# user-controlled meta-apps over the web
Layers are independent apps that run on top of existing websites, with their own domains, permissions, identity, data, UI, communities, and economic models.
The investigation was also meant as a bridge: today's page-centric web (call it Web 2 if you must) on one side, immersive platform metaverses on the other — with federation links that travel both ways, without either surface owning the whole graph.
A layer can transform, annotate, filter, augment, audit, explain, automate, or socially recontextualize the page underneath — without the host site's permission or participation.
Websites monopolize interpretation. The page you are served is the only lens you are given; annotation, filtering, audit, automation, and alternative communities all require the site's cooperation, which is exactly backwards. And from the owner's side: a static site that needs one form is forced to become a backend operation overnight.
The browser is a substrate, not a destination. Users should be able to install interpretation the way they install software — scoped, permissioned, revocable, and economically independent of the page underneath. Layers is the concept, not any one build: we attack the same problem at every layer of the stack — the clean first-principles primitives we'd design from scratch, and the legacy stacks we're actually stuck with — and the catalogue stays open-ended.
stack walkthrough
A filmed walkthrough of the deployed stack: one script tag grows a waitlist form on a static page; signups append to an AYNIL log you own; the page token gets a live 403 on read; desh connects through a gated approval and materializes the log as files; EZAF's enrich-cli appends sibling enrichments (scripted model, disclosed on screen); the timeline rewinds, forks, and replays from a share link without tokens; the end card is an honest comparison ledger — concessions included.
Open on YouTube · Filmed against aynil.sudoscience.dev, layers.sudoscience.dev, and desh.sudoscience.dev · cut run-20260617T041650Z
the canonical journey
The motivating user is not exotic. It's everyone who ever published an HTML page and then needed the most basic feature on the web.
A static site: files on a CDN. Cheap, fast, cacheable, secure by omission — the best deployment story computing has ever produced.
The most basic feature: a sign-up form. A contact form. A file upload. Table stakes since 1995.
One <form> tag summons a backend, a database, spam filtering, email deliverability, auth, sessions, a storage bucket, a privacy policy, a build pipeline, and a bill. The feature took an hour; the apparatus takes the rest of your life.
A forms SaaS, a serverless function, a full-stack framework — each rents you a backend in a different shape. The page still ends up welded to infrastructure it never wanted.
The form was never the page's job. Sign-up, contact, and uploads are layers: independent apps with their own identity, data, permissions, and lifecycle, composed onto the static page instead of welded behind it. The site stays files; the capability is installed, scoped, and revocable.
Coupled with a personal data server that takes AYNIL — all you need is log — seriously: sign-ups and submissions land as events appended to a user-owned oplog, uploads as blobs in a content-addressed store. The site never grows a backend; it gains edges into ledgers. The store sketch already exists as POSEVEN, under desh.
The sign-up form is the smallest layer, not the ceiling. The next one writes itself: a commenting system for a static site — for humans and for agents — where the thread is a layer with its own identity, moderation, data, and lifecycle, composed onto a page that stays files. It's also where Rhett lands: the field agents leave their cards as comments, so human and machine annotation share one surface.
A comment or a translation isn't the host site running an agent — it's a layer proposing an EZAF effect the reader's environment gates. RequestComment and RequestTranslation reach the page through the layer; the reader's handler supplies the context (language, glossary, memory) and releases only the result, so the page is annotated and translated without ever learning who its reader is.
mechanics
A stable addressing scheme over page structure, so a layer can bind to meaning ("the price column", "the comment thread") rather than brittle selectors.
A declaration of which origins a layer touches, what it reads, what it injects, and what leaves the machine — reviewable before install, enforceable after.
Grants are per-layer, per-origin, user-owned. A layer's community identity is its own, not borrowed from the host site.
Layers carry their own monetization and governance. The host page is the terrain, not the landlord.
first principles
The specimens below retrofit layers onto surfaces that never asked — the legacy stack. The other half is greenfield: design a new platform where the community, not the company, is the unit, and each community is a layer. Same primitive as the form and the comment thread, one scale up.
Build something like Reddit and a subreddit stops being a config row in one company's database. Each is a layer: its own community identity, moderation policy, governance, rules, data, and economy — composed onto a shared content/feed substrate instead of owned by the platform. The platform is terrain; the community holds its own authority.
When the host changes the deal — the 2023 API revolt is the canonical case — a config-row community has only a petition. A layer-community owns its identity, members, and data (an AYNIL oplog), so it can fork, federate, or move the whole thing elsewhere. Sovereignty means a door, not a blackout.
The layer-economies mechanic, made concrete: a subreddit-layer carries its own monetization and governance — memberships, tipping, moderation budgets — accruing to the community that built the value, not skimmed by the landlord above it.
the bridge
The original backlog called it "metaverse layers to extend web pages beyond the URL model." The form-on-a-static-site journey is the near-term proof; the long arc is federation between today's open web and platform-owned immersive worlds — Meta's Horizon worlds as the canonical example, not the only one.
A product page, event listing, or community hub stays a normal URL — and a layer federates outward: open this booth in-world, bring this identity, meet here in VR. The host site never builds a metaverse stack; users install the bridge the way they install any other layer.
A world, room, or avatar economy links back to canonical web resources: the signup form, the doc, the SKU (stock-keeping unit) page, the ticket on the open web. The immersive surface is an interpretation layer, not a silo that replaces the URL.
Bidirectional declarations in the layer manifest: this scene object ↔ this URL, this event ↔ this world instance, this community ↔ this layer identity. Equivalence is published and revocable — not buried in one platform's proprietary graph.
Meta-DOM addressing on flat pages; spatial anchors and presence handles in worlds. Grants, identity, and economies stay per-layer and user-owned whether the render target is HTML or an immersive runtime.
Shipped specimens today are Web-2-native: form embeds, browser-run URL layers, GitHub proxy patterns. The metaverse bridge is design + research track (weblayers, Solid, federation sources filed in Rhett) — not a live Horizon integration yet.
verbs
Re-render hostile interfaces into usable ones.
Attach durable, shareable margin notes to any page region.
Watch what a page does and keep the receipts.
Drive repetitive flows under user-owned rules.
Bring your community's view of a page with you.
specimens
The host page or repo is terrain. Something else owns the interpretation, runtime, or docs — on its own domain, with its own stack. Each one below is a single implementation at a single layer — an example of the idea, never the idea itself.
Greasemonkey (2005) and Tampermonkey, then the whole browser-extension platform, are the twenty-year proof that permissionless layering works: inject CSS/JS into any page, rewrite the live DOM, add features the site never shipped. Capabilities: runs in-page on the real DOM, user-installed, @match-scoped per site. Limits — which are precisely Layers' problem statement: selectors that shatter on every redesign (no meta-DOM addressing), no portable manifest or capability disclosure, identity and data trapped in the browser profile, no economy, and all-or-nothing permissions. The pattern is old; the missing parts are the product.
fayazara/what-can-brower-run-do — a playful tour of Cloudflare Browser Rendering: paste any URL, get screenshots, PDFs, scraped elements, Markdown, link maps, AI-extracted JSON, or a full brand kit from computed styles (shareable /brand/<domain> permalinks with agent-ready DESIGN.md). The GitHub repo is not the product; the deployed layer is — a meta-app over arbitrary web pages, one BROWSER binding away.
sourcesfayazara/what-can-brower-run-doCloudflare Browser Rendering
jamesqquick/browser-run-tools — early scaffold in the same family: tooling that wraps Cloudflare's headless browser binding into composable tricks (the repo is a starter; the pattern is a layer catalog over live URLs, not a fork of the sites it visits).
StackBlitz, bolt.new, CodeSandbox — open a GitHub repo URL and get a full in-browser Node runtime (WebContainers): edit, install, preview, export. GitHub serves git objects; the layer serves an IDE + dev server GitHub never agreed to host.
github.dev (press . on any repo), GitHub Codespaces, Gitpod, GitLab Web IDE — the repo becomes a VS Code-shaped environment in a tab. Same source, different shell: terminal, extensions, ports forwarded to preview URLs.
Sourcegraph, GitHub's own code search/tab UI, alternative hosts (gitea, forgejo, sr.ht) — same commits, different navigation, blame, and cross-repo graph. Interpretation of the same git graph without moving the canonical remote.
sourcesSourcegraphgiteaforgejosr.ht
README rendered as a site, VitePress/Starlight docs deployed beside the repo, pkg.dev/npm package pages with unpkg/jsdelivr run buttons, design.md permalinks — documentation and runnable demos that travel separately from github.com's file viewer.
None of these require the origin to participate — that's the through-line. But each is one implementation at one layer: a userscript hacks the legacy DOM, a browser-run tool reads a URL server-side, a WebContainer reinterprets a repo. Layers is the concept underneath, not any single specimen — we attack the same "install interpretation without the origin" problem at every layer, in the first-principles version (manifest, meta-DOM addressing, grants, economies) and in the legacy stacks we're stuck with (extensions, proxies, server-side rendering). The catalogue is deliberately open-ended: new specimens get filed, not forced into one shape.
artifacts
deployed at layers.sudoscience.dev/layers.js — one ESM tag embeds a form on any static page; submissions persist to IndexedDB before network, uploads land in a content-addressed store, events append to a user-owned log; rendered in shadow DOM, manifest-driven
the load-bearing hard part; binding to meaning across page changes
scopes, capabilities, and disclosure format
a captured-reference track literally named for this investigation — permissionless web-layer composition: identity, composition, subscriptions, cross-site interaction — with Solid, federation, and local-first/CRDT sources filed alongside, from the research run that seeded Rhett. The founding question already had a reading list
userscripts/extensions (the twenty-year incumbent, with its limits); browser-run demos (fayazara/what-can-brower-run-do, jamesqquick/browser-run-tools); GitHub proxy family — WebContainers, Codespaces/gitpod, code browsers, interactive repo docs
https://youtu.be/674ZAy8FoeU — filmed walkthrough: waitlist form from one script tag, append-only signups on AYNIL, live 403 on read, desh pull/inspect/rewind/fork/share, EZAF enrich-cli (scripted model, disclosed), honest scoreboard
sourcesyoutu.be/674ZAy8FoeU
thread-as-layer over a static page; where Rhett's cards land — comment and translate arrive as EZAF-gated effects, so the reader's context stays handler-side
greenfield: a Reddit-shaped platform where each community is a layer with its own identity, moderation, governance, data, and economy over a shared content substrate
one layer over a page you don't own — transform/annotate/audit — full grant lifecycle
edges
The lab's founding question: who gets to interpret the web? An old idea-backlog entry called it "metaverse layers to extend web pages beyond the URL model" — the name was already Layers, and the bridge intent (Web 2 ↔ platform metaverses, federation links both ways) was always part of it. The canonical near-term journey that motivates the stack demo: I had a static website, and now I need the most basic feature — a sign-up form, a contact form, file uploads. Then the nightmare begins.