Happy new year from worm-blossom.org!


About two years ago, we published willowprotocol.org, and our server took a million requests on the first day. Soon we were getting emails from companies, universities, weird individuals, and it felt like we were really making something that made people sit up and take notice. We received our funding to build a rust implementation of Willow, and then… things stalled. It got quieter and quieter, until I imagine to the outside it seemed like nothing was happening at all. A lot did happen, of course, just not in a way we’d choose to have things happen again.
The end of 2025 brings the close to a weird era of willow, an era whose weirdness I’d like to reflect upon as I think I can recognise some of the ways it went differently than we’d hoped.
Our first mistake was maximalism. Willow Confidential Sync was the newest member of the Willow family, with the most novelty and flash. Range-based set reconciliation. Privately determining common interests between peers. Teeny tiny privacy-preserving message encodings.
As a poster child of privacy and efficiency, Confidential Sync radiated complexity onto everything around it. Willow storage needed to be able to efficiently fingerprint and partition ranges of local data for range-based set reconciliation. Storage needed special push-centric APIs so that new data could be broadcast to peers. Ufotofu needed a menagerie of encoding traits to be able to accommodate the private encodings which Confidential Sync uses to mitigate man-in-the-middle attacks.
We started to recognise the weight of this complexity early on, and specified the Willow Drop Format just a few months after the launch of willowprotocol.org. It’s a vastly simpler spec which asks far less of its dependencies. But at that point our funding goals and our destination were locked in: Confidential Sync was where we were going. And that path led us straight into the swamp.
At the same time, we were refactoring willowprotocol.org to use a new version of Macromania, the system we use to author the entire site (and this one!). Aljoscha made a big effort porting all the existing content to the new version, and it was so much nicer to author pages with that we couldn’t really go back to doing it the old way. And now we had a branch of the website with the new, not-quite-ready system and new content all mixed together. This interdependency congealed into a kind of seal which stopped us from making small updates to willowprotocol.orguntil everything was ready in one giant mega-update.
So willowprotocol.org was not getting updates. Which not only made it look like we were inactive to the outside world, but it also hurt our morale because we felt like we were digging into a bottomless pit with no recognition for our efforts. The longer the silence became, the worse our perfectionism got: we wanted to have something to show for ourselves after that long period of silence.
So we found ourselves working in frustrated silence amidst a myriad of interlocking dependencies. It was gruelling. In a struggle to keep the project on track, I ended up breaking personal connections which I treasured. There was also life outside of Willow which insisted on happening.
So what did we learn? Avoid complexity. Deliver frequently. Focus on doing as little possible to achieve your goal. Communicate often. How often have you heard these things? How many dozens of blog posts and presentations have you seen stressing these very points ad nauseam? I had certainly heard those hard-won lessons countless times — but found out I had to win them the hard way for myself, nevertheless.
I also have anti-takeaways: we were led into a swamp, but it was a very fruitful swamp. We used lots of time to make difficult, foundational design decisions, decisions which are already giving us increasingly stable foundations to work upon. It was long and tedious but it was also instructive, and we have the opportunity to actually use that experience.
worm-blossom.org is our antithesis to the era described in this editorial: frequent, ad lib, joyous. That’s what I want to bring more of to 2026!
~sammy

We have published version 0.6.1 of the willow-data-model crate. This update marks the beginning of our implementation of proper Willow storage, adding a basic trait for abstracting over stores, and a non-persistent MemoryStore implementing that trait.
Things are pretty basic right now; you cannot even implement synchronisation on top of the current trait, because it does not support receiving and verifying payloads incrementally. This will be the job of a subtrait. In general, the idea is to provide a hierarchy of traits, adding more advanced functionality such as Bab-related methods, the ability to summarise data for range-based set reconciliation, and so on.
We are also not building Willow’25-specific versions of this functionality yet, we want to first see how these new traits feel, and how they fit together with other pieces such as the Bab implementation. But still, this release is the first step toward the major missing building block before we (and everyone else) can start building actual applications. And now we have something to expand upon, to bring things into shape in time for FOSDEM!
To the cargo-fuzz maintainers. We can look back to a year of productive testing, thanks to you.
I
There was a time when testing meant to me
Enumerating inputs and to pray
They'd cover everything there was to see
And missed no corner-cases on the way.
Then quickcheck promised instant peace of mind
Its elegant design had me enticed
Invariants and randomness combined
But sample sizes never quite sufficed.
A fuzzer proved to be the missing link
Ensuring every corner-case was checked
Allowing me to tentatively think
My code might actually be correct.
Now mind you writing tests is still a pain
But worth it for the confidence I gain.
II
I have been deeply in love
twice
no matter how long things go well
they can always shatter.
When I start the fuzzer I
wait
wait and wait
wait and wait and wait
pacing
wondering
if this will be the run that does not fail.
As the fuzzer hums and heats
reluctantly I let myself believe
but never know for certain.
How do I shield myself from disappointment
yet
allow myself
the hope that keeps me going
allow myself
to burn?
III
INFO: Running with entropic power schedule (0xFF,100).
INFO: Seed: 1658404568
INFO: Loaded 1 modules (74852 inline 8-bit counters): 74852 [0x562332a29c30, 0x562332a3c094),
INFO: Loaded 1 PC tables (74852 PCs): 74852 [0x562332a3c098,0x562332b606d8),
#2 INITED exec/s: 0 rss: 43Mb
NEW_FUNC[1/102]: 0x562332596b00 (BuildId: 4cf9597d4ab63dec5b3d24323cb8d9d0a41408a7)
NEW_FUNC[2/102]: 0x562332597000 (BuildId: 4cf9597d4ab63dec5b3d24323cb8d9d0a41408a7)
#5123 NEW cov: 726 ft: 727 corp: 2/51b lim: 53 exec/s: 0 rss: 46Mb L: 50/50 MS: 1 InsertRepeatedBytes-
#5124 NEW cov: 727 ft: 728 corp: 3/101b lim: 53 exec/s: 0 rss: 46Mb L: 50/50 MS: 1 CopyPart-
#5130 NEW cov: 727 ft: 748 corp: 4/151b lim: 53 exec/s: 0 rss: 46Mb L: 50/50 MS: 1 ChangeByte-
NEW_FUNC[1/11]: 0x5623325a6c60 (BuildId: 4cf9597d4ab63dec5b3d24323cb8d9d0a41408a7)
NEW_FUNC[2/11]: 0x5623325a8700 (BuildId: 4cf9597d4ab63dec5b3d24323cb8d9d0a41408a7)
Meanwhile though, our increasingly impersonal societies rend ever deeper wounds into our hearts.

What a year. Sammy looked back, and I will lay out some future plans — specifically, plans for Willow. By the end of January, we want to have a simple persistent storage implementation and a Willow Drop Format implementation. Obviously, we have many more plans. Here they are, roughly in the order in which we want to make them real.
With Meadowcap, persistent storage, and the Willow Drop Format implemented, it will be possible to build actual sneakernet-based applications. While it is tempting to add more powerful data synchronisation as the next step, we should probably revisit end-to-end encryption of entries and payloads first. The earlier we implement this, the fewer moving pieces we will need to change based on our learnings. The concrete scope of this will consist of specifying specific techniques and primitives as part of Willow’25, and then to augment our storage implementations with the ability to encrypt and decrypt data on the fly. Ideally, this work will introduce only small changes to our public APIs — but ensure that most everything going forward is encrypted by default. Realistically speaking, a whole bunch of data is going to end up on the servers of large cloud providers, after all.
Before I can describe the next endeavours we have planned, I need some slightly abstract groundwork: the distinction between pull-based and push-based APIs. In a pull-based API, the entity that wants data needs to actively ask for it. In a push-based API, a data provider can proactively send data to its subscribers as new data arrives. Push-based APIs have several advantages, but they are also significantly more complex to get right. To a large degree, I blame the subpar progress we have made in the past on prematurely trying to nail the perfect push-based APIs: the Willow Confidential Sync protocol for replicating data, as well as ambitious subscription-based APIs for interacting with local data stores. This is why we have adopted a pull-based-only approach for now; this decision has played a significant part in our frequency (and hopefully quality) of recent releases.
Keeping this push-vs-pull distinction in mind, the next logical step in making Willow more “real” is a synchronisation protocol over the internet. The Willow Confidential Sync protocol is deeply push-based, so it is not an option. Instead, we have concrete plans for a more HTTP-inspired protocol of relatively simple requests and responses. This is the Willow Transfer Protocol (WTP), and you can read a draft version here. Completing the WTP specification and implementing it will be the next larger chunk of work, and one I am looking forward to!
Once we have a WTP implementation, we will have a complete (pull-based) Willow stack. It will then be time to slowly move to more efficient push-based components. The first step there will probably be local APIs. More specifically, a Bab implementation that allows subscribing to new incoming data, and then a Willow storage implementation that allows subscribing to change events. This will be crucial for more advanced applications that want to dynamically maintain custom indexes for more efficient queries than simply interacting with a Willow storage directly. In the long term, I actually hope that Willow stores will be used for replication and as a foundational source-of-truth exclusively, whereas any data access would go through more appropriate special-purpose indexes. Subscribable stores are the key stepping stone for moving toward that world.
Another step we will need to take eventually is to provide a more efficient storage backend. Right now we are building simplistic, linear-time storage that simply scans through all data and filters out unwanted results. But in the mid-to-long-term, we will need a proper three-dimensional data structure to provide access in logarithmic time. I have thoughts already around a three-dimensional generalisation of zip-trees (and, possibly, G-trees). But these details are a topic for a different time.
Speaking of improved local data access: we currently provide only embedded Willow storage, but long-term we would like to move to an actual database server with which multiple applications can interact concurrently (using capabilities to scope access rights, of course). The basics of this are fairly straightforward, but the challenging part is making push-based APIs work. Ideally, we'd like applications to be able to maintain persistent subscriptions even across several sessions. This would require the database server to maintain an event log, and applications would supply an offset at which to resume their subscription upon connection. When an application falls too far behind, it would catch up via set reconciliation. This sounds nice in theory, but the actual specification and implementation process will probably be rather thorny.
And after all of that, there is Willow Confidential Sync. I assume that we will learn enough from the WTP to warrant reworking the confidential sync spec. And then we will need to implement it, of course. Which feels a bit daunting right now, yet also exciting — confidential sync is were so many of our design decisions converge into a package that will likely be greater than the sum of its parts. I want to live in the world where you can integrate that package into your application designs with miniscule effort.
Other Willow-related plans include benchmarking suites, transactional APIs for our local data storage, a peer-sampling service (possibly in concert with confidential sync), and implementing the Willow URIs spec. Then there are application ideas — Rummager, the Cobweb, perhaps libraries of common UI components. And beyond Willow, we still want to release Macromania, and we have too many ideas for other side-projects to even start enumerating them here.
This is already far more than we can hope to accomplish in 2026. And we’ll doubtlessly accumulate even more ideas along the way. 2026 will be a busy year, but also a fun one, and one brimming with potential.
~Aljoscha