Hello and welcome to a jam-packed edition of the Ink & Switch Dispatch! It begins with our first public update about the ARIA Safeguarded AI Programme, introducing our project GAIOS and the new lab staff working on it, followed by a report on its implementation of our new local-first auth system Keyhive. We’ll share three presentations from the LIVE 2025 conference, and cue-up a new lab note from the Beckett video game version control project. Finally, we have two new researchers-in-residence in the spotlight, and a fresh coat of yellow paint for the Automerge website. Phew!
In the previous dispatch we announced that Ink & Switch has joined the ARIA Safeguarded AI Programme (SGAI). Put plainly, the programme’s goal is to develop a suite of tools for modelling complex systems to determine how they might be augmented with AI. To that end we are building GAIOS, a malleable, collaborative software platform derived from our Patchwork project. GAIOS will allow other teams participating in the SGAI programme to unite their modelling and simulation tools, building atop a common foundation with interoperability and version control powered by Automerge. We’ll share more of GAIOS, including its source code, throughout the coming year.
The GAIOS logo, designed by Todd Matthews.
The team working on GAIOS includes many longtime Ink & Switch researchers, and a few new faces:
- The mononymous grjte will lend her expertise in zero-knowledge proofs and programmable cryptography to the GAIOS team. Previously at Bain Capital Crypto, grjte recently shared Groundmist, a series of experiments building local-first tools that leverage the AT Protocol and Automerge.
- Maciek Sakrejda worked on Postgres tooling for most of his career but has now seen the local-first light. He’s already an active contributor to Automerge Repo, and since joining the lab has helped land presence indicators for our in-house instance of Patchwork. His full-stack skills will be instrumental as we prepare GAIOS for real-world use.
- Fresh from presenting at LIVE 2025, Orion Reed brings his knack for quick-and-compelling prototypes, programmable canvas tools, and malleable substrates to the lab. Orion’s work spans disciplines, leading him to collaborate with varied groups like FolkJS, the mysterious Tentpole Collective (with researcher-in-residence alumni Elliot Evans and Lu Wilson), and the Liberatory Computing collective.
We’ve accelerated our work on Keyhive, a capabilities-based auth system specially designed for local-first software, to prepare it for GAIOS. Adding access control is an important step for collaborative systems like GAIOS and Patchwork: it defines who can connect, who can request documents, and lays the groundwork for richer permissions in the future. What follows is a lightly-technical summary of the most recent work on Keyhive, written by Brooklyn Zelenka and John Mumm.
Sharing a document in the Keyhive proof-of-concept.
Automerge Repo started with no ability to do auth. We added integration points to Automerge Repo for authorization APIs, and then plugged in Keyhive as the auth provider. This gives us a natural point to enforce capabilities whenever a document is accessed while maintaining the existing Automerge Repo APIs. This integration provides the following:
- All messages sent or received are signed with the local non-extractable signing key
- Messages for a particular document are authorized by checking the access rights of the authenticated sender of the message against the local Keyhive instance
- Keyhive’s ops are synchronized over the same network stack as the rest of Automerge Repo, but currently with a naive diffing mechanism which we plan to replace with the new sync system (Subduction — more on that below)
The end result is that all documents in GAIOS are protected at the network boundary by the Keyhive access control CRDT and GAIOS guest applications are passed an interface to manage this access control state without needing to know about storage or synchronization. This is an initial integration, and ongoing work includes adding E2EE and enforcing revocations on backdated Automerge content.
In parallel, we began prototyping a “share” (permissions) dialog for users. This menu provides a clear UI to invite collaborators, adjust permissions, and revoke access. The goal is to make capability management feel familiar — more like adding a collaborator in Google Docs, less like managing cryptographic keys. Behind the scenes, these actions map to issuing or revoking Keyhive capabilities. This design aims to connect the user mental model (“sharing a document”) with the technical enforcement layer (capabilities).
We’ve recorded a short video demonstrating this early UI prototype if you’d like to see it in action.
One recurring challenge in CRDT-based systems is synchronization at scale. As more users join, and as documents grow larger, our reference sync server implementation has shown stress points:
- It maintains a fully materialized version of every document in memory.
- It computes hashes and related states eagerly for each request.
- Being written in Node.js — which being 32-bit has a 4GB memory limit — it can run into memory pressure.
The result: servers sometimes time out under heavy load, particularly when handling large diffs or very active documents.
To address this, we’ve been developing an alternative sync strategy we call Subduction. Instead of materializing entire documents, Subduction deterministically chunks documents and streams only the minimal state needed to reconcile peers.
An illustration of document chunking.
We believe that this should result in:
- Improved scalability: less memory overhead, much less CPU use per request.
- Better performance: faster diffs, quicker round-trips.
- Set us up for E2EE documents since it doesn’t need to know anything about the underlying document other than some hash identifiers.
We are finalizing the integration of Subduction with Automerge Repo, and hardening the integration of Keyhive in GAIOS. Subduction and Keyhive are nearly ready for their public debut — after just a little bit more internal testing and dogfooding.
In September we participated in LIVE 2025, the 11th Workshop on Live Programming. Here are three of the presentations from folks affiliated with the lab.
Screenshots from the three live presentations, showing a poker game with various statistics and scenarios in Ambsheets, an illustration of Nova’s stacks, and a few strategies for adversarial interoperability.
In Ambsheets: A spreadsheet for exploring scenarios, Alex Warth, Geoffrey Litt, and Avi Bryant introduce Ambsheets, a spreadsheet that lets you model uncertainty and explore multiple scenarios simultaneously. The paper builds on their earlier explorations, discusses limitations they discovered, and presents a new version of the language that addresses those limitations. Also make sure to check out the video.
June Gardner, a researcher-in-residence at the lab, presented her work on Nova, a lightweight model of computing that uses rule-based modelling and physical metaphor to bridge the gap between physical media (pen/pencil, notecards/paper) and the programming of digital, electronic computers. The talk covers the basics of Nova as well as its advantages and current development status, as well as some hints at what the future might hold for Nova as a programming language.
Orion Reed, who recently joined the lab to help build GAIOS, collaborated with Christopher Shank on Live Programming in Hostile Territory. The paper and talk argue that live programming research should broaden its purview from the creation of new environments to the augmenting of existing ones and, through a selection of prototypes, explore three adversarial strategies for introducing programmatic capabilities into existing environments which are unfriendly or antagonistic to modification.
Beckett — our exploration of version control inside the Godot game engine — continues apace. We’re pleased to share that Lilith Duncan has joined the team. Lilith is a gamedev and toolmaker, most recently at Unity focused on worldbuilding and environment tools. Lilith and the rest of the team were in-person at GodotFest Munich, and they received a glowing response to various demos of their work-in-progress.
Speaking of work-in-progress, we’ve just published the first Beckett lab note, Version Control for Space and Structure. The note describes our latest findings after working to integrate diff visualizations into the Godot editor viewport and handling various structural changes within Godot scene files. These scene files are stored as text, making it possible to track them with traditional version-control systems (like git), but these systems fail to uphold important structural relationships within the files, leading to broken, unopenable projects. Read the lab note to learn how Beckett overcomes these issues.
We’re also pleased to spotlight two more new people who have joined Ink & Switch as researchers-in-residence. June Gardner, as we mentioned above, is the creator of the Nova programming language. She plans to spend the residency enhancing Nova and improving the tooling and documentation around it. Previously, June created Modal and founded the Nouveau creative computing collective.
Mimi Reyburn is a design-focused engineer and AI researcher, currently working at the NHS to improve information for patients and visualizing their needs. A few of her playfully inspiring personal projects are isthetubef.uk and Inky Calendar (not to be confused with Sketchy Calendar).
Finally, after months of internal brainstorming and iteration, we unveiled a brand-new website for Automerge with a striking visual design created by Todd Matthews and a whizzy interactive demo by Ivan Reese. The new website uses punchy language and illustration to nail down a few key points: what Automerge is for, how you can adopt it, and why it’s worth using. Behind the scenes, the website uses a custom static site generator that Ivan previously created for the Ink & Switch website, designed for rapid iteration and ongoing tailoring to our exact needs. This will increase how quickly and readily we can update the Automerge website and unblock our effort to improve the docs, tutorials, and other resources.
The new Automerge website, in vibrant yellow, with an interactive demo on the home page.
That’s all for this mega-sized Ink & Switch Dispatch. If you’d like to collaborate with us or share your thoughts, we’re all ears. See you next time!
The Ink & Switch Dispatch
Keep up-to-date with the lab's latest findings, appearances, and happenings by subscribing to our newsletter. For a sneak peek, browse the archive.
Instagram Engineering
Shopify Engineering