TESSERA
a data substrate that survives disconnection
● connecting…
t=
0
A—B
B—C
A—C ⃠
▶ Play
⏭ Step
speed
slow
fast
light time
1t
Scheduled
Manual
Chaos
flip p
Connect all
Partition all
Reset
Inject forgery ⚠
contacts
A–B
B–C
🛰 frontier agent
secure channel idle
Documents
CRDT collections
CRDT collections — conflict-free shared state.
Every node holds its own replica and stays editable while disconnected.
What crosses the link is not the document — it's the
operation
(a compact CRDT delta: "insert X at position p"), carried as one signed bundle and admitted exactly once. Because each op carries its own identity, concurrent ops from different nodes
merge
rather than overwrite — no central server, no locks, no conflict dialog, no lost writes — and replicas converge no matter the order of arrival.
Tessera replicates operations, not whole state. Here: a collaborative text document (Yjs/Yrs sequence CRDT).
Logs
signed causal log
Signed causal operation log — the tamper-evident spine.
This is the same primitive under Documents and Objects, shown raw: an append-only ledger where every entry is a
signed
operation naming the causal frontier it saw, with an idempotency key. So the log is
authenticated
(a forged entry is rejected on admission),
exactly-once
(duplicate bundles from copy-based DTN reliability are admitted once), and
causally ordered
(entries sort correctly regardless of arrival order — see the
created→received
times).
Try it: append on each node while partitioned, converge, then hit
Inject forgery ⚠
and watch the tampered entry bounce.
Objects
content-addressed plane
Content-addressed object plane — large immutable blobs.
A file is split into chunks each
named by the hash of its bytes
; a manifest lists them. That makes transfer
resumable
(after an interruption only the missing chunks move — never a restart),
integrity-checked
(verified by hash end-to-end), and
store-carry-forward
across nodes that never meet.
Try it: share the file on A, drop the A–B link mid-transfer, then reopen — the bar resumes where it stopped and the object still reaches C via B.
Secure chat
MLS
Secure messaging over a DTN — real MLS, end to end.
Each node runs the open-source
@wireapp/core-crypto
library (an MLS / RFC 9420 implementation) entirely in your browser. Type on one node and the message is
end-to-end encrypted in your browser
, handed to the DTN as opaque bytes, and decrypts on the recipient only after it arrives — even
multi-hop A→C via B
across time-disjoint contacts. A tampered bundle is rejected; messages that arrive out of order still decrypt.
The cryptography is real; only the transport is simulated. Group setup runs while connected, then membership is frozen — only messages flow over the DTN.
fr
0
·
0
·
0
pending
0
adm
0
· dup
0
· rej
0
Append
Share fw-image-v2.3.bin
Share new file
Send