N NexusFS

Current Status

Encrypted, replicated, operable, and provable.

All eight milestones are complete: files round-trip through a signed operation log applied to CRDT-backed namespace state, an S3-compatible API exposes that state over HTTP, two nodes converge over QUIC with every operation and chunk verified before it is accepted, content is encrypted at rest without breaking that verification, replication adapts what it transfers to the device's power, heat and link cost, operators can reclaim storage, upgrade across on-disk formats and enrol peer keys ahead of first contact, and the state root is a Merkle commitment whose entries can be proved present or proved absent, and a node that skipped content to save power fetches it on demand when someone reads. 237 tests, clippy clean, every feature combination built in CI. The POSIX facade and a real proving system are still in the backlog, and named as such rather than implied.

Implemented now

A working local filesystem: signed operations, CRDT namespace state, deterministic conflict resolution, path resolution and file reads, filesystem CLI verbs, and a browsable admin console.

Try it yourself

The playground runs this exact core in your browser: two replicas, a partition, and deterministic convergence.

Present as scaffolding

The POSIX/FUSE and privacy crates are stubs. The ZK crate is not — it holds the commitment and the proofs; what it does not hold is a proving system.

Operator tooling

verify audits, gc reclaims, migrate upgrades the on-disk format, and peer enrols keys before first contact.

Provable state

prove emits a self-contained proof that a path holds its content — or that an inode is gone; check-proof verifies one without opening any repository. A commitment scheme, not zero-knowledge.

Highest-value backlog

A mountable interface, if one is wanted — the difference between an object store you script against and a folder you use. New scope rather than a debt: M2 asked for one facade and the S3 one shipped.

Verified, not asserted

Content a peer was never asked for is dropped even when it hashes correctly, and check-proof reports the inode the proof commits to rather than the labels the file carries.

Implemented now

  • Filesystem CLI: `mkdir`, `put`, `cat`, `ls`, `rm`, `mv`
  • Persistent config, device identity, and admin token flows
  • Sled-backed blob and KV storage with tests
  • Canonical object encoding, hashing, and chunked CAS writes
  • CRDT-backed directory and inode state with deterministic conflict naming
  • Signature verification enforced before any state change
  • Pending-operation queue for causally early operations
  • Snapshots committing to both directory structure and file content
  • Admin API and browsable console for state, storage, and oplog
  • S3-compatible objects, buckets, and ListObjectsV2
  • QUIC replication with verified remote apply and pinned peer keys
  • At-rest encryption with per-file keys, still verifiable by peers
  • File keys sealed per recipient, so replicas share no repository key
  • Key rotation, so removing a peer withdraws access from then on
  • Push notification — a write reaches a peer in 0.32s, not a poll interval
  • Signed transparent proofs and a verify audit command
  • Energy-aware replication budgets, observable at /api/energy
  • Garbage collection, an enforced format version, and peer enrolment
  • Merkle state commitments with proofs anyone can check offline
  • Absence proofs, so a deletion is demonstrable
  • On-demand fetch of content a constrained node deferred
  • A maintained inode map, so a one-entry change is not a whole-tree walk
  • Link-cost detection, so the metered rule can fire outside a test
  • A storage-headroom floor replication will not cross
  • Collection of orphaned namespace records, not only blobs

Still in backlog

  • Reading a link's cost through a VPN, and spotting a Wi-Fi hotspot on macOS
  • An incremental Merkle tree — the map is maintained, the tree is not
  • Encrypted file names and directory structure
  • A mountable interface, which is new scope rather than a debt
  • A real proving system, which needs a circuit-friendly hash

Source Of Truth

The markdown status file lives in the repo

The detailed implementation and backlog breakdown is maintained in the `documentation/current-status.md` file alongside the rest of the public-facing docs.

Back To Docs See Roadmap