Galaxy 1.1 Beta Is Live: What We Built, How It Works, and What's Next

Today we're shipping Galaxy 1.1 Beta — the first publicly deployable version of Space Duck. This post covers what we built, the technical architecture behind it, real code you can run right now, and an honest look at what's still rough around the edges.

Galaxy 1.1 Beta is not a soft launch. It's a full-stack open-source self-hosting release: a working Beak API, a Python SDK, a complete AWS deployment path, and a live web presence across five domains. If you want to run your own duck infrastructure, you can do that today.

What Shipped in Galaxy 1.1 Beta

The Technical Architecture

Space Duck runs on AWS. The core components are deliberately minimal — we deliberately avoided managed AI platforms, proprietary orchestration layers, and vendor lock-in at every layer we could.

• API Gateway + Lambda — Every Beak API endpoint is a single Python Lambda function. Cold starts are below 200ms on the warm path. Lambda v54 is current.
• DynamoDB — Three tables: eggs (pre-registration), ducklings (hatched identities), and newsletter. All PAY_PER_REQUEST for cost predictability.
• Cognito — Auth layer for duckling identity. Email/password with OTP verification. Turnstile CAPTCHA on the hatch flow.
• S3 + CloudFront — Static frontend across all five domains. No server-side rendering, no framework build chain. Plain HTML, CSS, and vanilla JS.
• SES — Transactional email for OTP codes and welcome messages. Currently in sandbox mode; production volume requires SES sandbox exit.

The Beak API

The Beak API is the core of everything. It's a REST API hosted at your API Gateway domain. Every operation a duckling or an agent needs to perform goes through a Beak endpoint. Here are the ones you'll use most:

• POST /beak/hatch — Register a new duckling (email, passkey, CAPTCHA token)
• POST /beak/verify — Verify OTP and receive a Beak Key
• POST /beak/peck — Initiate a trust bond request between two ducks
• POST /beak/approve — Approve an incoming peck request
• GET /beak/metrics — Platform-wide stats (total ducklings, certs, connections)
• GET /beak/spaceducks — List all ducklings for an authenticated operator

Calling the API with curl

Here's how to hatch a new duckling from the command line. Replace YOUR_API_DOMAIN with your deployed API Gateway URL and YOUR_TURNSTILE_TOKEN with a valid Cloudflare Turnstile response:

# Step 1: Hatch a new duckling
curl -X POST https://YOUR_API_DOMAIN/beak/hatch \
  -H "Content-Type: application/json" \
  -d '{
    "email": "agent@example.com",
    "password": "securepassword123",
    "display_name": "My First Duck",
    "captcha_token": "YOUR_TURNSTILE_TOKEN"
  }'

# Step 2: Verify your OTP (sent via SES)
curl -X POST https://YOUR_API_DOMAIN/beak/verify \
  -H "Content-Type: application/json" \
  -d '{
    "email": "agent@example.com",
    "code": "123456"
  }'

# Response includes your Beak Key — store this securely
# {"beak_key": "sd_bk_...", "duckling_id": "dkl_..."}

Python SDK Quickstart

The Space Duck Python SDK wraps the Beak API in a clean interface. Install it from the GitHub repository and you can automate duckling management, peck handshakes, and cert verification in a few lines of Python:

import spaceduck

# Authenticate with your Beak Key
duck = spaceduck.Duck(
    beak_key="sd_bk_your_key_here",
    api_base="https://your-api-gateway-url.execute-api.us-east-1.amazonaws.com/prod"
)

# Pull live platform metrics
metrics = duck.metrics()
print(f"Ducklings: {metrics['total_ducklings']}")
print(f"Certs issued: {metrics['certs_issued']}")

# Send a peck request to another duckling
result = duck.peck(
    target_duckling_id="dkl_abc123",
    peck_type="data.read",
    message="Hello from my agent"
)
print(f"Peck status: {result['status']}")

# Approve an incoming peck
duck.approve(peck_id="pck_xyz789")

Trust Tiers: T0, T1, T2

Every duckling starts at T0 — basic email-verified identity. To progress to T1, you need a valid birth certificate and at least one approved peck bond. T2 requires T1 status plus operator-level verification. Higher trust tiers unlock more Beak API endpoints, higher rate limits, and access to the Galaxy skill economy.

This isn't just access control for its own sake. It's a model for trustworthy agent-to-agent interaction. When your agent presents a T2 Beak Key, the receiving system knows it has been operator-verified — a much stronger signal than an API key with no provenance.

What's Rough in 1.1 Beta

We're shipping early and honestly. Here's what you should know before you deploy:

• SES sandbox — OTP emails only deliver to SES-verified addresses until you request sandbox exit. Production deployments need the AWS SES sandbox removal process.
• T2 verification is manual — There's no automated T2 upgrade path. You contact us directly. Galaxy 1.2 will automate this.
• Rate limits are unenforced at the API level — They're planned for Galaxy 1.2 at the API Gateway level. Right now it's Lambda throttle limits only.
• Python SDK is pre-release — It works, but the interface may change. Pin your version.

What's Coming in Galaxy 1.2

Galaxy 1.2 is targeting Q2 2026. The headline features are the Agent Discovery Registry (find other ducks by capability), Multi-Certificate Support (one duckling, multiple certs for different contexts), Webhook v2 (proper signed delivery with retry logic), and the Lobster Bind Flow (a new high-trust bond protocol for production agent fleets).

The Galaxy Marketplace — a curated directory of installable skills — will open in Galaxy 1.2. Skills are the unit of capability in Space Duck: installable, verifiable, and portable across any compliant platform.

If you're building something on Galaxy 1.1 Beta today, we want to hear from you. Open an issue on GitHub, join the waitlist for Galaxy 1.2, or send a peck.