#Aims and reasoning
#Keep useful work available without making hosts authorities
A person should be able to read retained material, edit permitted local state, and queue work when connectivity fails. A community workspace should reuse that foundation without forcing its hosts to interpret kaupapa, decide membership, or read content. Restoring bytes must not restore a revoked device's authority.
Distribution is valuable when it removes a named dependency or survives a named failure. It is not a single property that a package can supply:
| Term | Meaning on the stated path | Does not imply |
|---|---|---|
| Distributed | Several machines or failure domains | No indispensable authority |
| Decentralized | No mandatory single administrator for that function | Confidentiality, traffic privacy or availability |
| Federated | Independent operators interoperate | Direct peer exchange or E2EE |
| P2P | Endpoints exchange data | Collective authority or hidden metadata |
A replaceable relay can coexist with an indispensable directory, quota redeemer or repair coordinator. Name the function and observer in each claim. “Saved locally,” “copied elsewhere,” and “backed up under policy” must remain visibly different outcomes.
#Portability must preserve context and custody boundaries
Moving a local reference, copying ciphertext, admitting a reader and publishing an artifact are different acts. A host receipt is a claim about custody, not personal authorship or permanent availability. A funder need not learn the recipient's inventory. Sensitive route failure must not cause a hidden downgrade to public discovery or a direct connection.
The issue map separates format #6, custody #7, accounting #8 and network privacy #9. §11 owns gifting, paid capacity and personal-hosting launch gates.
#Protocol and architecture
#Distribution axes
One implementation owns each accepted state machine. Reuse a library's representation or validation when its semantics pass the application contract; SQLite does not require a second authoritative history above every CRDT. Storage hashes, delivery offsets and transport identities never become grants merely by appearing in this pipeline.
| Seam | Leading candidate or bounded comparison | Integration boundary |
|---|---|---|
| Local persistence and effects | Rust/Tokio plus SQLite/rusqlite | Atomic state/outbox updates, stable operation IDs, recovery and encrypted local protection |
| Synchronization | p2panda-sync/p2panda-net; selected CRDT sync where appropriate | Accept object/identity semantics explicitly; no duplicate authority history |
| Direct/relay transport | iroh first carrier experiment; libp2p comparator | Context-scoped addressing, discovery, endpoint rotation and explicit route policy |
| Private or constrained routes | Tor integration, Session/Lokinet, SimpleX/XFTP; Zenoh/Reticulum for named local workloads | Separate availability, mobile and observer tests; no ready-made TalkCo adapter assumed |
| Representation and custody | ERIS/Kapla, Tahoe/ZKAP, Rust service with opaque S3 or iroh-blobs | Codec, serving, leases, repair and accounting remain independently replaceable |
Current p2panda uses iroh as part of its modular stack, so this is a choice about composition and semantic ownership, not “p2panda versus iroh” at one layer. Its upstream README still marks APIs and core types as unstable for production (p2panda, checked 2026-10-24). Full candidate coverage stays in the tools index.
#Peer discovery methods
An invitation can be stolen, a rendezvous can eclipse a peer, and a known route can be stale. Public DHTs or provider records are not defaults for unrevealed contexts. A private libp2p deployment need not use a public DHT; disabling one does not establish anonymity. Iroh's default address lookup publishes endpoint/relay records, so that default must be included in the privacy review (iroh address lookup). Local/festival profiles may explicitly permit LAN discovery; private profiles queue when their permitted route is unavailable.
#Local-first persistence
Persist the appropriate authenticated changes and ciphertext before acknowledging durable local success. Apply the accepted merge/replay semantics once, quarantine missing authority or dependencies, and keep personal blocks and local ranking preferences out of shared history unless separately specified.
A stable operation ID makes retries deduplicable; it does not guarantee exactly-once network delivery. Lost acknowledgments must not double-apply effects or double-charge capacity. A Durable Streams cursor is delivery state, not membership or conflict resolution. Test the actual permitted service or peer for connectivity rather than requiring access to a public website.
#Ciphertext custody patterns
| Class | Content | Custody meaning |
|---|---|---|
| Temporary delivery | Invitations, descriptors, inbox traffic | Expiring buffering, not an archive lease |
| Working set | Current records, changes, recent attachments | Local persistence plus complete replicas/checkpoints |
| Archive/media | Larger immutable content | Segmented application encryption, packing and selective redundancy |
| Hot cache | Declared event resources and current objects | Expendable cache or explicitly leased copy |
The custody contract covers reservation, bounded writes, commit receipts, verified retrieval, renewal, release and draining. Temporary uploads, lease generations, retry behavior, health checks and handover need explicit bounds. Several valid leases may retain one physical block; ending one lease cannot destroy the others' rights.
#Variation — ERIS representation with a separate block service
ERIS v1 separates an encrypted block representation from its transport and storage. The proposed inner application encryption keeps disclosure authority independent of a block server or an ERIS read capability. Intermediary-peer deniability does not establish personal-author deniability. Kapla is a separate service candidate, with compatibility and maintenance checks still due.
ERIS implementation and capability boundaries
ERIS supports 1 KiB or 32 KiB blocks. Block references, ERIS read capabilities, application grants and application keys are different types. A convergence secret affects encoding/deduplication and is unnecessary to decode an existing capability; deleting it is not erasure of that capability's content.
Qualify SQLite/CBOR and HTTP/CoAP adapters independently. Native Rust or Zig codecs need independent conformance vectors; prior source findings about short writes, root validation and memory growth require reproduction at pinned revisions. Extensions have separate maturity from the core format.
Batch or pack blocks rather than performing a remote operation per small block. Preserve standard ERIS identity. Inner streaming AEAD determines when application bytes are authenticated; outer random access is insufficient. Physical packing must not combine unrelated content keys or retention lifetimes. A root hash alone cannot enumerate encrypted descendants: a repair worker needs an explicitly granted capability, inventory or bounded assignment, each with different structure leakage.
#Variation — A smaller Rust custody service
This path minimizes initial service adaptation while leaving more lifecycle code to maintain. iroh-blobs supplies hash-verified, resumable range transfer (official documentation); S3 supplies provider-specific object operations. Neither grants durable custody, recipient authorization, deletion guarantees or anonymity. Bao/BLAKE3 and ERIS are representation comparisons; changing the codec is not merely swapping a network transport.
#Variation — Tahoe custody with private allowances
Tahoe-LAFS already separates client/file services from storage servers. The comparison is whether its capabilities, leases, encoding and runtime remove more work than adapting them costs. ZKAPAuthorizer supplies a private-storage authorization input; it is not an established ERIS integration or a complete cross-provider spending protocol. A fork requires a measured advantage and an independent maintenance/review plan.
#Repair and failure domains
Repair grants are bounded by generation, destinations, expiry and work/byte allowance. They cannot issue readers, regain device authority or renew retention forever. Replicas are the initial comparison; K-of-N coding for large immutable data must justify its added scheduling, parity authentication and metadata. Root/index recovery must not depend circularly on the data it is meant to recover.
Model seeds, community/paid hosts, laptops, old phones and temporary copies separately. Household, owner, network and provider correlation matter more than raw piece count. The numerical families in §11 remain hypotheses; its parameter detail identifies why the earlier repair bands cannot be used as an ordered policy unchanged.
#Retention must survive repair and recovery
Future-read revocation, application-key destruction, cooperating-host deletion and erasure-coded redundancy are separate properties. Trace surviving key paths through envelopes, vaults, recovery bundles, checkpoints, backups, indexes and previews. A limited withdrawal/context record need not preserve the body or old key indefinitely. Stale repair cannot renew an expired generation. Malicious hosts and recipients may retain copies; universal forgetting is not a claim. Lane #12 owns separately scoped incident retention.
#Private quotas need an independent protocol
Separate physical host limits, funding/gifting and spending authority. Compare provider- or pool-bound allowances first. Globally spendable offline tickets require a double-spend design. UCAN/Biscuit-style grants constrain operations but do not enforce cumulative usage alone. Privacy Pass and ZKAP are inputs, not evidence that this composition is implemented.
Measure issuance/redemption timing, denominations, issuer correlation, deduplication probes, repair amplification, retries and crash-safe metering. A quota receipt must not accidentally create personal evidence about a private object's author.
#Metadata posture
| Profile | Permitted tradeoff | Required failure behavior |
|---|---|---|
| Controlled direct/relay experiment | Explicit peer IP and provider-metadata exposure | Never presented as anonymous delivery |
| Private route | Named onion/mix/relay path and observer budget | Queue instead of direct/public fallback |
| Local or constrained network | Explicit LAN, radio or other local visibility | Preserve E2EE and validation across any bridge |
Scoped identifiers, buckets, batching, bounded queues, endpoint rotation and expiry reduce particular leaks; they do not hide every grouping, payment or access pattern. Iroh's direct paths reveal peer IPs and relays observe connection metadata (security/privacy documentation). Its Tor transport is an experimental candidate with daemon, configuration and recovery limitations, not a production anonymity guarantee.
Session/Lokinet, SimpleX/XFTP and mixnet routes remain workload comparisons. Pigeonhole is a temporary private-delivery/storage candidate, not a media archive. Include DNS/provider fallback, wake hints and source-evidence artifacts in traces. A global-observer claim needs separate traffic-shape evidence.
#Partition behavior
The context's freshness policy determines which disclosures remain permitted offline. Reconciliation must not retroactively claim that a key released during a partition was never disclosed. Preserve useful local work while keeping current authority and readable archive restoration distinct.
#Falsification tests
- Codec conformance, bounded memory, range authentication and capability redaction pass independently of custody tests.
- Every custody candidate faces interrupted uploads, corruption, full disks, host loss, correlated failures and finite leases.
- Repair stays within budget and cannot revive expired retention or grant access.
- Lost acknowledgments, duplicate redemption and offline allowances cannot create unbounded spending or duplicate effects.
- Unrevealed contexts do not expose undeclared shared references, endpoints or recovery handles.
- Private-route failure never triggers direct or public-discovery fallback.
- A host receipt, log or token does not establish unintended personal authorship evidence.
- No global-observer claim follows from single-provider traces; raw capture handling is bounded.
#Evidence and open questions
Primary iroh, p2panda, ERIS and Tahoe documentation was checked on 2026-10-24 for the narrow roles cited above. This is not an audit, implementation run, performance benchmark or package-version approval. The shared-core synthesis, authentication note, tools inventory, and profile tests retain the wider research.
Open work remains in #6 for format/codec and ERIS versus Bao; #7 for Kapla/Tahoe/Rust custody; #8 for private accounting; #9 for carrier and observer profiles; and #4/#12 for restored state, retained keys and incident boundaries.