From chat bubble to published thread

This is a proposed superseding architecture decision, not the current canonical protocol specification. Adoption requires explicit reconciliation with the Session-lineage transport, Signal-lineage messaging, channel-encryption, and TACo working positions in §10.

The platform's distinctive operation is not “send” or “publish” in isolation. It is the moment when a private message is deliberately promoted into a publication, with a thread that can continue across both contexts. That moment is where product meaning becomes protocol authority: a new audience must not receive access merely because a projection exists, and a reply must not silently inherit a wider audience than its author chose.

#The recommendation in one sentence

Use one signed causal event model and many projections. Protect durable posts, replies, and attachments with per-object AEAD plus HPKE recipient envelopes; use MLS for active conversations and selected stable private spheres; authorize actions with context- and object-bound signed grants; discover peers through invitations and scoped rendezvous; keep transport, storage, and release services replaceable and unable to decide TalkCo authority.

#The three approaches

These are profiles over the same authority and event substrate, not three incompatible platforms. Anonymous admission, metadata-hiding transports, storage backends, and transparency services should be adapters evaluated against the same acceptance tests.

#The product transition is an authority transition

The canonical objects should separate object_id, event_id, revision_id, projection_id, and ciphertext_id. A publication.propose event names the source event, target publication, intended audience, reply policy, and source revision. A publication.commit event records the resulting projection, ciphertext/envelopes, key epoch, manifest, authority references, and signatures.

Pinning is local and never changes access. Promotion creates a new immutable channel-post revision only after every meaningful participant whose material is lifted signs a consent receipt naming the selected source revision, target channel, audience, retention policy, and permitted provenance disclosure. When the source is MLS-protected—or publication changes context, audience, retention, associated data, or unlinkability—the client creates a fresh publication object and fresh ciphertext. Rewrap-only is permitted only for an already object-enveloped source whose signed policy and associated data explicitly authorize the projection and accepted linkability. Public provenance is consent-safe; source event, conversation context, consent signatures, and policy epoch belong in an encrypted audit receipt.

Replies are independent signed child objects. They carry a thread root, parent revision, author/device, chosen audience, ciphertext envelope, and moderation references. Their effective audience is the intersection of the parent discussion scope, the commenter's chosen scope, and the commenter's current grants. A reply cannot widen its parent audience; broader publication requires a separate promotion and consent event. “Below the post” is a projection relationship, not a cryptographic inheritance rule.

#Replacing plain TOFU with a trust ladder

Plain TOFU remembers the first key it saw. It does not authenticate the first contact, distinguish a user from a device, prevent a directory from showing two views, or define safe recovery. The answer is a stack of mechanisms, each with a narrow job.

The ordinary profile can use a directly authenticated QR/NFC/SAS ceremony or a delegated introduction from an already verified device, followed by device continuity and a local signed membership history. An unaudited link or directory result remains TOFU and should be labeled as such. Private or high-risk contexts add user-visible verification and independent checkpoint observation. A context directory can be distributed across peers, but discovery is not membership: a rendezvous record tells a client where to try; the signed context record tells it whether the peer belongs.

Key transparency is useful for detecting inconsistent directory views, but it does not prove human identity and is not a substitute for authorization. Witnesses supply observation, not identity. WebAuthn or passkeys protect use of a local root at the TalkCo origin; they do not authenticate a remote correspondent. Recovery must be visible and policy-bound: restored backups must not silently resurrect revoked devices.

#Post-quantum migration is a seam, not a production default

NIST FIPS 203 standardizes ML-KEM. The MLS ML-KEM ciphersuite work is still an active Internet-Draft, so TalkCo should require algorithm agility and hybrid migration seams without making draft suites a default. For 1:1 messaging, benchmark PQXDH and post-PQ ratchet work against the existing Signal-lineage direction. Test size, mobile performance, offline prekeys, downgrade resistance, mixed-version groups, and migration without reusing classical-only long-term envelopes.

#Mechanism choice by object

The separation follows the MLS architecture, MLS protocol, and HPKE boundaries. It also preserves a simple invariant: a valid action grant is not a decryption grant, and ciphertext custody is not content authority.

The envelope contract still needs to be specified: version and algorithm suite, object/revision IDs, context, policy epoch, audience commitment, recipient device/key version, CEK commitment, expiry, sender authentication, and domain-separated info/AAD. Test substitution, replay, recipient removal, historical grants, state loss, and algorithm downgrade before treating the envelope as settled.

#Distributed means more than “not one server”

TalkCo should be distributed along independent axes:

1. Authority: signed user, device, context, publication, and moderation events can be verified by replicas.
2. Persistence: local replicas retain useful state during disconnection and repair from peers.
3. Delivery: direct links, relays, rendezvous services, and queues can be exchanged without changing event validity.
4. Storage: trusted peers hold bounded ciphertext shards or replicas under quotas and signed manifests.
5. Observation: independent monitors or witnesses can compare key-directory checkpoints.
6. Release: a threshold or policy service can be added only for a named condition.

These axes can fail independently. A distributed storage mesh does not make the application decentralized if one service still decides membership; a decentralized event protocol does not make it distributed if only one relay is reachable. The protocol should name which failures each axis tolerates and which metadata each service sees.

#Discovery without a public social directory

The default discovery chain should be:

out-of-band invitation
  → short-lived scoped rendezvous
  → application-key authentication
  → transport negotiation
  → relationship and capability learning

The rendezvous namespace should be opaque and expiring. A peer proves possession of a TalkCo-bound device key after connection. A libp2p rendezvous or iroh endpoint can be an adapter, but its peer ID is not the account identity. The system should default to known-peer and invitation routes; broad DHT indexing is a later option with an explicit metadata budget.

The minimum metadata posture is bounded rather than magical: opaque identifiers, size buckets, compartmentalized providers, modest batching/jitter, and no global content or relationship index. A global observer can still correlate timing and endpoints unless a sensitive-context profile adds padding, mix routing, or another higher-cost transport.

#Moderation without universal decryption

Moderation is an authority and evidence problem, not a request to give every moderator every key.

• The author signs content and revisions.
• The reader receives a scoped decryption envelope.
• A moderator receives an encrypted report bundle or a deliberately granted moderation view.
• The reducer materializes signed hide, quarantine, label, appeal, revision, or tombstone overlays.
• Public evidence can contain a content commitment, action, policy reference, and signatures without exposing the private content.

Invalid or unauthorized moderation events are rejected or locally quarantined by default. Privacy-minimized evidence is retained only through an explicit report, abuse-response, or legal workflow with defined access and retention. A conflict between authorized moderators must have an explicit policy—such as precedence, quorum, or materialized disagreement—not arrival-order authority. Without universal decryption, TalkCo cannot perform universal proactive content inspection; moderation relies on local controls, opt-in labelers, reports from authorized readers, and narrowly scoped disclosure grants.

#Library and package shortlist

The package boundary matters more than the package name. Each candidate must pass platform, license, audit, recovery, maintenance, browser/mobile, and adversarial relay tests. OpenMLS, Automerge, iroh, libp2p security guidance, p2panda access control, Tessera, and the Tahoe-LAFS architecture define useful boundaries, not automatic adoption decisions. Two custody peers are a distributed semantics prototype, not a sharding or erasure-coding result.

#What stays outside the first critical path

#PRE and threshold release

Use them when the requirement is “no one recipient can hold this key directly,” such as author-offline recovery, conditional release, or a steward quorum. Do not use them to hide ordinary envelope fanout. Measure committee liveness, collusion, policy updates, recovery, and metadata before making them a dependency.

#ZK proofs

Use them for a narrow predicate—anonymous admission, rate-limit eligibility, or non-revocation—when a signed token would expose too much. They do not replace encryption, key discovery, moderation authority, or availability.

#Smart contracts

Use them, if at all, as public control-plane commitments, lease/payment accounting, committee registries, or disputes. Keep content, recipients, and private policy off-chain. Every contract path needs an offline signed-evidence fallback and a declared behavior during chain outage or upgrade.

#Public blockchains as authority

Reject them as the default source of membership, moderation, or post visibility. Their replication does not solve private audience changes and may turn relationship metadata into permanent public data.

#The first vertical slice

Build A0 around one conversation, one promoted post, one reply, two device keys, one moderator, one relay, and two ciphertext custody peers:

1. Persist and replay signed events in SQLite with arbitrary ordering and duplication.
2. Bind device roots, context membership, promotion, reply, and moderation events to the same deterministic authority reducer.
3. Encrypt the private message and post with object envelopes; widen the post audience through an explicit new envelope/ciphertext.
4. Run MLS only for the conversation if its group semantics are useful; export no authority from the MLS state without a TalkCo event.
5. Discover peers through an invitation and scoped rendezvous; authenticate the application key after transport setup.
6. Store and repair opaque ciphertext manifests at edge peers under finite quotas.
7. Verify the same results through direct, relay, offline, duplicate, stale-device, and malicious-directory paths.

The vertical slice is successful only when the private source remains private, the published projection is independently verifiable, the reply audience is explicit, moderation is deterministic, and no relay, database, CRDT, MLS group, or storage peer can promote itself into TalkCo authority.

#What would change the recommendation?

The A0 recommendation should be reconsidered if measured fanout makes object envelopes unusable for the intended audience sizes; if stable spheres have group churn that A0 cannot handle without unacceptable battery or bandwidth; if a concrete author-offline or policy-boundary requirement cannot be satisfied without PRE/threshold release; or if a transparency witness profile is necessary to meet the chosen threat model. Those are falsifiable engineering findings, not reasons to add every advanced primitive in advance.

The shared harness is in the research plan, with lane evidence in Wave 1, Wave 2, Wave 3, and Wave 4.

#Open Threads

• Choose exact authority topologies for personal posts, shared contexts, and delegated channels.
• Specify envelope binding, device succession, and moderation evidence schemas.
• Measure fanout, repair, battery, metadata, and witness freshness at audience sizes 10/100/1,000/10,000.
• Have Sol verify the recommendation against promotion provenance, MLS scope, TOFU alternatives, library maturity, and distributed-versus-decentralized terminology.
• Reconcile this proposed architecture with the existing §10 Session, Signal-lineage, symmetric-group-key, and TACo decisions before treating A0 as canonical.