KANDO is a decentralized, censorship-resistant, and gas‑free social network protocol built on complex contagion theory — the scientific insight that trust, cooperation, and collective action spread through reinforcement from multiple independent sources (Damon Centola, UPenn).
No blockchain, no gas fees, no central servers – just a self‑organising hexagonal mesh network with a 3-Approval propagation rule that stops spam and misinformation at the first ring.
Research-driven. Practical. Uncensorable.
| Feature | Description |
|---|---|
| 🔒 Censorship-Resistant | Dual‑layer architecture (overlay + physical mesh) works over internet and offline (Bluetooth LE, Wi‑Fi Direct, LoRa). No central point of control. |
| ⛽️ Gas‑Free | DHT‑based storage — no blockchain, no tokens, no gas fees. Ordinary users pay zero transaction costs. |
| 🌐 Decentralised | Self‑healing network with local voting, relocation, and no single point of failure. |
| 🧠 3-Approval Rule | Content advances to the next ring only after 3 of 6 neighbors approve. Reduces bandwidth by 60‑80% and acts as a native spam filter. |
| 🕊️ Optical Channels | Direct links between non‑neighbor users for urgent information (earthquakes, security alerts). Bypass the 3‑approval rule, but limited in number. |
| 🎮 Network Simulator | Interactive hexagonal grid simulation to visualize complex contagion propagation in real time. |
| 🆔 Portable Identity | Non‑transferable cNFT / DID passport (self‑sovereign identity) — use across all KANDO‑compatible apps without revealing real identity. |
| 🔷 Hexagonal Topology | Maximizes clustering coefficient (0.4‑0.67) — optimal for complex contagion. O(1) routing complexity via axial coordinates. |
| 🧩 Open Source | AGPLv3 licensed — transparent, auditable, and community‑driven. Patent‑protected (Estonian Patent Office) against commercial copycats. |
Each node is assigned axial coordinates (q, r). The third implicit coordinate is s = -q - r. The hexagonal distance between two nodes is:
Ring structure:
- Ring 0: Queen node (0,0)
- Ring 1: 6 nodes at distance 1
- Ring 2: 12 nodes at distance 2
- Ring N: 6N nodes
Each node maintains at most 6 direct neighbors.
Why six? A hexagonal grid maximizes the clustering coefficient (0.4-0.67) compared to square or random graphs, which is optimal for complex contagion.
- Content is initially shared only with a node's 6 direct neighbors
- Each neighbor may send a cryptographic approval
- If at least 3 independent approvals are collected within a predetermined timeout (e.g., 24 hours), the content advances to the next ring (distance +1)
- The process repeats at each ring
- If the threshold is not met, propagation stops permanently
Benefits:
- Bandwidth reduction — low-quality content stops at the first ring, reducing network traffic by an estimated 60-80% compared to flooding or gossip protocols
- Built-in spam filter — fake news and rumors cannot collect three approvals from trusted neighbors and therefore never leave the local neighborhood
For urgent information (earthquakes, security alerts), KANDO provides optical channels — direct links between two non-neighbor users that bypass the 3-approval rule. Their number is limited (e.g., 10 per user) and they are only allowed for public safety information.
A node passes through three statuses:
| Status | Condition | Permissions |
|---|---|---|
| RESERVED | Created by invitation from an existing citizen, without any neighbor requirement | Occupies a coordinate but is not yet active |
| CANDIDATE | Promoted from RESERVED when all six of its immediate neighbor positions are occupied (by any node type) | Visible but cannot vote or create content |
| CITIZEN | Promoted from CANDIDATE when each of those six neighbors itself has at least six neighbors — i.e., the second ring around the node is completely filled | Full active membership — can invite, approve, send content, and vote |
Upon becoming a CITIZEN, the node receives a non-transferable digital certificate (cNFT) — a self-sovereign identity passport (DID). This certificate is bound to the node's public key forever and can be used across all KANDO-compatible applications without revealing real identity.
Why does this resist Sybil attacks? To create a single fake citizen, an attacker would need to fill six neighbor positions (each of which must itself have six neighbors). This exponential requirement makes large-scale Sybil attacks prohibitively expensive.
Inactivity handling:
- A citizen that shows no activity for 30 days transitions to INACTIVE status
- Living neighbors may initiate a vote — for six neighbors, four positive votes are required
- If the vote succeeds, the node becomes DISPLACED and its coordinates are freed
- If no vote succeeds for an additional 30 days, the node becomes DEAD — its certificate remains as a historical record but no longer grants active membership
Relocation: A DISPLACED node may request relocation to an empty coordinate. Required approvals depend on request type:
| Request Type | Required Approvals (out of 6 neighbors) |
|---|---|
| Voluntary move of an active citizen | 4 |
| DISPLACED node moving to a different empty coordinate | 3 |
| DISPLACED node returning to its own previous coordinate (if still empty) | 2 |
If approvals are met, the node moves and its status becomes CITIZEN again. Otherwise, relocation fails and the node remains DISPLACED.
KANDO does not rely on permanent internet connectivity:
- Layer One (Overlay Network) — based on virtual coordinates (q, r). Neighbors are chosen by trust and shared interests, not by geographic location. Two people on different continents can be virtual neighbors.
- Layer Two (Physical Mesh Network) — uses Bluetooth LE, Wi-Fi Direct, or LoRa for offline local communication when the internet is cut off.
Thus KANDO supports both global, trust-based relationships and local, offline communication — without any central server.
All node records (coordinates, status, neighbor references, voting records, certificates) are stored in a Distributed Hash Table (DHT) — for example, a Kademlia DHT. No blockchain, no token, no gas fee is required. Ordinary users pay zero transaction costs.
The interactive simulator lets you visualize KANDO's complex contagion propagation:
- Hexagonal Grid — each cell represents a node with axial coordinates
- Propagation Animation — watch content spread ring by ring based on the 3-approval rule
- Threshold Testing — adjust approval thresholds and observe network behavior
- Sybil Simulation — test attack resistance by adding fake nodes
- Inactivity Simulation — see how nodes become displaced and relocate
# Clone the repository
git clone https://github.com/comfyuse/Kando.git
cd Kando
# Install dependencies
npm install
# Run the development server
npm run dev
# Open http://localhost:3000
## 📊 1-Approval Propagation Ruleflowchart TD
Start([Start: Node creates content]) --> Step201[201: Content shared with 6 direct neighbors]
Step201 --> Step202[202: Each neighbor may send an approval]
Step202 --> Decision203{203: ≥3 approvals\ncollected within timeout?}
Decision203 -->|Yes| Step204["204: Content advances to next ring\n(distance +1)"]
Step204 --> Decision205{205: Next ring exists?}
Decision205 -->|Yes| Step201
Decision205 -->|No| End([End: Propagation complete])
Decision203 -->|No| Step206[206: Timeout expires]
Step206 --> End2([End: Propagation halted])
flowchart TD
Start([Start: Node invited by a citizen]) --> Step301[301: Node becomes RESERVED]
Step301 --> Decision302{302: All six neighbor\npositions occupied?}
Decision302 -->|No| Wait[Wait & retry]
Wait --> Decision302
Decision302 -->|Yes| Step303[303: Node becomes CANDIDATE]
Step303 --> Step304[304: For each of the six neighbors,\ncheck if they have ≥6 neighbors each]
Step304 --> Decision305{305: All six neighbors\neach have ≥6 neighbors?}
Decision305 -->|No| Wait2[Wait & retry]
Wait2 --> Step304
Decision305 -->|Yes| Step306[306: Node becomes CITIZEN\nIssue non‑transferable certificate]
Step306 --> End([End: Citizen active in network])
flowchart TD
Start([Start: Citizen inactive for 30 days]) --> Step401[401: Status becomes INACTIVE]
Step401 --> Step402[402: Living neighbors may initiate a vote]
Step402 --> Decision403[s20]
Decision403 -->|No| Step404[404: Wait another 30 days]
Step404 --> Decision405[s21]
Decision405 -->|No| Step406["406: Node becomes DEAD\n(certificate remains as history)"]
Decision405 -->|Yes| Decision403
Decision403 -->|Yes| Step407[407: Node becomes DISPLACED\nCoordinates freed]
Step407 --> Step408[408: DISPLACED node requests relocation\nto an empty coordinate]
Step408 --> SelectType[Select move type]
SelectType --> TypeA[Type A: Voluntary move\nof an active citizen]
SelectType --> TypeB[Type B: DISPLACED to\ndifferent empty coordinate]
SelectType --> TypeC["Type C: Return to previous\ncoordinate (if empty)"]
TypeA --> Req4[Need 4 approvals]
TypeB --> Req3[Need 3 approvals]
TypeC --> Req2[Need 2 approvals]
Req4 --> Decision410[s24]
Req3 --> Decision410
Req2 --> Decision410
Decision410 -->|Yes| Step411[411: Node moves to new coordinate\nStatus becomes CITIZEN again]
Decision410 -->|No| Step412[412: Relocation fails\nnode remains DISPLACED]
Step411 --> End([End: Citizen active])
Step406 --> End2([End: Dead])
Step412 --> End3([End: Displaced])