Pre-alpha · protocol first, product later
Evermesh splits media — video and music — into a small, permanent substrate — signed records and content-addressed blobs that verify from their own bytes — and a competitive edge of gateways, nodes, and viewers that decides everything contested: moderation, discovery, monetization. No servers of record. No token. No company you have to trust, including ours.
Experimental — not production-ready Optionally built on DMTAP-PUB §22
Every design decision in Evermesh answers one question: does the network still work after every organization involved dies or betrays it?
Not "is it federated". Not "is it open source". Those are means. The test is whether a video or a track published today is still playable, still attributable, and still re-hostable when the gateway that served it, the foundation that wrote this spec, and the operators who ran the relays are all gone.
The gateway shuts down
A gateway is an index and a cache with a domain name and a legal posture. It holds a selection of the substrate, not the original of anything.
Still works The records and blobs are just as valid on any other gateway that chooses to index them, and any node that pinned the blobs can re-seed them. Nothing needs to be migrated, because nothing was ever owned.
The foundation dies
The steward publishes a spec, a kind registry, and a conformance suite. It runs no servers, holds no keys, and has no ability to revoke, delist, or authorize anyone.
Still works A frozen spec is a working spec. The registry is a file you can fork; the conformance suite is 189 vectors you can replay. The two-implementations rule exists so nothing in the protocol depends on one group's code surviving.
The network splits
No chain, no global ordering, no quorum, no firehose everyone must reach. Records are signed and content-addressed, which is enough to verify them alone in a room.
Still works Both sides of a partition keep publishing and keep verifying. Offline bundles move content across an air gap on a disk. When the link comes back, the two halves merge — there is nothing to reconcile because nothing was ever a vote.
A protocol that needs its authors to stay alive is a product with extra steps.
Three layers, and only the middle one is permanent. The kernel names no transport, no company, and no chain — it defines bytes that carry their own proof.
Layer 1 — publish
A creator's key signs a canonical CBOR envelope. Media itself lives in blobs addressed by BLAKE3 chunk trees, so a byte range can be proven without fetching the file.
Layer 2 — carry
Relays accept, store, and forward records over a websocket sync protocol with filtered subscriptions, proof-of-work anti-spam, and retention policy. Losing one costs you nothing.
Layer 3 — serve
A gateway indexes its own selection, sets its own moderation policy, answers to its own jurisdiction, and competes on search, transcoding, community and payment.
Participation is a ladder. Every rung is optional, useful on its own, and reversible — you can stop being a node on Tuesday and still be a viewer on Wednesday.
Watches or listens. Verifies signatures and hashes client-side while the video or track plays, so a hostile or careless gateway cannot quietly substitute different bytes. No account, no setup, no commitment.
Pins what you choose — your own videos first, subscriptions second — and re-seeds it to others inside budgets you set. This is the rung that makes "outlives its platforms" literally true. No public-facing duties, no domain, no legal exposure.
An independent site on its own domain that indexes and serves its own selection of the substrate, under its own moderation policy and its own jurisdiction. Gateways are where the contested decisions live, on purpose, so that the substrate never has to make them.
A creator is not a separate piece of infrastructure — it is any keyholder who publishes a video or audio manifest, and creators may run a node and a gateway too. A foundation stewards the spec, the registries, and the conformance suite, and runs no servers of its own.
A page like this usually describes software that does not exist yet. Here is the line between what runs today and what is only written down. It mirrors the repository README exactly, and it is meant to be uncomfortable while it is still true.
Evermesh is pre-alpha. There is no deployment, no public gateway, and no app you can install. What exists is a normative spec, a protocol kernel, a relay, a reference gateway, and a conformance suite whose tests pass. Where code and spec disagree, the spec wins.
| Path | What it is | State |
|---|---|---|
| spec/ | Normative protocol spec (000–011 + IETF draft) | Complete for v1 |
| evermesh-kernel | Records, identity rotation, blobs and chunk proofs, bundles, all 27 kinds | Implemented, tested |
| evermesh-relay | Sync websocket, storage, subscriptions, gossip, PoW, retention, blob sidecar | Implemented, tested |
| evermesh-wasm / kernel-ts | WASM bindings and the typed TS API over them | Implemented, tested |
| gateway/server | Index, policy engine, key custody, ingest, upload, JSON API | Implemented, tested |
| gateway/web | The uniform reference UI: video & audio player, playlists, verification, channels, upload | Implemented, tested |
| tools/conformance | 189 deterministic vectors replayed against three runtimes | Green |
| swarm / P2P | WebRTC / BitTorrent-style retrieval described in the spec | Spec only — not built |
| live streaming | live.manifest / live.chat kinds validate in the kernel |
Spec only — no ingest, no player |
| non-custodial keys | Client-held keys; the reference gateway custodies keys server-side today | Later phase |
| evermesh-node | Desktop client (Tauri 2) — browses a gateway, verifies manifests natively, pins video and audio for offline playback | Implemented, tested |
| node seeding / swarm | The desktop client pins and caches for its own owner but does not seed to other nodes yet | No P2P transport |
The same vectors are replayed against three independent runtimes — the Rust kernel in-process, the WASM kernel under Node, and a live relay over its websocket. A vector must pass identically in every runtime; a divergence is a protocol bug, never a fixture to special-case. The differing counts are documented per-runtime skips — each runtime only checks what it is responsible for.
| Target | Pass | Fail | Skip |
|---|---|---|---|
| kernel | 189 | 0 | 0 |
| node (WASM / kernel-ts) | 142 | 0 | 47 |
| relay (/sync) | 115 | 0 | 74 |
Cross-referenced, self-consistent, and boring on purpose, so a stranger can reimplement the whole thing from the text alone. Read them in the docs viewer or in the repository.
Most of these have been asked in bad faith at some point. They are all still worth answering.
PeerTube federates independent servers, but each server still owns the identity and data of its own users — moving off one means starting over. Evermesh keeps identity and content self-certifying and portable; gateways select and serve rather than own.
Nostr shares the substrate spirit — signed events distributed through relays you choose. Evermesh is built specifically for media on top of that idea: native manifests, renditions, authorship claims, and offline bundles that a plain event feed does not define.
Bluesky / AT Protocol also uses rotation-based portable identity, similar in spirit to Evermesh's identity log. The difference is that Evermesh has no required global relay or app-view: every gateway builds its own view from scratch, and the protocol is designed to keep working partitioned, not just when everyone can reach a central firehose.
No, permanently. The spec carries optional payment primitives so creators and gateways can charge for things if they want to, but it takes no position on business models, and no protocol token exists or will exist.
No. No chain, no mining, no global consensus of any kind. Records are signed and content-addressed, which is enough to make them independently verifiable — and that verification never depends on everyone agreeing on a shared ledger.
The substrate does not delete, and pretending otherwise would be a lie. Removal happens where it can actually be enforced: at the gateway that chooses to serve, in the jurisdiction it operates in. The reference gateway ships a policy engine, signed and subscribable takedown feeds, geo-blocking, and a legal toolkit — because moderation is a real operational job, not a protocol keyword.
No one operationally. A foundation stewards the spec, the kind registry, and the conformance suite; it runs no servers and holds no user data. The design goal is that the network keeps working after the foundation is gone — see the survival test above.
Re-basing the substrate on a shared publish/subscribe layer (DMTAP §24) is under decision and has not been adopted. The analysis is public in DMTAP convergence and the reasoning log in DECISIONS. Until it is decided, the spec in this repository is the protocol.