silt

A content-addressed, erasure-coded storage and distribution network.

Mothballed 2026-09-22 — paused, not abandoned. Active development stopped; the project resumes at a later date. The storage plane works and is field-driven. The trust plane has one open liveness mechanism on adverse networks, and the mission claim has never been put to the external red team that is the only standard this project accepts for it. See docs/MOTHBALLED.md for the handover — what is true by evidence tier, where the work stopped, and what not to re-derive.

Early and experimental — 0.x, unaudited. silt is published to get technical feedback, not to be trusted with data you cannot afford to lose.

What silt is

silt is two planes on one substrate: a storage plane (content-addressed, erasure-coded, peer-served chunks with NAT traversal) and a trust plane (consensus-secured registry, reputation, and revocation). The storage plane stands alone and is the default; the trust plane is opt-in and secures governance.

Neither plane is the product. silt is the substrate other things are built on.

Three properties shape everything else:

• The link is the primitive. A silt: link is the whole product surface: a content-addressed identity plus the key to read it. Durability, placement, and repair are the network's job, not the holder's.
• Capabilities, not infrastructure. Store, relay, registry, validate, caretake are capabilities any node can offer, never special nodes baked into the binary. No node is permanently load-bearing.
• The naming boundary. silt core resolves hashes, never names. Turning an opaque root into human meaning — names, descriptions, curation — is a separate resolver layer, and core carries zero meaning. A link guarantees the bytes it names; trusting a name means trusting whatever resolver you asked.

silt is use-agnostic. Core carries zero meaning and takes zero position on use.

What silt promises

silt exists to hold the privacy × accountability × Sybil trilemma — to refuse to trade any corner away. Every prior system in this space picks two corners and surrenders the third.

• Privacy. Publishing is unlinkable to a durable identity. silt refuses to surveil who fetches what, pursuing access-privacy to the metadata-layer limit the anonymity trilemma allows — not an absolute blob-layer guarantee. A serving node necessarily sees what it serves and to whom, for as long as serving requires; silt records nothing beyond that, and nothing of it leaves the node.
• Accountability. Genuinely harmful content can be removed by acting on a hash, never on an identity and never through a global switch. Takedown is pluralistic, curators are themselves accountable, and every honored removal is committed to an append-only transparency log with inclusion and consistency proofs.
• Sybil-resistance. Standing cannot be cheaply forged. Identity is free and pseudonymous; influence costs sustained, challenged, real work — and the publishing act stays cryptographically unlinkable from the bonded identity that did the work.

This is hold, not resolve. It is not a claim to have solved a research problem all at once. It is a refusal to trade a corner away, and a design in which the corners co-mature: privacy is architectural from day one, accountability is content-level and reactive from day one, and Sybil-resistance is the corner that bootstraps — weakest on a young network, strengthening as real, sustained work accrues.

The bet, stated plainly

Decouple the cost of creating an identity from the cost of having standing.

No single mechanism can prevent Sybils under free identity minting with no permanent center; that is a settled impossibility. The guarantee lives in the composition. Each part denies one economy of scale a Sybil relies on — a size-bound bond, unique sealed content, witnessed unlinkable demand receipts, address and AS diversity, retention decay — so that every shortcut on one axis trips another axis's check. The target is that forging N standings costs N× of every non-substitutable resource, which is exactly what honest provision costs.

This multiplicative interlock is the target, not yet the operative guarantee. Today consensus standing is gated by the bond axis and its time dimension: a bond must be sized, backed by real sealed bytes, and continuously re-proved, and one plot cannot back two identities. Served demand and address diversity are designed and staged, and do not yet enter the standing number. core/chain/sybil_cost_census_v5_test.go reports which of the five is denying and which is unwired, arm by arm, and fails if that changes without being noticed.

How you would know

silt is finished when an external red-team — a party other than the author — runs the adversarial suite and denies all three failure modes: no publish-to-identity linkage, no identity-level or global takedown, and no Sybil-farmed standing at a discount. That answer belongs to an outsider, not to the builder.

Design posture

• Consensus is boring, by policy. The novelty budget is spent entirely on the Sybil composition. The consensus layer is literature-faithful BFT, hardened, not reinvented. Admission is objective, bond-weighted commit admission — a block commits only on an intersecting super-quorum of a validator set the chain itself sizes (a strict anchor majority at launch, >⅔ of the epoch's frozen on-chain bond once standing is earned), so a sub-quorum partition commits nothing, stalls, and catches up to the majority's history on heal rather than reorging onto it. A validator never signs twice at a height, and that memory survives restart. The validator set changes only at finalized boundaries. Commit and final are distinct. Fork-choice is a deterministic total order, and every safety violation is attributable — an honest node is never slashed.
• Storage is tiered. Archival nodes retain all history to genesis. Pruning nodes keep a rolling retention horizon. Edge nodes serve content and relay bandwidth without carrying validation weight. The registry's validity-relevant state is committed each block under a state root, so a validator on a small box validates by checking transitions against witnesses instead of holding the tree.
• The economy prices value and never mints a subsidy. Bandwidth earns balance-lane credit that can never become standing. A delivery receipt mints no credit. Repair bounties are funded only from an object's own escrow, never from a network mint.
• Durability is the default, not a hardening pass. Every network path assumes the adverse internet — jitter, loss, reordering — as the everyday case. Security never rests on a wall-clock number an adversary's own path can move.

It runs on a hobbyist's ~1 vCPU / 2 GB box. Cheap honest participation is treated as a security property, not a courtesy.

Build

Requires Go 1.26.5 or newer. No cgo, no native toolkit.

go build ./cmd/silt          # single binary at ./silt
go test ./...                # the suite

Cross-compile release binaries for macOS, Windows, and Linux, with checksums:

./build.sh v0.1.0            # writes dist/ plus dist/SHA256SUMS

Each artifact is one self-contained binary. The web UI is embedded with go:embed; there is nothing else to ship.

Run

Store a file and get a link back. add prints the root (the public name) plus the key (the private capability), and a care link that grants repair rights without decryption. Files are erasure-coded — with the default k=10, n=16, any 10 shards of each stripe reconstruct it.

silt add <file> [-store DIR] [-mode convergent|private] [-k K] [-n N]
silt get <link> -o <out> [-store DIR]
silt info <link-or-care-link> [-store DIR]
silt ls [-store DIR]

Run a node:

# desktop app: serves and consumes, opens a browser UI
silt client [-store DIR] [-capacity 5G] [-bootstrap ID@ADDR,...] [-ui ADDR]

# headless swarm node
silt daemon [-listen ADDR] [-store DIR] [-capacity 2G] [-bootstrap ID@ADDR,...]

# as a validator
silt daemon -validator -bond 8M -quorum Q -attesters ID[,...]

Work against a real swarm, and inspect:

silt swarm add <file>     -peers ID@ADDR[,...] -registry REF
silt swarm get <link>     -o <out> -peers ID@ADDR[,...] -registry REF
silt swarm holders <link> -peers ID@ADDR[,...] -registry REF

silt id [-store DIR] [-listen ADDR]     # a node's ID, without launching it
silt chain-status [-store DIR]          # head height and hash, read-only
silt genesis [-text]                    # the founding block a fresh network carries

Simulations run the whole network in-process, no sockets:

silt sim run scatter | churn | economy | audit | capacity | consensus | bondstanding | takedown
silt net demo [-nodes N] [-size B]      # the same, over real TCP

Run silt help for the full flag surface.

Canon

Two documents govern this repository:

• docs/TENETS.md — the mission, what silt is, how it is built and tested, the bright lines, and the three tiers that say which decisions are immutable.
• docs/VISION.md — the finished system, told through the people it serves.

Where the build differs from the vision, the code and its tests are the honest record.

docs/MOTHBALLED.md records the state the project was paused in. It is not canon, and it is a snapshot dated 2026-09-22 rather than a plan.