A companion to the platform vision in Universal Nexuspolis and the commons argument in The New Commons and The Grid Commons.
Working document — Sepahsalar Labs / Univrs.io. Comparison matrices, gap analysis, and a sequenced build list.
1. Matrix A — Layer ownership
Who controls what, and on what terms. OSS = public source. SAP = source-available on purchase. Blob = opaque dependency. — = not addressed.
| Layer | Serenum (Smith) | Oxide | Univrs today | Univrs target |
|---|---|---|---|---|
| Silicon | Blob (commodity RISC-V SoC) | Blob (AMD Turin/Milan + PSP) | Blob (4-cloud x86) | Blob, but attested and declared |
| Root of trust / firmware | — (no RoT story) | Own RoT + SP, Hubris, OSS | — | Open-hardware RoT node (OSS + OSHW) |
| Boot | Own, SAP | Own, OSS (no BIOS, no BMC) | Cloud-vendor | Measured boot → attestation receipt |
| Kernel | Own, SAP | Hubris (embedded) + illumos/Helios, OSS | — | VUDO as supervisor, not kernel |
| Runtime | Native RISC-V | bhyve/Propolis VMs | VUDO WASM (partly public) | VUDO, fully OSS, frozen ABI |
| Language / compiler | Brevis, self-hosted, SAP | Rust + LLVM (upstream) | DOL v0.8.x, self-hosted, OSS | DOL as policy surface, not just spec language |
| Executable format | PB, own | ELF + own image formats | WASM + manifests | Content-addressed Spirit, reproducible |
| Network | Own stack, Wi-Fi | Maghemite, OPTE, P4/Tofino, OSS | libp2p + LoRa + SCION track | Multipath: IP / SCION / LoRa, degrade-not-fail |
| Storage / state | Own filesystem | Crucible (replicated block), OSS | MYCELIUM-SYNC CRDTs | CRDTs as DOL language primitives |
| Control plane | — (single user) | Omicron, OSS | Nexus (4-cloud) | Nexus + capability grants as the unit |
| Identity | — | Rack-scoped | Ed25519 | Portable sovereign identity + delegation |
| Economics | Purchase price | Enterprise sale | ENR, mutual credit | Metering in the scheduler, not the invoice |
| Governance | One person | RFD process (public) | Constitutional invariants (design) | Public RFDs + protocol-level invariants |
| Hardware | Product, closed design | Product, closed design | — | OSHW edge node (KiCad + BOM) |
| License posture | SAP with device | MPL-2.0 software, closed HW | Mixed / some private | OSS-by-default, OSHW where trust is decided |
| Capital model | One person, product sales | $344M VC, enterprise | Self-funded + intended grants | Mission grants + commons services |
2. Matrix B — Design philosophy
| Dimension | Serenum | Oxide | Univrs (proposed) |
|---|---|---|---|
| Unit of ownership | The machine | The rack | The capability grant |
| Unit of failure | One person’s attention | One rack, one update domain | One sovereignty domain |
| Complexity budget | ~50k LOC, hard ceiling | Whatever 120 engineers can operate | Explicit LOC + surface ceiling per layer |
| What it refuses | C, POSIX, ELF, LLVM, drivers | Opaque layers, BMCs, vendor blobs | Unattributable action |
| The unownable blob | The SoC | AMD PSP, SSD firmware | Model weights |
| Verification story | One mind can read it | DTrace, Humility, oximeter, RFDs | Deterministic replay of agent execution |
| Update semantics | Write once, run forever | Single rack-wide update domain | Frozen ABI + content-addressed builds |
| Non-determinism | Not a design concern | Not a design concern | First-class design concern |
| Who it’s for | The individual programmer | The enterprise operator | The polity |
| Revenue | Device sales | Rack sales | Mission services + commons credit |
The last two rows are where Univrs is not competing — it is doing something neither of them attempted.
3. Matrix C — Their shortcomings → your openings
| Shortcoming | Whose | Why it matters | Univrs opening |
|---|---|---|---|
| No story for stochastic actors | Both | Neither system was designed for a component that can decide. Every safety property assumes deterministic code. | Capability gates compiled from DOL specs; authority declared before behaviour |
| Openness is partial and inverted | Both | Oxide: open software, closed hardware. Serenum: closed repos, source in the box. Neither is reproducible by a third party. | Reproducible builds + OSHW for the trust-deciding parts |
| Single-operator or single-vendor governance | Both | Smith is a bus factor of one. Oxide is a cap table. | Charter + public RFDs + protocol-level invariants that survive the founder |
| No multi-generational guarantee | Oxide | Rack lifecycle is 5–7 years and vendor-dependent | ABI freeze + content addressing as an explicit 30-year promise |
| No collapse tolerance | Both | Both assume grid power, supply chains, and IP transit | LoRa mesh + local inference + CRDT convergence after partition |
| Economics live outside the machine | Both | Metering is billing, bolted on | ENR metering as a scheduler input |
| No public design record | Serenum | Knowledge dies with the blog | Copy Oxide’s RFD process verbatim — it is free and it is their most transferable asset |
| Model provenance | Both (unaddressed) | The blob of this decade is weights, not firmware | Model attestation + local-first inference + declared degradation path |
4. The five inversions (what “beyond” actually means)
-
The unit of sovereignty is the capability grant, not the box. Smith owns a machine; Oxide owns a rack; you own the right to act. Hardware becomes an implementation detail of an attestation claim. This reframes every build decision below.
-
The compiler is the policy kernel. DOL’s “systems describe what they ARE before what they DO” is already the right shape for this. Extend it so that a Spirit’s declared traits and constraints compile into the WASM host-function surface it is permitted to touch. An agent cannot exceed its ontology because the ontology is the ABI. Neither Brevis nor Hubris needed this; you do.
-
Replay is the new debugger. Oxide’s real moat is not Rust — it is Humility, DTrace, oximeter, and the RFD archive: the ability to explain what happened. For stochastic systems the analogue is deterministic replay. WASM makes this tractable: record every host-function call and return, and any Spirit-plus-agent execution can be replayed bit-exact for audit. Ship this early; it is a credibility artifact for government buyers and a research contribution simultaneously.
-
Weights are the blob — so build the seam, not the purity claim. Oxide is honest that the PSP remains opaque. Be equally honest: frontier weights are not yours. What you can own is the seam: model attestation, capability-scoped inference, a local-first fallback (the Qwen3/llama.cpp stack you already run), and a declared degradation ladder from frontier → local → deterministic.
-
Persistence is a protocol property, not a promise. Serenum’s “write once, run forever” is a marketing claim backed by one person’s discipline. Make it a mechanism: frozen Spirit ABI, versioned DOL spec with a conformance suite, content-addressed artifacts, reproducible toolchain. Then a 2026 Spirit demonstrably runs on a 2056 runtime.
5. What to build — concrete
5.1 Open source (new repos)
| Repo | Purpose | Precedent |
|---|---|---|
univrs/rfd | Public, numbered design record with a real review lifecycle | Oxide RFDs |
univrs/spirit-abi | Frozen ABI spec + conformance test suite + versioning policy | WASI, POSIX |
univrs/oracle (replay) | Record/replay debugger for Spirit + agent execution | Humility, rr |
univrs/attest | Measured boot, SBOM, model provenance, attestation receipts | in-toto, SLSA, Sigstore |
univrs/capability | Capability grant format, delegation, revocation, expiry | macaroons, UCAN, ZCAP |
univrs/conformance | Runs the ABI + capability + CRDT convergence suites against any implementation | WPT |
univrs/gov-controls | NIST 800-53 / 800-171 / AI RMF crosswalks, SSP templates, as OSS | OpenControl |
Everything else already exists in some form (dol, vudo, enr, network, nexus). The discipline is: no new capability repos until these seven exist.
5.2 Open hardware — narrow, not heroic
Do not attempt a sled. Oxide spent nine figures and still ships vendor firmware. Build open hardware only where trust is decided:
- Node R0 — sovereign edge node. RISC-V SoC (SiFive/StarFive/Milk-V class) + LoRa radio (Meshtastic-compatible) + open secure element (OpenTitan-derived or LPC55-class) + measured boot into VUDO. KiCad sources, published BOM, CERN-OHL-S licence.
- Deliverables that make it real: schematics, gerbers, BOM with second sources, a build guide someone else can follow, and a conformance-passing reference image.
- Why this and not a server: it is the artifact that makes “sovereignty” checkable rather than rhetorical, it is fundable at grant scale, and it is the piece that survives infrastructure failure.
5.3 Services — government mission track
Sequence it as capability → credential → contract:
- Beachhead deliverable. Pick one civic service where the infrastructure claim is visible and the outcome is measurable. (Your Direct File fork is the obvious candidate — verify its current federal status before you anchor a narrative on it, since the programme’s position has moved.)
- Compliance as open source. Publish the control mappings, SSP templates, and SBOM/attestation pipeline. This is unusual, cheap, and it converts your Cargill FedRAMP/CMMC experience into a public good and a moat simultaneously.
- Entry paths worth pursuing in parallel: SBIR/STTR (DoD, DHS, NSF), DIU solicitations, state digital-service contracts (lower barrier, faster), and research grants where the replay/attestation work is the deliverable.
- Positioning. Sell verifiable sovereignty: reproducible builds, attested execution, replayable agent decisions, and continued operation under partition. That is a procurement-legible sentence. “Post-liberal cultural framework” is not.
6. The cultural layer — how to make it load-bearing
You already hold the right instinct: resistance must be encoded at the protocol level, not the policy level. Make that concrete.
| Principle | Protocol mechanism |
|---|---|
| Subsidiarity (Swiss federalism, satrapy) | Sovereignty domains with local-first authority; upward delegation is explicit, scoped, and revocable |
| Ostrom: clear boundaries | Capability grants with named holders and expiry |
| Ostrom: graduated sanctions | Entropy tax / credit degradation rather than binary exclusion |
| Ostrom: nested enterprises | Domain hierarchy in Nexus, with no root authority |
| Multi-generational persistence | ABI freeze + conformance suite + content addressing |
| Narrative as institutional technology | Lion & Swan canon versioned alongside the spec, in the same repo |
| Refusal of absorption | No privileged operator role anywhere in the protocol — if you can be compelled, so can the system |
One piece of honest advice on framing. “Post-liberal” is a contested label that reads very differently to a grant reviewer, an academic, and a contracting officer, and it will cost you in at least two of those rooms. Keep the philosophical work in the Sepahsalar publication track, where the argument can be made properly. In the infrastructure and procurement track, use the operational vocabulary — subsidiarity, commons governance, digital sovereignty, continuity of operations. Same commitments, no unforced translation loss.
7. Honest constraints
- Surface area is your Serenum problem. DOL, VUDO, ENR, Nexus, SCION, LoRa, Cogito/JEPA, Imaginarium, Direct File, plus the publication track. Smith’s 50k-line ceiling is the real lesson, and it applies to fronts, not just lines. Freeze at least three of those before starting the seven repos above.
- Self-hosting is not the milestone people think it is. DOL self-hosting is genuine, but Brevis self-hosted in 2022 and Serenum still has no third-party users. The milestone that matters is someone else’s Spirit, built from your published spec, passing your conformance suite.
- Serenum’s last release was January 2025. One person, twenty months, no release. The failure mode is not technical.
- Open hardware is a three-year commitment minimum once you have a board that boots. Budget for revisions, not a rev A.
- The government track has an 18–30 month lead time. Start the credential work now so it matures alongside the technology, not after it.
8. Sequencing with gates
| Gate | Proof required | Unlocks |
|---|---|---|
| G1 — Legibility | rfd live with 10 RFDs; spirit-abi v1 published; conformance suite runs in CI | External review, citation, contribution |
| G2 — Accountability | oracle replays a Spirit + agent session bit-exact; attest produces a verifiable receipt | Research publication; procurement conversations |
| G3 — Independence | Third party builds a Spirit from published docs and passes conformance | Claim “platform” honestly; Imaginarium launch |
| G4 — Sovereignty | Node R0 boots measured into VUDO; two nodes converge over LoRa after an IP partition | Open-hardware release; mission pitch with a demo |
| G5 — Mission | One civic service running on the stack with published controls | Contract track, grant renewal, the political argument made materially |
Nothing after G3 is worth attempting before G1 is done. G1 costs weeks and is the highest-leverage work in this document.
Sources for the comparative claims: Oxide’s public repositories and RFD archive; samhsmith.com and serenum.computer release notes; Handmade Seattle 2023 demo. Univrs state as recorded in project context — re-verify before relying on specifics.
Sources
- Univrs project context and internal architecture notes (VUDO / DOL / Skills, mycelial-network crates, ENR economics) — re-verify specifics against the live repos before relying on them.
- Handmade Seattle 2023 demo (referenced for the systems-programming / hand-built-tooling lineage).
- Comparative platform reads used for Matrices A–C draw on the design philosophies and published limitations of the incumbent agent/cloud platforms discussed in-text.
Part of the Univrs research ecosystem:
- Research: metalearn.org · ardeshir.io · sepahsalar.org · univrs.io
- Creative: imagine.univrs.io
- Code: github.com/univrs · github.com/ardeshir