Three months of vx-maintainer development, reconstructed from git history: how every failed workflow run became a patch to the recipe — more caching, more reuse, harder gates — …
Why there is a landing page before there is a release, and what the first one will actually contain.