What's New Since Udanax-Gold

In 1999, Udanax-Gold was open-sourced — 200,000 lines of mechanically-translated Smalltalk-to-C++ with elegant data structures but no working transclusion queries. Here is everything we built on top.

1. Three-Way Merge for Collaborative Editing

Gold was single-user only. Xudanu supports real-time collaborative editing via otree-merge, a three-way merge that operates directly on O-tree elements — not flattened text. Collaborative edits preserve transclusions, overlays, data bindings, and attribution.

How It Works

When two users edit the same document concurrently, the server performs a three-way merge against a common base:

1. BLAKE3 fingerprint alignment — identify unchanged segments between three versions
2. Segment classification — Unchanged, OnlyA, OnlyB, Conflict, Insert
3. Composable position mappings — positions shift correctly after each merge decision
4. Conflict-free by default — concurrent inserts at different positions auto-merge

Figure 1: Two concurrent edits merged via three-way fingerprint alignment.

pub enum MergeSegment<T> {
    Unchanged(T),
    OnlyA(T),
    OnlyB(T),
    Conflict { a: T, b: T },
    Insert { pos: usize, elements: Vec<T> },
}

2. Cookie-Based Auth with Signing Keys

Every edit in Xudanu is cryptographically signed with an Ed25519 key. The challenge: how does a web browser hold a signing key? The answer is a carefully designed auth chain where the key is encrypted at rest, decrypted on login, and cached in the server-side session.

Login Flow

1. POST /auth/login — validates club credentials against Argon2id password hash
2. Decrypts signing key — authenticate_with_pending uses Argon2id + ChaCha20-Poly1305 AEAD
3. Caches in session — OAuthSession.signing_key_bytes stores the Ed25519 key bytes server-side
4. Sets HttpOnly cookie — xudanu_session cookie with CSRF token provided separately

WebSocket Auto-Auth

1. Browser sends cookie on WebSocket upgrade request automatically
2. Server reconstructs SigningKey via authenticate_session_from_oauth from cached bytes
3. Provenance works — materialize_with_provenance finds the key, signs every edit
4. Public fallback — session_login_public for anonymous browsing if no cookie present

Figure 2: Auth chain from login through WebSocket auto-authentication.

3. Cryptographic Provenance

Gold had no cryptographic attribution — authorship was asserted, not proven. Xudanu signs every edit with Ed25519. An append-only SHA-256 hash-chained transparency log records every provenance signature, making forgery detectable after the fact.

Three Author Types

ElementProvenance {
  signature:   Signature,   // Ed25519
  author_key:  PublicKey,
  author_name: String,
  author_type: AuthorType,
  // Human | Llm | Historical
  timestamp:   u64,
  server_id:   String,
}

// Signature covers:
// BLAKE3(
//   fingerprint
//   || author_key
//   || timestamp
//   || server_id
// )
// with domain separation

Transparency Log

Every provenance signature is recorded in an append-only SHA-256 hash-chained log. Each entry includes the hash of the previous entry — tampering with any single entry breaks the entire chain from that point forward.

Figure 3: SHA-256 hash-chained transparency log for provenance signatures.

4. Content-Addressed Chunk Store

Gold used in-memory Smalltalk object storage with no persistence. Xudanu stores document content as individually addressable .xchunk files in hex-sharded directories, each verified by BLAKE3 hash. Checkpoints write only changed chunks, not the entire state.

Storage Layout

xudanu-data/
├── chunks/
│   ├── ab/
│   │   └── ab3f...c821.xchunk
│   ├── 7e/
│   │   └── 7e2a...f409.xchunk
│   └── ...
├── works/
│   ├── work-001.json
│   └── ...
├── manifest.json
└── audit.log

Properties

5. Char-Range Annotations

A full CRUD annotation system operating on character ranges. Yellow highlights in the editor, annotation panel with author attribution, keyboard shortcut Ctrl+Alt+A / Cmd+Alt+A. Annotations are a metadata layer — they don't modify document content — so they work on source works too.

pub struct Annotation {
    id:              String,
    doc_id:          String,
    start:           usize,    // char offset
    end:             usize,    // char offset
    text:            String,   // annotation body
    color:           Option<String>,
    created_by:      String,   // club ID
    created_by_name: String,   // display name
    created_at:      u64,
}

Features

• Create, read, update, delete — full lifecycle via WebSocket ops
• Persistent storage — annotations_hash in manifest, chunk-stored
• Author attribution — created_by_name resolved from club display name
• Source work support — annotations allowed on frozen source documents
• GC-aware — orphaned annotations cleaned up with chunk garbage collection
• Canvas rendering — yellow highlight overlay, pointer-events: none when no annotations to draw

6. Modern Web Frontend

Gold had a terminal/Motif UI. Xudanu has a React SPA with TypeScript, real-time collaborative editing via WebSocket, canvas-based attribution overlays, and side-by-side comparison with bridge curves connecting transcluded regions.

Components

Wire Protocol

110+ operation codes covering sessions, clubs, works, editions, links, transclusion, blobs, overlays, labels, retrieval, attribution, search, shared content, range queries, versioning, recorders, crypto, endorsements, federation, membership, governance, and CRDT sync. Dual codec: binary (LEB128 + postcard) and JSON.

7. Historical Author & Source Import

Pattern-based detection for Project Gutenberg, Internet Archive, and plain text. Registry for non-digital authors with external IDs. Content boundary detection to skip header/footer boilerplate. Source works are permanently frozen — no edits allowed. Content matching on paste automatically attributes provenance to historical authors.

Source Import Flow

1. Detect format — Project Gutenberg headers, Internet Archive metadata, or plain text
2. Extract boundaries — skip boilerplate header/footer, identify actual content
3. Register author — match to existing historical author or create new (with optional external IDs)
4. Freeze work — mark as source (immutable), public by default
5. Attribution on paste — when pasted content matches a source work, provenance automatically attributed to the historical author

8. LLM Integration

Multi-backend support for AI-assisted editing. All LLM output is cryptographically tagged in the provenance system with AuthorType::Llm and the model name.

9. Club-Based Identity & Security

Personal "clubs" with Ed25519 keypairs encrypted at rest. Gold had no concept of user identity or access control.

Security Features

Federation with Byzantine Fault Tolerance

Encrypted peer channels (X25519 + ChaCha20-Poly1305). OrSet and LwwRegister CRDTs for state reconciliation. PBFT governance for membership and policy decisions. Cross-server transclusion queries. Transport layer exists; content sync is incomplete. Once finished, federation would provide automatic multi-node replication — an alternative to the manual off-site backup script for data redundancy.

10. Optimized Transclusion Queries

The Udanax team designed elegant data structures but left core queries unimplemented. The BackfollowEngine had no callers. H-tree canopy flags were allocated but never checked. Xudanu connects the pieces and makes them fast.

W = works, L = text length, U = unique fingerprints, A = avg works/fingerprint, n/m = doc lengths, r = regions, t = text

11. Nelson's 17 Rules: Implementation Status

How closely does Xudanu implement Ted Nelson's original 17 Rules of Xanadu? Here is the honest accounting.

12. What's Not Yet Implemented

Features from Ted Nelson's original vision that remain to be built.

Content & Editing

Infrastructure

Known Limitations

• Write lock serialization — the server uses Arc<RwLock<Server>>, allowing concurrent reads (health checks, blob reads, session lookups) via with_server_ref. Gold was single-threaded with no concurrency support at all. The RwLock is a step up, but mutations (edits, saves) still acquire an exclusive write lock via with_server and are serialized — the bottleneck for write-heavy workloads.
• Desktop-only frontend — no responsive layout or mobile breakpoints
• No global dark mode — only the debug panel is dark-themed
• Verified user names — crdt_awareness_update accepts user_name from the client without server-side verification. Any connected user can impersonate any other user.

13. Gold Features Not Yet in Xudanu

Features present in the Udanax-Gold C++ codebase (~200,000 lines) that have no equivalent or only stubs in Xudanu.

Content Model

Identity & Access Control

Protocol & Infrastructure