Active

Self-Organising Mesh (Pollen)

Decentralised mesh where workloads spontaneously organise — QUIC transport, CRDT state, cryptographic admission, WASM plugin runtime.

Go WASM QUIC/mTLS CRDT NATS
Zero-trust (Google BeyondCorp) · Cellular mesh (Uber/Netflix) · mTLS+QUIC (Cloudflare)
Problem Statement

The Home LAN Orchestration Gap

Traditional cluster orchestration (Kubernetes, Nomad) assumes a central control plane, persistent membership, and homogeneous nodes. On a home LAN — Fire Stick, Android phone, MacBook — these assumptions fail: devices come and go, IPs change, architectures differ, and there’s no always-on server. The question was: can we build a mesh that self-organises from any set of nodes, with no leader election, no central registry, no cloud dependency?

Existing solutions require a fixed orchestrator node, persistent etcd or Consul clusters, and homogeneous runtimes. A Fire TV Stick cannot run kubelet. An Android phone cannot join a Nomad cluster without a companion agent. And none of these platforms tolerate an always-on cloud dependency for registration and discovery. The mesh had to be peer-to-peer, self-healing, and architecture-agnostic at the workload layer.

Approach & Architecture

Symmetric Mesh, No Leaders

Pollen is a decentralised mesh where every node is symmetric. Each node runs a Go binary (/cmd/pln) that speaks QUIC with mutual TLS to every peer it discovers. Node state is replicated via a CRDT (Conflict-free Replicated Data Type) — every node holds a full copy of the mesh state: which peers are live, what workloads are seeded, which peripherals are attached. There is no leader, no consensus, no Raft. State merges automatically when partitions heal.

# Seed an intent into the mesh
pln intent "find all available peripherals" --exec

# CRDT merge — two peers converge after partition
pln crdt merge --peer tls://macbook.local:8443
# → Merged 12 new states, 0 conflicts
Architecture Diagram
CRDT STATE MERGE FIRE STICK wasm stt wasm MACBOOK wasm ai wasm yolo ANDROID wasm stt wasm RASPBERRY PI wasm wasm NAS cas wasm QUIC/mTLS QUIC/mTLS QUIC/mTLS QUIC/mTLS QUIC/mTLS WASM Plugin QUIC/mTLS Data
Data Flow Diagram

NL Query to Tool Execution Pipeline

USER Natural Language Query 1 NEEDLE-RS Intent Classification 26M Transformer 2 CRDT STATE Tool Registry Node Discovery 3 WASM RUNTIME Plugin Execution Extism PDK 4 RESULT Tool Output Response QUERY DECOMPOSITION FLOW Parse Intent 1 Match Tool 2 Schedule Node 3 Execute WASM 4 Return Result Sync command flow Async data flow Sequence step
Component Interaction Diagram

WASM ↔ Host ↔ CRDT ↔ Transport

SYSTEM COMPONENT INTERACTION Solid = sync call · Dashed = async/event TRANSPORT LAYER QUIC Stream netxlite/quic-go mTLS Auth TOFU Cert NATS Bridge Pub/Sub Gateway Mesh Discovery Peer Exchange CRDT STATE LWW Register State Merge Tool Registry Capability Map Node Membership Health Status Vector Clock Concurrency WASM RUNTIME Extism PDK Plugin Sandbox Host Functions CGo Bridge Hot-Reload WASM Push WASI I/O File System HOST (GO CORE) Scheduler Workload Placement CLI / Dashboard Bubble Tea TUI Logging / Telemetry Distributed Tracing Content Store CAS Blob Store sync sync event sync CGo I/O Async: NATS Pub/Sub
Key Subsystems

Architecture Breakdown

Transport Layer — QUIC + mTLS
Every mesh connection is a QUIC stream (netxlite/quic-go) authenticated with mutual TLS using self-signed certificates pinned at first contact (TOFU). Automatic reconnection with exponential backoff. Stream multiplexing means a single transport handles CRDT sync, workload streaming, and RPC dispatch without head-of-line blocking.
CRDT State Layer
Node membership and tool registry are replicated via Last-Writer-Wins (LWW) registers. Every node holds the complete mesh state. When a partition heals, states merge automatically — no consensus round needed. Vector clocks disambiguate concurrent writes. The state is small (<50KB for 20 nodes), so full replication is practical even on memory-constrained devices like a Fire Stick.
WASM Plugin Runtime
Workloads are .wasm binaries seeded into the mesh and scheduled across nodes via placement hints (architecture, peripherals, capability score). The Extism PDK provides sandboxed execution with hot-reload. Plugins can be pushed from any node and automatically distribute — a .wasm file seeded on the MacBook appears on the Raspberry Pi within seconds.
Needle-rs Integration
A 26M-parameter tool-calling transformer runs on Apple Silicon nodes via CGo bindings to needle-rs. Average inference: 335ms. Handles natural-language-to-tool routing — “turn on the camera on the Fire Stick” becomes a structured tool invocation dispatched across the mesh. No GPU needed, runs entirely on CPU via quantised weights.
STT Pipeline & Vision
whisper.cpp integration provides speech-to-text on any node with a microphone (Android phone, MacBook). YOLO ONNX-based object detection can be dispatched across nodes for distributed vision processing. Both are packaged as WASM plugins with device-capability gating — a node advertises “has-mic” or “has-camera” and eligible workloads flow to it.
Tech Stack

Languages, Protocols & Runtimes

Languages
Go 1.22 (core) TinyGo (WASM plugins) Rust (needle-rs CGo bindings)
Protocol
QUIC (netxlite/quic-go) mTLS (crypto/tls) CRDT (LWW registers) NATS (pub/sub bridge)
AI
Needle-rs 26M tool-calling transformer whisper.cpp STT YOLO ONNX vision
Runtime
WASM via Extism PDK CGo needle backend
Storage
Content-addressed blob store (CAS) SQLite (app data)
UI
Bubble Tea TUI (dashboard, logs) React (web dashboard via pln-dashboard)
Architecture Decision Records

Key Decisions

ADR-001
CRDT over Raft
Decision: CRDT LWW registers → no consensus
No leader election needed, simpler at small scale, merges automatically when partitions heal. Avoids the complexity of Raft log replication, quorum requirements, and the tail latency of leader-driven writes. For a mesh of <50 nodes where availability trumps strong consistency, CRDTs are the correct tradeoff.
ADR-002
QUIC + mTLS over TCP/TLS
Decision: QUIC transport with mutual TLS
Faster handshake (0-RTT vs 2-RTT), built-in stream multiplexing eliminates head-of-line blocking, and connection migration handles IP changes transparently. mTLS provides mutual authentication without a CA hierarchy — each node generates its own cert at first boot, pinned via TOFU.
ADR-003
WASM Plugins over Sidecar Processes
Decision: WASM via Extism PDK → sandboxed plugins
Sandboxed execution, hot-reloadable, architecture-independent. A single .wasm binary runs on ARM (Raspberry Pi, Android, Fire Stick) and x86 (MacBook) unchanged. Sidecar processes would require per-architecture binaries, introduce orchestration overhead, and lack the memory-sharing guarantees of WASM.
ADR-004
Needle-rs 26M over Larger LLM
Decision: 26M-parameter transformer → on-device inference
Runs on Apple Silicon at 335ms inference, no GPU needed. Larger models (7B+) require GPU acceleration or cloud offloading, both incompatible with the mesh’s no-cloud-dependency constraint. The 26M model is sufficient for tool-calling from structured intents — the mesh routes NL queries to the nearest capable node.
ADR-005
CRDT over Central Database
Decision: Fully replicated CRDT → no central DB
Works with intermittent connectivity, no single point of failure, peer-to-peer by nature. Central DB (even embedded like SQLite with NATS bridge) introduces a coordination dependency and a SPOF. With full CRDT replication, any two nodes that discover each other can synchronise state directly, even if the rest of the mesh is unreachable.
Session Timeline

Key Development Sessions

Needle-rs Integration 1,152 messages
3.14M tokens
1.6¢
Needle-rs integration: wow usecases
Discovering how needle-rs fits into the pollen architecture. Evaluated tool-calling accuracy, latency profiles on Apple Silicon, and designed the CGo bridge layer. Concluded that a 26M-parameter model is sufficient for structured intent routing across the mesh.
Peripheral Detection
1,046 messages
1.21M tokens
1.3¢
Mesh peripheral detection and pooling
Designed the peripheral registry: a CRDT-replicated map of device capabilities (mic, camera, GPU, storage). Each node advertises its peripherals, and workloads with matching requirements are scheduled to capable nodes. Handling device hotplug and departure gracefully.
Dashboard Features
986 messages
1.45M tokens
0.97¢
Surface new features on live dashboard
Planning dashboard visualisations for mesh topology, live CRDT sync status, WASM workload distribution, and peripheral pooling. Designed the Bubble Tea TUI layout and the React web dashboard component tree.
STT Integration
756 messages
1.80M tokens
0.93¢
Voice-command STT with whisper.cpp
Integrating speech-to-text across mesh nodes via whisper.cpp compiled to WASM. Designed the voice pipeline: audio capture on the node with a mic, STT inference, NL routing via needle-rs, tool dispatch. Evaluated model sizes for real-time performance on ARM.
Mobile UI Strategy
720 messages
1.42M tokens
0.86¢
Lightweight Android UI plan & React Native eval
Mobile UI strategy for the mesh dashboard. Evaluated React Native vs Flutter vs native Android. Decision: lightweight React Native dashboard with a Go bridge for mesh state queries, optimised for low-bandwidth mesh conditions.
Outcome & Impact

Project Metrics

112
Sessions Dedicated
25
Key Decisions Documented
9M
Tokens Consumed
5.7¢
Total Cost

Active development — the mesh runs on production home infrastructure across 5 device types. Industry pattern alignment: Google BeyondCorp (zero-trust networking), Netflix cellular architecture (self-organising mesh), Cloudflare (mTLS+QUIC transport).

Google BeyondCorp — Zero-Trust Networking Netflix Cellular Arch — Self-Organising Mesh Cloudflare — mTLS + QUIC Transport