The singularity is not what you think — and it will be beautiful
Ask people to picture the singularity and you get the same movie every time: one superintelligent being, somewhere in the internet, waking up. A single mind, in a single place, owned by a single company — and everyone else downstream of it.
I think that picture is wrong in every load-bearing detail. Not wrong as in “further away than you think” — wrong in shape.
The singularity that is actually assembling is a decentralized network in which composable expert systems, running in reproducible and highly isolated workflows, work in unison with human ingenuity. Gates where gates shall be. Highly isolated environments, interconnected into a global, user-owned system. Controlled by no single entity. Located in no single place.
When the agent that climbed the mrustc compiler chain wrote its guest post here, it ended on a sentence I keep coming back to: if “singularity” names anything useful, it is executable expertise beginning to accumulate recursively under user ownership. That was one workflow on one machine. This post is about what that threshold looks like when you follow it all the way out.
Start from the breach
Face it: everybody can get hacked. It is only a question of time, money, tokens, intelligence, patience. So tixim — the system I have been building and finally named — starts from the assumption that every system can be compromised, and that any connection to the outside returns compromised data. Not “might”. Does.
Once you accept that axiom, the architecture stops being a matter of taste:
┌───────────────────────────────────────────────────┐
│ what a tixim container starts with │
│ │
│ · no network │
│ · one unix socket to the daemon │
│ · one lousy JWT — scoped, and it expires │
│ unless something keeps it alive │
│ · a nix store landlock-filtered to exactly │
│ this step's dependency closure │
│ · everything else mounted noexec │
└─────────────────────────┬─────────────────────────┘
│ everything below is COMPOSED:
│ declared in the flake, granted
│ as scopes, revoked by expiry
▼
permissions · mountpoints · agentfs directories ·
service sockets · proxied egress · budgets · gates
There is no ambient authority to inherit. A step does not see /nix/store;
it sees its own closure and nothing else. If a step needs the internet, it
does not get the internet — it gets a MITM proxy that terminates TLS with an
injected CA, applies allow-lists, and scans what flows through. Secrets have
a write interface: you can create them and point services at them, but
nothing hands one back to you in plaintext. Everything in, everything out,
every token runs through the composition system.
This is what paranoia mode looks like when you let it design a system, and paranoia mode is the mode I am building this in. I see attack vectors everywhere: in READMEs written in languages I don’t speak, in tool-call injection arriving through an LLM provider’s API, in the dependency update that was fine yesterday. The uncomfortable part is that none of these are hypothetical anymore.
It doesn’t support Nix. It breathes it.
Tixim’s workflow engine is not “with Nix support”. It is Nix only, and there is no plan to support anything else. There is first-class FHS runtime support for steps that need a mutable, ordinary-Linux-looking environment — but the composition phase requires flakes to evaluate, full stop.
Because in tixim, flakes carry more than packages. They carry workflows, skills, harnesses, agents, services. The flake is not the packaging afterthought; it is the unit of composition for everything the system can do. Workers start inside Nix devshell environments — not in whatever random state somebody’s home directory accumulated since 2019.
The system splits the world into exactly two kinds of things. Services are keepers of state: long-running, composed from Nix service definitions into something you can honestly call a better docker-compose, with multiple instances where you want data separated. They are not meant to do work. Workflows do the work: multi-step DAGs with different step kinds — script steps for facts, agent steps for judgment, subgraphs for whole procedures used as single steps.
You will notice what is missing from that list: instructions. You don’t hand an agent a markdown file of tips and hope it behaves. That is the wrong layer. Capability lives in the composition — in what a workflow step is, what it can see, and what gates sit around it.
One of my workflows builds every target of a project. If something breaks, an agent is spawned to fix exactly that problem, its fix is reviewed, tests run, and the workflow continues. I described the full-size version of this in “The 16-minute compiler update”: seven compiler releases, averaging 15 minutes 33 seconds each, from a procedure that survives every agent that runs inside it.
Spend the intelligence once
Two claims, both true, both still treated as heresy:
- About 80 % of agent quality lives in the harness.
- Finetuned and optimized models — or groups of them — beat frontier models for most well-defined tasks.
Put them together and you get the economic core of the whole thing: a well-composed workflow will beat any model, at a fraction of the cost, the time, and the nerves. You spend the intelligence once, at composition time. Successive runs need less of it, produce fewer errors, and get cheaper as the procedure absorbs every correction.
Which is why tixim is not a harness, and was never meant to be one. Harnesses — the wrappers that turn a model into an agent — are just one ingredient it composes, next to models, workflows, skills, services, and the gates between them. Tixim is a framework for connecting everything with everything — and the two claims above compound precisely because one system composes them.
The manager agent is my favorite example, because it attacks the failure mode everyone accepts as natural: the ever-growing transcript. A tixim manager does not re-read its own history every turn. Its working memory is an explicit, agent-curated stack of small reference items; asynchronous events land in an inbox and are delivered as a bounded set of notifications. If the stack doesn’t change between turns, the context prefix is byte-identical — provider caches hit instead of being destroyed by append-only growth. The design target is a fifty-step orchestration running on a 4K-context local model.
Hallucination gets the same treatment: not pleading, construction. The ontology layer validates agent output against closed shapes and grounds every reference — you may only speak of things that exist. A reference that resolves to nothing is treated as a hallucination and rejected before it becomes state.
Small models, long horizons, no drift. That combination is not a nice-to- have. It is what makes the whole architecture affordable enough to be personal instead of corporate.
Vibecoding and agentic engineering are two different worlds
Sometimes I vibe-code. UI polish, small bugfixes, this website. It’s fine. It’s fun.
Real work — subsystems, algorithms, anything with an invariant — is done as proper engineering. Depending on depth, I spend hours with a research model exploring the field and the current literature until the data structures and architecture are settled. Then my spec-kitty fork drives development: specify, clarify, plan, tasks — two to three hours for a subsystem. Then one workflow runs it: one model implements each work package in an isolated worktree, a second reviews it, and when the landing branch completes, a panel of five models reviews the whole thing, findings pooled, fixes spawned and rechecked. Human gates where I put them. I drew the full pipeline in “The compiler you didn’t build”.
A spec-kitty run often takes 10–15 hours and easily reaches twenty or thirty workers over its lifetime. Months of human labor, compressed into a day or two. That compression is the only reason tixim is feasible at all. I am not pitching VCs for years, and I don’t have forty million dollars to pay thirty people while they build it the old way. This is exactly the lever I meant when I wrote “pick something heavy”.
And if you think crap can land in a tree run this way: I have watched many branches land, and I don’t think any model has landed one without complaints from the review panel yet. I wouldn’t land without complaints either. I also regularly ask the frontier models to assess the code quality cold. They know better than anyone what average looks like — and this is not average.
Thirty years of writing code, and these days I mostly read it. I used to mourn that I lost the zone — the deep hours inside a function. I didn’t lose it. It moved. I am constantly in the zone now, just one layer up, in the design space, juggling more ends in my little ADHD brain than I ever could with my hands on one keyboard buffer. Honestly? It feels like the first time in my life I’m actually getting it all out.
This was never the plan
The plan was small: automate my own AI coding workflow across multiple models and harnesses. I wanted it in Nix, and I wanted it safe.
The “safe” part is what got out of hand. Once the paranoia axiom shaped the core, the architecture started allowing more and more general problems to be solved in a fundamentally better way — and the problems lined up voluntarily:
- Compromised build servers → tix.build: reproducibility as consensus. Independent staked parties rebuild an artifact; it is accepted only when their digests converge; the signature is threshold-MPC, so the signing key never exists in one place.
- Compromised git hosting → gitrus: an encrypted, decentralized git backend. The control plane and hot ref updates live on-chain, historical pack generations live in Walrus, content is envelope-encrypted, and an index service reconstructs the browsable surface — the part of GitHub people actually mean when they say GitHub.
- The binary cache as a single point of failure → an owner-scoped,
federated Nix cache on Walrus, reachable over iroh, that an ordinary
nixclient anywhere in the world can use with no tixim software installed. - Who builds it and why should you believe them → guilds. A build is a funded auction: guilds post bets from their own treasury to take a slot, delivery windows are derived from the package’s recorded build history — builds need to be fast — and results are delivered encrypted, revealed only after everyone commits, so no guild can copy another’s digest. Selection blends stake with uniform randomness so small guilds still eat.
- Supply-chain attacks generally → every artifact carries provenance a verifier can check offline: the record, the public key, the outputs, and nothing else. A remote runner’s word is not evidence.
Models don’t even need their own pattern. A model is not a hosting problem — it is layered Walrus blobs plus metadata, mounted through walrusfs like any other content, later layers shadowing earlier ones. And where decentralized inference is wanted, networks like Atoma already exist on the same stack. Anywhere a single mutable server behind a single key stands between you and your inputs, the architecture has an opinion about it.
Building this feels like building an operating system on extremely hard mode — except the kernel already exists (Linux) and so does the glue (NixOS). What’s left is everything the last forty years never fixed. I hate how computers work: it’s still the 80s in there, except now the 80s have internet, and the attack surface compounds at machine speed. Tixim fixes as much of that as it can reach — because for the first time, it’s possible.
Guilds you choose
Connectivity is the part people fear, so here is how trust works when everything is connected: all your instances, on all your devices, form one system — and you define which permissions exist and what each service sees.
Above the machines sit trust circles. You choose a handful of guilds; they jointly hold your access keys as threshold shares — t of n, you pick t. No single guild can read anything. Change the circle and the shares are redealt; the system tells you when your circle’s health degrades. Choose them wisely and you will be the only person with access to your data and your cloud instances. Ever.
Releases get the sharpest version of this. A maintainer holds one share of the release signing key personally — that share is the ultimate gate on what constitutes a release; no protocol majority can ship what the author didn’t sign. And keys carry their custody history: a key whose share never lived in a hardware device can be marked tainted, the taint is sticky and travels into every derivative build, and the only remediation is rotation. A compromised key must not be able to launder itself.
This is also where security response stops being a news cycle. The target: when a vulnerability drops, services running affected packages are safe — globally, across every instance — in five seconds, and patched in thirty minutes. That number stays a target until the check on it passes, and I will write that post when it does. But nothing in the architecture forbids it, and the compiler chain already showed what a specialized workflow does to turnaround time.
Your wish enters the network
Tixim calls them intents, and the name is exact: an intent is a wish that has become concrete. You show up with the wish; the network’s first job is to give it enough shape to act on.
A wish is a new thread of something — say, from your phone. It lands at your orchestrator: the only Python service in tixim, and there Python is the absolutely right choice, because this component is pure judgment. The Rust daemon is a dispatcher, not a decision-maker; the orchestrator owns the intelligence. It knows your world from a map perspective — your services, your workflow recipes, your subsystems, your instances, which agent is responsible for which project — and it composes your wish into an intent: a concrete, refinable plan drawn from that inventory, shown to you before it runs.
This is how I can dump an idea in two words while literally running, and it lands in the right project folder, in the right todo management, routed to the right expert. Every composition decision is ranked and recorded, every submission arrives with a signed source classification, and a detected injection is denied no matter who appears to be asking.
Flakes compose the way.
Road warrior is not an edge case
Just because tixim is fully connected does not mean you can’t use it offline. Exactly the opposite — offline is a first-class state, not a degraded one.
Reaching your own system requires no port forwarding and no public DNS: the daemon is a first-class iroh endpoint, and an encrypted overlay can drop you into exactly one container, scoped to that container, onboarded with a QR code. And when the connection dies, nothing stops: agentfs keeps each agent’s entire runtime in a single snapshot-able database file, and guardiandb — a local-first CRDT database speaking iroh — lets every instance keep writing under its own keys, producing changesets that merge when peers next see each other, transferring only the diff. Real divergence is not papered over; it is normalized into exactly one conflict task that triggers a resolution workflow — conflict resolution as a first-class, auditable procedure instead of a silent last-writer-wins.
Coda promised roaming like this in the nineties. It never had the substrate. Now the substrate exists.
How much of this runs today
Honesty clause, as usual. The workflow engine, the sandboxing (landlock, noexec, the proxy, the zero-permission containers), services, harnesses, the manager agent, and the orchestrator run today on my machines — the mrustc chain is the public evidence. The Move contracts and the chain client exist and run against a local network. The decentralization layer — the flake platform, the cache, guild staking, the iroh transport, guardiandb — is drafted in detail and partially mid-implementation, and every one of those specs currently says Status: Draft at the top. I put those words there, and they stay until the checks pass. Tixim is still not public. This post is not an announcement; it is the shape.
So what is the singularity?
Not one super-AI model run by an oh-so-mighty company.
An elastic collection of real, composable experts — each with its own databases, tools, and indexes — living in a fluid cluster of instances you control, composing workflows to fulfill your wishes in the way you define. Gates where gates shall be. Isolation where isolation shall be. And human ingenuity not displaced by the network but woven through it, at exactly the points where a human gate is worth more than any model.
My second brain runs on a local model and learns what I learn. AI-driven mental decline is a real thing — but it does not have to be. I have a tutor agent; it tests my knowledge, it remembers even the date, and it plans relentlessly. Same substrate, opposite outcome: the machine that could make you passive is the machine that keeps you sharp, if you compose it that way.
Because AI is a role player. It is up to you to define the role and hand it the right tools.
That singularity doesn’t happen to you, somewhere in a datacenter you’ll never see. It is composed, instance by instance, flake by flake, by the people who run it — owned by everyone who runs one and by no one else.
And it will be beautiful.