Research-grade · 9 component repositories
Can you read something without leaving a trace that you read it?
That is the single question Nomad exists to answer. Nomad is a working research prototype: the network sends a constant, unchanging stream of equal-sized packets, so nothing an observer can see reveals what any reader is looking for. This page states what has been measured, and nothing beyond it.
9
component repositories
19/19
live testnet gates met
0/30
production gates met
→ operator a · 102 cells · 1200 B each
→ operator b · 102 cells · 1200 B each
→ operator c · 102 cells · 1200 B each
· reader-to-object links observed: none
01 · What it is
A reading path built so that reading is not an event.
Normally, opening a page creates a request that ties you to what you opened. Nomad removes that request. Everything you search for happens on your own machine; the network only ever sends its fixed, unchanging stream.
The stream never changes
Packets are always exactly 1200 bytes and always sent on the same clock, whether you read a thousand things or nothing at all.
No single operator can read it
Three separately keyed operators shuffle the traffic, and it takes two of three shares to decrypt anything. One operator alone learns nothing.
Your search stays on your machine
Searching, ranking and reassembly happen locally. Automated checks in the build refuse to let private choices reach the part that sends packets.
The reader cannot phone home
The macOS client has no network permission at all. It reads finished, signed files from a local folder and verifies every one before showing it.
02 · How a read happens
Six fixed steps, from the wire to the screen.
Each step is separately tested. None of them is claimed to be proven anonymous.
01
Fixed cells
1200-byte packets leave on a signed 20 ms cadence; a missed deadline fails instead of catching up.
02
Network coding
Content becomes 504-byte RLNC packets over GF(2⁸), so any sufficient subset rebuilds the whole.
03
Verified shuffles
Each operator performs one independently randomised Kyber Neff shuffle and signs the transcript.
04
Immutable cache
Only valid encrypted work is stored, written atomically and committed by a digest over the whole batch.
05
Threshold decryption
A 2-of-3 committee from a networked Pedersen DKG proves partial shares; no aggregate secret is ever assembled.
06
Local materialisation
An offline process rebuilds the object, checks hash and signature, and writes a signed .nomadobject file.
03 · How it's built
Nine Go repositories, one enforced separation.
spec
nomad-protocol
Architecture, terminology, threat model and the production definition of done.
network
nomad-constant-rate-fabric
Fixed-size, fixed-cadence traffic scheduling.
network
nomad-anytrust-mix-sim
Payload-preserving Kyber Neff shuffle for the research profile.
coding
nomad-rlnc
Dependency-free network coding over GF(2⁸) with 504-byte generation packets.
private
nomad-semantic-basins
Local vector-to-basin similarity experiments, kept away from the network.
private
nomad-local-reconstruction
Local ranking, decoding orchestration and exact verification.
boundary
nomad-selection-firewall
Emission planning that takes public inputs only — never a private choice.
testnet
nomad-testnet
The live reference deployment, ceremony tooling and the release gate.
client
Nomad-browser
Client contracts plus a sandboxed macOS alpha with no network entitlement.
The rule the build enforces
Continuous integration inspects the dependency graph on every commit: the network side may not import the private selection or reconstruction code, and the private side may not import the fabric, planner or mix. The separation is checked mechanically, not promised in prose.
04 · Evidence
What is measured, and what is not.
Nomad's own documents keep two separate registers: a live-testnet gate and a far stricter production gate. Both are reproduced here unchanged.
Measured on the live testnet
- Datagrams captured
- 102 from each of 3 distinct operators
- Payload size
- 1200 bytes, every packet
- Median interval
- 49.97 – 49.98 ms
- Capture SHA-256
- 630286a8…aa0bb9e6
- Materialised envelope
- e3d49edc…d68fe8b965
- Baseline commit
- 9b246eff…2bb15330
What this does not show
- ·That three independent organisations administer the operators — the single-host deployment cannot prove governance.
- ·Behaviour over a real wide-area network with loss, reordering, NAT and clock faults.
- ·Any reviewed anonymity claim: no third-party cryptographic or traffic-analysis review is closed.
- ·A production-ready system: 0 of 30 production gates are met.
One claim is contradicted
CONTRADICTEDThe project's own testing measures a reproducible timing difference on loopback, which contradicts the claim that cell timing is independent of private activity. It is recorded as CONTRADICTED in the project's evidence index rather than removed.
Open the full register →05 · License & acquisition
Source-available for review. Any use requires a written agreement.
Nomad is published under the Nomad Restricted Source License 1.0. It is deliberately not open source: you may read, compile and review the code, and nothing more.
This page is a description, not an offer, and nothing here grants any right under the license. The license text in each repository controls.
Inspection is allowed
Evaluation, academic research, interoperability analysis and good-faith security or privacy review, in a non-production environment.
Operation is not
No production network, hosted or managed service, product, protocol implementation or browser built on it — in whole or in part — without a separate agreement.
No forks, no training
No redistribution, sublicensing or derivative works; using the code as training data for a general-purpose or code-generating model needs written permission.
Commercial terms are open
A separate written agreement may include a license fee, royalty, revenue share, equity, acquisition or assignment. Governing law is Swedish.
A realistic acquisition path
01
Review agreement
A named party signs an inspection and confidentiality agreement and receives read access to the private component repositories.
02
Technical and legal due diligence
The buyer's own reviewers work through the gate registers, the CI evidence archives and the dependency-separation checks, and can re-run the release gate themselves.
03
Negotiated form
License, royalty, equity or full acquisition — the license explicitly leaves all four open, so the structure follows the buyer's intent.
04
Transfer
Copyright, the Nomad name, domains, CI evidence history and the operator key ceremonies move to the acquirer under a signed assignment.
06 · What remains
What an external audit still has to establish.
These items are taken directly from Nomad's own release gate. They cannot be produced inside one repository or by one administrator, and they are the honest boundary of the work so far.
Independently administered operators
REMAINSAt least three legal or administrative entities controlling separate hosts, credentials, networks and incident processes — five for the production gate.
Wide-area measurement
REMAINSSigned production endpoints reachable over a measured WAN profile, exercised with NAT, loss, reordering, clock faults and regional outages.
Separately run shuffle rounds
REMAINSEach shuffle executed under its own operator's administration; the current fixture bootstrap still holds all demo identities.
Third-party review
REMAINSCryptographic, systems, browser and traffic-analysis review closed with no unresolved critical or high findings.
Publication and admission controls
REMAINSPublication airlock, Sybil and admission policy, forward-secure epoch rotation and revocation live rather than protocol-level only.
Long-duration operational evidence
REMAINSExtended packet captures, key custody and erasure witnessing, rotation and compromise drills, and a real operational response process.
07 · Contact
Talk to the author.
Nomad is authored and maintained by Jonatan Tensetti. Review access, audit questions and acquisition conversations all start at the same address.
Jonatan@tensetti.se