• Rereading the local-first paper in 2026
  • The seven, audited
    • 1. Fast — validated, and the industry partly capitulated
    • 2. Multi-device — solved technically, unsolved socially
    • 3. Offline — held up, became table stakes
    • 4. Collaboration — technically solved, governance unsolved
    • 5. Longevity — the principle that aged worst
    • 6. Privacy — validated as ideal, defeated in practice
    • 7. User control — split decision
  • What the paper didn’t see

§Rereading the local-first paper in 2026

In October 2019, four researchers at Ink & Switch and the University of Cambridge published a paper that gave a name to a discontent many of us had been carrying for years. “Local-first software: you own your data, in spite of the cloud.” Seven ideals, twenty-five pages, and a vocabulary that would be quoted for years to come.

Seven years on, the paper still circulates. New projects cite it in their READMEs. It is the closest thing the local-first community has to a constitution. Which makes it worth a careful re-reading — not to canonize, but to see where time has been kind and where it hasn’t.

§The seven, audited

§1. Fast — validated, and the industry partly capitulated

The “no spinners” promise held up cleanly. IndexedDB, OPFS, SQLite-WASM, structured cloning — the browser became a serious local runtime. The interesting effect is second-order: cloud-first apps now ship local caches, optimistic UI, and offline tolerance precisely because users learned to expect instant response. The ideal won partly by colonizing its opponents. You can call this dilution. I call it victory.

§2. Multi-device — solved technically, unsolved socially

At the protocol level this is solved, with caveats. Yjs, Automerge, Loro and the broader CRDT lineage give multi-device consistency without conflicts — provided you accept a sync server in the loop. In pure peer-to-peer setups it remains harder, and worth flagging separately rather than glossing over.

What didn’t get solved at any architecture is identity and pairing. Adding your tablet to your account in any open local-first system is still a moment of friction that makes ordinary people give up. Apple solved it inside their walled garden. The open ecosystem hasn’t. Until we have a cross-platform pairing flow that doesn’t involve typing 32-character keys, multi-device remains a developer’s principle, not a user’s reality.

§3. Offline — held up, became table stakes

Working offline used to be a differentiator. Now it’s an expectation. Service workers, PWAs, mobile-first design — even mid-tier SaaS has some offline tolerance. The principle is no longer a flag local-first software waves; it’s the floor everyone is expected to meet. That’s a win, even if it makes the term feel less distinctive than it did in 2019.

§4. Collaboration — technically solved, governance unsolved

CRDTs delivered. Concurrent editing without conflicts works in production. The harder problem turned out to live one layer up: who is allowed to edit what, how do permissions evolve over time, how does asynchronous collaboration carry context across weeks. Real-time co-editing is easy now; building a durable community around shared data, where people join and leave and contribute under varying levels of trust, is still mostly DIY, mostly ad-hoc, mostly painful. The paper’s collaboration story was about merge, not governance. We learned the harder one is governance.

§5. Longevity — the principle that aged worst

This is where re-reading gets uncomfortable. The paper imagined data outliving software through open, portable file formats. Seven years later, the leading local-first stacks store their data as CRDT operation graphs in binary blobs that are unreadable without the specific library that wrote them. Sometimes unreadable even with that library two major versions down — Automerge’s v1-to-v2 transition is a documented case in point, requiring explicit migration tooling for documents written under the older core to be readable by the newer one. Format portability has gone backward, not forward. You can argue this is a transient phase — that we’ll converge on standards. We’ve been saying that since 2019. A PDF of a thesis is still more portable than its source in any modern collaborative tool. Longevity is the principle the community talked about most and delivered least.

§6. Privacy — validated as ideal, defeated in practice

End-to-end encryption by default remains the right answer. The world mostly didn’t ship it. Signal yes, iMessage yes, a handful of niche apps. Most local-first applications store user data unencrypted on whatever sync server they happen to use, because E2E makes everything harder — server-side search, ML features, recovery flows, customer support. The AI shift has made it harder still: every product wants to feed your data to a model, and end-to-end encryption is in direct tension with that. Privacy held up philosophically and lost ground commercially.

§7. User control — split decision

Two trends pulled in opposite directions. On one hand, self-hosting matured beyond a hobbyist activity — Nostr relays, ownCloud OCIS, Forgejo, Jujutsu, the whole infrastructure of “run your own” became approachable. On the other hand, the platforms tightened: App Store policies, mobile DRM, browser attestation, the slow erosion of sideloading. User control on user-owned servers is up. User control on user-owned hardware is, paradoxically, down. The principle isn’t wrong. The battleground moved.

§What the paper didn’t see

Re-reading is also an exercise in noticing blind spots — not failures, but things the future revealed about the present.

The AI shift. The paper assumes the user performs operations on data inside an application running on a local device. Increasingly, the operation isn’t local — it is a model call. “Write me the next paragraph” doesn’t happen in the client; it happens at someone else’s GPU cluster.

This is not an incidental gap. It is a structural conflict with the original framing. Local-first promised data sovereignty: you own the canonical copy of your document, you control where it goes, you control who else gets a copy. LLM-first introduces a second locus of value — the model — which the user emphatically does not own. You can keep your document on your disk and still depend on rented intelligence to operate on it. The vendor moved from owning your data to owning your reasoning.

There are three honest responses to this, and none of them is fully comfortable. The first is to shrink the model: local LLMs are improving, and for narrow tasks the frontier gap is already closed. For most tasks it isn’t, and “wait for hardware” has been a deferred promise in this space for years. The second is to encrypt the call — confidential computing, attested enclaves, in the limit fully homomorphic encryption. Technically real, operationally heavy enough to be confined to niche use cases for now. The third is to accept the asymmetry: declare that AI features are outside the local-first envelope, the way the paper implicitly accepted that some forms of network communication would always involve trusted intermediaries.

What the manifesto may need is a principle the original seven don’t quite cover: the user controls what computation runs on their data. Data sovereignty without computation sovereignty is a partial victory. There isn’t a clean word for this yet, and most local-first stacks are silent about the question entirely.

Network as substance, not transport. The paper treats the network as the place where sync happens — a means to an end, where the end is the local copy. This works cleanly for documents, spreadsheets, designs. It works less cleanly for the entire class of applications where the network is the substance: chat, social feeds, presence, real-time interaction. You can’t be “local-first” about your social graph in the same sense you can be local-first about a Markdown document. Local-first for communication needs different primitives than local-first for documents. The community has mostly inherited the document framing and tried to retrofit it to communication. The fit is imperfect, and the imperfection shows.

Mesh and the relay model. A refinement, not a contradiction. The paper imagined sync via servers. What’s emerging is sync via mesh — small replicable relays, gossip protocols, pluggable transports. Nostr and similar systems suggest an evolution of the original framing: not local-first via cloud, but local-first via swarm. The local copy stays canonical; the network of relays is plural and replaceable. This is consistent with the paper’s spirit. It goes further than its specifics.

The format regression. Worth restating as its own observation. The trend the paper hoped for — convergence on open formats — went the other way. We have more formats and less interoperability than we did. Some of this is because the technical primitives (CRDTs, operational graphs) are inherently harder to standardize than file formats. Some of it is because vendors have no incentive to standardize. The result is the same regardless of cause: data does not outlive its software. That promise remains unkept.

The paper still holds up as a manifesto. Seven years on, the ideals point in the right direction even where the reality has wandered off. What’s needed isn’t to discard them. It’s to add the things 2019 couldn’t have known to ask.

The local-first paper was right about where authority should live. It was less precise about the mechanisms that would get us there, and silent on the mechanisms that would later come to matter most.

Where does the model live? What’s the local-first equivalent for communication? What does it take to actually make data outlive its software, in a world that has materially regressed on that front?

These aren’t rhetorical questions. They’re the homework for whoever writes the 2030 update.