The network

A flake is the on-chain unit of value: you create an account from a wallet, enroll your instances through scoped capabilities, publish flakes bound to encrypted repositories, and release them through multi-guild attestation. No layer below has an owner you must trust.

Sui — roots, policy, proofs Building

Small, root-oriented objects anchor everything that must be public and ordered: accounts and device capabilities (scoped, spend-capped, revocable), the flake registry, releases and build attestations, guild stakes and epochs, the cache index, the experience index — and registered service endpoints with their frontend releases, so a portal like tix.camp loads exactly what a project published and speaks to exactly the backend the project registered. Every state change emits an authenticated event. Heavy data never goes on-chain — Sui is the spine, not the warehouse.

Walrus — the warehouse Building

Decentralized blob storage holds the weight: model weights, git pack generations, release artifacts, experience payloads, NARs for the binary cache. Storage rent is solved structurally: every flake has a permanence pool — anyone can deposit, no human can withdraw, and an off-chain renewal service drains it only to keep the flake’s blobs alive. Fund a project’s storage forever without trusting who runs its infrastructure.

Seal — secrets with a quorum Building

Threshold encryption with on-chain access policies: private releases, members-only content, sealed build digests, your secrets. Key release requires t of n key servers to independently verify the request against the policy — and through trust circles, those key servers are run by guilds you selected, not by a fixed provider list.

Ika — signatures nobody holds alone Building

An MPC network providing dWallets: threshold ECDSA where the private key never exists in one place. Tixim uses it to sign release digests, with the maintainer optionally holding one share as a personal veto, plus rotation and a sticky, auditable taint lineage for compromised custody.

iroh — connected from anywhere Shipping

Encrypted QUIC connectivity between everything you own: dial your daemon directly with no port forwarding, reach a specific container over the iron IPv6 overlay, sync replicated databases, pair a new device by scanning a QR code — the paired key doubles as a login. Relays are content-blind; your traffic is yours.

gitrus — git without a registry Building

Encrypted, decentralized git: repository identity is a single on-chain object, hot deltas live on Sui, pack generations on Walrus, and the tip is anchored to the flake that owns it. Your source history gets the same survivability as your releases. gitrus is a release requirement, not a development mandate: day-to-day trees can live entirely in private instances — what must land on gitrus is the release, pointing at a frozen tag, an immutable ref that can never be moved or rewritten. That frozen tag is what the release dWallet signs and the guilds rebuild from; there is no “the tag moved after review” in this system. The standalone implementation — Rust client plus Move package, developed in its own repository — is mostly done; wiring it into the daemon is what remains.

The binary cache: rooted in Walrus, served over iroh

The decentralized Nix cache Building is a real Nix substituter — narinfo, NAR streaming, build logs — that stock Nix clients can use today, with standard Ed25519 signatures and the attestation registry adding the trust layer on-chain. Its storage story is layered:

• Walrus is the backing store. NARs live as content-addressed blobs with the index on Sui, so the cache has no home server. Any instance that speaks the protocol can recover a full working cache from Walrus alone — lose a node, lose a datacenter, and nothing is gone.
• iroh is the edge. Nodes discover each other over the mesh and serve the signed packages already sitting in their local Nix store to their peers. Horizon Because every package is signed and guild-attested, an untrusted mirror can never hand you a tampered binary — the worst it can do is miss.
• Anyone can be the neighborhood cache. An ISP — or anyone with an old machine in a closet — starts a cache instance, and subnet discovery makes it a query target for every nearby node. Horizon Popular closures get fetched once per network segment instead of once per machine, and the bandwidth stays local.

What rides on top

• walrusfs Building — a FUSE filesystem that mounts Walrus blobs and quilts as local read-only directories: a release, a model, a whole published tree appears under a mount point, locally cached, immutable by construction. Mostly done standalone; integration into the platform is next.
• guardian-db Building — a CRDT peer-to-peer database replicating over iroh, conflict-free by construction, with per-entry Ed25519 signing and verified ingest — and it is close to landing. Its first job is exported knowledge: indexes that sync between your instances with no server in the middle, with Walrus quilts moving a whole index in one optimized transfer. Built for road warriors — work offline on the laptop, merge cleanly when you reconnect.
• An eventual-consistency filesystem Horizon — the same offline-first discipline at the file layer: a filesystem that syncs between your instances and resolves conflicts through workflows — your merge policy, applied by the machinery that already knows how to review and gate changes, instead of a “conflicted copy (2)” dumped in your lap. Offline-first filesystems have been promised since Coda; workflow-based conflict resolution is the piece Coda never had. Planned on bcachefs + eBPF with a custom daemon — FUSE or a lightweight fusionfs where kernel support isn’t there.
• The TIX economy Building — a hard-capped coin with an algorithmic stabilization mechanism funds build jobs, staking, and storage: the meter that keeps strangers honest with each other.