Jagoo Bahee

Across much of the world, speech online is governed less by law than by leverage. Digital security acts criminalise criticism in language broad enough to reach anyone, and platforms , hosted by companies that can be pressured, subpoenaed, or simply switched off to comply. The result is a chilling effect: people who witness injustice stay silent, because the account that reports it is traceable to a person who can be arrested. When protest does build, the second lever follows. Governments cut the internet during unrest, curfews, and wars; earthquakes and floods do the same thing without intent. Every mainstream platform fails at once, because every one of them assumes a reachable server. Relief coordination, missing-person searches, and independent reporting stop together, at the moment they matter most. The gap is a platform that needs no authority to be trusted and no infrastructure to survive. It must let people speak, organize, and document abuses without a real-world identity that can be correlated or seized and it must keep working when the network is islanded, filtered, or gone entirely, degrading to LoRa radio, phone-to-phone mesh, and hand-carried files rather than shutting down. Nothing in wide use does both.

Jagoo Bahee is a federated forum where every action is a signed envelope rather than a request to a server. Your identity begins as a BIP-39 passphrase held only on your device. From it, hardened BIP-85 derivation produces every key you use: a device key, a separate key per community so activity in one cannot be linked to another, a per-epoch secret that proves you posted without revealing who you are, and a blinding secret for anonymous credentials. There is no account, no email, no phone number, the identity is the public key. Nothing is registered anywhere, so a server never holds a secret it could be forced to surrender. On top sits a familiar forum: communities, threaded comments, votes, moderation, roles, awards. What differs is that content is valid the moment its author signs it. No server approves a post, because withheld approval is indistinguishable from a network error, that is how silent censorship works. Moderation is additive signed opinion, and deletion is a tombstone: author, timestamp, acting moderator and reason stay public, so every removal is itself evidence. Independent instances federate over gRPC, admit one another on first contact rather than by allowlist, and re-verify every envelope they receive. Any node can publish itself as a Tor onion service. Spam is priced out with proof-of-work and blind credentials instead of identity, so anonymity is never what you trade for usability. When the network degrades, the platform does not stop; it descends. It prefers the narrowest working path, LAN, then ISP-local, then national, then global, continuously, so the fallback is already warm when it becomes the only path. A multi-homed node bridges two islanded ISPs. Below IP, phones exchange signed envelopes directly over a WebRTC mesh with hop and TTL limits, or by hand-carried .jbpack files. At the lowest rung a Reticulum sidecar carries traffic over LoRa and packet radio. Because a frame is 220 bytes, emergency traffic is budgeted for it: broadcasts and check-ins are capped at 512 bytes, fragmented, reassembled and queued durably so a severed transfer resumes, while bulk posts are refused outright rather than flooding the link. These ride a second, identified plane . named channels, emergency broadcasts, safety check-ins, missing-person and resource reports , derived from a wholly separate passphrase, so speaking publicly under your own name never deanonymises anything you said anonymously. Nothing in the design requires a server to be honest.

Languages: TypeScript (backend, frontend, SDK, audit-log), Rust (reference impl), Python (vectors + optional Reticulum relay), Protocol Buffers (schema), Kotlin (native Android bridges). Backend (NestJS/Fastify): NestJS, Fastify, @grpc/grpc-js, nice-grpc, MongoDB driver, ioredis, argon2, AWS S3 SDK — mostly MIT/Apache-2.0. Attributions - Reticulum Meshchatx, Sideband, Youtube video clips for Facebook post Frontend (Expo/React Native): React, React Native, Expo SDK, TanStack Query, Zustand, Reanimated, react-native-webrtc (bundles Google libwebrtc), react-native-nitro-tor (bundles Tor client) — all MIT, underlying native libs BSD-3-Clause. Crypto SDK (packages/sdk-ts): Noble/Scure libraries by Paul Miller — @noble/curves, @noble/hashes, @noble/ciphers, @noble/post-quantum (ML-KEM/ML-DSA), @scure/bip32/bip39 — all MIT, attribution required. Rust reference (crates/jb-core): sha2, ed25519-dalek, serde, unicode-normalization — MIT/Apache-2.0/BSD-3. Python: grpcio, protobuf (Apache/BSD), and Reticulum Network Stack (rns) + lxmf by Mark Qvist — MIT, used for offline LoRa/mesh messaging. Native Android: Bouncy Castle 1.83 (crypto backend) — MIT-style; Chaquopy (embeds Python runtime) — commercial license, flagged for review. Infrastructure (Docker): MongoDB (SSPL), Redis (BSD-3 or RSALv2 depending on patch), MinIO (AGPL-3.0), Tor (BSD-3-Clause, external service). Fonts: Poppins, JetBrains Mono, Inter — Google Fonts, SIL Open Font License 1.1. AI/Pre-trained models: None — confirmed via repo-wide search; no LLM/ML component anywhere. Project license: AGPL-3.0-or-later (compatible with all above). Flags: Chaquopy commercial terms and MongoDB/Redis licensing worth a compliance check before public distribution; everything else is permissive and freely combinable.

Gemini Antigravity, Claude Code and Codex for coding assistance