Endo is a JavaScript framework for object-capability security, built by Agoric — the team behind HardenedJS and SES. It gives you a runtime where capabilities are plain JavaScript objects, confinement is enforced by a Hardened compartment, and every method call across a process or network boundary goes through the same E() eventual-send abstraction.
These twelve tutorials take you from a single object in a single process all the way to a blockchain-based capability marketplace with a mobile PWA wallet. Each tutorial is self-contained and ends with a specific checkpoint; the series builds one consistent mental model across all twelve.
You do not need prior exposure to capability-based security, SES, or distributed systems. If you are comfortable with modern JavaScript — ES modules, async/await, factory functions — you have everything you need for tutorial 1.
The tutorials
Tutorial 1 — Alice's Car Key: Capabilities, Attenuated
Define a Car object with two methods. Wrap it in a "valet key" that only unlocks. Hand the key to a confined guest and watch the guest try (and fail) to drive away. By the end you understand pet names, formulas, Far, harden, eventual send (E()), and the Principle of Least Authority.
Tutorial 2 — Mailing Bob the Start Fob: Capabilities Across the Wire
Bob moves from a guest on Alice's daemon to his own daemon. Alice issues an invitation, Bob accepts, and Alice delivers the start capability over CapTP — the same capability transport protocol used in Agoric's production blockchain. You meet invitations, the CRDT-backed synced pet store, and the revocation model.
Tutorial 3 — One Key Per Valet: Per-Grantee Wrappers and Independent Revocation
Build a makeRevocableForwarder factory. Mint one wrapper per grantee. Revoke Bob's without touching Charlie's. The Car keeps running. This is the per-grantee wrapper pattern: attenuation and revocation are independent, both expressed in plain JavaScript closures.
Tutorial 4 — Bob Makes a Request: The Endo Mailbox and Forms
Bob asks Alice for a capability instead of waiting for her to push one. Alice sees the request in her inbox, approves or rejects it, and Bob's code handles both outcomes. Covers the Endo mailbox, endo resolve, endo reject, persistent settled requests, and pipelining off a promise before the host acts.
Tutorial 5 — The Plugin That Can't Escape: Hardened Compartments
Run untrusted third-party code inside a Hardened JavaScript Compartment. Three escape attempts — fetch, process.env, prototype mutation — each fail cleanly. The same plugin does its legitimate work through an attenuated capability. Covers SES compartments, frozen primordials, supply-chain attack resistance, and the Date.now / Math.random covert channel.
Tutorial 6 — The Smart Garage: A Capability Broker
Assemble tutorials 1–5 into a working system: a garage broker that provisions per-grantee forwarders to third-party plugins, audits active grants, revokes any plugin independently, and emergency-stops everything at once. Two plugins — one well-behaved, one adversarial — each get exactly the access they were given.
Tutorial 7 — What the Garage Is Missing: Toward a Blockchain Capability Marketplace
A bridge chapter. Five things the garage cannot do: trust is personal not contractual, payment and access are not atomic, there is no marketplace, the fob cannot be traded, revocation is Alice's word not the chain's. Each gap maps directly to a part of Agoric's stack — ERTP, Zoe, on-chain marketplaces, the wallet, and a Lit PWA mobile wallet.
Tutorial 8 — The Car as a Digital Asset: ERTP
Agoric's Electronic Rights Transfer Protocol. Turn the car's access right into a tradeable non-fungible asset. Mint a payment, deposit it into a purse, transfer it to Charlie without Alice's involvement, burn it on revocation. Every ERTP primitive maps to a concept from tutorials 1–3 — supply control, attenuation, revocation — now standardised and financially meaningful.
Tutorial 9 — The Garage as a Smart Contract: Zoe
Port the garage to a Zoe smart contract on a local Agoric chain. Alice lists a CarAccess token for 50 IST. Zoe holds both sides in escrow and releases them atomically. Neither party can cheat. Offer safety is enforced by the contract, not by Alice's goodwill.
Tutorial 10 — The Listing Board: An On-Chain Capability Marketplace
Multiple sellers post CarAccess listings at different prices. Buyers browse the board, pick a listing, and buy atomically through Zoe. No central operator, no discovery gap, no trust required between parties. Closes the marketplace gap from tutorial 7.
Tutorial 11 — The Wallet: Petnames on the Blockchain
The Agoric wallet is tutorial 1's three-layer model applied to a blockchain. Pet name → ERTP brand → purse balance. Bob approves a CarAccess purchase through the wallet UI, seeing exactly what he gives and receives before signing. The dapp-wallet bridge is attenuation and offer safety composing at the financial layer.
Tutorial 12 — The Mobile Wallet: Lit, Web Components, and Offline Capabilities
The capstone. A Lit + Vite PWA installable on iOS and Android. lockdown() fires before any component code. Each <car-fob> web component holds its CapTP reference in a private field — the closure from tutorial 3, running in a browser. IndexedDB stores the offline CRDT replica. Tutorial 1's three-layer model, twelve tutorials later, on a phone connected to a blockchain.
What this series is about
Every pattern in these tutorials is production Agoric. The E() call that unlocks Alice's Car in tutorial 1 is the same eventual-send abstraction that routes messages between smart contract vats on the Agoric blockchain. The Far('Car', {...}) that marks an object as a capability is the same primitive that ERTP uses to represent financial rights. The Compartment that confines a plugin in tutorial 5 is the same execution environment that runs Agoric smart contracts.
Endo is the framework. Agoric is what happens when you build a blockchain on top of it.
If you want to go further after these tutorials: the Agoric documentation, the Endo repository, and the ski/endo fork where these tutorials live — including the source for the synced pet store CRDT that makes tutorial 2's revocation model work.