This is not a report of something we've built. It's a letter to a later version of us — a description of where we're trying to get, written down while it's still only a direction, so that if we ever arrive we can hold it up against what we actually did and ask an honest question: were we sincere?
Alice and Bob are lying to us
Right now, on two windows on one machine, Alice and Bob can find each other, follow each other, hand each other the keys to reach across, and take those keys back. It works. It's real. And it is quietly lying to us — because at two peers, everything hard is invisible.
Two peers can hold a live connection open forever. Two peers never have to wonder whether a message reached someone who was asleep. Two peers can't form a clique, can't stampede a hub, can't drown a third party in noise, can't collude. The whole interesting physics of a network — the part where the design either holds or comes apart — only switches on somewhere past Alice, past Bob, past Carol, out where there are a thousand of them and none of it fits in your head.
So the honest version of the question we're actually asking isn't "does it work?" It's "does it still mean what we said it meant, when there are a thousand of them?"
What we're actually building
Strip away the parts and here's the shape we're aiming at.
A steward that lives on your device — a small model, running on your own hardware, not a giant one running in someone else's building. It knows your world because it's in it. It holds only the keys you lend it, and it can never quietly help itself to more. It reads before it speaks, it sends nothing without your say-so, and — the load-bearing promise of the whole thing — it is never a principal. The model proposes; the keys dispose. What the steward can actually do is decided not by how clever or how compromised its words are, but by the capabilities you handed it and the ones you didn't.
And then: a lot of them. Yours talking to Carol's, Carol's to a stranger's, introductions passed hand to hand, small agents running errands across a graph that no company owns and no server sits at the centre of. Not a platform you log into. A neighbourhood of households, each sovereign, each with a steward at the desk, connected by keys they chose to exchange.
That's the north star. It's easy to write in a sentence and it hides an enormous amount of work.
Why write it down before we get there
Because a north star you can't measure against is just marketing.
Anyone can say "private," "yours," "safe." The words cost nothing and mean nothing until something could have proven them false and didn't. A vision that can't be checked is a vision you can quietly betray one convenient shortcut at a time, and never notice, because there was never anything to fail against.
So we want to commit, now, in writing, to a north star that is falsifiable — one with a test attached — and we want the test to be sharp enough that a future us can't wriggle out of it. This page is that commitment. If we get there and the test doesn't pass, this page will say so.
The test is the sincerity
Here is the part we're most excited about, because it's the part where the ambition and the honesty are the same move.
The stewards are small models on local hardware. That means we can run them by the thousands — not as scripts pretending to be users, but as the real thing: actual autonomous stewards, each with its brain live, each deciding on its own who to reach, what to say, when to act. We loose a thousand of them on a server somewhere and we watch a whole network live — non-deterministically, unpredictably, the way it would actually behave with a thousand real people behind it.
The cost that would normally make this absurd — a model call for every thought of every agent — evaporates, because the brains are ours, running on our silicon, not metered by the sip. The same choice that makes the steward private in the first place is what makes a thousand of them affordable to simulate. The architecture pays for its own proof.
And this swarm is not a lab mock of the product. It is the product, run ahead of itself — a network of autonomous stewards exercising each other, which is precisely the thing moimoi is trying to become. The rehearsal and the performance are the same play.
The four things we promise to check
One swarm, four ways of looking at it. Each is a different set of questions we refuse to answer with a slogan:
Social. Set a thousand stewards loose and watch the graph form. Does it grow into something healthy and navigable, or does everyone pile onto three hubs while the edges starve? Do communities cohere or fragment? Does what you post reach the people who follow you, or die in an echo chamber? A friendly network is a claim, and the graph either shows it or it doesn't.
Economic. When stewards can hold and move value, does the little economy stand up? Who pays to send an errand across the network — and, the question everyone skips, who gets paid to carry other people's data? Does being a good neighbour pay, or does the free-rider win and the commons collapse? We'd rather find the broken incentive in a simulation than in someone's wallet.
Privacy. With a thousand agents probing, does what's meant to be private stay private? And past the obvious — even when the contents are sealed, does the shape of the network, who-talks-to-whom and when, leak the thing the encryption was supposed to hide? That's a leak you cannot see at two peers and cannot miss at a thousand. We want to measure it, not assume it away.
Security — the one that earns all the others. We will make some of the stewards hostile. They'll try to talk each other's brains into misusing keys they hold. They'll forge introductions, replay invitations, flood the network, claw at a revocation that's supposed to have shut them out. Because "the model is never a principal" is not a philosophy — it's a security claim, and the only honest thing you can do with a security claim is attack it. If a thousand rogue stewards throw everything they have and the rule still holds — no steward ever exceeds the keys it was given, no matter what it was told — then we will have survived the claim instead of merely asserting it. That is the difference between a manifesto and a fact, and it is the whole reason to build the swarm.
Where we honestly are
Not there. It would be a kind of lie to end on the vision without the map.
Today: Alice and Bob, on one machine, exchanging keys that finally don't jam when they meet. A book that remembers who you've connected to and scales the way a real address book has to. A steward that reads before it speaks and refuses to make things up.
Between here and the north star: the feeds have to move first — text and pictures flowing across those connections — because that's what turns abstract keys into a thing with real weight, and what forces the honest questions about what should be pushed and what should be pulled. Then the steward has to come out of its window and learn to run headless, with no screen and no hands, which — if it works — is itself a proof that the screen was never in charge. Then Carol, who is not merely a third guest but the first moment the interesting shapes appear: an introduction passed through a mutual friend, a group that more than two people share. And then it's just more of the same small process, a thousand times over, and the swarm, and the four axes, and the day we find out whether any of this was true.
How we'll know we meant it
So here is the note, sealed and left on the desk for whoever we are when we get there.
If we arrive and the graph is healthy, and the economy stands, and the privacy holds under the shape of the traffic and not just its contents, and a thousand hostile stewards spent themselves against the rule and the rule did not bend — then we were sincere. We meant the words when the words could still have been proven empty, and they weren't.
And if we arrive and we find we quietly dropped the hard parts — let the model become a principal because it was easier, let the private thing leak because no one was measuring, let "yours" become "ours on your behalf" — then this page is the witness that we knew better, wrote it down, and chose the shortcut anyway.
We're writing it down on purpose. A north star only means something if you're willing, later, to be measured against it.
We intend to be.
End of Transmission.