A Living Archive
How Anchor turns a network of small machines into a commons for digital art

Anchor is a small appliance with a large ambition, keeping the art behind your NFTs genuinely safe. A token on a blockchain is permanent, but the artwork it points to almost always lives somewhere else, on IPFS or Arweave, and that somewhere else is frequently a single service that can quietly disappear. When it does, the token survives and the art does not.

Anchor keeps an independent, verifiable, local copy of your collection. No private keys, no seed phrases, only public wallet addresses. That is the first tier, your own backup, sitting safely in your home (technical slides ).

This post is about the second tier, the part we find most exciting. It is the layer where many Anchors find one another and begin to preserve each other’s art, turning a room full of quiet boxes into a shared, resilient memory for a whole creative ecosystem.

Content addressing is a quiet miracle. A hash proves that a file is exactly what it claims to be, untampered, authentic, forever verifiable. But a hash says nothing about whether a copy of that file still exists anywhere in the world. Integrity and persistence are different promises, and the ecosystem has mostly kept the first while assuming the second.

Persistence is, in the end, an act. Someone has to keep the bytes alive. Community preservation makes that act a shared one. Picture a commons of collectors, each running a modest machine, each holding a little of everyone’s culture, so that no single failure, no shuttered platform, no abandoned pinning service, can erase a work that people care about. That is the promise the permaweb always implied, and we think a community is exactly what can finally keep it.

Building that commons turns out to be a genuinely interesting design problem, with three hard parts that shape everything else.

The first is deceptively simple, how many copies, and who holds them. “Exactly thirty copies” sounds reassuring, but it is a fiction in any living network, because machines join, leave, sleep, and return. A real preservation layer cannot promise a fixed number, it has to know how many copies are alive right now and quietly heal back to a healthy floor when the count slips.

The second is privacy. Choosing to preserve a piece of art should never require you to reveal who you are or where you live.

The third is the Sybil problem. An open, permissionless network is a beautiful thing, anyone can join and contribute, but openness also invites a single actor to pretend to be a thousand, and a network that cannot tell one machine from a thousand impostors cannot reason about its own redundancy. We treat these three not as obstacles bolted onto the design, but as the shape of the design itself.

Before any of that, the Anchors have to find one another and pass around which wallets need help. Pleasingly, we build almost none of this ourselves. The gossip layer that carries those messages rides on the same libp2p publish-subscribe machinery that the Kubo IPFS node already runs, so the network that coordinates preservation is, in a real sense, the IPFS node the device was going to run anyway.

Once a wallet is known to the network, the question is who actually keeps a copy. The obvious starting point is to borrow from IPFS again, since it organizes peers with a distributed hash table and a notion of XOR distance, so why not let the peers closest to a wallet’s key be the ones who preserve it. The trouble is that the closest peers in the global IPFS keyspace are arbitrary nodes that have never heard of Anchor and will never pin anything for us. And even within our own peers, XOR neighbourhoods are restless, the closest set churns and reshuffles every time a node comes or goes.

So we reach for something steadier, rendezvous hashing, also known as highest random weight. Every node scores every wallet with a simple combined hash, score = hash(PeerID, H), ranks the results, and the highest few become responsible for that wallet. Every node computes the identical answer with no coordination at all. The magic is in how it behaves under change, when a node leaves, only the wallets it personally held need a new home, and the next-ranked node simply steps up. Nothing else moves.

Because our network is measured in the thousands rather than the millions, every node can hold the full membership in memory, which means we do not need a DHT’s clever logarithmic routing to find responsible peers, we just compute them. The result is a network where responsibility is fair, predictable, evenly spread, and self-healing, which is precisely what a preservation commons should feel like.

This is also the quiet answer to the question that matters most, what happens when a collector’s own device goes dark for good, the very loss the whole project exists to guard against. Nothing is lost, because responsibility for that wallet never depended on the owner being present. The backers the network already chose go on holding the art and go on announcing that it still needs a home, and as machines come and go the next nodes in line step in to refill any missing copies. The moment you would most fear losing a collection is precisely the moment the commons quietly takes over keeping it.

Here is a principle we hold to, do not tax the network before the tax earns its keep. So we begin open and permissionless, and we treat Sybil resistance as a ladder we climb only as far as the moment requires, each rung stronger than the last.

The first rung is proof that an identity cost something to create. This idea will be familiar from blockchains, where proof-of-work asks miners to burn computation, and the expense is what keeps an attacker honest. We could ask each new identity to prove similar effort. But the same hashing puzzle that secures Bitcoin does not fit our world, and it is worth saying clearly why. A hashcash-style puzzle is embarrassingly parallel, an attacker with a rack of GPUs, let alone purpose-built ASICs, can search for proofs thousands of times faster than our small home appliance. Set the difficulty gently enough for the appliance and it becomes trivial for the attacker, so it deters no one, and worse, it quietly rewards whoever owns the most hardware, the exact opposite of the level commons we want to build.

The elegant answer is a verifiable delay function. A VDF is a computation that must proceed one step at a time and cannot be rushed by throwing more machines at it, yet anyone can check the result in an instant. A ten-minute VDF costs roughly ten minutes for everyone, the modest appliance and the well-funded attacker alike, give or take a small constant. Fairness is restored, because the price is paid in time that cannot be bought in bulk. We are honest that this is still a soft measure, a determined actor can run many VDFs side by side, so it raises the price of faking many identities without making it impossible, and that is exactly the right amount of friction for an early, growing network.

The second rung is proof that you are actually doing the work. With audit-based standing, a node earns its place by answering random challenges to return a specific content-addressed block, a response that verifies itself because its hash must match. Standing is something you build by genuinely preserving, and a hollow identity that stores nothing is found out and quietly loses its influence. We love this one, because it aligns the defence perfectly with the mission, the way to be trusted is to truly preserve.

That strength comes with a subtlety we take seriously, because proving that you hold something is, by its nature, visible. A node that answers a challenge reveals that it keeps that wallet’s content, and in truth IPFS already announces as much, since any node that pins a file advertises that it can serve it. For the people who back other collectors’ work this is harmless, even admirable, they are seen helping to preserve public art that is not their own. The care is needed for the owner, because a collector’s own device holds their whole, coherent collection, and a holder sitting outside the set the network would have chosen is easy to single out as the owner. So we draw a clean line. A device’s own collection is held privately and is never advertised or audited as part of the commons, the standing system sees only the community backers, each tending a scattered handful of other people’s wallets, where being seen reveals nothing personal. Preservation you do for others earns your standing, the collection you hold for yourself stays yours.

The third rung is proof that you committed real resources. Proof-of-space asks a node to dedicate genuine disk, the very resource the network exists to pool, so that every counterfeit identity must pay in the same currency the commons values most. It carries a happy bonus, committing space proves a real cost without revealing anything about what a node actually stores, so it strengthens the network without asking anyone to expose their holdings.

Beyond the ladder, we keep one strong option in reserve. Every Anchor can carry a key sealed inside a secure element, and a certificate signed at manufacture can prove that a device is a genuine Anchor. With that, every identity maps to a real piece of hardware, and faking a thousand nodes costs as much as buying a thousand devices, an honest and decisive barrier that suits a hardware product beautifully.

We are deliberate about not switching this on by default. Hardware attestation leans on a certificate authority, a point of coordination, and we would rather keep decentralization first and reach for this only if the network truly needs it. When and if we do, we would publish the trust roots openly, so that devices keep validating one another even if we ever step back. The hardware is there, ready to vouch for honesty the moment the network asks it to, and not a moment sooner.

A preservation commons should protect the people in it. When your Anchor announces a wallet it wants to help preserve, it speaks through a throwaway identity and routes that announcement through relays, so the network learns which art deserves saving without ever learning your home connection. There are no keys to leak, only public addresses, and the control panel is reachable only from your own network, never the open internet.

The same instinct shapes the standing system above, your own collection is held quietly and never put on display, so that proving you preserve never becomes a way of revealing what you own. Today this gives you privacy at the level of your IP address, and the road ahead leads to stronger unlinkability still, with techniques that let a node prove it is playing by the rules without revealing which node it is. Privacy here is built in from the start, and it only grows stronger as the network does.

Put these pieces together and something quietly remarkable appears, a network of small, humble machines that, simply by helping one another, becomes one of the most durable homes digital art has ever had. No single company to trust, no single point to fail, just a community that has decided some things are worth keeping, and built the means to keep them together.