What we have built.

Privacy of this kind is a function of time: the protection comes from staying in, which is exactly the period when capital would otherwise earn nothing. Sacred Finance made that period productive, so a depositor earned across the window they were already committed to, and the return never became the thing that identified them. The work ran through three networks as costs demanded, and the final architecture came from having been wrong about the first one.

• —Private yield, introduced where privacy had meant giving up the return
• —Contracts and proving circuits independently audited, remediation complete
• —Yield earned across the privacy window rather than in spite of it

Role

Research, architecture and development

Status

Shipped

Stack

Solidity · ZK-SNARKs · Merkle trees · Relayers

• Read the audit report→

Every straightforward way of doing this leaks something. Rewarding people by name is trivial, but rewarding them by duration while knowing neither their name nor their transactions is not, and no existing method worked. The mechanism was designed, tested, ported into the contracts, and audited.

• —The mechanism behind private yield, designed because none existed
• —Prototyped, ported to Solidity, and independently audited

Role

Research and development

Status

Shipped

Stack

Solidity · JavaScript · ZK-SNARKs

The finding was that building there needed materially less infrastructure, and that bridge modules were quick to write and easy to replicate. The honest cost was recorded too: adopting it meant restructuring the existing codebase substantially. The recommendation was a management judgement rather than a technical one, that where two credible approaches compete you ship both and let users decide.

• —Noir evaluated at alpha, including why an intermediate representation decouples the language from the proving backend
• —A recorded recommendation to ship both approaches rather than pick early

Role

Research and prototyping

Status

Research

Stack

Aztec · Noir · Solidity

Two groups discussed the same sensitive topic, one anonymous and one not, observed throughout and interviewed afterwards, with the transcripts also analysed for sentiment. The discussion did improve under anonymity. The architecture put content on decentralised storage and kept only the hashes and their relationships on chain, which is what let posts, comments and ownership hang together without a database anyone had to trust.

• —A controlled study on anonymity in discussion, run and published
• —Content on decentralised storage, relationships recorded on chain
• —Editable posts on immutable storage, with every prior version publicly verifiable

Role

Research, product and development

Status

Shipped

Stack

Solidity · ZK-SNARKs · IPFS · Next.js · Relayers

You can know that everyone in the room is from one department without knowing whether you are talking to the head of it. That is the whole value, and the hard part is that a platform which cannot identify anyone also cannot attach anything to them, so reputation, moderation and voting weight all have to work without identity.

• —Membership and credential proofs that reveal nothing but the fact itself
• —Built as modules, extended across multiple networks

Role

Research and development

Status

Shipped

Stack

ZK-SNARKs · Solidity · Semaphore

Summary, arguments for and against, second order effects, each generated independently and assembled. Because a full analysis takes long enough to break a request, the server returned a handle immediately and a background worker did the work while the client polled for it. Demonstrated to real users, whose main complaint was that the output was too long, so it was shortened.

• —Parallel multi analysis of a single document, assembled into one view
• —Background worker and job polling, because the honest answer was slow
• —Built to run inside the product or to be called as a separate service

Role

Research and development

Status

Shipped

Stack

LangChain · Node.js · Large language models

The reason people would not move was that their community already existed somewhere else, so the answer was not to ask them to move. Posts made there appeared here, posts made here appeared there, and the migration tooling carried a community across when it was ready.

• —Mirroring in both directions, with anonymity preserved outbound
• —Migration tooling for communities already established elsewhere

Role

Product and development

Status

Shipped

Stack

Node.js · Next.js · Platform APIs

The trade was explicit: a great deal of speed and cost, against some privacy. Moderation and administration had to be built from nothing, because by design nobody, including us, could identify a user, and content still has to be removable. When the underlying social library stopped being maintained mid project, the closed parts were reverse engineered, the network beneath was addressed directly, and a data module and interface were built to replace it.

• —Settlement in seconds rather than tens of seconds, at no transaction fee
• —Moderation built for a system whose operators cannot identify anyone
• —Kept going when a core dependency was abandoned by its maintainers

Role

Architecture, product and development

Status

Shipped

Stack

Ceramic · IPFS · Next.js · MongoDB

Small, and included because it is checkable. It is normal to build on top of your tools. Occasionally the right answer is to work on the tool.

• —Built a login the library did not support, by forking it
• —Shipped officially upstream by the library's own team

Role

Development

Status

Shipped

Stack

Web3Auth · Farcaster · TypeScript

One service pushed users off the site to complete verification, which testing showed was where they stopped. The other did not support the identities that mattered. Building it meant owning the problem rather than the integration.

• —Two third party services evaluated and rejected, for stated reasons
• —Accounts provisioned for people who have never held crypto

Role

Architecture and development

Status

Shipped

Stack

Decentralised identifiers · Next.js · Node.js

Existing services take a large cut, require the recipient to sign up first, push the sender off the page, or inject into a platform in breach of its terms. All four were avoided. A scheduled parser reads posts for a trigger, so the interaction stays where the reader already is. Real time notifications were built as a livestream overlay compatible with standard streaming software, with animation and sound, so a creator sees a tip as it arrives.

• —Tipping by text, with nothing to install and no prior account to create
• —Livestream overlay notifications, compatible with standard streaming software
• —Built inside platform terms, deliberately, where competitors were not

Role

Architecture, product and development

Status

Shipped

Stack

Chrome extension · Nest.js · Redis · Solana · Base

The interesting part is the attester. Bridging an identity that lives off chain to settlement that happens on chain needs someone to vouch, and the question is how to make that vouching narrow enough to be safe: a signature good for one deposit, one recipient, and nothing else. The documentation includes a risk page naming our own centralisation points and what we do not guarantee, published before launch rather than after.

• —Attestations scoped to a single deposit and recipient
• —The recipient needs no gas, and no funded wallet
• —A published risk disclosure, written before launch

Role

Architecture and development

Status

Shipped

Stack

Solidity · Polkadot Asset Hub · EIP-712 · Next.js

• Read the documentation→

Building the same architecture twice, against two very different chains, is how you find out which parts of a design were principles and which were accidents of the first implementation.

• —The same design proven against a second, very different chain
• —Deployed to Base mainnet

Role

Architecture and development

Status

Shipped

Stack

Solidity · Base · USDC · Hardhat

Not a retreat from multiple chains, which had worked. A deliberate decision that the cost of supporting them was being paid by users rather than by us, and that this was the wrong way round.

• —Sponsored fees, so a user never has to hold a native token
• —Wallet abstraction to the point of invisibility

Role

Architecture and development

Status

Shipped

Stack

Base · Next.js · Drizzle · viem

• Open the product→
• See the extension listing→

The weighting is the opinion: putting money behind something should count for more than costless approval. An admin console configures a whole contest, including the scoring weights themselves, and an archive mode freezes a finished contest permanently, serving cached results with no expiry, because a finished contest should stay finished.

• —Ranking that weights money far above costless approval, on purpose
• —A whole contest configurable from an admin console, scoring included
• —Archive mode, so a result stays exactly as it ended

Role

Product and development

Status

Shipped

Stack

Next.js · shadcn/ui · Platform APIs · Redis

Moving money across a border is not the hard part. Knowing it arrived is. Most of the design went into what a sender never sees: verifying a person once and carrying that verification across every partner in the corridor, routing a payment across providers rather than depending on any one of them, holding funds until both sides are verified, and reporting a status that is true rather than optimistic. The commercial assumptions were tested as hard as the technical ones, including a pricing model we wanted to work and abandoned when the evidence went against it.

• —A corridor a sender can follow end to end, instead of a receipt and a wait
• —Verify a person once, and carry it across every partner in the corridor
• —An agent runtime and Model Context Protocol server, so software can start a payout
• —A pricing model we wanted to work, tested against the evidence and abandoned

Role

Research, architecture and prototyping

Status

Research

Stack

Next.js · AI SDK · Model Context Protocol

Multi tenant isolation is the real work here. The interesting constraint is not building two views, it is being certain that the boundary between them holds every time, including in the aggregate figures.

• —Strict separation between accounts, enforced rather than assumed
• —Two audiences, one dataset, one system

Role

Architecture and development

Status

Current

Stack

Next.js · Prisma · Postgres