#Aims and reasoning
The inventory groups tools, protocols, applications and implementation references by the work they could remove and the authority/privacy boundaries they must preserve. It incorporates the earlier repository inventory, the September 18–21 evaluations, and the Open Local First / FOSDEM 2026 project scan. Consolidation removes repeated qualification boilerplate; historical evidence remains in its source workbench and Git history. No general freshness or security audit is claimed by this edit.
#How to use the inventory
Choose the job first. A format, runtime, database, network, capability system, storage service and social governance model are not interchangeable alternatives. A mature implementation can be a poor fit; a useful prototype can still be unsafe to deploy. Every accepted mechanism needs a recorded contract, not necessarily an additional custom implementation of the same contract.
#Column design
The tables identify job, candidate, disposition and the decisive boundary/test. Supporting evidence is in the dated notes and linked issue bodies. Those bodies contain context, options, acceptance criteria, dependencies and output locations; they can be assigned without this conversation.
#Status vocabulary
Leading experiment means a provisional comparison, not approval. Adapter is bounded to a named interface. Reference/benchmark preserves useful concepts without proposing wholesale adoption. Gated requires a named requirement or unresolved license/platform/security check. Deferred is outside the current critical path, not a claim that the project is intrinsically bad or inactive.
#Protocol and architecture
#Candidate architecture seam
An accepted library may own merge or authorization semantics; installing it does not accept those semantics by default. Descriptors and payloads have different recipients and lifetimes. Format conformance, transfer integrity and custody obligations are separate tests. A plugin injection token is not automatically a cryptographic capability, and a verified package hash is not an execution sandbox.
#Where the leading candidates connect
| Interface | Leading candidates from this inventory | Owning design and decisive limit |
|---|---|---|
| Command/state/view | Rust/Tokio + SQLite/rusqlite/FTS5; optional Effect/TanStack DB | §10: one durable authority/retry owner; snapshot/delta and crash recovery |
| Integrated workspace | DXOS/ECHO/HALO/Composer | §09, profiles: library semantics accepted as a composition, not duplicated underneath |
| Private relationship and group sessions | Signal-lineage/libsignal; OpenMLS; bounded Tachyon-style comparator | §05, encryption: different evidence and history profiles |
| Draft/shared-record changes | Automerge; Yjs/Yrs or Loro; evaluated p2panda-auth semantics | lifecycle, access: causal dependency and revocation admission |
| Object disclosure | Per-object AEAD and selected HPKE recipient descriptors | §04, §06: audience ceilings and complete source-evidence analysis |
| Sync and carrier | p2panda sync/net over iroh, smaller iroh adapter, libp2p and private-route comparisons | distribution: p2panda/iroh may compose; no private-to-direct fallback |
| Representation and custody | ERIS/Kapla; iroh-blobs; Tahoe/ZKAP; Rust object_store | §11: distinct locator/read-cap/key/lease types; expiry-aware repair |
| Wake and interruption | APNs/FCM/Web Push or pull adapters + local policy | §07: opaque hints carry no message authority; urgent mobile delivery unproven |
#Narrow primary-source refresh — 2026-10-24
| Source checked | Supported claim | Remaining adoption gate |
|---|---|---|
| p2panda upstream | Modular sync, network, store, authorization and encryption packages; network composition uses iroh; pre-v1 API/core-type stability warning | Exact revision, evidence graph, adopted permission semantics, mobile lifecycle and migration |
| iroh privacy | Direct peers disclose IP addresses; relays observe connection metadata | Per-context configuration, lookup, packet traces and observer model |
| iroh-blobs | BLAKE3-addressed verified blob/range transfer | Authorization, leases, quota, repair and expiry belong elsewhere |
| OpenMLS book | MLS implementation with interchangeable providers; tested targets differ from built-but-unsupported mobile/WASM targets | Target-device testing, credential binding, fork/recovery policy and evidence review |
| libsignal | External use unsupported; API/service reuse is not a stable commitment | Distribution/license, integration maintenance, service compatibility and independent network path |
| ERIS specification | Encrypted immutable block representation independent of storage and transport | Specific codec, application encryption, capability secrecy and custody service |
| SQLite FTS5 | Embedded full-text indexing | Local disclosure/index retention, secure deletion paths and no global sync of plaintext indexes |
These checks support component placement and qualifications. They do not refresh every catalogue entry, execute an implementation, certify a dependency or validate a composed security profile. The inherited Matrix/DXOS/Jazz/license/source findings retain their original dates.
#Current decision-relevant evidence
| Job | Candidate | Current disposition | Next gate |
|---|---|---|---|
| Shared runtime and durable local state | Rust, Tokio, SQLite/rusqlite, FTS5 | Smaller-core experiment | #1, #10: platform/lifecycle and one state-machine owner |
| Local protection | SQLCipher and platform keystores | Required protection boundary; implementation gated | #4: journals, backups, recovery and erased-key paths |
| TypeScript asynchronous lifetimes | Effect | Focused client prototype | #10: cancellation, cleanup, versioned APIs; do not duplicate durable retries |
| Reactive query UI | TanStack DB custom collections | Focused projection prototype | #10: snapshot watermark/delta race, bounded data and command authority |
| Integrated community workspace | DXOS/ECHO/HALO/Composer | Main reorientation experiment | #1/#10: FSL revision/terms, app access, context isolation, evidence, recovery and custody |
| Collaborative objects | Automerge; Yjs/Yrs and Loro countercandidates | Select one representation per job | #5: intention, dependencies, membership, late history and retention |
| Shared-record grid/calculation | Glide Data Grid; Mog; IronCalc; Rows n’ Columns | Separate UI/engine/collaboration decisions | #5/#10: stable identities, formulas, source scope and licensing; no full-product inference from engine docs |
| Peer log | OrbitDB with selected access/encryption modules | Bounded alternative, not an extra duplicate log | #5/#10: creator defaults, malicious writers, key flow and discovery metadata |
| Encrypted document layer | Fireproof | Key/metadata-flow experiment | #10: a non-reading metadata host, identifier correlation and retention |
| Cryptographic collaboration | Classic Jazz | Separate reference from v2 | #3/#4/#10: recovery, credentials, signed history and migration support |
| Server-authoritative Jazz generation | Jazz v2 | Not the private peer-authority default | #10: do not import Classic's security description into v2 |
| Immutable ciphertext representation | ERIS v1 | Leading format experiment | #6: codecs, streaming, capability types and context separation |
| Reusable ERIS storage node | Kapla | First bounded node comparison | #7: leases versus cache eviction, crash/expiry/repair |
| Existing encrypted distributed storage | Tahoe-LAFS + ZKAPAuthorizer | Compare before any sustained fork | #7/#8: lifecycle, private accounting and maintenance |
| Smaller storage implementation | Rust object_store + local/S3-compatible capacity; optional Garage | Replication-first comparison | #7: explicit custody protocol, operator boundary and costs |
| Recipient descriptor authentication | Established ratchets; selected HPKE Auth/DHKEM | Cryptographic research gate | #3: simulation, replay, compromise, collusion and evidence graph |
| Evolving group security | OpenMLS / RFC 9420 profile | Conditional group experiment | #3/#5: no general MLS deniability claim; credential and late-reader semantics |
| Scoped service delegation | UCAN; Biscuit; minimal signed grants | One-operation comparison | #8: format generation, audit, attenuation, replay and metering |
| Client-owned Matrix groups | Tachyon / experimental DMLS room engine | Bounded recurring-group countercandidate, not a whole-stack selection | #1/#3–#5/#13: exact source, concurrent membership, private evidence, context isolation and crash recovery; study |
| Embedded Matrix state and local links | Neutrino + Neutrino/Iroh | Experimental state-resolution/transport reference | #4/#9/#10/#13: effective signed/trusted mode, BLE identifiers, receipt semantics and exact Android artifact; not production approval |
| Optional Matrix delivery and interoperability | Matrix to-device carrier; explicit conventional-room export | Separate metadata-qualified adapter decisions | #2/#9/#12: real-server behavior, bounded queues, consented export, no automatic inheritance of private TalkCo properties |
| Delivery and privacy | Iroh, libp2p, p2panda; private-route and queue adapters | Same-fixture comparisons | #9: endpoint isolation, observer model and no silent fallback |
| Resumable optional relay | Durable Streams | Opaque delivery adapter | #9: offsets are delivery, not authority; stream/subscriber metadata |
| Admission/release extensions | Privacy Pass; PRE/TACo/threshold/ZK | Named requirement only | #1/#8: prove necessity beyond ordinary envelopes and finite grants |
| Evidence and independent review | Common fixture, property/model tests, traces, supply-chain checks | Required adoption gate | #13: reproducibility and honest scope |
#The 2026-09-18 comparison narrows the next choices
The tool evaluation records the primary links and selected source revisions behind the new candidates. Important distinctions are DXOS's inspected FSL terms and optional feed-at-rest encryption, Jazz Classic versus v2, LiveStore's central order, Fireproof's metadata-key path and OrbitDB's explicit extension hooks. These are configuration/version-specific findings, not blanket deployment verdicts.
The authentication evaluation adds a later gate: encrypted signed history can still produce transferable evidence. Review the complete person/key/content binding before selecting DXOS, OrbitDB, Classic Jazz, p2panda, Hypercore or any similar history model. A deniable contextual-key profile may be possible; it has not been validated here.
The Matrix P2P/Tachyon study adds a client-owned group-engine comparison and keeps Neutrino, opaque delivery and conventional interoperability distinct. Source inspection corrects the stale blanket claim that Neutrino has no signing implementation, while retaining its experimental status and default trusted-network caveat. No existing Session/TACo/Signal commitment is silently superseded; architecture lane #1 remains the decision owner.
#Available libraries, tools, and packages
The full inventory below retains researched alternatives. Page-specific role tables link here; they do not create separate adoption ledgers.
#Implementation libraries and client shells
| Job | Candidate(s) | Disposition and boundary |
|---|---|---|
| Systems runtime | Rust, Tokio | Leading smaller-core experiment; cancellation, backpressure, native lifecycle and FFI still need tests |
| Client shells | Tauri 2, React/TypeScript; Flutter; Kotlin Multiplatform; browser/WASM | First platform unresolved; secure storage, background delivery and recovery determine fit |
| Typed client services | Effect | Useful client task/dependency/error model; not durable protocol state or secure erasure |
| Reactive local queries | TanStack DB | Adapter over accepted local state; not a second durable event system |
| Local persistence | SQLite, rusqlite, SQLite WAL, FTS5 | First-slice candidates; journals/indexes/backups are privacy/retention surfaces |
| Local database encryption | SQLCipher, platform keystore | Gated build/license/platform/recovery boundary; not a central reset service |
| Collaborative documents | Automerge, Yjs/Yrs, Loro | Compare content semantics, stable references, history leakage, revocation dependencies and checkpointing. Yjs v14 attribution/change work remains prerelease as of the 2026-09-22 check; attribution metadata is not source authentication. |
| Replicated SQL/local data | cr-sqlite, RxDB, PouchDB/CouchDB, Dexie | Narrow alternatives; convergence/reactivity is not authorization or key management |
| Embedded/hosted SQL | PGlite, Turso/libSQL, Turso Sync, FoundationDB | Requirement-gated comparisons; avoid another database runtime or coordinator without benefit |
| Integrated P2P application | DXOS ECHO/HALO/Composer | Main whole-workspace countercandidate; scrutinize identity, app access, custody and licensing |
| Integrated E2EE local-first framework | NextGraph | Bounded architecture countercandidate: Rust core, CRDT/RDF documents, reactive bindings and capabilities are relevant; stable repository/document identifiers, broker visibility, cross-context linking, permission scope and alpha maturity are gates. |
| Peer log/database | OrbitDB | Custom controllers and separate payload/replication encryption hooks; SimpleEncryption warning retained |
| Local encrypted documents | Fireproof | Metadata/key and address-correlation gates; not automatically a blind metadata service |
| Grouped object collaboration | Classic Jazz, Jazz v2 | Materially different authority models; version/generation is part of the decision |
| Event-sourced local SQL | LiveStore | Normal sync's total-order/rebase contract is not removed by replacing the provider |
| Source-database sync | Electric Sync/ElectricSQL, PowerSync, Zero | Backend-centered architectures; not independent peer authority by default |
| Backend reconciliation | Replicache | Prior review reported maintenance mode; refresh before any new dependency |
| Reactive backend | Convex; Object Sync Engine article; Convex Automerge example | Trusted backend or reference integration, not a demonstrated P2P substrate |
| Database access | Prisma | ORM/tooling only; no present reason to interpose it in the Rust SQLite path |
| Spreadsheet UI | Glide Data Grid, Rows n’ Columns | UI/component candidates; audit data model, licensing and formula/collaboration boundaries |
| Spreadsheet engines | Mog, IronCalc | Requalify code and exposed sync seams; earlier broad Mog product claims are not established by headless source |
| Authorization framework | Local-First Auth, Keyhive, p2panda-auth | Compare implemented device/group/revocation semantics and review state, not diagrams. Keyhive's current Rust workspace is pre-alpha, explicitly not production-ready, and reports no security audit; concurrent membership/revocation work remains active. |
| Sync/transport packages | p2panda, p2panda-sync, iroh, libp2p | Selected components may replace work; peer/topic/encoding metadata must not dictate application policy |
| Blob I/O | iroh-blobs, object_store, Storj Uplink/libuplink | Data transfer/backend libraries, not custody promises or content-key policy |
| Transparency backend | Tessera/Trillian-Tessera | Checkpoint implementation, not complete identity, private lookup or authority |
| Anonymous credentials | anoncreds-rs | External-credential requirement only; issuer/revocation/linkability remain policy |
Qualification notes — implementation libraries and client shells
Source code and documentation evidence is recorded in the September evaluation, earlier shortlist and library review. Current versions, APIs, dependency vulnerabilities, licenses and platform binaries require a fresh check before use.
For the smaller core, SQLite owns durable storage, the selected object implementation owns its semantics, and TanStack DB owns a bounded view. Use snapshot-plus-watermark or subscription buffering to avoid initialization races. UI mutation callbacks submit commands; they do not mint roles or treat optimistic data as durable. Effect and Tokio must not independently retry the same operation.
For DXOS, test Composer as an integrated replacement, not only extracted internals. The reviewed feed Cypher is optional at rest; this does not describe every network/store deployment. The inspected license was FSL-1.1-Apache-2.0 and app/device access was broad. Review exact use and source revision.
For Fireproof, test the intended metadata/key-gossip path against a non-reading metadata service. The observed key serialization is not an exploit finding. For OrbitDB, test custom controllers, encrypted log/payload separation and delayed revocation. For Classic Jazz, verify recovery and support/migration; do not attribute its cryptographic permissions to v2's server model.
#Protocols, formats, standards, and abstractions
| Job | Candidate(s) | Boundary / next decision |
|---|---|---|
| Portable application objects | Context-scoped objects, revisions, descriptors and accepted event semantics | #2/#5; open formats do not require a public repository or universal signatures |
| Confidential objects | AEAD, per-object CEKs, reviewed streaming AEAD | #3/#6; read keys do not establish authorship; segment/context bindings and key lifetimes matter |
| Recipient envelopes | HPKE / RFC 9180; hpke-rs candidate implementation | #3; distinguish Base/Auth/PSK and selected KEM, replay, recipient compromise and retained-key limits |
| Deniable relationship delivery | Double/Triple Ratchet, PQXDH, Sesame; libsignal integration | #3/#4/#10; protocol semantics differ from external API/service support and licensing |
| Designated verification | Designated-verifier signatures; experimental deevee | #3; independent construction review before production; multi-recipient evidence is not trivial |
| Group sessions | MLS / RFC 9420, RFC 9750, OpenMLS | #3/#5; no general deniability claim, no automatic application ACL or safe credential binding |
| Cheap bounded fanout | Symmetric group keys | #5; group MACs do not distinguish authors against insiders |
| Transferable structured attestation | COSE / RFC 9052; contextual or threshold signatures | Use only where the evidence consequence is intended; deterministic encoding does not supply policy |
| Encoding and compatibility | Deterministic CBOR / RFC 8949; Protobuf, Buf; Postcard | #2; distinguish canonical authenticated bytes from carrier-specific encoding; test unknown fields/downgrade |
| Immutable block format | ERIS v1, ERIS read capabilities and block references | #6; application encryption above ERIS; read cap is not edit permission or author proof |
| ERIS codecs | eris-rs, Zig ERIS, OCaml ERIS, Guile ERIS, python-eris, Codeberg eris-go, independent andrew-d/eris-go | #6; conformance, streaming, short I/O, secret-safe types and per-implementation license gates |
| ERIS operational tools | Kapla, ERIShell, eris-captp/Goblins integration | #6/#7/#9; bounded adapter tests, not a complete custody/traffic privacy system |
| ERIS extensions | CBOR serialization, SQLite block storage, HTTP/CoAP, ERIS-FS, link files, Canons, RDF/cache vocabulary, DNSLink/Magnet | Extension maturity separate from v1; public naming only intentional export, append-only history not automatic governance |
| Verified byte streaming | Bao/BLAKE3 | ERIS countercandidate; integrity against a root is not provenance or encryption; don't confuse BLAKE3 and BLAKE2b references |
| Action delegation | UCAN, Biscuit, Macaroons, signed bounded grants | #8; version/audit/attenuation/replay, cumulative meters and deniability evidence need separate checks |
| Capability + replicated-state composition | Spritely Goblins / Brassica Chat / zcaps | #2/#5/#8 reference: object capabilities govern behavior while authorization certificates are replicated alongside CRDT data. Useful authority separation; Scheme/Goblins is not a current runtime candidate. |
| Editor collaboration boundary | Teamtype Collaborative Editing Protocol (CEP) | #2/#10 early protocol-interface reference; preserve an LSP-like seam between editors and collaboration engines without freezing editor-specific state into TalkCo's canonical object protocol. |
| Namespace capabilities and private sync | Willow family: Meadowcap, Confidential Sync, Drop Format, Transfer Protocol, Bab | #2/#4/#5/#9; strong reference for structured namespaces, attenuable capabilities, private-interest overlap and arbitrary/offline delivery. Transferable capability evidence, namespace identifiers, context correlation and payload-key lifecycle remain TalkCo decisions. |
| Conditional transformation | PRE, Umbral/pyUmbral | #1/#3; named author-offline/transformation requirement, compromise and revocation review |
| Divided release | Threshold release, TACo | #1; liveness, committee membership/collusion, operator costs and metadata |
| Divided signing | FROST / RFC 9591 | Threshold signatures are not consensus, erasure coding, divided decryption or deniable authentication |
| Policy-shaped encryption | Broadcast encryption / ABE | Later requirement; key management, policy exposure and revocation cost |
| Directory consistency | Key transparency/IETF drafts, witnesses and gossip | #4/#9; not legitimacy, private lookup or a mandatory public root |
| Key succession / claims | KERI, DID Core, Verifiable Credentials, PGP/GnuPG web-of-trust patterns | Optional interoperability; avoid universal keys, public trust graphs and portable reputation |
| Local authentication | WebAuthn/passkeys; platform keystores | #4/#10; origin/provider/backup behavior, not remote human identity |
| Private recovery research | Kintsugi, DKVE, Signal SVR | #4; preauthorization, guessing resistance, witness/locator leakage and current implementation evidence |
| Supporting Signal mechanisms | Sealed Sender, safety numbers, usernames | Narrow references, not a complete TalkCo identity or custody model |
| Public names | ENS and other registries | Export integration only; exact shared locators/local aliases are the private default |
| PQ confidentiality | ML-KEM / FIPS 203, PQXDH, ML-KEM Braid-style work, HPKE-PQ/PQ-MLS drafts | #3/#13; pin suites, distinguish research from standard, test migration and deniability compatibility |
| PQ attestation | ML-DSA / FIPS 204, SLH-DSA / FIPS 205 | Use only for intended signatures; size/platform and key migration gates |
| PQ migration references | NIST guidance; repository-cited RFC 9958 | Identify exact applicability; do not infer relevance from an unexplained citation |
| Anonymous admission/accounting | Privacy Pass / RFC 9576 and RFC 9578, ZKAPAuthorizer | #8; tokens are not personhood or decryption; issuance/redemption metadata and double spending |
| Anonymous group predicates | Semaphore, RLN, AnonCreds | Named narrow requirement only; issuer/root/nullifier/epoch correlation and recovery |
| External auth bridge | JWT, OAuth, SIWE/wallet authentication | Optional services only; a login factor is not a permanent subject or content key |
| Public coordination | Smart contracts | Named public commitments only; ordinary private messages/recipients stay off-chain |
| Private query access | PIR/ORAM, PRO-ORAM | #9; measure a specific leak and operational cost before admission |
| Transport security | QUIC, Noise, TLS | Secure transport does not supply audience, personal identity or traffic-analysis resistance |
| Storage interface | S3 API semantics | Byte I/O, not retention/repair contract or shared-object authority |
| Verified import | Helia verified-fetch, IPFS CIDs | Validate retrieved bytes; control gateways/discovery; no inferred privacy, authorship or persistence |
| App/resource packaging | Web Tiles, LUCID | Experimental portable packs; loader sandbox and bounded local access are separate |
| Immutable indexing | Prolly trees, mikeal/prolly-trees | Prefer through a selected implementation; no accidental database project from a low-level structure |
| Privacy engineering | RFC 6973 | Turn observer/correlation guidance into an explicit testable budget |
Qualification notes — protocols, formats, standards, and abstractions
The encryption page owns source authentication, retained keys and key release. The object page owns content meaning. The storage page owns custody. Their explicit boundaries supersede the earlier shorthand that every application object must be signed.
ERIS v1 is stable as a format, not a security endorsement of every implementation/extension. Prior static review of eris-rs identified short-write, eager-memory and root-key-validation concerns to reproduce. Deleting the convergence secret cannot erase existing readable capabilities. Test application encryption and recipient authentication separately from block conformance; batch/pack I/O without silently changing v1.
UCAN generations are not interchangeable; the reviewed Rust work identified an RC profile and no formal audit. A provider allowance is a useful first experiment, but requires an authoritative cumulative meter. Capability proofs, recipient content-key envelopes, ERIS read capabilities and signed receipts are distinct artifacts.
Public signatures can be appropriate for intentional attestations. A context-key signature with a deniable personal binding is a different hypothesis from a non-transferable authenticator. A recipient can disclose a decrypted ordinary signature; group encryption alone does not settle that. Review all adjacent identity, consent, upload, quota and recovery artifacts under #3.
#Carriers, access services, and storage platforms
| Job | Candidate(s) | Disposition and boundary |
|---|---|---|
| Small private message carrier | Session, Session Protocol V2, Session Nodes/swarms | Legacy starting candidates reopened in #1/#9; current protocol/platform properties require refresh |
| Rich onion-routed traffic | Lokinet/SNApps | Gated platform/operations comparison; not a content/object protocol |
| Low-latency privacy | Tor, Iroh–Tor adapter, Tor padding | Test actual configuration, scoped endpoint keys and no direct fallback; timing limits remain |
| Mix delivery | Loopix reference, Katzenpost, Nym | Named stronger observer profile only; latency, cover traffic, mobile and operational costs |
| Private temporary storage | Katzenpost Pigeonhole | Delivery/inbox experiment; not indefinite archive custody |
| Direct P2P adapters | Iroh, libp2p, scoped rendezvous | Carrier/endpoint identity is not membership; packet/discovery traces required |
| Data synchronization | p2panda-sync, Willow implementations | Verify exact version and semantics; keep author/topic/encoding metadata and authority explicit |
| Constrained/local networks | Zenoh, Reticulum | Newly routed bounded comparisons, not qualified dependencies; adapters before forks |
| Resumable relay | Durable Streams, minimal HTTP relay | Optional opaque delivery; stream offsets are not canonical application ordering |
| Public discovery | Kademlia DHT, public provider indexes | Not private-core defaults; intentional public/export use only |
| Pairwise queues and files | SimpleX, SMP v20 references, SimpleX Channels, XFTP | Version/implementation refresh; transfer/inbox lifetime is not archive custody |
| Opaque operator storage | S3-compatible service, AWS S3 client-side encryption patterns, Storj Uplink | Application encryption before upload; provider size/timing/access metadata remains |
| Coordinated durable service | Storj Satellite | External repair/accounting coordinator; not application authority |
| Capability storage | Tahoe-LAFS, ZKAPAuthorizer/PrivateStorage reference | Compare immutable storage, lease/repair and private authorization before fork commitment |
| Integrated private filesystem | Peergos | Bounded whole-platform counterproposal; public naming/home-server/context constraints need testing |
| ERIS storage tools | Kapla, ERIShell; historical oebstly | Kapla node prototype; exact license, persistence and custody behavior open; inactive historical tools not launch defaults |
| Rust object backend | object_store, local filesystem/SQLite block stores | Reuse I/O; still implement explicit lease/repair/accounting semantics |
| Reliable operator cluster | Garage, SeaweedFS, Ceph | Shared operator capacity, not a permissionless phone mesh; license and administration boundaries |
| Placement reference | CRUSH | Failure-domain modeling; not audience or custody authority |
| Existing S3 implementation | MinIO | Freshness/license/maintenance-gated; do not repeat an unverified archived-status claim as current fact |
| Erasure codec | reed-solomon-simd and comparable reviewed codecs | Codec only; not placement, manifest authentication, recovery or Tahoe compatibility |
| Economic storage | Filecoin, Sia, Walrus | Optional custody adapters; chain/payment/coordinator metadata and failure semantics |
| Availability structures | Walrus slivers/receipts; Codex/Logos Storage | Experimental/platform comparisons; availability proofs do not supply lifecycle or private identity |
| Hot retrieval | Saturn CDN and other retrieval services | Historical reference requiring status refresh; public cache demand is not private community policy |
| Permanent archival publication | Arweave | Not ordinary expiring private storage; intentional permanent export only |
| Public content-addressed export | IPFS, Kubo, IPFS Cluster, Bitswap, Graphsync | Explicit constrained routing/export; provider records, selectors and query patterns leak interest |
| Public media export | Blossom / NIP-B7 | Hashes, URLs and server lists are not private-sphere identities |
| Topic-based messaging | Waku | Later adapter; content topics, filters and Store queries require observer review |
| Structured public/hosted data | Ceramic, ComposeDB, OrbisDB | Schema/indexer and public graph commitments can exceed our needs |
| Public/relayed publication | Nostr and related event protocols | Reference/export only by default; signed evidence and social metadata differ from private profiles |
Qualification notes — carriers, access services, and storage platforms
The earlier architecture review, metadata research and storage page carry the detailed distinctions. The prior rankings are evidence history, not immutable adoption decisions.
Compare the same encrypted payload through Kapla/ERIS, Tahoe/ZKAP and a smaller Rust service. Distinguish bounded caching from promised custody, full replicas from erasure coding, erasure from key destruction, and object retention from identity recovery. Treat quotas, repair grants, metadata and legal response as separate interfaces. A repair worker may see a bounded inventory or an ERIS tree over inner ciphertext; neither is zero metadata.
The public code review found a concrete Iroh–Tor experiment and Pigeonhole implementation evidence, but exact compatible releases, transport defaults and retention need current tests. Iroh-blobs and ERIS hashes are different; choose a direct transport adapter or explicit bundle mapping rather than treating the identifiers as interchangeable.
Friends may know they are gifting storage without receiving every recipient read or object inventory. Paid providers can be optional; storing opaque data with one does not require adopting its identity/control plane. Operator-managed Garage/Ceph deployments and independent household hosts are different failure domains.
#Notifications and platform delivery
| Candidate | Job | Boundary |
|---|---|---|
| Web Push / RFC 8291; web-push library | Browser wake hints | No plaintext, durable message authority or private audience identifiers in wake data |
| APNs | Apple wake integration | OS/background and token metadata; not an E2EE transport |
| FCM | Android wake integration | Provider dependency and timing; optional/privacy-profile behavior needs design |
| UnifiedPush | Optional distributor-based wake adapter, where supported | Endpoint and distributor metadata, target-device support, battery and latency need testing; no urgent-delivery guarantee. Primary overview checked 2026-10-24. |
| OS Focus/notification controls | Recipient interruption policy | Sender priority never overrides recipient choice; device policy need not be globally synchronized |
Qualification notes — notifications and platform delivery
§07 remains the product owner. Queue delivery, wake, retrieval, display and interruption are separate events. Test token rotation, stale subscriptions, duplicate hints, push outage, background limits and reinstall/recovery. A filesystem or coordination feed does not justify enabling presence, response-pressure signals or task-productivity tracking by default.
#Validation, supply chain, and operations
| Job | Candidate(s) | Gate or limit |
|---|---|---|
| Primitive/codec vectors | Wycheproof, ERIS vectors, independent implementations | Primitive success is not a composition proof; add malformed/short-I/O/property tests |
| State models | TLA+, TLC | Bounded membership, quota, repair/expiry models; name excluded assumptions |
| Integration/faults | Testcontainers, Toxiproxy, tc-netem | Pinned environment, reproducible loss/delay/partition schedules and recovery outcomes |
| Packet inspection | TShark, Wireshark | Explicit observer/leakage oracle; raw traces are sensitive and retained narrowly |
| Dependency advisories | OSV-Scanner, Grype | Timestamp databases; absence of findings is not proof of security |
| Inventory | Syft, Anchore OSS ecosystem, SBOMs | Evidence of dependency composition, not license clearance |
| Artifact provenance | Cosign, SLSA, signed releases | Signatures identify the artifact claim; independent rebuilds/review still needed |
| Reproducible builds | Native/mobile/WASM and server build drills | Account for FFI, codecs, OS packaging and dependencies |
| Node deployment | Podman Quadlet, container/systemd packaging | Linux-specific operator tooling, not universal mobile runtime |
| Operational metrics | OpenTelemetry Collector | Allowlisted coarse health; no private capabilities, person IDs or reader histories |
| Client integrity | Play Integrity; OWASP MASVS Resilience | Secondary abuse/resilience signals, not the basis of privacy or exclusion of open clients |
| Social/failure simulation | Mesa, AgentPy, NetworkX | Named mechanism tests, not predictions of human legitimacy or adoption |
| Analysis | Pandas, Polars | Reproducible summaries, not substitutes for protocol/privacy tests |
| RDT construction and verification | Flec, ECROs, VeriFx | #5/#13 research/validation reference: make network/security constraints explicit, detect invariants that require synchronization, and verify custom RDT convergence where applicable. Not an application runtime selection. |
| Repository publication | Node.js, npm, existing Markdown build | Documentation validation only; not evidence of app runtime selection |
| Contributor workflow | GitHub issue lanes, ADRs, independent human/agent review | Self-contained context; generated code does not approve itself |
Qualification notes — validation, supply chain, and operations
Issue #13 owns the common fixture and the difference between source review, executed tests, model results and independent audit. The current repository workflow checks new local source links and builds HTML with permitted Mermaid source fallback. It neither deploys the site nor validates diagram rendering, encryption or privacy.
Pin source and build inputs before an experiment. Record failures, environment and remaining unknowns. Agents can produce adapters, compatibility tests, fuzz cases, migrations and documentation; the author of a crypto change must not also supply its only independent approval. A sustained fork needs named maintenance, security response, upstream/compatibility policy and rollback/recovery plans.
#Adapter and benchmark candidates
| Candidate family | Retained role | Boundary |
|---|---|---|
| Marmot, marmot-ts, White Noise/MDK | MLS-over-relay profiles and audit-bounded examples | Pin audited scope and post-audit delta; not TalkCo's object/identity/metadata contract |
| vodozemac | Matrix cryptographic implementation reference | Matrix account and room assumptions remain separate |
| Hypercore, Hyperdrive, Autobase, Dat | Append histories, sparse file transfer and multiwriter coordination | Signature/evidence, membership, retention and paid custody need explicit treatment |
| Hyperswarm | Topic discovery | Topic/provider metadata is not hidden by payload encryption |
| SSB, tinySSB | Offline gossip and per-author feed patterns | Public history/graph and sparse-device constraints; not automatic private audience semantics |
| Briar | Contact-oriented partitioned/offline design | Useful local-network benchmark, not a universal object/custody engine |
| Jami | P2P messaging/calls comparison | Account/DHT and platform model need a bounded adaptation |
| Syncthing | Trusted-device ciphertext transfer comparison | Folder synchronization is not untrusted custody or independent object authorization |
| Holochain, hREA, Nondominium | Agent-centric resource/data/runtime comparisons | Revisit against an accepted validation contract; no blanket rejection merely because a library validates data |
| ValueFlows | Optional intent/commitment/event/resource vocabulary | Not mandatory fields, physical ownership proof or a complete governance system |
| Hylo, Decidim, PolicyKit, sociocratic domain patterns, Radicle | Product/process/threshold and scoped-adoption references | Borrow clear interactions; avoid importing a full governance hierarchy or backend |
| Le-Space P2P spreadsheet and surrounding stack | Browser/libp2p and identity integration reference | Demo transport is not a mature spreadsheet, authorization or retention system |
| Bento/Dash | File-as-source-of-truth, blind-relay and spreadsheet collaboration reference | Newly merged/unreleased spreadsheet work; capability/signing model is useful but not a mature deployment |
| MindooDB/Haven/TeamGrid | Encrypted local-first audit and data-model reference | Tenant-rooted authority does not meet the decentralized governance target by default |
| NextGraph | Encrypted document/governance architecture reference | Rust framework is alpha; broker/client topology, stable repository/document identifiers, capabilities, whole-framework scope, cross-document correlation and migration require current source evidence |
| Radicle / Heartwood | Local replicated social-artifact and Collaborative Object reference | Strong ancestry/object-extension pattern; stable repository IDs, signed DAG histories and gossip are deliberate provenance mechanisms, not TalkCo's deniable private default |
| Seed Hypermedia | Sovereign publishing, provenance and community case study | Useful object/publishing reference and privacy-regression fixture; a 2026-09-08 release temporarily disabled private-document creation while containing an access-exposure issue. Do not import its Explore/feed surfaces into core product semantics. |
| Teleportal / Hocuspocus | Yjs provider/server benchmarks | Teleportal cleanly separates storage/transport/runtime but its current E2EE leaves CRDT metadata plaintext to the service; Hocuspocus is a mature central-server comparison, not independent peer authority. |
| Cellster, spreadsheet CRDT research including AegisSheet | Formula/structural concurrency research | Research semantics are not an installed production engine |
| Hecate, NOTRY | Reporting and deliberate retroactive evidence research | Additional trust/construction requirements; not default private-message witnesses |
#Application case studies and implementation references
These projects are not competing whole-stack dependencies. They retain production lessons or reusable interface patterns that can change a TalkCo test, component choice, or boundary.
| Project / family | Retained lesson | Boundary |
|---|---|---|
| Plane Wiki | Production Yjs lessons: server-originated edits, sync scaling, large documents, state-vector version history, dead-tab resume and realtime permissions | Add the failure classes to #10/#13; do not inherit Plane's backend authority |
| BlockNote / ProseMirror / Yjs 14 | Rich-editor integration, attributed version history and track changes | Attribution metadata is optional UI history, not cryptographic authorship; Yjs 14 was still RC in the 2026-09-22 source check |
| Modal / Reflection | Native Linux/mobile local-first application and reusable P2P-service/API direction around p2panda | Product/reference implementation; p2panda remains the substrate candidate |
| Miru | Collaborative nonlinear media timeline and offline editing | Future rich-media CRDT reference; AGPL-3.0 project is outside the present core path |
| LibreOffice Writer + yrs | Bounded integration: collaborative comments without converting the entire mature document model | Prefer narrow CRDT adoption where only one object class needs concurrent merge |
| LaSuite Docs | BlockNote/Hocuspocus/Yjs deployment, reusable sharing/search UX and public-sector collaboration | UI/component reference. Optional BlockNote XL features create a feature-level AGPL licensing gate despite the MIT-compatible base build |
| SQLRooms | Separate large/read-only source data from the smaller collaborative state that actually needs a CRDT | Apply as a design test to attachments, indexes, analytics and shared views; DuckDB/Loro are not core TalkCo dependencies |
| PouchDB / CouchDB | Long-lived offline replication without CRDTs; explicit conflicts and mature open-source governance | Operational benchmark, not TalkCo authority |
| Le-Space simple-todo | WebAuthn/libp2p/IPFS/OrbitDB integration example | Existing browser/P2P reference; identity and storage primitives remain separately gated |
#Grouped dead ends and non-core comparators
Backend-authoritative synchronization can be useful for a separate service but is not the independent peer core. Public registries, actor outboxes, follower/liked collections and global provider discovery conflict with private contextual identity unless used in explicit public export. Permanent archives are not the ordinary retention model. Heavy financial/control planes require a concrete benefit rather than a general decentralization label.
Matrix/power levels are not the community role model. ActivityPub/ActivityStreams, Mastodon, AT Protocol/Bluesky/Ozone and Nostr/NIP-09/NIP-10/NIP-B7 remain useful interoperability and contrast references. Their signed histories and exposed social structures are not automatically inherited. The software is not intended to compile social norms or kaupapa into exhaustive rules.
A useful narrow primitive is not a complete solution: AEAD, HPKE, FROST, UCAN, Meadowcap, PRE, threshold release and ZK each solve different jobs. A source-review limitation is not a blanket rejection of every possible deployment. Unverified maintenance claims, including earlier MinIO and ecosystem assertions, must remain freshness-gated rather than repeated as facts.
#Methodology for evaluating a package
Ask: does the component remove a named piece of work; can its semantics be accepted without a contradictory authority; does it fit target platforms; can it be distributed under the selected terms; what does its evidence actually cover; how does it fail and recover; what does it expose; and can it be replaced or maintained?
The answer is documented in the owning issue and an ADR when accepted. Do not label all unseen source as secure or every incomplete library as unusable. Compare alternatives under the same fixture and include the cost of adapters, key management, forks and long-term maintenance.
#Smallest experiments
- Implement a private conversation, consented publication, shared materials grid, document checkpoint and attachment in a smaller Rust-owned core and in DXOS/Composer.
- Test recipient verification and evidence transfer without granting a malicious reader impersonation to another reader.
- Verify recovery, concurrent membership and late history admission before approving a shared log.
- Run the same application ciphertext through ERIS/Kapla, Tahoe/ZKAP and replicated Rust custody, including lost hosts, full disks, expiry and stale repair.
- Test one UCAN/Biscuit/provider allowance operation, including cumulative accounting and replay.
- Compare direct/local and private routed delivery against named observers; never infer privacy from content encryption alone.
- Use Fireproof/OrbitDB/Classic Jazz only for focused experiments that could reverse the leading implementation choice.
#Falsification tests
A candidate fails its proposed role when it requires a hidden central owner, public cross-context root, unauthorized key release, unbounded storage, silent privacy downgrade, broken restore semantics, undocumented causal filtering or transferable private evidence outside the selected profile. Some failures can narrow a component to a useful adapter; they need not erase it from the inventory.
Merging this inventory is not a test pass. The fixture and evidence gates specify what must actually be demonstrated.
#Research links
Start with the research hub, Open Local First / FOSDEM 2026 scan, integration synthesis, September tool note and September authentication note. Earlier detail remains in the shortlist, round-two architecture, round-three comparisons, round-four access, round-five library evidence and round-seven register.
#Evidence boundary and unresolved choices
The inherited evidence spans August–September 2026; the catalogue retains the 2026-09-22 conference scan and the explicitly scoped 2026-10-24 refresh above. This integration reorganizes those findings and the user's requirements. It does not refresh every version, advisory, hosted-service term, repository status, audit or license. Exact source pins and independent evidence are required before adoption.
#Open questions
The issue-lane index routes all decision-changing work. The immediate gates are shared-core ownership (#1), object/authentication/identity/history (#2–#5), storage format/custody/accounting (#6–#8), network privacy (#9), client/platform selection (#10), community practice (#11), safety/launch (#12) and reproducible validation (#13). Existing unrelated product threads remain in the roadmap.