#Aims and reasoning
#Choose an implementation without flattening the product
TalkCo's conversations, channels and optional community workspace need shared infrastructure without sharing every audience, identity or history. A private file, an evolving group conversation, a jointly edited record and a finite storage lease do not necessarily need the same protocol machinery.
Compare complete compositions against those meanings. The useful result is less implementation and maintenance work with preserved privacy and authority, not the largest collection of libraries. A library can own accepted validation, identity or collaborative semantics; a parallel custom authority log is not automatically safer.
#The smallest prototype is not automatically a safe deployment
A0 makes object and authority boundaries testable. A direct carrier or simple relay can expose metadata unacceptable for a vulnerable community. A deniable descriptor proposal is not a verified cryptographic construction. Production admission requires the selected observer model, recovery, evidence and platform gates in addition to functioning synchronization.
Existing Session/Lokinet, TACo and Signal bridge directions remain explicit choices for architecture lane #1. Showing another composition does not establish that those directions have passed, failed, or been silently replaced.
#Protocol and architecture
#Shared foundation
Acceptance can reuse a library's semantics or require a narrowly scoped adapter. Its account model, database ordering, CRDT merge rule or relay cursor cannot silently decide disclosure or social legitimacy. Local blocks remain local. Storage hash, logical object identity, contextual source authentication and permission to change remain different values.
#Compare independent decisions
| Decision axis | Candidates | What selects one |
|---|---|---|
| Object/security profile | A0 object fabric; A1 recurring groups; C conditional release | Audience shape, evidence requirements, freshness and named release conditions |
| Implementation ownership | Smaller Rust core; DXOS/ECHO/Composer countercandidate | Accepted semantics and total maintained adaptation cost |
| Recurring-group engine | OpenMLS; bounded Matrix/Tachyon client-owned group experiment | Credential and epoch policy, group history, evidence profile and recovery |
| Collaborative representation | Automerge, Yjs/Yrs or selected integrated engine | Required data model, causal dependencies, revocation and checkpoint behavior |
| Delivery/privacy | iroh; libp2p; private Session/Lokinet/Tor-style path; constrained adapters when needed | Observer budget, offline delivery, platform and traffic class |
| Immutable custody | ERIS/Kapla; Tahoe/ZKAP; smaller Rust service with peer or S3 backends | Codec, leases, repair, accounting and host-departure tests |
A1 can be added to either suitable implementation of the A0 contract. A private carrier does not require conditional release; a custody codec does not choose the conversation protocol. The tools index remains the comprehensive dependency inventory.
#Variation — Smaller shared core with A0 objects
This experiment makes each boundary replaceable and suits a headless host, but leaves application integration and security composition work to TalkCo. The durable core owns retry state; Effect manages UI lifetimes without independently retrying the same external effect. TanStack DB is a bounded reactive projection where used, not a second authority store. A CRDT may own its accepted representation; SQLite need not duplicate its history.
A0 uses application-encrypted payloads and separately authenticated recipient descriptors. Established ratcheted relationships lead the descriptor experiment; HPKE Auth/DHKEM and contextual/designated-verifier mechanisms remain bounded comparisons in encryption research. No universal sender signature over private content is implied. Authentication mode comes from trusted context state, never an untrusted field that selects a weaker verifier.
Current p2panda combines modular sync and networking, including iroh; its production-stability warning is a gate, not a reason to duplicate its machinery automatically (upstream README, checked 2026-10-24).
#Variation — Integrated workspace core under the A0 contract
This is the main countercandidate when accepted integrated mechanisms remove enough bespoke work. It advances only after context separation, plugin authority, licensing, device recovery, private evidence, custody and export tests. The diagram shows the required integration boundary, not an assertion that the package already exposes every adapter. Do not retain both ECHO and a new custom authoritative log for the same semantics without a demonstrated need.
Fireproof, OrbitDB and Classic Jazz receive bounded tests only where they could change this choice. Self-hosting a backend-centered service does not itself establish independent-peer authority. The detailed evidence and dates remain in the local-first evaluation.
#Variation — Recurring groups with A1 epochs
A1 must earn its state and recovery complexity by improving recurring-group behavior over A0 fanout. OpenMLS implements MLS group-security machinery; TalkCo still needs credential binding, persistence, delivery and conflict policy. MLS messages carry signatures, so encrypted group traffic does not itself establish the desired non-transferable private-authentication profile (RFC 9420).
The Matrix/P2P research admits a Tachyon-style engine as a bounded comparison at this group seam. Its archived Matrix to-device carrier, client authorization graph and DMLS epoch graph must remain distinct. Neutrino/Iroh is a separate embedded-homeserver laboratory, not a component to stack below Tachyon by default. Ordinary Matrix interoperability may be an explicit conversation/export boundary; it does not make rooms the universal unit for files, custody or profile spheres.
Test simultaneous membership changes, malicious insiders, lost devices, restored backups and late readers. A checkpoint endorsed now, original authentication and reported history establish different facts. The selected conflict/freshness rule must never infer that convergence retracted a key already released during a partition.
#Variation — Conditional release for a named requirement
C enters only when recipient-held keys and ordinary grants cannot meet a named condition, such as divided recovery authority or an external release trigger. TACo/PRE and threshold services remain candidates; ZK admission is a separate mechanism and need not be bundled into every release. A committee or chain service is not required simply because a community uses shared governance.
Measure liveness, collusion, recovery, metadata, operator dependencies and cost. Failure must not install an undisclosed override. Revoking future release cannot revoke plaintext or keys already delivered. Existing TACo commitments are explicitly reconsidered in lane #1; this diagram neither approves nor abandons them.
#Custody and public interoperability compose separately
Distribution research diagrams ERIS/Kapla, Tahoe/ZKAP and smaller Rust custody alternatives. Compare replication before choosing erasure-coding parameters. A maintained fork requires a demonstrated benefit and a review/maintenance plan. Ciphertext repair grants convey neither social authority nor read access.
Intentional public export may use transferable attestations for the new publication. It must not reveal private history or silently link unrevealed contexts. Audit invitations, root proofs, consent, uploads, receipts and recovery records as well as the payload: encrypting an adjacent signed artifact does not remove its evidentiary effect after disclosure.
#A0: provisional first vertical slice
The shared fixture contains a private conversation, consented publication, materials record/grid, document checkpoint and attachment. Alice, Bob and Carol have distinct devices. Add a late reader, a non-reading custodian, replaceable relay and two unrevealed contexts. Each candidate must preserve the same meaning under the same faults.
| Fixture action | Observable outcome |
|---|---|
| Save and synchronize | Distinguish durable local state, remote copy and policy-backed custody |
| Move a local reference | Change a view without widening the audience |
| Promote selected material | Require the applicable consent and fresh encryption where scope/lifetime demands it |
| Admit a late reader | Label original authentication, current endorsement or reported history accurately |
| Remove or restore a device | Separate archive data from current rights; reject stale authority |
| Repair or release storage | Respect finite lease generations and allowances; no revived expired content |
| Coordinate shared resources | Allow unknown ownership, overlapping spaces and concerns from affected people |
Community interaction tests include moving an item before logging it and contributing without a complete organizational chart. Equal replica bytes are insufficient if the interaction creates mandatory administrative work or unintended disclosure.
#Shared falsification harness
Record revisions, dependency images, commands, environment, outcomes and limitations. Source inspection, analytical models, executed integration and independent security audits are different evidence classes. Lane #13 owns reproducibility; a green documentation build is not a cryptographic or hosting approval.
| Test family | Failures that must be exercised |
|---|---|
| Authority and evidence | Outsider forgery, malicious readers, recipient simulation, profile downgrade, public certificates, unapproved promotion, contradictory authorized changes |
| Audience and retention | Concurrent admission/removal, prior key delivery, late history, parent audience changes, restored revoked devices, backup envelopes, withdrawal racing repair |
| Discovery and privacy | Stolen invitations, key changes, split checkpoints, unavailable witnesses, endpoint reuse, public/direct fallback, unintended cross-context equality |
| Custody and accounting | Missing/corrupt blocks, interrupted writes, full disks, duplicate jobs, lost acknowledgments, lease exhaustion, correlated host failures, provider replacement |
| Platform and crypto lifecycle | Mobile suspension, bounded memory, persistence recovery, mixed suites, downgrade, key/ciphertext expansion, prekey availability, implementation vectors |
No package advances merely by supplying the named primitives. Record current platform, license, advisories, maintenance, recovery and audit evidence. Endpoint IDs are not membership; CRDT convergence is not consent; a receipt is not a durability proof; signed records are not automatically social ratification.
#Decision rule and open questions
Select the smallest composition that passes the required tests and has a sustainable maintenance path. Preserve counterevidence and reverse recommendations when results change. The thirteen issue lanes remain open where their tests have not run; prototype assumptions can be versioned while work proceeds in parallel.
The immediate decisions are semantic ownership, exact private-authentication construction, late-history admission, A1 churn thresholds, context-specific route policy, custody/codec integration, private accounting and recovery. The shared-core synthesis, authentication note, Matrix comparison and research hub hold the supporting evidence. The diagrams specify experiments and interfaces; they do not report completed implementations.