01
GET THE SOURCE.
Clone the two sibling Rust repositories. Keep them next to each other so rsLXMF can find rsReticulum.
git clone https://github.com/ratspeak/rsReticulum.git git clone https://github.com/ratspeak/rsLXMF.git
NOTICE / 001 This is a browser-local alpha. Cryptographic tools work here; Reticulum transport requires a native node. No live peers or public mesh connectivity are implied.
UNAUTHORIZED
BY DESIGN
BY DESIGN
[ NETWORK DESK / LOCAL INSTANCE ]
BUILD YOUR
OWN EXIT.
Your identity. Your words. Your routes. The first tools are already yours to run—no central account required.
CONTACTS / DEVICE0
SEALED CAPSULES / DEVICE0
SIGNED PAGES / DEVICE0
BROWSER IDENTITYNOT SET
[ USE THE TOOLS ]
WAYS THROUGH.
01 / PRIVATE KEYS✳OWN
SEAL
NO
BUILD
OWN
YOUR NAME.
Create a password-protected browser identity. Carry your encrypted backup to another device.
MAKE AN IDENTITY ↗ 02 / ENCRYPTED COURIER↯SEAL
THE WORD.
Encrypt and sign messages for anyone who gives you their public identity. Share through any available route.
OPEN COURIER ↗ 03 / INDEPENDENT PRINT✱NO
EDITOR-IN-CHIEF.
Write, sign, and verify independent pages. Seal shorter zines for private delivery to other readers.
USE THE PRESS ↗ 04 / REAL NETWORK LAYER⌗BUILD
THE ROUTE.
Boot your own Reticulum and LXMF daemons using source-based node instructions.
INSPECT NODE KIT ↗REALITY CHECK / 01
Censorship resistance comes from independent paths, not a landing page. Portable encrypted data works offline; a signed, encrypted courier message has also completed a two-node Reticulum/LXMF loopback test. Public routing and independent hosting remain open work.
[ 01 / IDENTITY CONTROL ]
NO PHONE.
NO PERMISSION.
Generate two browser keys: one signs what you publish, the other receives encrypted capsules. Your private keys are wrapped with your passphrase before local storage.
YOUR VAULTCHECKING
MAKE AN IDENTITY.
A public address is generated here. No account registration or wallet needed.
Restoring is available only when no identity already exists on this device.
THE VAULT IS LOCKED.
Unlock it to sign pages, encrypt capsules, or read messages. The passphrase never leaves this tab.
● LOCAL SESSION UNLOCKED
YOUR KEYS. YOUR CALL.
Keys are available only in this tab's memory until you lock or reload it.
PUBLIC CONTACT CARDSHAREABLE
SUB/
—
—The fingerprint identifies these browser keys. It is not a Reticulum address.
[ TRUST BY FINGERPRINT ]
ADD A CONTACT.
After importing a card, you can attach that person's separate native LXMF destination in the address book. Verify both fingerprints and destinations through a trusted channel.
DEVICE ADDRESS BOOK0 KEYS
[ TAKE YOUR LIFE OFF THIS DEVICE ]NO ACCOUNT.
NO ACCOUNT.
NO HOSTAGE DATA.
Export one fully encrypted archive containing your password-wrapped identity, public contacts, encrypted inbox and outbox, and signed press library. Restore on another device, or merge safely into the same identity. No upload, account, or cloud backup.
PACK YOUR DEVICEAES-256-GCM
RESTORE THE UNDERGROUNDMERGE / NO OVERWRITE
PORTABILITY NOTICE: A browser can evict local storage. Keep an offline copy of the encrypted archive and both passphrases. Signed pages are public inside your device but encrypted inside this backup. Outbound native delivery job statuses are not transferred.
KEY SAFETY: Store your encrypted backup and passphrase separately. We cannot reset your passphrase. Losing both your device storage and backup means losing this browser identity. P-256 browser keys do not interoperate with Reticulum identities.
[ 02 / UNTRUSTED COURIER ]
SAY IT.
SEAL IT.
End-to-end encrypt a portable message for one public key and sign it with yours. Deliver the capsule through any channel you choose—SUBSTRATA does not host a central mailbox.
WRITE A CAPSULELOCAL ENCRYPTION
SEALED / READY TO CARRYSIGNATURE ADDED
Nothing is transmitted until you pair your local bridge and explicitly approve a native LXMF send.
RECEIVE A CAPSULEVERIFY BEFORE OPEN
Sender signatures prove control of a key, not a person's real-world identity. Check fingerprints through a trusted channel.
ENCRYPTED INBOX0
SEALED OUTBOX0
DECRYPTED ON THIS DEVICE
[ 03 / THE INDEPENDENT PRESS ]
PRINT WHAT
THEY WON'T.
Make a self-contained publication. Sign it, export it, or wrap a shorter edition in an encrypted courier capsule for a correspondent to verify and archive.
SET THE TYPESIGNED BUNDLE
PROOF / LIVE VIEWNO ACTIVE SCRIPTS
START WRITING.
THE PRESS IS YOURS.
THE PRESS IS YOURS.
YOUR LOCAL PRESS ARCHIVE0 PRINTS
[ PASS THE PRINT ]
IMPORT A PAGE.
VERIFIED PAGE / DEVICE ARCHIVE
[ 04 / INFRASTRUCTURE IS A VERB ]
BE THE
UNDERLAY.
A real network needs real interfaces and running nodes. SUBSTRATA builds on the Ratspeak/rsReticulum/rsLXMF source. Use these source-based commands on a machine you control.
PHYSICAL REALITYNO RADIO = NO MAGIC RADIO. NO UPLINK = NO FREE WAN.
These daemons use available LAN, TCP, and configured radio transports. Reticulum encrypts and routes packets, but is not an anonymity system by itself.
02
BUILD THE ROUTER.
The Rust binaries remain compatible with the upstream protocol. You need Rust/Cargo and platform build tools.
cd rsReticulum cargo build --release --locked ./target/release/rnsd-rs --exampleconfig
03
RUN AN ACTUAL NODE.
Create a starter config only if one does not already exist. Inspect and edit its interfaces before starting; a config template does not create a usable transport by itself.
mkdir -p "$HOME/.rsReticulum" if [ ! -e "$HOME/.rsReticulum/config" ]; then ./target/release/rnsd-rs --exampleconfig > "$HOME/.rsReticulum/config" fi # REVIEW $HOME/.rsReticulum/config FIRST ./target/release/rnsd-rs --config "$HOME/.rsReticulum"DOWNLOAD SAFE SETUP HELPER ↓
04
ADD THE MESSAGE DAEMON.
Build rsLXMF next to rsReticulum, generate its configuration without overwriting existing settings, and start it against the same Reticulum config.
cd ../rsLXMF cargo build --release --locked mkdir -p "$HOME/.rsLXMF" if [ ! -e "$HOME/.rsLXMF/config" ]; then ./target/release/lxmd-rs --exampleconfig > "$HOME/.rsLXMF/config" fi # REVIEW $HOME/.rsLXMF/config FIRST ./target/release/lxmd-rs --config "$HOME/.rsLXMF" --rnsconfig "$HOME/.rsReticulum"
[ NATIVE RELEASE / GNU-LINUX x86_64 / EXPERIMENTAL ]
NO COMPILER.
NO COMPILER.
JUST THE WIRE.
The first precompiled SUBSTRATA native courier test kit is available. It includes real Rust Reticulum/LXMF executables, the local bridge, original license notices, and the exact two-node encrypted-message test that passed. Linux x86_64 with glibc only. No installation or connection is started automatically.
tar -xzf substrata-native-linux-x64-alpha.tar.gz cd substrata-native-linux-x64-alpha python3 -B tests/native_two_node_smoke.py --wait 110
Verify your archive before executing it: SHA-256 CHECKSUMS ↗. Run sha256sum -c SHA256SUMS.txt from a folder containing both downloads and the checksum file.
WHAT IT PROVES: Actual encrypted LXMF transmission between two isolated local nodes, inbound signature verification, and successful recipient decryption. WHAT IT DOESN'T: Internet-wide reachability, bypass of an ISP block, anonymous transport, secure multi-device deployment, or message read receipts. The matching original AGPL source and license files are offered separately above.
[ WINDOWS / NATIVE DESKTOP ROUTE ]
THE UNDERLAY
THE UNDERLAY
RUNS ON WINDOWS.
Use PowerShell on a Windows development machine. This reviewed-by-you script clones the two upstream Rust projects, builds their native .exe programs, and creates sample configs if absent. It does not request administrator rights, open firewall rules, install services, start daemons, or overwrite existing checkouts.
# Inspect the downloaded script before running it. # From your chosen PowerShell working directory: powershell -NoProfile -File .\substrata-node-kit.ps1 # The script prints exact start/status/address commands for your build. # Allow the required Rust/MSVC toolchain time to finish compiling.
PowerShell execution policy may prevent downloaded scripts from running; review the file and follow your machine's policy. A real node still needs transport interfaces configured independently. The LXMF inbound hook and localhost bridge can run under Python for Windows once the daemons have been built.
[ REAL TRANSPORT / OPTIONAL LOCAL BRIDGE ]
WIRE THE BROWSER
TO YOUR NODE.
Run the small open-source Python sidecar on the same machine as lxmd-rs. It listens only on localhost, demands a random pairing secret, forwards sealed capsules, and can ingest native LXMF messages through an explicit local hook. No delivery receipt, centralized relay, or anonymity guarantee is claimed.
python3 substrata-bridge.py \ --lxmd /path/to/lxmd-rs \ --lxmf-config /path/to/lxmf/config-dir \ --rns-config /path/to/reticulum/config-dir \ --spool /path/to/private-substrata-inbox
INBOUND SIGNAL / HOOK SETUP
GIVE THE NODE
GIVE THE NODE
AN EAR.
Make a private directory with 0700 permissions. Restart lxmd-rs with the inbound hook below. Use the same absolute spool path for the bridge and hook. The hook reads saved native .lxm files and stores only encrypted SUBSTRATA capsules. Ordinary LXMF messages are ignored.
mkdir -p -m 700 /path/to/private-substrata-inbox chmod 700 /path/to/private-substrata-inbox # In the LXMF config's [lxmf] section set: # delivery_transfer_max_accepted_size = 160 # The default 1 KB cannot carry larger encrypted capsules. ./target/release/lxmd-rs --config /path/to/lxmf/config-dir \ --rnsconfig /path/to/reticulum/config-dir \ --on-inbound "python3 /absolute/substrata-bridge.py --ingest --spool /path/to/private-substrata-inbox"
KNOW YOUR NATIVE ADDRESS.
The daemon's LXMF destination is not your browser vault fingerprint. Once the daemon has created its identity file, use the upstream identity utility to derive your 32-character LXMF delivery hash, then share it with a correspondent along with your SUBSTRATA public card.
/path/to/rsReticulum/target/release/rnid-rs \ -i /path/to/lxmf/config-dir/identity \ -H lxmf.delivery
CRITICAL / WHICH HASH: The command prints two different values. Copy the 32-hex value after destination for this Identity is—not the identity hash after full destination specifier is. Using the latter silently routes to the wrong destination.
The local hook and HTTP bridge must be running on the same machine. Native LXMF admission is handled by the daemon; the browser independently verifies SUBSTRATA signatures before importing ciphertext.
LOCAL PAIRING / 127.0.0.1:8741NOT PAIRED
CONFIRM REAL LXMF TRANSMISSION.
NO BRIDGE LINK. NATIVE DELIVERY IS DISABLED.
[ BRIDGE / INCOMING WIRE ]
00THE MAIL DROP.
Import verified encrypted LXMF arrivals into your browser vault. The native spool is cleared only after the browser has saved each verified capsule. Unverified or foreign-address messages stay in the spool for inspection.
PAIR A LOCAL BRIDGE AND CREATE AN IDENTITY TO RECEIVE.
While paired, this tab checks periodically when visible. Everything is stored as ciphertext. Decryption still requires unlocking your browser vault.
NATIVE BRIDGE STATUS / FIRST LOOPBACK PASS: An encrypted, signed browser capsule was sent between two independent local Reticulum/LXMF nodes, received by the actual inbound hook, signature-checked and decrypted successfully in an isolated TCP test. The sidecar supports outbound CLI handoff and inbound LXMF spool; the website itself does not join Reticulum. Public-internet peer connectivity, anonymity, and end-user delivery/read receipts remain unverified. No synthetic peer counts or pretend routing are displayed.
[ 05 / RUNNING INVENTORY ]
CHECK THE
REAL SIGNAL.
Every status below comes from your current browser or device records. No simulated node metrics.
DIRECT PEER LINKWEBRTC / LAB
LOCAL PATH EXPERIMENT.
The manual-signaling channel needs a direct route, generally on one LAN. It is not the Reticulum stack.
OPEN BROWSER DIRECT-LINK LAB ↗DEVICE PRIVACYTHREAT MODEL / ALPHA
Cryptographic keys are wrapped on-device. Message envelopes are signed and ciphertext-only in storage. Imported public pages are intentionally readable. The website cannot promise anonymity, protect against a compromised browser, or offer worldwide connectivity without infrastructure.
VIEW PROTOCOL STACK ↗[ 06 / DEVICE SOVEREIGNTY ]
CONTROL
THE FOOTPRINT.
STORAGE RESILIENCELOCAL ONLY
Browser storage can be deleted by the browser or its operator. Ask this browser to keep SUBSTRATA's offline archive, and inspect the actual allocated space.
CHECKING DEVICE STORAGE…
LEAVE NO LOCAL ARCHIVEIRREVERSIBLE
ERASE THIS DEVICE.
Removes this browser's vault, contacts, encrypted messages, and signed pages from SUBSTRATA storage. Does not delete copies you exported, sent, or stored on a native LXMF node. Other sites and browser caches are unaffected.
FORKS & ATTRIBUTION
SUBSTRATA uses original visual assets and is developed from the Ratspeak, rsReticulum and rsLXMF AGPL-licensed ecosystem. Original contributors retain their copyrights. Browser Vault V1 and portable capsules are experimental, separate formats.