A Living Archive
How Anchor turns a network of small machines into a commons for digital art

Anchor is a small appliance with a large ambition, keeping the art behind your NFTs genuinely safe. A token on a blockchain is permanent, but the artwork it points to almost always lives somewhere else, on IPFS or Arweave, and that somewhere else is frequently a single service that can quietly disappear. When it does, the token survives and the art does not.

Anchor keeps an independent, verifiable, local copy of your collection. No private keys, no seed phrases, only public wallet addresses. That is the first tier, your own backup, sitting safely in your home. (See technical slides)

This post is about the second tier, the part we find most exciting. It is the layer where many Anchors find one another and begin to preserve each other’s art, turning a room full of quiet boxes into a shared, resilient memory for a whole creative ecosystem.

Content addressing is a quiet miracle. A hash proves that a file is exactly what it claims to be, untampered, authentic, forever verifiable. But a hash says nothing about whether a copy of that file still exists anywhere in the world. Integrity and persistence are different promises, and the ecosystem has mostly kept the first while assuming the second.

Persistence is, in the end, an act. Someone has to keep the bytes alive. Community preservation makes that act a shared one. Picture a commons of collectors, each running a modest machine, each holding a little of everyone’s culture, so that no single failure, no shuttered platform, no abandoned pinning service, can erase a work that people care about. That is the promise the permaweb always implied, and we think a community is exactly what can finally keep it.

There is a worry worth answering before anything else, could someone abuse a shared preservation network, flooding it with junk or tricking it into storing whatever they like. They cannot, and the reason is built into how the network decides what is worth keeping.

A request to preserve a wallet carries one thing only, a public wallet address. It never carries files, and it never carries the content identifiers of what to store. Instead, every Anchor that considers the request reads that wallet straight from the blockchain itself and works out, independently, which artworks it holds and where they live. The person making the request does not get to choose what gets stored, the chain does, and each node confirms it for itself.

So a made-up or empty wallet simply resolves to nothing, and is dropped at no cost. You cannot point the network at an arbitrary file, or a random piece of IPFS content, and have it kept, because the only things it will ever store are the media that genuine NFTs in real, public wallets actually reference. To get anything preserved at all, it has to be anchored to a real token minted on a real blockchain, and minting costs money. In other words the blockchain itself is the spam filter, and it bills the attacker, not us.

Even an honest but greedy request is held in check. Each device honours a size limit per wallet and an overall budget for how much it will give to others, each identity is limited in how often it may make requests, and because responsibility is spread by the method we describe below, only a small handful of machines ever take on any single wallet. No one request can sweep the whole network. We deliberately do not sit in judgement of which art deserves keeping, the network preserves what is real and lets these simple limits, rather than taste, keep abuse in check.

Building that commons turns out to be a genuinely interesting design problem, with three hard parts that shape everything else.

The first is deceptively simple, how many copies, and who holds them. “Exactly thirty copies” sounds reassuring, but it is a fiction in any living network, because machines join, leave, sleep, and return. A real preservation layer cannot promise a fixed number, it has to know how many copies are alive right now and quietly heal back to a healthy floor when the count slips.

The second is privacy. Choosing to preserve a piece of art should never require you to reveal who you are or where you live.

The third is the Sybil problem. An open, permissionless network is a beautiful thing, anyone can join and contribute, but openness also invites a single actor to pretend to be a thousand, and a network that cannot tell one machine from a thousand impostors cannot reason about its own redundancy. We treat these three not as obstacles bolted onto the design, but as the shape of the design itself.

Before any of that, the Anchors have to find one another and pass around which wallets need help. Pleasingly, we build almost none of this ourselves. The gossip layer that carries those messages rides on the same libp2p publish-subscribe machinery that the Kubo IPFS node already runs, so the network that coordinates preservation is, in a real sense, the IPFS node the device was going to run anyway.

Once a wallet is known to the network, the question is who actually keeps a copy. The obvious starting point is to borrow from IPFS again, since it organises peers with a distributed hash table and a notion of XOR distance, so why not let the peers closest to a wallet’s key be the ones who preserve it. The trouble is that the closest peers in the global IPFS keyspace are arbitrary nodes that have never heard of Anchor and will never pin anything for us. And even within our own peers, XOR neighbourhoods are restless, the closest set churns and reshuffles every time a node comes or goes.

So we reach for something steadier, rendezvous hashing, also known as highest random weight. Every node scores every wallet with a simple combined hash, score = hash(PeerID, H), ranks the results, and the highest few become responsible for that wallet. Every node computes the identical answer with no coordination at all. The magic is in how it behaves under change, when a node leaves, only the wallets it personally held need a new home, and the next-ranked node simply steps up. Nothing else moves.

Because our network is measured in the thousands rather than the millions, every node can hold the full membership in memory, which means we do not need a DHT’s clever logarithmic routing to find responsible peers, we just compute them. The result is a network where responsibility is fair, predictable, evenly spread, and self-healing, which is precisely what a preservation commons should feel like.

This is also the quiet answer to the question that matters most, what happens when a collector’s own device goes dark for good, the very loss the whole project exists to guard against. Nothing is lost, because responsibility for that wallet never depended on the owner being present. The backers the network already chose go on holding the art and go on announcing that it still needs a home, and as machines come and go the next nodes in line step in to refill any missing copies. The moment you would most fear losing a collection is precisely the moment the commons quietly takes over keeping it.

Here is a principle we hold to, do not tax the network before the tax earns its keep. So we begin open and permission-less, and we treat Sybil resistance as a ladder we climb only as far as the moment requires, each rung stronger than the last.

The first rung is proof that an identity cost something to create. This idea will be familiar from blockchains, where proof-of-work asks miners to burn computation, and the expense is what keeps an attacker honest. We could ask each new identity to prove similar effort. But the same hashing puzzle that secures Bitcoin does not fit our world, and it is worth saying clearly why. A hashcash-style puzzle is embarrassingly parallel, an attacker with a rack of GPUs, let alone purpose-built ASICs, can search for proofs thousands of times faster than our small home appliance. Set the difficulty gently enough for the appliance and it becomes trivial for the attacker, so it deters no one, and worse, it quietly rewards whoever owns the most hardware, the exact opposite of the level commons we want to build.

The elegant answer is a verifiable delay function. A VDF is a computation that must proceed one step at a time and cannot be rushed by throwing more machines at it, yet anyone can check the result in an instant. A ten-minute VDF costs roughly ten minutes for everyone, the modest appliance and the well-funded attacker alike, give or take a small constant. Fairness is restored, because the price is paid in time that cannot be bought in bulk. We are honest that this is still a soft measure, a determined actor can run many VDFs side by side, so it raises the price of faking many identities without making it impossible, and that is exactly the right amount of friction for an early, growing network.

The second rung is proof that you are actually doing the work. With audit-based standing, a node earns its place by answering random challenges to return a specific content-addressed block, a response that verifies itself because its hash must match. Standing is something you build by genuinely preserving, and a hollow identity that stores nothing is found out and quietly loses its influence. We love this one, because it aligns the defence perfectly with the mission, the way to be trusted is to truly preserve.

That strength comes with a subtlety we take seriously, because proving that you hold something is, by its nature, visible. A node that answers a challenge reveals that it keeps that wallet’s content, and in truth IPFS already announces as much, since any node that pins a file advertises that it can serve it. For the people who back other collectors’ work this is harmless, even admirable, they are seen helping to preserve public art that is not their own. The care is needed for the owner, because a collector’s own device holds their whole, coherent collection, and a holder sitting outside the set the network would have chosen is easy to single out as the owner. So we draw a clean line. A device’s own collection is held privately and is never advertised or audited as part of the commons, the standing system sees only the community backers, each tending a scattered handful of other people’s wallets, where being seen reveals nothing personal. Preservation you do for others earns your standing, the collection you hold for yourself stays yours.

A fair question follows, if your own device never raises its hand to be counted, how does your collection get picked up for safekeeping in the first place. The trick is that asking for preservation and proving preservation are kept entirely apart. A request to preserve a wallet is a tiny, one-time message sent through a throwaway identity over relays, it names only a public wallet address, holds no standing, and is never audited, and the identity that sent it is discarded the moment the message is out. The nodes that answer the call are the persistent backers, and they fetch the art not from you but from where it still lives on the public network, and from then on it is they, not you, who keep announcing that the wallet still needs a home. So the crowd that asks and the crowd that is audited are two different crowds, and your own machine sits in neither of them for your own wallet. There is no announce-then-go-quiet footprint to single you out, because your machine never announced as itself to begin with. The one assumption this rests on is the same one the whole project rests on, that the art is still reachable somewhere at the moment you ask, which is exactly when there is still time to save it.

The third rung is proof that you committed real resources. Proof-of-space asks a node to dedicate genuine disk, the very resource the network exists to pool, so that every counterfeit identity must pay in the same currency the commons values most. It carries a happy bonus, committing space proves a real cost without revealing anything about what a node actually stores, so it strengthens the network without asking anyone to expose their holdings.

Beyond the ladder, we keep one strong option in reserve. Every Anchor can carry a key sealed inside a secure element, and a certificate signed at manufacture can prove that a device is a genuine Anchor. With that, every identity maps to a real piece of hardware, and faking a thousand nodes costs as much as buying a thousand devices, an honest and decisive barrier that suits a hardware product beautifully.

We are deliberate about not switching this on by default. Hardware attestation leans on a certificate authority, a point of coordination, and we would rather keep decentralisation first and reach for this only if the network truly needs it. When and if we do, we would publish the trust roots openly, so that devices keep validating one another even if we ever step back. The hardware is there, ready to vouch for honesty the moment the network asks it to, and not a moment sooner.

A preservation commons should protect the people in it. When your Anchor asks the network to help preserve a wallet, it speaks through a throwaway identity and routes that request through relays, so the network learns which art deserves saving without ever learning your home connection. There are no keys to leak, only public addresses, and the control panel is reachable only from your own network, never the open internet.

The same instinct shapes the standing system above, your own collection is held quietly and never put on display, so that proving you preserve never becomes a way of revealing what you own. Today this gives you privacy at the level of your IP address, and the road ahead leads to stronger unlinkability still, with techniques that let a node prove it is playing by the rules without revealing which node it is. Privacy here is built in from the start, and it only grows stronger as the network does.

Put these pieces together and something quietly remarkable appears, a network of small, humble machines that, simply by helping one another, becomes one of the most durable homes digital art has ever had. No single company to trust, no single point to fail, just a community that has decided some things are worth keeping, and built the means to keep them together.