#Share implementation without flattening the product
TalkCo's conversations and channels remain distinct. A community workspace adds records, tasks, needs/offers, materials, documents, grids and knowledge. These can reuse device/key lifecycle, authenticated objects, encryption, local persistence, synchronization, retention and ciphertext custody without merging audiences, identities or histories.
A shared codebase is the leading integration direction, not a requirement that every participant install every module. A headless host should be separately deployable and need no community role or content keys.
TalkCo conversations and publishing Optional community workspace
\ /
Context-preserving core
object meaning and accepted authority
encryption / key lifecycle / local persistence
/ \
delivery adapters ciphertext custody
private or local paths caches / leases / repairThe architecture issue must identify one owner for each state machine. A library may own accepted merge, validation or identity mechanics. Reuse is preferable to a redundant custom implementation when its semantics have been explicitly adopted and tested. A package's defaults do not become authority merely by being installed.
#Requirements from the discussion
#Kaupapa guides practice; software does not constitute the festival
The user-defined kaupapa is a set of guiding principles rooted in shared philosophy and collective purpose, clarifying intention and expectations without reducing them to rules. It can be an optional field or reference on spaces, groups, projects and items. It is not an automatic authorization language, inherited power ladder or AI moderation verdict.
Do-ocracy is the ordinary coordination practice, not another approval procedure. People can take initiative, ask for help, record what happened, raise a concern and make repairs. The app accepts incomplete, unknown and contested information. It must not require a complete organizational chart or ownership record before someone contributes.
Descriptive responsibility is distinct from a security grant. Formal processes can be useful for sensitive keys, scarce resources or recurrent conflicts; they are bounded tools rather than mandatory paperwork for all activity. Local variations and broader shared commitments need different representations. Forking a dataset does not duplicate physical resources or obligations. The community lane owns the interaction tests.
#Portable files need not become public evidence
The useful social-filesystem property is open formats independent of clients and hosts. A post or shared record retains logical identity while representations, revisions and locations change. Paths, feeds, boards and grids are views, not a global person-wide repository.
Source authentication, byte integrity, decryption, permission to change, and custody are separate. Requiring a receiver's private key does not make an ordinary sender signature non-transferable: after decryption, the receiver can disclose the signature without that private key. Pairwise keys can limit correlation, but a contextual public signature and its personal identity binding remain distinct evidence questions.
The provisional private-object composition is one application-encrypted payload and small recipient-authenticated descriptors. ERIS may encode the payload for independent retention and retrieval. Ratcheted delivery, HPKE Auth and designated-verifier/contextual-key approaches are research candidates. No complete deniability claim or wire format is accepted here. The authentication lane owns the threat model, including colluding recipients and online observers.
#Shared history has an admission policy
An individual group MAC cannot distinguish writers against insiders. Pairwise change authentication and contextual signing keys with deniable personal bindings have different costs. A late reader may receive newly authenticated old material, a checkpoint endorsed now, or another participant's reported history; these establish different facts.
CRDT convergence does not define membership, consent or retroactive validity. Filtering a revoked author's binary update can break later causal dependencies. Model semantic corrections, dependency closure and checkpoint/rebase alternatives before selecting a collaboration engine. The collaboration lane owns this decision.
#Hosting is not reading, and repair is not governance
A file may be personal, jointly controlled, received from a friend, or ciphertext held for someone else. Contribution, reading, control of future access, custody and repair are separate relations. Moving a local reference does not widen an audience; releasing one host's capacity does not erase the logical object or another valid lease.
ERIS is a candidate immutable format, not erasure coding, private accounting or a custody network. Application encryption remains above it in the proposed private profile. A repair worker may receive an ERIS capability over application ciphertext or a bounded block inventory without application content keys; its structural visibility must still be measured.
Cryptographic erasure depends on all surviving key/recovery paths. Host deletion depends on cooperation. Erasure coding supplies redundancy. None proves that a malicious host or recipient forgot a copy. Stale repair must not renew an expired generation. Codec, custody and accounting are separate decisions.
#Reuse encrypted objects only inside an intended linkability domain
Several readers can fetch one encoded ciphertext through separate descriptors. Unrevealed contexts normally need different representations and identifiers. Reader-local deduplication can hide duplicate feed entries without publishing a universal equality key. Pack files may group already encrypted blocks physically without giving unrelated objects one inseparable key lifetime.
Transport privacy is separate again. A local festival context may permit LAN links; a private context must not silently fall back to a direct connection. Each profile names its observers, leakage budget and unavailable-route behavior. Networking owns those measurements.
#Implementation hypotheses, not dependencies
The smaller-core experiment uses Rust/Tokio, SQLite/rusqlite/FTS5 and an explicit local protection/recovery boundary. A TypeScript client can test Effect for asynchronous lifetimes and TanStack DB for bounded reactive views. The durable core owns persistent retries; the UI does not maintain a competing retry/authority state machine.
DXOS/ECHO/Composer is the main integrated-workspace countercandidate. Fireproof, OrbitDB and Classic Jazz merit only bounded comparisons that can change the decision. Backend-centered sync tools remain useful references or optional services, not independent-peer authority by default. A tool's actual architecture, version, license and identity/evidence path must be checked, not inferred from its brand.
The storage experiment compares ERIS/Kapla, Tahoe-LAFS/ZKAP and a smaller Rust custody service over existing object-store backends. Replication-first is a prototype choice, not a settled final redundancy plan. A Tahoe or Kapla fork follows measured adaptation cost and a maintenance/review plan; ERIS interoperability should not be broken for a preferred language or hash.
The detailed comparisons remain in the sole tools inventory. The client lane compares complete maintained cost, not only initial demo effort.
#Explicit decisions still owed to the numbered specification
The earlier sections 01/10/12 named Session, TACo and a Signal B→A bridge as working commitments. This integration does not claim a replacement stack passed tests. Issue #1 must explicitly retain, narrow or supersede those choices across their owning pages.
The new product requirements are not contingent on a library choice: no universal author-signature default for private content; no hidden cross-context root; community practice does not require an administrative model; and shared custody does not imply reading or social authority. Exact deniability construction, quorum semantics, conditional release, rollout scope and package versions remain unresolved.
Personal blocks stay local and unaudited. A community memory feed is distinct from technical history and sensitive reports. Intentional publication requires consent; intentionally attesting to a new artifact does not retroactively prove private conversation authorship. Existing counsel-reviewed launch gates remain in force, with the evidence/retention design tracked in #12.
#Evidence and integration provenance
This page integrates the user discussion and the supplied September 18 and 19 workspace snapshots with the live repository baseline bbfb7c8a304ba201a236d4271bfdf7d194f3b780. It is not a new blanket verification of every external claim. The September tool evaluation and September authentication note retain their original evidence dates and limitations.
Prior source inspection, published examples, executed tests and independent audits must remain distinguishable. No cryptographic implementation, carrier trace or storage repair workload was executed by this documentation integration. The validation lane turns the proposed shared fixture into reproducible evidence.
#Open Threads
The issue-lane map gives each remaining decision an owner surface, acceptance criteria and dependencies. Do not open a second package inventory or claim a research lane is complete when documentation alone has landed.