Not a Rocketship: One Person, One Owl, In Public

What this means for you

Nestr is not a venture-backed launch. It is one founder shipping in public, and the trust device has changed: instead of dated promises, the site publishes what failed and what is still open. The roadmap carries no dates (“each item is an open row in the known limitations”). Sources: landing src/components/sections/FounderStatement.tsx:37,63 @cb59f69; nestr.tools roadmap and founder journal, read 2026-10-25.

The pitch

The founder went from designing spacecraft systems to shipping digital products: “managing complexity across distributed systems where failure isn’t an option”. He built Nestr with Olly as its mascot, wrote the goal down as a specification, and the Security page says which parts are not met yet. “This isn’t a VC-backed rocketship. It’s one person and one owl, building something useful, in public, one commit at a time.”

Who it’s for

The skeptical operator who has been burned by a tool that over-promised, and the design partner who would rather see the failure log than a launch video.

Proof points

• Founder statement names the prior domain: spacecraft systems.
• Founder journal, 2026-10-12: “Our adversary tests failed. Here is what we fixed.” Fixed PEL-ART-003, PEL-SBX-012 and PEL-SBX-001 (sockets); open PEL-SBX-001 (identity).
• Roadmap “Now”: hook identity (run hooks as an unprivileged user) and a default-deny syscall filter to replace the current deny-list (PEL-SBX-002).
• The 2026-05 version’s milestones (Engine v0.9 in a month, Pro tier in three, Enterprise SSO in six) are withdrawn; the Pro tier no longer exists (nestr-020).

timeline
  title Public roadmap, no dates
  Now : Hook identity : Default-deny syscall filter
  Next : Namespace authority : Transparency-log witnesses on the hosted registry : Quarantine actions wired
  Later : Open-source CLI and self-hosting : Live payments : GA pricing after adversary tests pass : Enterprise SSO