One rule decides every argument in this project
If a protocol-essential capability stops working when the founder disappears, it is either designed to degrade while an equivalent decentralized path remains available, or it is a centralization defect.
Some things are allowed to vanish: the official domain, the managed hosting, the App Store build, the founder's polished portal. Those are conveniences.
These must survive: finding other nodes, verifying and distributing the software, retrieving media, enrolling new nodes, synchronizing records, succeeding governance, propagating lawful legal state, and continuing development through another channel or a fork.
What a hundred servers buys you, and what it does not
The test that shaped the architecture. One operator spins up a hundred machines and mirrors the same video onto every one of them.
Run it yourself: decenter-node custody demo. It builds a hundred delegated node identities and a hundred signed endorsement attempts from one account, then asserts the outcome and exits nonzero if the numbers move.
Infrastructure ownership may increase durability and availability. It must not manufacture social endorsement.
Four identities, never one
"The CID" is where decentralized systems go wrong. A system with one identifier cannot tell "same video, re-encoded" from "different video".
| Name | Answers | Changes when |
|---|---|---|
| rendition_file_root | Are these the exact bytes? | A single file's bytes change |
| manifest_hash | Is this the same described set? | Any rendition or metadata changes |
| bt_v2_infohash | Which swarm do I join? | The file set or piece length changes |
| upload_record_id | Who published this, and when? | Never. It is a signed historical fact |
Re-encoding a video at a new bitrate changes the first three and leaves the fourth alone. That distinction is not expressible with one identifier.
What is actually built
Stated plainly, because a project about not overclaiming should not open with an overclaim.
Working and verified
- Deterministic encoding, signatures and media identity, cross-checked against an independent Python implementation and unmodified libtorrent 2.0.8
- 32 of 32 conformance checks, passing from a clean clone
- A single binary that serves the network, the clients, the docs, and its own source
- Two independently keyed nodes exchanging records and media over a bounded corpus, with resumable, piece-verified transfer
- The custody separation above, with six executable acceptance exercises
Not built, and not pretended
- No public network. Nothing is live.
- No open discovery, DHT, trackers or relays
- No public uploads, and none until a safety-processing path can survive the founder
- No governance, no recommendation, no mobile apps
- Nothing has been exercised without founder-controlled dependencies, so nothing claims the headline property yet
This server is the whole thing
You are looking at a Decenter node. The same process serves this page, the browser client, the protocol API, the media, the documentation, and the source of the server serving it. One binary, one port.
Drop the exported files into an ordinary Apache or nginx webroot and the archival half still works, labelled as a snapshot rather than a live peer. Nothing here depends on us staying online, because you can run the same binary.