# BNS Roadmap — from prototype to a permissionless web stack

*Silent Mode (a Deviant division). Hub: `D:\Dev\SilentMode\README.md`.
Products: **Theseus Navigator** (browser), publisher app, resolver daemon,
**Argo** (host network, crewed by **Argonauts**), **Argonautica** (discovery).*

The four moving parts (see [DESIGN-hosting-pact.md](DESIGN-hosting-pact.md),
[PROTOCOL.md](PROTOCOL.md)): **chain** for ownership, **storage** for bulk,
**gossip** for liveness, **pool** for incentives. Phases are ordered by
dependency, not calendar; tracks 5 (browser) and 2 can run in parallel with
everything.

## Phase 0 — Prototype (DONE, July 2026)

Names as CashTokens name certificates on BCH chipnet; OP_RETURN records; beacon discovery;
resolver daemon + NRPT/adapter installer; HTTPS via local root CA with
on-chain fingerprint pinning; wallet app with embedded browser; real sites
served three ways (own server via ip record, reverse proxy, Sia storage via
s3d with server-side authority + 6h auto-sync); subdomain namespaces
(deviant.bch); dilution-pool design written.

## Phase 1 — Harden the name layer (protocol v2)

- Expiry + renewals (anti-squatting garbage collection; Kalodner 2015)
- Graduated pricing: short/dictionary names cost more (ENS lesson)
- Commit-reveal registration (front-running protection, Namecoin's name_new)
- CashScript covenant registry: consensus-enforced uniqueness (novel on BCH)
- Constrained CA (X.509 name constraints limited to .bch) + short-lived leaf certs
- Mainnet port (config only: network + electrum servers + real BCH)

## Phase 2 — Distribution (reach other machines)

- Firefox extension (Mozilla-signed, self-distributed): intercepts .bch,
  routes via resolver/gateway — no DNS surgery, no DoH conflict
- Chromium extension (store review)
- Signed Windows installer; macOS/Linux daemon ports
- LAN mode: daemon answers with host-LAN IP so phones/TVs resolve .bch
- Android: resolver+gateway as an app (sideload APK first)

## Phase 3 — Publisher app ("the missing UX")

One window: pick folder → pick name → pay → site is live. Under the hood:
- Sia Storage SDK (or s3d) for storage; BNS txs for the name
- Auto-sync scheduling (generalize the coinspectrum systemd timer)
- BCH-denominated plans (Architecture A): user pays BCH; app funds storage
  via Sia's market; BCH surplus funds the serving layer
- This is where ordinary users enter; everything before it is plumbing

## Phase 4 — Argonautica: dynamic discovery (live sites without servers)

- Chain record gains the owner's signing pubkey
- Site updates = feed of author-signed records (ZeroNet/Nostr pattern);
  resolvers verify signatures and apply updates — no chain tx per update
- Multi-author records (comments, reactions) as CRDT merges (add-wins sets)
- Law to respect: gossip only for conflict-free facts; anything "exactly-one"
  stays on the chain

## Phase 5 — Argo: the hosting pact (dilution pool, Architecture B)

- v0: coordinator audits + pays openly on chipnet; hosts run our host agent;
  per-host-unique erasure shards (sybil resistance); stake bonding
- v1: possession proofs (block-hash challenge → Merkle proof) verified by a
  CashScript covenant; coordinator only attests serving quality
- v2: watchtower attestation replaces coordinator; open-join equilibrium
  replication fully market-driven
- Result: BCH-native host network; Sia becomes one backend among several

## Track 5 (parallel) — Theseus Navigator, the independent browser

See BROWSER-PROMPT.md — built in its own session/repo (`D:\Dev\BnsBrowser`),
consuming this repo's resolver core as a library. `theseus.bch` is registered
and should eventually serve the browser's own homepage over BNS itself.

## Standing risks

- Chromium ignores NRPT → extension/full-mode/browser are the mitigations
- s3d instances don't share object indexes → one authority instance per account
- .bch collision with a future ICANN gTLD → long-term: IETF special-use
  reservation (the .onion path)
- Root CA key custody until name constraints land