Continuity without contact data
A person should be able to return, receive questions, and answer without first surrendering a conventional identifier.
Open-source application infrastructure Experimental · Flegias casework is planned, not live
Secure infrastructure
for sensitive work.
Build confidential, resilient applications over infrastructure that must not be trusted with plaintext.
For human-rights and civil-society teams, journalists, safeguarding organizations, trusted intermediaries, and the developers who support them.
01 / Boundary Delivery systems move encrypted state. They are not entrusted with application plaintext.
02 / Continuity Sensitive work extends beyond one message: state, evidence, roles, recovery, and follow-up matter.
03 / Evidence Every security and maturity claim is bounded by what the repository can demonstrate today.
Latest progress · October 2026
Encrypted messages, real networks,
nothing for the relay to read.
Styx now carries end-to-end encrypted messages between machines on different networks over public Nostr relays, delivers them through failures, and turns away an outside attacker. Here is the recorded test run.
Text description of the recording
- Encrypted message across two networks. Alice, on one network, sends a message to three public relays. Bob, on another network, receives the encrypted event, decrypts it and reads the text. Alice gets Bob's signed receipt.
- What the relay operator sees. A captured relay frame with TLS removed: the content is MLS ciphertext. Next to it, the text Bob reads after decryption, which only a group member can do.
- Faults. Alice loses one relay; another relay carries the message. Then her network stalls; she keeps the message queued, retries, and it is delivered and acknowledged.
- An attacker from outside. Mallory runs on a server outside both networks, reads the public relays and holds no group key. She replays a message (not delivered a second time), alters one (two relays refuse it; her re-signed copy is discarded), injects her own (discarded) and forges a delivery receipt (Alice ignores it: only Bob can sign Bob's receipt).
- Summary. Four messages sent, four received; the relays saw message content only as ciphertext; nothing Mallory published reached the application.
- 01
Across real networks
Two machines on different networks exchanged MLS-encrypted messages over three public Nostr relays.
- 02
Ciphertext is all the relay gets
With TLS removed, exactly what a relay operator receives, the content is MLS ciphertext, byte-identical at both ends.
- 03
Delivery through failures
A relay cut off, the sender's network stalled: the message was queued, retried, delivered and acknowledged.
- 04
Attacker turned away
Replay, tampering, injection and a forged receipt from outside: nothing she published reached the application.
- 05
Ahead of plan
Milestone 1 complete. Milestone 2 at 31 of 41 tasks, 1,514 of 1,514 tests passing. Milestone 3 started early.
Why it matters. Whistleblowers, journalists and the people who handle their cases need to work over infrastructure anyone can run, without trusting whoever runs it with their words. This delivery layer is the base for Flegias, our Milestone 4 goal.
Limits: synthetic data · prototype test harness, not yet the SDK client · one sample per attack · pre-audit.
Read the progress notes in the repositoryThe mission
Confidentiality is a boundary.
Trust is a system.
Sensitive relationships need more than an encrypted message.
Styx is a platform-neutral secure application substrate. It is being designed to combine self-custodied identity, end-to-end-encrypted collaboration, verifiable state transitions, offline operation, and redundant delivery.
Reporting, safeguarding, source protection, and protected coordination need clarification, assignment, receipts, evidence history, retention, recovery, and asynchronous replies. Conventional systems often bind that continuity to identifiers or a central plaintext authority.
Styx separates product policy from application state, secure sessions, and runtime custody. It is infrastructure for applications, not a general-purpose messenger.
Read the public project briefThe problem
A secure channel is not yet a safe workflow.
End-to-end encryption protects content within a defined threat model. It does not automatically solve identity exposure, durable state, delivery truth, endpoint compromise, metadata, or organizational procedure.
State beyond chat
Cases need verifiable transitions, roles, receipts, deadlines, retention, and recovery—not an ambiguous stream of messages.
Infrastructure with limits
Relays can carry encrypted material while still observing metadata. Browsers, endpoints, recipients, and operators remain in the threat model.
Who it is for
Built around the people who carry sensitive responsibility.
- 01People reporting abuse, harassment, discrimination, wrongdoing, or safeguarding concerns
- 02Human-rights defenders, journalists, civil-society teams, and trusted intermediaries
- 03Organizations managing confidential cases with least-privilege roles and continuity
- 04Developers building casework, evidence, coordination, or other sensitive applications
Four-layer architecture
Product meaning stays separate from cryptographic transport.
No current implementation is intended to be the normative protocol.
A language-neutral, transcript-only corpus now provides cross-runtime
evidence while the application protocol remains incomplete and C0.3
remains NO-GO.
- 04Human purpose
Planned first vertical
Flegias product experience
Workflow, roles, policy, safety language, and accessible reporter and operator interfaces.
- 03Durable meaning
Conformance evidence on main
Styx application protocol
A fully synthetic transcript corpus is replayed independently in Python and JavaScript against adversarial mutations. Corpus construction is complete; protocol completion and implementation alignment are not.
- 02Protected exchange
Bounded evidence
Secure-session profiles
Membership, epochs, continuous group key agreement, convergence, and confidential delivery. Exact-pin interoperability is proven only for the isolated Phase B scope; a supported product adapter remains future work.
- 01Local custody
Browser foundation exists
Runtime profiles
Key custody, encrypted storage, workers, notifications, distribution, and platform integration. A future signed native profile could offer stronger origin assurance.
The first vertical
Planned · not yet available
Flegias by Styx
Confidential case intake with a path back to conversation.
A reporter would create a fresh case context and high-entropy return capability locally, submit an encrypted case object, and use that capability later to receive questions and send answers—without an ordinary account.
Organizations would need role-based intake, assignment, rotation, revocation, retention, controlled export, continuity, and minimized administrative audit. Safe deployment also depends on trained handlers, independent escalation routes, legal and privacy review, incident procedures, and tested backups.
Flegias targets anonymity or pseudonymity only against declared observers under tested conditions. Network, device, timing, content, and human factors may still identify a reporter.
Explore the anonymous-dialogue use caseEvidence today
Foundations to build on.
Not a finished product.
Implemented evidence is deliberately separated from Draft and planned work.
Reference evidence
Application-state experience
A tested Dart reference ledger covers signed event chains, causal clocks, deterministic merge, offline outbox, retention and recovery. It is not normative or interoperable with the browser stack.
Inspect the reference evidenceBrowser foundation
Encrypted session path
The JavaScript stack contains a 1:1 MLS reference chat, authenticated QR pairing, Nostr validation, encrypted local custody, and pinned WASM boundaries. Current envelopes still expose metadata.
Review the capability assessmentBounded result
Exact-pin interoperability proof
At the revisions recorded in the final Phase B report, Styx interoperated with the pinned MDK peer through a bounded synthetic direct-MLS lifecycle. This is not general Marmot conformance or product activation.
Read the bounded Phase B verdictApplication-protocol evidence
Synthetic C0.3 conformance corpus
A transcript-only corpus, independent Python and JavaScript replay, and a closed adversarial mutation registry are merged on main. This is corpus evidence—not implementation conformance, a security audit, or product readiness. C0.3 remains NO-GO.
Proposed funded roadmap
From tested foundations to a controlled pilot.
These are proposed engineering outputs, not delivery promises. Each security-sensitive change remains subject to a bounded contract, independent review, exact tests, and human approval.
Status as of 19 October 2026.
- 01
Protocol and conformance Milestone 1 closed
The transcript-only synthetic corpus and cross-runtime replay are merged. Milestone 1 added a bounded application-core interface contract and a Python reference evaluator. Remaining protocol decisions, conformance work, and implementation alignment stay separately gated.
- 02
Secure-session persistence In progress
Milestone 2 saves the MLS session into the encrypted browser vault and restores it after a restart or crash: authenticated records, all-or-nothing commits, a single writer, and restore that fails closed. Core modules are integrated on a review branch: 31 of 41 tasks done, 16 components in, and all 1,514 tests of its 18 suites passing. Browser and fault-injection trials and a closing security review remain. Target: a controlled-beta test profile, not production.
- 03
SDK and reliable delivery Started early
The public SDK interface and the delivery-layer contracts (queue, bounded retries, receipts, multi-relay publishing) are ratified. Implementation started on a separate branch, ahead of its funded milestone: the queue, retry, multi-relay and receipt modules are integrated and already ran in the recorded test run.
- 04
Flegias alpha
Build text-first accountless case intake, return dialogue, operator roles, revocation, retention, and safety UX.
- 05
Distribution assurance
Strengthen browser release controls and decide a future signed native profile with reproducible operations.
- 06
Audit and controlled pilot
Commission independent review, remediate findings, test procedures, and pilot only within an approved scope.
Security boundaries
No absolute claims.
Security is a set of declared conditions, not a badge.
The browser profile is weaker against an adversary controlling the web origin. Reproducible WASM does not authenticate every script delivered to a user.
Current delivery exposes routing, timing, size, and relationship information. Additional relays can improve availability while increasing the observer set.
End-to-end encryption does not protect a compromised device, keylogger, screen capture, or content copied by an authorized recipient.
IP addresses, browser fingerprints, writing style, attachments, monitored networks, and colluding infrastructure may identify a person.
Pruning cannot guarantee physical erasure from flash storage, backups, screenshots, or third-party replicas.
Styx has not completed an independent complete-product audit. Upstream review does not transfer to Styx integrations or operations.
Open-source strategy
Inspectable by design.
Specific about the terms.
Original Styx software and documentation are licensed under AGPL-3.0-or-later. Six exactly enumerated interoperability vector files use Apache-2.0 so independent implementations can reuse that evidence. Third-party components retain their upstream terms.
External code contributions are temporarily paused while contributor terms are defined. Issues, reproducible feedback, and private vulnerability reports remain welcome. Project names and official visual identity are governed separately from source-code permissions.
Evidence before promises
Help make sensitive software worthy of trust.
Inspect the architecture, challenge the threat model, reproduce the evidence, or bring a bounded use case. Never include sensitive information in a public Issue.