SEC-08: The YOLO++ Report
sec-08-the-yolo-report
Sovereign Engineering
Build the tools. Ship the future. #SovEng
14 min read
The last week of every cohort we take a ride on the Pirate Ship off Madeira, to see whales, swim in the Atlantic and talk about the pirating we did the past six weeks and the pirating beyond. We pass the mic around asking each participant for highlights of the cohort which is encapsulated in the No Solutions episode "Drinking from the Firehose".
The first response set the pattern for the ride, "Napplets, FIPS, runtimes, shells. More FIPS, more napplets, more shells. FIPS over audio. Zazafication. Better friendships, jams, walks, barbecues."
, who was at SEC-01, had one word; "pain", and said this cohort felt closer to the first one than any since, everyone figuring it out from scratch again.
commented:
A year ago we were talking about where we want to be and what tech we want to have, and there were always missing gaps. Now there don't seem to be many..
Totem is a case in point. Totem is a modular hardware platform running napplets on devices that connect in a mesh. We first imagined it at SEC-03, then shelved it for two years, not because people lost interest but because you could not build it right yet. Gzuuus, who has spent more time at Sovereign Engineering than any human alive said, "Totem never died, it was waiting for FIPS and napplets and runtimes to exist." This summer Totem got built, it had a friend and the two talked to each other.
SEC-08 ran 20 July to 28 August. Six weeks of pure unadulterated YOLO++ with half alumni and half new faces. After the focused sprints of SEC-06 and SEC-07 we went back to open exploration: mesh networking, maps, merchant payments, package distribution, a desktop pet, and a multiplayer game stuffed into one HTML file.
Do you even FIPS yet?
Native FIPS, public-key-addressed application traffic with no IP stack in the way, was reserved for FIPS v2. By the end of this year at the earliest. Then you put
and
in the same room and it is a one-week problem.
The native datagram API eliminates HTTP, TLS, TCP and IPv6 out of the equation. No more npub.fips hostnames. The npub is the endpoint, and it looks close enough to a Berkeley socket. JeffG benchmarked it while wiring it into Wok and the relay got 8 to 58% faster depending on message size. By demo day Wok spoke native FIPS and White Noise was FIPS only. Encrypted group chat with no IPs, and no DNS.
FIPS was in the air again;
sent FIPS over sound. FipWave modulates packets into audio and two laptops hold a conversation across a room with nothing but chirps. Somebody on the pirate ship proposed dolphins next.
-
fips-exit-gate, fips-shield, fips2go and a FreeBSD port (
) - reaching the legacy internet, filtering application-level abuse, putting Android and FreeBSD on the mesh.
-
JeffG's fips-mac installs and runs a FIPS node on a Mac and shows the mesh from the menu bar. Johnathan's fipsctl gives you the command-line view.
-
hzrd149 added FIPS support to nostr-relay-tray, putting your desktop relay on the mesh.
-
demonstrated LUKS over FIPS, remotely unlocking an encrypted NixOS drive.
-
hzrd149's FIPS Pong bridged a game across three machines through a browser tab. His own review: "completely useless, but it worked."
-
and
worked on CruxCoach, which syncs a group's climbing playlist over a local BLE/FIPS mesh without internet access. The app itself can be shared over the same mesh. J also used Android's accessibility features to extract the user's MoonBoard logbook, because the MoonBoard needs to be liberated from its enshittification.
Napplets, runtimes and shells
Nostr is easy to use badly and hard to use well. Key handling, signing, relay selection, caching, encryption, expiry, and on and on. Every client implements all of it, and most implement some of it wrong.
Sandwich spent the past year working on NIP-5D, the napplet protocol. A napplet is a sandboxed, single-purpose app that asks a host shell to handle signing, relay access and storage. It never holds your key, never picks your relays, and doesn't know anything about storage. The hard, security-critical work is handled by the shell.
So to write a Nostr app, you don't have to be a Nostr developer i.e. you. Nostr already hands you self-signed structured data and a client was only ever the presentation layer, but until now, we kept making people rebuild the whole Nostr protocol to build clients. Now, a napplet can be shared over Bluetooth via FIPS, or fit inside a link along with its state which can be run on any of the napplet shells.
-
's RocketShell is a web runtime for NostrRocket.
-
's Uzel is a native Debian napplet runtime. 's nampplets provides a native Rust runtime for macOS.
-
hzrd149's Napplet Portal provides a server-backed host you can reach from your phone.
-
Rage of Empires (Gsovereignty and Yo) - decompiled AoE from the Windows binary and packed into a single 83 MB HTML file, multiplayer running once as a napplet and once as an nsite. As put by a participant, "I thought it was dumb. After a few days I got it. We can reverse engineer so many of the applications from the last generation."
-
Arjen's Myco is a meta sneakernet app over FIPS mesh to share apps and communications. and Arjen worked on file sharing, think AirDrop over the mesh, and André brought it to the desktop with myco-desktop.
-
Nostrocket (Gsovereignty and ) - G started this years ago around an absurdly ambitious question: how do you build a system resilient to psychopaths? Jeroen revived it this cohort, rebuilt as composable napplets. If you are curious, and you should be, go egg them on.
-
Nappagochi (Sherry) turns your Nostr activity into the changing life of your Nostr pet.
-
Anon&Mato (Balas) generates a playable world from your npub. It is beautifully created.
-
XR napplets (Sandwich) - remember Google Glasses? This is napplets on AR glasses! Think HUDs.
Blossoming Hashtrees
We didn't just FIPS, we Nix'd over Blossom(ing) Hashtrees. This one came off a walk, which is the least surprising sentence in this report. A Nix guy and a Blossom dude went up the hill, and came down with Nix packages over Blossom.
Nix addresses everything by hash. Blossom stores blobs by hash. Do you see it now? It was obvious, but the left foot, right foot rhythm was required for left brain, right brain juices to flow and synchronise. By Friday we had Nix packages distributed with no registry.
-
nixstr-cache (hzrd149) and Narwal with its publisher (Julien)- resolve Nix packages over Nostr and Hashtree, blobs pulled from Blossom, served to an ordinary Nix client. The packages arrive through a standard Nix binary cache interface, so you can keep using nix build. Nostr announcements identify the publisher, and Nix checks the cache signatures against the keys you trust. It barely worked by Friday - very promising, the correct state for a Friday before the BBQ.
-
Hashtree explainer (hzrd149) - if you always wanted to know what a hashtree is, it's IPFS without the rest of IPFS.
During the Hashtree talk, someone asked whether a map of the Earth could use one root, with smaller areas fetched as you zoomed in. and went and built Mapplets. They used a modified hashtree for the map and Nostr events for the map data, including Madeira's bus routes. Map tiles load as you zoom, and private overlays are shared with the people you choose.
Just works
Our favourite Poncha bar in Funchal knows us as the Bitcoin people. Its payment terminal had been broken for weeks, so we kept paying in euros. One week a bunch of participants decided to team up and fix the UX.
Just Works ( , Yo and ) was built. Just Works just creates beautiful nsites that just work. It has info, menu, schedules, reviews, news, PoS, payments, etc. and keys.justworks ( ) handles the keys underneath.
Just Works takes every establishment in the area. Scrapes their site and their socials, generates a pretty nsite from it, links back to the legacy profiles so their customers still recognise them, gives them an npub, a QR code and a point of sale, and then it puts all of them on the just works map. And you can just start tipping them because you love your local dive bar so much. The owner ends up with a profile, a site, key management and a pile of sats waiting to be claimed.
It also looks good - which is not a sentence we get to write often. Work this far down the stack and you tell yourself beautiful is somebody else's job, right after the protocol is right. Zaza sat down with people one project at a time and showed them otherwise, ran a workshop and by the last demo day almost everything had been Zazafied.
Then we had Granola ( ), an idea since 2024. At SEC-08 he found people to build it with. It coordinates Cashu atomic swaps over Nostr. Other work explored escrow and dispute resolution in anonymous marketplaces.
-
Meza ( )- lets you zap a highlighted passage and split the payment between its author, the person who highlighted it, and Boris, the reading app.
-
600 Billion Timelock TCG ( and Breno) on Nappelin makes every card in a booster pack a Cashu token, with NUT-22 blinded tokens keeping your hand private. Coloured coins on Cashu, for a card game.
Clankers, data, and the strange stuff
Agents got treated as ordinary users of the network this time. They discover things, pay for things, remember things, and generally make great teammates.
-
's Nostrology exposes Nostr ecosystem metrics over MCP, maps marketplace growth by geography, and accepts Cashu payments for Nutzap data queries. An agent finds a dataset, pays for a query and gets its answer.
-
Nectar explores structured, attestable datasets on Nostr.
-
si-eval explores auditable model evaluation for tasks such as key handling and privacy.
-
MDK and White Noise agents (JeffG)- used agents to generate thousands of test scenarios for MDK and built White Noise/Marmot connectors for the major agent tools. Other experiments involved shared memory in White Noise groups and short “mantras” intended to improve small models' tool calls.
-
Rahul explored agents helping with real-life tasks through Mappy, then put an agent inside a napplet with Kipina.
-
fips.email (Thomas) - accepts email addressed to your npub and forwards it as an encrypted NIP-17 message to your DM relays. He built it for agents, though people can use it too. No FIPS involved. People just love FIPS.
-
Mist (Julien) lets you explore Nostr conversations in clusters.
We worked on hardware too. Totems running napplets in shells connected in a self-healing mesh of other Totems over FIPS. Participants had flown in with cases of tools and equipment to build. Even so, they could not build the things they really wanted, because Madeira has no makerspace. This inspired two of the participants to start one, ready to fund it themselves. and other donors piled in behind them, now Nostr Office is giving the lab a home.
People came here to build things and left behind a place for building things.
Talks and workshops
-
Everyone's AI setup - a fixture now. Every participant shows how they actually work: harnesses, prompts, tools, learnings, etc. No two setups match. You steal two things on day three, then have six weeks to refine and upgrade.
-
In the spirit of Bitcoin (Gigi) - What does it mean to build it in the spirit of Bitcoin? What is the spirit of Bitcoin? Nobody can define the spirit of Bitcoin in a sentence, but you know it when someone violates it.
-
Nostr anti-patterns (Gigi) - the old internet is a habit, and habits follow you. The talk was about habits of the old internet and anti-patterns in Nostr, when deliberately avoided, allow us to be liberated from.
Other talks: A primer on Marmot (JeffG), Construction on Nostr (Felix), Everything is a Stream (hzrd149), TEEs (Gzuuus), History of Maps (FLX), and Messaging Protocols (JeffG and Gzuuus)
Cohort Experiments
We skipped the break week this time. By week four everyone was feeling it. SEC-05 had a detox week at that point, and we will probably bring it back.
In week five, Johnathan paired everyone up and asked them to announce their demos three days ahead. Participants appreciated this and took on more complex problems together. We have tried this before and want to keep refining it.
For one week, demos lasted just a minute. You had to decide what people needed to see and get straight to it. The discussions afterwards were better too, because the demos left more questions unanswered. Someone suggested shortening them throughout the cohort, from six minutes in week one to one minute in week six. We want to try that. G also built the Demo Day Command Center to keep us within our allotted time, which provided plenty of entertainment.
The final week was deliberately quieter. After five weeks of building, Gzuuus suggested leaving more time to take it all in and talk to each other. We rarely get six weeks in the same room with these people, and wanted to make the most of the time left.
Walks and barbecues are still the highest leverage R&D we do. Solvitur ambulando.
Paths forward
We didn't know what Sovereign Engineering really was when we started. We set out with a direction, an unshakable belief to "fix the internet". We didn't know how, and most of the tools did not exist. Eight cohorts on, ideas like Totem can finally be built. There is still plenty to figure out, but we can now build things we could only talk about only a year back.
Cohort after cohort of experimenting taught us what works, what doesn't, and how to run the loop that keeps producing ideas like these. Nix and Blossom happened on a walk. Spending six weeks together gives people time to understand each other's work, try something unlikely, abandon it and try again.
But six weeks is a lot to ask. People have jobs they cannot leave and children in school. Some have spent twenty years finding out how systems fail in practice, and we would love to have them here. Wanting to come does not make it possible.
So alongside the six-week cohorts, we are exploring shorter formats. Maybe a week in a mountain hut, working on one question and building towards a demo.
People have also asked about cohorts in other parts of the world. We want to explore that and work with people building local-first hardware/software and mesh networks who might never have considered coming to SEC.
If six weeks is why you have never applied, tell us what you could make time for. If you want to help organise something where you live, come talk to us.
Closing notes
SEC-08 ran on participants going full tilt for six weeks with no breather, and on the captains: Arjen, Gsovereignty, Thomas, Sandwich, Johnathan and Gzuuus, who each steered the ship for a week and took it seriously. Thank you to Zaza for showing us that our work could look beautiful, to for the BBQs and Ponchas, to the ladies at the Cowork for hosting us, to for the space and dealing with the unglamorous parts of running Sovereign Engineering, and to for the heart he keeps putting into this.
Head over to the projects page, pick something off this list. Try it, break it, go tell the person who made it. Then come build with us.
The pieces be scattered, laddies, but they be ours. Lash 'em together an' sail.
More: sovereignengineering.io | No Solutions
Help keep these ideas circulating
This is an independent project. If you'd like to help support it, you can make a contribution. But there's no obligation at all. Reading, sharing, and coming back is already a form of support.
Read also
1
Bitcoin, Nostr, and building things real enough to trust.
2
Sovereign Engineering is an engine built to spur conversations—and, ultimately, produce new creations.
3
Humans need better key management. For machines, keys are the only path to autonomy.
Want to publish here too? No sign-up, and the text stays yours. Learn how to start
Replies (0)
Loading…