#Aims and reasoning
The evidence in §02b identifies interacting causes of cumulative advantage: visible popularity, global reach, engagement ranking, and cheap amplification. TalkCo removes the product surfaces that combine those inputs. This is a design intervention to test, not a guarantee that social hierarchy or harmful sharing disappears.
#No global feed
A person's feed contains the channels they choose and material available in their contexts. It does not inject out-of-network content to maximize attention. Simulation evidence that opening a global feed increased toxicity supports testing this boundary in TalkCo's different setting (Tornberg2023).
#Discovery is relational
People and communities are found through invitations, QR codes, deliberately shared names, or introductions. Search covers material a person is entitled to access locally. It does not query a planetary content or relationship index.
This boundary reduces convenient graph extraction and the need to operate global indexing infrastructure. An authorized reader can still search or retain what they receive; the interface must not imply otherwise.
#Reposts: the engine we do not build
TalkCo has no boost or retweet primitive. Two useful sharing acts remain:
| Act | Required boundary |
|---|---|
| Excerpt with link and the sharer's own commentary | A new publication to the sharer's chosen audience; quotation/disclosure must be permitted and source access checked separately. |
| Private “I thought you'd like this” link | A deliberate message to a recipient; the link does not create a grant or reveal protected source material. |
No automatic backlink stream, popularity count, or recursive delivery follows either act. Independent people can still repeat, copy, or externally publish material. The claim is removal of built-in amplification, not impossibility of virality.
#Reactions: warm in conversation, silent in broadcast
In conversations, acknowledgments can answer a request; §05 and §07 define their notification behavior. On channel posts, reactions are visible only to the author and do not notify other viewers. There are no up/down votes, karma, or public reaction totals.
The relevant distinction is whether later viewers see a popularity signal and whether ranking uses it. Concealing a count while retaining an engagement optimizer would preserve the mechanism (Muchnik2013, LarooijTornberg2025). Qualitative author feedback must not turn into a portable success metric.
#Comments and discussion
A poster decides whether discussion is enabled and its outer audience. A commenter may speak to a narrower compatible audience. Comments carry no votes, rank, or public reaction count; public-to-all discussion requires deliberate compatibility between both parties' choices.
Scoped discussion avoids forcing a poster to answer many duplicate private threads. Private replies remain available. Hiding existing comments until someone writes their own is an optional de-biasing experiment, not an adopted default.
#A feed with a bottom
The feed completes. It should say “you're all caught up” when the chosen set is exhausted, without generating another batch of recommendations or making the empty state a re-engagement prompt. New arrivals are available for a later deliberate review; they do not indefinitely extend the current reading session.
#Ordering: declared, not inferred
Ordering follows declared intent: chronology or a person's explicit eagerness for a channel. It must not infer importance from clicks, response speed, or predicted engagement. Controls should be adjustable as a need arises, without requiring an upfront classification of all relationships.
Ordering caveat to test
A chronological-ordering extremity effect in a political simulation remains a hypothesis to test after removing its global feed, repost, and public popularity mechanics. §02b owns the simulation plan; the result does not justify quietly reintroducing inferred ranking.
#The hostile-fork guard
The core should supply no global timeline, actor-wide public outbox, follower/following enumeration, liked collection, or unauthenticated “all public posts” endpoint. An outside index would need its own collection and indexing infrastructure. These boundaries limit convenient extraction; they cannot prevent recipients from copying plaintext or slowly traversing their authorized neighborhoods (RFC6973).
#Protocol and architecture
#The feed is an authorized local projection
The review cursor needs a stable frontier: an explicit snapshot or equivalent bounded set. Newly arriving events cannot keep extending that frontier. Offline “caught up” means caught up with locally received material, not proof that every remote peer is synchronized.
| Seam | Candidate and disposition | Boundary to enforce |
|---|---|---|
| Feed, follows, muted children, revision context | SQLite / rusqlite; provisional baseline | Feed ordering is a view, never authority for accepting an event. |
| Search | SQLite FTS5; leading local search candidate | Index authorized local plaintext only; no shared global index or remote query disclosure by default. |
| Local file protection | SQLCipher or platform-protected storage; gated choice | Include search indexes, backups, journals, and key recovery in the threat model. |
| Event acquisition | p2panda-sync or a narrower relay adapter; candidates | Subscriptions and topic identifiers must respect context boundaries. |
| Reactions and comments | Existing object-envelope or session adapter | Deliver to the intended recipients without publishing audience lists or counts. |
The tools inventory owns package comparison. FTS5 provides full-text indexing; it does not provide encryption or access-control semantics. Index updates must track accepted revisions, local expiry, and visibility changes. Removing a local result does not revoke someone else's retained plaintext.
#Comment delivery applies an audience ceiling
An audience intersection is a rule, not permission to expose both parties' complete contact sets. Its private computation and grant proof remain protocol work. A client must validate the accepted parent policy and applicable causal state before releasing a new comment key. Later narrowing cannot recover keys already disclosed. The lifecycle and access-control pages own historical access and concurrent-revocation semantics.
#Reaction and excerpt paths do not create public engagement state
A source reference is not a decryption capability unless deliberately designed as a bearer reference. For private sources, being allowed to read does not imply permission to quote into another context. For unlisted sources, exposing the locator may itself widen discovery. Private references, excerpts, and preview text need one disclosure decision rather than separate paths that leak by accident.
#Extraction controls attach to resources, not reputation
Resource-scoped request budgets, bounded pages, expiring cursors, and backoff can slow automated traversal after authorization. They do not create confidentiality. Object retrieval, channel traversal, and profile discovery need separate limits so custody traffic does not become permission to enumerate identities (RFC6585).
Optional signals and interoperability
App attestation may be evaluated as a limited abuse signal, but ordinary access must not silently depend on one approved client or locked device ecosystem. Neither anti-tamper measures nor robots.txt replaces authorization (PlayIntegrity, OWASPMASVSResilience, RFC9309). ActivityPub's recognizable outbox and relationship collections are a useful contrast when testing whether a bridge introduces enumeration surfaces (ActivityPubSpec). Public interoperability must be an explicit export surface with its own privacy consequences.
#Open Threads
- Excerpt-with-link edge cases. Set quotation, unlisted-reference, preview, archiving, and external-commentary rules without implying that link delivery grants source access.
- Comment visibility mechanics. Define private audience intersection, stale parent policy, comment-level narrowing, and any hide-until-you-comment experiment.
- Declared ranking without upfront labor. Test lazy per-channel controls and finite review frontiers under delayed synchronization.
- Local search and deletion. Verify index/journal/backup protection, expiry behavior, and context separation on the first target platform.