Local-First Integrity: A New Approach to Data Ownership

Author: Denis Avetisyan

A new distributed system, Sark, prioritizes user control and data security by eschewing global state in favor of local-first integrity management.

Sark architecture embraces inherent fragility, acknowledging that every structural decision foreshadows eventual compromise and decay within the evolving system.

Sark offers a decentralized solution for asset management, leveraging Merkle trees and a novel governance topology to provide confidentiality without relying on traditional blockchain architectures.

Maintaining data integrity and confidentiality often demands a centralized authority or globally consistent state, creating inherent trust assumptions. This paper introduces Sark: Oblivious Integrity Without Global State, a novel reference architecture for asset management that prioritizes local-first data control and oblivious computation. By decoupling integrity from global consensus, Sark offers a distinct decentralization-trust trade-off, leveraging a permissioned blockchain and commitment roll-ups to ensure data validity without revealing underlying asset details. Could this approach unlock more robust and privacy-preserving systems for managing digital ownership and sensitive data?

The Illusion of Choice: Secure Custody Versus Transparent Control

Conventional asset management frequently forces a choice between secure custody and verifiable transparency, a dichotomy that inherently restricts functionality. Systems designed for robust safeguarding often operate as ‘black boxes’, limiting the ability of owners to independently audit holdings or confirm their assets are managed according to agreed-upon parameters. Conversely, platforms emphasizing transparency – such as those leveraging public blockchains – can compromise privacy, exposing sensitive financial information and potentially increasing vulnerability to attack. This fundamental tradeoff creates friction for both individuals and institutions, hindering broader adoption and limiting the potential of digital assets. The inherent limitations of prioritizing one attribute over the other necessitate a re-evaluation of existing architectures to unlock greater utility and control for asset owners.

Sark introduces a fundamentally different approach to asset management by prioritizing both privacy and user control through an oblivious, non-custodial architecture. Unlike traditional systems where assets are either held by a third party – risking centralization and potential loss – or managed with full transparency, potentially revealing sensitive financial information, Sark keeps asset details concealed from all but the owner. This is achieved by employing cryptographic techniques that allow for operations on encrypted data, meaning transactions can be validated and executed without ever exposing the underlying asset values or ownership details. The system empowers individuals with complete sovereignty over their holdings, eliminating the need to trust intermediaries and fostering a secure, private, and efficient means of managing digital assets.

The system’s core innovation lies in a ‘local-first’ integrity architecture, fundamentally shifting asset management away from centralized custodians. Instead of relying on third parties to verify and secure holdings, this approach places data validation and control directly within the user’s environment. This is achieved through cryptographic techniques that allow assets to be managed and transacted without revealing sensitive information to intermediaries. By minimizing the need for trust in external entities, the system not only enhances security-reducing the risk of hacks and censorship-but also significantly empowers users with complete sovereignty over their digital assets. This localized control fosters a more resilient and private financial experience, enabling individuals to truly own and manage their wealth without undue reliance on potentially fallible institutions.

The Sark implementation demonstrates a vertical configuration.

The Architecture of Trustlessness: Local-First Integrity

Sark’s Local-First Integrity System operates by generating cryptographic proofs of asset state that allow verification of data integrity without requiring access to the underlying asset data itself. This is achieved through the construction of commitments – succinct representations of data that can be publicly verified. The system prioritizes local computation for proof generation and verification, minimizing reliance on external oracles or trusted third parties. This approach enhances privacy by preventing the disclosure of sensitive asset details during integrity checks, while simultaneously ensuring data authenticity and preventing unauthorized modifications. Verification relies on the mathematical properties of the commitment scheme, allowing anyone with the proof to confirm the asset’s state at a specific point in time.

The Sark core utilizes Merkle Trees – specifically Jellyfish and Patricia Trees – as the foundational data structure for efficiently committing and verifying transaction records. These trees allow for succinct proofs of data inclusion without revealing the entire dataset. Jellyfish Trees offer advantages in certain scenarios due to their dynamic resizing and resistance to range proofs, while Patricia Trees, a more traditional Merkle Tree variant, provide predictable performance characteristics. Porter components are integrated to optimize the construction and verification processes, contributing to minimized computational overhead and improved scalability. The combination of these technologies enables efficient proof generation and validation, essential for maintaining data integrity within the system.

Merkle Patricia Tries (MPT) offer performance advantages over per-block Jellyfish Merkle Trees when dealing with uniformly random keys. Testing indicates that MPTs achieve lower latency and higher throughput in these scenarios due to their structure, which allows for more efficient proof generation and verification. Specifically, the Patricia Trie component optimizes storage and retrieval by pruning empty branches and using a compact key-value representation. This contrasts with Jellyfish Trees, where proofs are constructed on a per-block basis, leading to increased computational overhead and slower processing times when keys are randomly distributed.

Anchoring data integrity proofs to a blockchain establishes a permanent, publicly auditable record. This process involves submitting a cryptographic commitment – typically a hash – of the proof to the blockchain as a transaction. Because blockchains are inherently tamper-evident, any attempt to alter the underlying data would result in a mismatch between the committed hash and the recalculated hash of the altered data. This mechanism prevents opportunistic rewrites of the data history, providing cryptographic finality. The blockchain acts as a trust anchor, allowing anyone to independently verify the integrity of the data by comparing the committed hash with a newly calculated hash of the data and the corresponding proof.

The Fabric of Resilience: System Architecture and Consensus Options

Sloop utilizes the Raft consensus algorithm to provide Crash Fault Tolerance (CFT) within the Sark network. Functioning as a validator node, Sloop is responsible for proposing and agreeing upon blocks to be appended to the ledger. Raft achieves consensus through leader election and log replication, ensuring that even if some nodes fail, the system continues to operate correctly as long as a majority of validators remain active and can communicate. This implementation positions Sloop as a core component of Sark’s data consistency and reliability mechanisms, providing a foundation for secure and dependable transaction processing.

The Sloop architecture is being designed to accommodate integration with Byzantine Fault Tolerance (BFT) consensus engines, specifically Tendermint and CometBFT, to potentially improve system resilience beyond that offered by the native Raft implementation. These BFT engines offer different fault tolerance characteristics and may be preferable in scenarios demanding higher robustness against malicious actors or a broader range of failure modes. Investigation focuses on interoperability and performance trade-offs when utilizing these alternative consensus mechanisms within the Sloop framework, allowing for a flexible approach to security and fault tolerance based on specific deployment requirements. Compatibility layers are being explored to facilitate the use of these engines without requiring substantial modifications to the core Sloop logic.

Within the Sloop system employing the Raft consensus algorithm, best-case transaction finality is achieved with a latency of $Tb + \epsilon$ . Here, $Tb$ represents the block timeout, which is the maximum time a leader has to propose a new block. $\epsilon$ denotes a negligible time component, and is defined as being less than or equal to $Tc$ , the block commitment timeout. This indicates that under optimal network conditions and rapid leader responsiveness, finality can be reached quickly, constrained primarily by the block timeout duration and a small, bounded propagation delay represented by $\epsilon$ .

Under the Raft consensus algorithm, worst-case finality in Sloop is calculated as $Tb + Th + Δ + 2ϵ$ . This represents the total time required for a transaction to be considered final under adverse conditions. $Tb$ is the block timeout, defining the maximum time a block can take to be proposed. $Th$ denotes the Raft heartbeat interval, representing the time between leader confirmations. $Δ$ signifies the duration of a leader election, which occurs when a leader fails and a new one must be selected. Finally, $2ϵ$ accounts for minor delays inherent in network propagation and processing, where $ϵ$ is a negligible value less than or equal to the block commitment timeout. This formula provides a quantifiable upper bound on transaction finality time, critical for assessing system performance and reliability.

To broaden interoperability, Sloop is evaluating integration pathways utilizing the Application Binary Interface (ABI) standard, specifically through Tower ABCI. This allows Sloop to function as a module within existing blockchain applications built on the Cosmos SDK. Concurrently, investigation into Malachite, a modular blockchain framework, aims to establish a pathway for Sloop to operate as a custom layer within Malachite-based chains, providing a method for deployment on alternative virtual machines and potentially benefiting from their respective security and performance characteristics. Both approaches prioritize compatibility with existing ecosystems without requiring substantial modifications to core Sloop functionality.

The Pillars of Trust: Prioritizing Security and Privacy

System design in Sark is fundamentally anchored by the principles of the CIA Triad – Confidentiality, Integrity, and Availability. This means that protecting sensitive user data – confidentiality – is paramount, alongside ensuring that data remains accurate and untampered with – integrity. Crucially, these safeguards aren’t achieved at the expense of access; the system is engineered to maintain consistent and reliable service – availability – even under challenging conditions. This deliberate prioritization shapes every architectural decision, influencing choices related to data storage, transaction processing, and network communication, ultimately aiming for a robust and trustworthy system where these three security pillars are not traded off against one another but are mutually reinforced.

The system’s architecture builds upon decades of research into privacy-preserving digital payments, notably referencing the pioneering work of David Chaum who first proposed blind signatures enabling untraceable transactions. This foundation extends to practical implementations such as GNU Taler and Penumbra, both of which explored different approaches to shielding transaction details from public view. By drawing inspiration from these predecessors, the design leverages established cryptographic techniques and lessons learned from earlier systems, aiming to refine and enhance privacy features while addressing limitations encountered in previous iterations. The intent is not to simply replicate existing solutions, but to synthesize the best aspects of these systems into a novel architecture capable of providing robust privacy guarantees for its users.

The system’s governance isn’t simply about how decisions are made, but also about safeguarding the confidentiality of those involved and mitigating potential systemic vulnerabilities. A distributed governance topology is employed, deliberately avoiding centralized control that could compromise user privacy or create single points of failure. Proposals and voting processes are designed to minimize the revelation of individual preferences, utilizing techniques inspired by secure multi-party computation. This approach ensures that decisions reflect collective consensus without exposing the private intentions of any particular participant, thereby fostering a resilient and trustworthy system where user data remains protected and the overall network is shielded from concentrated risk.

The Sark protocol facilitates secure communication by establishing a shared key through a Diffie-Hellman exchange and encrypting subsequent messages using <span class="katex-eq" data-katex-display="false">AES</span>. — The Sark protocol facilitates secure communication by establishing a shared key through a Diffie-Hellman exchange and encrypting subsequent messages using $AES$ .

Toward a Resilient Future: Addressing Limitations and Future Directions

Recognizing that consistent data accessibility is crucial for the long-term viability of any decentralized system, the project acknowledges potential constraints arising from network interruptions or node failures. To proactively address these challenges, strategies centered around data redundancy are being thoroughly investigated. Specifically, data replication – creating multiple identical copies across different nodes – offers a straightforward, though resource-intensive, solution. More sophisticated approaches, such as erasure coding, are also under consideration; this technique divides data into fragments, adds redundant information, and allows reconstruction even if some fragments are lost, providing a more space-efficient means of ensuring data availability and bolstering system resilience against partial failures.

The system’s architecture deliberately incorporates flexibility, allowing deployment across a spectrum of environments – from tightly controlled, permissioned networks where identity and access are centrally managed, to fully decentralized, permissionless settings. This adaptability isn’t merely a matter of technical convenience; it’s a core design principle intended to maximize real-world impact. While initial implementations may benefit from the structure of permissioned systems, the underlying mechanisms are engineered to support broader participation and ultimately foster a more open, resilient, and user-controlled asset management landscape. The long-term vision prioritizes minimizing reliance on central authorities, enabling individuals to maintain greater sovereignty over their digital holdings without compromising security or efficiency.

Sark envisions a paradigm shift in asset management by fundamentally altering how data integrity and consensus are achieved. Rather than relying on centralized authorities, the system marries a ‘local-first’ approach – where users directly control and cryptographically secure their asset data – with resilient, distributed consensus mechanisms. This combination empowers individuals with complete sovereignty over their digital holdings, minimizing counterparty risk and enhancing privacy by reducing the need to share sensitive information with intermediaries. The resulting architecture doesn’t merely facilitate transactions; it establishes a foundation for a more secure, transparent, and user-centric financial ecosystem, one designed to withstand censorship and ensure the long-term preservation of valuable digital assets.

The pursuit of systems that manage assets without reliance on global state echoes a fundamental truth about complex structures. It’s a delicate dance, this attempt to impose order. The paper’s focus on local-first integrity, using techniques like Merkle trees, isn’t about building a trustworthy system, but cultivating conditions where trust can emerge organically. As Donald Davies observed, “The only safe system is one which is simple enough to be understood.” Sark, in its design, acknowledges that perfect security is an illusion; instead, it seeks resilience through distributed responsibility. Every refactor begins as a prayer and ends in repentance, for even the most carefully constructed system will inevitably grow in unexpected ways.

What’s Next?

Sark proposes a shift – not toward consensus, but toward confident local autonomy. This is less a solution and more a careful articulation of the problem: that global state is, invariably, a single point of prophetic failure. The system doesn’t prevent corruption; it assumes it, and designs for graceful degradation. The interesting question isn’t whether such a system will remain uncorrupted, but where the fissures will appear, and what narratives will coalesce around them. The governance topology, a deliberate echo of biological systems, is the most compelling aspect; a recognition that control is an illusion, and resilience a more achievable aim.

The limitations are, of course, inherent. A system built on local-first principles concedes something of the utopian dream of a shared, immutable truth. Data integrity becomes a matter of degrees, of relative confidence, not absolute certainty. Future work must address the challenges of inter-locality – how these islands of integrity negotiate with each other, how conflicts are resolved without recreating the very structures they seek to avoid. The true metric of success won’t be the absence of divergence, but the cost of reconciliation.

Perhaps the most crucial avenue for exploration lies in the observation that logging, in such a system, is not merely record-keeping, but a form of confession. Each local instance bears witness to its own state, and the absence of testimony is itself a signal. Alerts are not warnings of failure, but revelations of intent. If the system is silent, it is plotting. The end of debugging is not a destination, but the cessation of attention.

Original article: https://arxiv.org/pdf/2512.20775.pdf

Contact the author: https://www.linkedin.com/in/avetisyan/