#Separate the authorities
TalkCo has at least four authority types:
| Authority | Can decide | Should not imply |
|---|---|---|
| Author | Create a revision or propose promotion | Everyone may read it |
| Member/reader | Decrypt within a granted audience | May publish, moderate, or re-share |
| Moderator | Apply a scoped moderation action | Receives every content key |
| Key-release steward | Release a conditional envelope under policy | Becomes content author or universal reader |
Availability is separate again: a relay or edge host may hold ciphertext without being able to read or authorize it.
#Working cryptographic split
- Messages and active group conversation: MLS epochs, with application binding and TalkCo identity/device records around the MLS group. RFC 9420 defines MLS; OpenMLS is the primary implementation candidate.
- Posts, replies, attachments, and durable revisions: per-object AEAD content-encryption keys with HPKE recipient envelopes. Sign the object metadata and bind the envelope to object, revision, audience, epoch, and TalkCo context.
- Actions and delegation: signed, attenuated capabilities such as UCAN, Biscuit, or Meadowcap. A valid capability authorizes an action; it does not decrypt content.
- Moderation: signed moderation events with deterministic reducers. Invalid or unauthorized events are rejected or locally quarantined by default. Privacy-minimized evidence is retained only through an explicit report, abuse-response, or legal workflow with defined access and retention. Private reports can carry encrypted evidence to a moderator subset; public evidence can expose a keyed or salted, domain-separated content commitment, action, reason, policy, and signature without publishing the content.
- Wider promotion: create a new publication envelope and normally new ciphertext. PRE is a recovery or offline-author exceptional path, not the default for every post.
#Conditional-release candidates
| Candidate | What it buys | Why it is not the default |
|---|---|---|
| Proxy re-encryption | A designated service can transform a ciphertext for a new recipient without seeing plaintext | Adds key delegation, proxy compromise, revocation, and misuse semantics |
| Threshold/TACo-style release | No single steward can release a protected key | Adds committee liveness, membership, metadata, and recovery complexity |
| Broadcast/attribute encryption | Compact policy-shaped recipient sets | Mature implementation and revocation tradeoffs are narrower than the product needs |
| ZK proof | Proves a predicate without revealing the witness | Does not deliver content keys, solve discovery, or decide policy |
| Smart contract | Publicly verifiable policy/state transition | Public metadata, availability, upgrade, and key-release leakage; not a private message bus |
The TACo site is useful as a threshold-release research input. It should enter only through an adapter with a named failure and recovery policy.
#Falsifiers
- A capability grants an action but is incorrectly treated as a decryption grant.
- A new reader obtains historical chat content merely by joining a group or publication.
- Removing a reader is claimed to revoke already cached plaintext.
- A moderator can silently change content or read all reports without a scoped grant.
- A release committee is unavailable during the exact recovery scenario it was meant to solve.
- Smart-contract or ZK metadata correlates people, audiences, or moderation activity more than the ordinary path.
#Open Threads
- Define the object envelope and capability claims before selecting a PRE or threshold library.
- Decide which moderation evidence is private, selectively auditable, or public under each context profile.