What is live today
1 min read · 210 words
Most of this is already running.
The tailnet is deny-by-default, governed by a version-controlled policy, applied through a CI pipeline that tests on every change and blocks a bad apply. The community node carries a server identity.
The node's public door is closed, proven from outside the network. The only public surface left is the Telegram mail-slot.
The per-item grant system is complete: one book, one person, enforced on read, images, export, edit, shelf, search, the AI's tool lane, the graph, and the collections — hidden everywhere, in every case, for everyone without the grant.
Capabilities have names — svc:community-web, svc:community-models — and members address the name, never the machine. The machine's own address is already invisible to them.
A member's device is their identity, and a share link can carry a book to a phone without a session.
Three migrations are applied to the substrate; the whole thing is pinned by more than sixteen hundred tests; and the settings panel shows a member their place in the forest.
We caught a real bug on the way — an off-by-one in the search floor — because the discipline here is to never trust the last step, to smoke-test the live thing. That, as much as any feature, is the point.