Decentralised by design

From a phone to a field of nodes.

RURAL aims to be tougher than a cockroach: one engine that runs from a single device to many independently owned nodes, and keeps working when parts of the network do not. Today it runs locally. The field is the design and the aim, and this page keeps the two apart.

Cut a link See the profiles
Illustrative · a link is cut, the mesh routes around itAim
A landscape of connected nodes: phone, laptop, server tower and a solar-powered node Illustration. A phone, a laptop, a field cell, a server tower, a solar node and a distant cell are joined by a mesh. The direct link from laptop to server is cut and traffic travels via the field cell instead. Positions and behaviour are illustrative, not a running network. Phone Laptop Cell Server node Cell Solar node Illustrative, not live

Motion is illustrative. With reduced motion on, the picture holds the reroute state: link cut, traffic through the cell.

Scale spectrum

One engine, five rungs.

The aim is the same database at every size. Each rung has its own honest status.

  1. 01

    Phone

    Aim

    Embedded and in the browser via WASM, with a bounded working set.

    Today

    A real WASM engine runs in the browser aquarium demo. No phone engine target exists yet.

  2. 02

    Laptop or desktop

    Today

    The embedded Zig API opens a local store in your own process.

    Today

    Trusted-local, directory-backed. Bounded profile, pre-v1.

  3. 03

    Dedicated server node

    Today

    One owning service per store, same engine behind an HTTP surface.

    Gated

    Runs locally. Hosted is blocked behind open readiness gates.

  4. 04

    Field of cells

    Design

    Independently owned cells, federated, with explicit cross-cell coordination.

    Design

    ADR-017, ADR-024, ADR-025. Model-checked for safety only. No cluster runs.

  5. 05

    The new internet

    Aim

    Continuity beyond its creator, post-quantum-hybrid privacy, consent-based sharing, contributed compute.

    Aim

    Whitepapers and requirements. Not delivered.

Survival principles

Assume the network will break.

These are design rules the architecture is built around. They are requirements and models, not a shipped cluster.

  • Cells own their publication authority.Each cell, partition or coordinated group decides what it publishes. Independent cells run in parallel.
  • Cross-cell atomicity only by explicit coordination.A commit is not atomic remote execution. Spanning cells is something you ask for, not something you get by accident.
  • Partitions are expected.Designed profiles for attached, partitioned, detached and fenced operation, so a split is a mode and not a surprise.
  • Revocation cannot erase received copies.You can stop future delivery. You cannot unsend data a peer already holds. The model says so.
  • Unknown is reported as unknown.When an outcome cannot be confirmed, the answer is unknown. You retry with the original identity.
A single server reachable worldwide is not a globally resilient database.
Why a field of cells, and not one big box
Interactive, illustrative

Cut a link. Watch it route around.

Take a node offline or cut a link, then see whether a route still exists. If the network splits, each side keeps its own cells.

Simulation · a toy graph, not RURAL runningDesign

Simulation of path-finding on a toy graph. It shows the idea, not an implemented protocol. Click a node or a link, or use the toggles.

Nodes
Links
Cell profiles

Same engine. Different promises.

A profile states what a cell guarantees. RURAL never advertises one profile's guarantee for another.

ProfileWhat it is forStance on guaranteesStatus
Transient RAMHot scratch state and reconstructible caches.Volatile. No durability promise by design.Today bounded
Embedded durable localAn application store in your own process.Acknowledged means durable, with unknown outcomes reported. No power-loss certification.Today local
Browser / WASMThe engine in a page or worker, with a bounded working set.Declared constrained profile. Browser persistence is unqualified.Today demo, ephemeral
Dedicated nodeOne owning service per store, reachable by others.Single owner. Other processes talk to the owner.Today local; hosted gated
Disconnected mergeable peerA device that works offline and rejoins later.Merge after rejoin. Exploratory portable-cell design.Design
Managed replicated clusterSeveral nodes agreeing on one cell's history.Majority agreement. Fixed membership in the model, safety only.Design Aim
9

TLA+ models

25 configurations: 10 positive, 15 deliberate counterexamples. Bounded model checking, not a proof.

82,056

States in the replication model

RuralCellReplication: 3 acceptors, 1 slot, fixed membership. Safety only.

0

Clusters running

No distributed runtime exists. The models describe intent.

3

Not modelled

Liveness, Byzantine behaviour and disk loss are outside the replication model.

Security direction

Private by design. Not yet a protocol.

The primitives are in place and checked. What you build on them is the work still ahead.

Primitives, verified

Today

ML-KEM-768 and ML-DSA-65 run through a first-party adapter and match independent known-answer vectors.

No keys are stored. This is not a protocol or a security claim.

Hybrid privacy

Aim

Post-quantum hybrid key exchange for communication between cells, with private discovery.

ADR-018 names Matrix-style federation and Signal-style ratchets as references.

Consent-based sharing

Design

Grants are scoped and expiring. Federation never pools permissions.

Data cannot grant itself authority. Permission is rechecked at delivery.

Contributed compute

Design

ADR-019 sketches grants, leases, reservations and result verification for work done on other people's nodes.

Untrusted contributors are not trusted voters.

Continuity past 2077

Aim

A target of continuity through compatibility, migration and recovery, with creator-independent handoff.

It is not a lifetime reliability claim. Independence from the creator never means independence from the current owner.

Cockroach-grade survival

Aim

Durable recovery, consensus, ranges, backup and restore are being built in first-party code.

Matching an incumbent is a target that needs matched evidence. None of it is matched yet.

Gates to the mesh

Earn each step before the next.

Phase 5 is where the mesh becomes real. It opens only after security and retention gates close.

  1. Gate 1

    Core and security first

    Transactions, recovery, measured performance and retention gates close before any network work is trusted.

    In development
  2. Gate 2

    Two real processes

    Not a simulation. Two separate processes exchanging real data under the cell rules.

    Design
  3. Gate 3

    Disconnect and rejoin

    Cut the link, keep writing on both sides, reconnect, and converge without losing acknowledged work.

    Design
  4. Gate 4

    Replay and revocation

    Replays are safe. Revoked permission stops future delivery, and the limits are stated.

    Design
  5. Gate 5

    Recovery

    A node is lost and rebuilt from what the others hold, with unknown outcomes surfaced, not hidden.

    Design

No dates are promised. A gate passes when the evidence passes.

Keep going

See how it is built. See what is proven.

The architecture page shows the layers. The evidence page shows what has actually been checked, with its limits.

Read the architecture Check the evidence