#Proposed seam map
TalkCo signed events
→ authority and deterministic moderation reducer
→ OpenMLS groups OR object AEAD/HPKE envelopes
→ local durable store and projections
→ discovery, transport, relay, and ciphertext custody adapters| Seam | First candidate | Role | Boundary or caveat |
|---|---|---|---|
| Group messaging | OpenMLS | MLS state and epochs | Pin versions, exercise persistence/exporters/recovery, and maintain TalkCo binding |
| Messaging interoperability | Marmot | MLS-over-Nostr reference/adapter | Newer protocol; do not make interoperability authority |
| Local projections/drafts | Automerge or Yjs | Offline draft and view state | CRDT is not authorization; published state remains signed events |
| Durable local store | SQLite first; RxDB/PouchDB as benchmarks | Query/index/projection storage | Replication must not choose authority |
| Native transport | iroh | QUIC endpoints, relay, discovery, blobs | Endpoint identity is not TalkCo identity |
| Browser/multi-language transport | libp2p | Noise/TLS, relay, rendezvous, pubsub | Discovery and metadata policy need application control |
| Fine-grained local-first spike | p2panda | Signed operations and permissions reference | Verify current encryption, audit, FFI, and migration maturity |
| Transparency backend | Tessera | Append-only checkpoint/tile service | Transparency supports consistency evidence, not identity or authorization |
| Edge custody reference | Tahoe-LAFS | Capability-oriented encrypted storage model | Storage availability and read authority remain separate |
#Candidates kept as benchmarks or adapters
Matrix, Nostr, Hypercore/Hyperswarm, SSB, ElectricSQL, cr-sqlite, Loro, and PouchDB/CouchDB each illuminate an event, replication, or discovery tradeoff. They should be measured against the TalkCo event and authority contract rather than adopted for feature count. Archived or abandoned transparency code should not become a live dependency; a maintained transparency implementation must pass the same maturity gate.
#Smallest useful experiments
- Persist signed message, promotion, reply, device, and moderation events in SQLite; replay them in arbitrary order and compare reducer state.
- Add OpenMLS for a small conversation and verify that TalkCo user/device roots bind the group and exporter context.
- Encrypt a post and attachment once; deliver HPKE envelopes to separate audiences; promote to a wider audience without revealing the source conversation.
- Run the same event set over iroh and libp2p adapters with a malicious relay and an offline peer.
- Replace the local database and transport independently; prove that neither substrate identity nor arrival order changes authorization.
- Add a disposable p2panda/Marmot adapter only after the canonical tests pass.
#Falsifiers
- A package's built-in identity becomes the authority instead of TalkCo signed records.
- Sync, discovery, or CRDT repair cannot preserve duplicate/out-of-order event semantics.
- Browser/mobile persistence or key recovery is weaker than the intended context profile.
- License, audit, maintenance, FFI, or security-advisory constraints block the target platforms.
- Relay/DHT metadata exposes the social graph beyond the declared privacy budget.
#Open Threads
- Verify exact versions, security advisories, licenses, and mobile/browser support immediately before implementation.
- Benchmark fanout, battery, repair time, proof size, storage, and group churn at the planned audience sizes.