#Executive summary
TalkCo's remaining research is no longer a search for one complete platform. The product promise is already legible: people should be able to keep context-specific identities, publish from conversations only with meaningful consent, control access without turning infrastructure into an authority, and receive attention on recipient-declared terms. The unresolved work is to state which parts of those promises must survive across devices and carriers, then test the smallest mechanism that can preserve them.
This register therefore covers the decision-impacting gaps that could block a vertical slice or make a later protocol specification dishonest. It does not claim that all 182 named candidates in the available libraries, tools, and packages inventory were freshly revalidated. Lower-impact candidates remain useful comparison points and are marked for recheck or deferral on that page.
The current working direction is conditional:
- Event and client core: Rust with Tokio; SQLite with FTS5 for local state and search; SQLCipher only behind a native-build, key-lifecycle, and recovery gate; platform keystores for device-local roots.
- Messages and signatures: Protobuf/Buf for evolvable control messages; COSE with deterministic CBOR as the leading signed-event candidate. Protobuf deterministic serialization is not a canonical signing representation.
- Group cryptography: OpenMLS 0.9.0 is a disposable group prototype, not a decision that all TalkCo objects should be MLS groups. Object-level AEAD/HPKE remains the countercandidate for small, bounded audiences.
- Clients: Tauri 2 is conditional when a Rust-owned shell is the priority; Flutter remains the broad-platform countercandidate. Neither shell supplies TalkCo's state classification, key recovery, background behavior, or protocol authority.
- Transport and custody: Start with an iroh plus dumb-relay harness, an opaque client-encrypted S3-compatible object store with a signed manifest, and one notification adapter that carries only opaque wake hints. Keep Session, SimpleX, Storj, Tahoe-LAFS, Lokinet, Katzenpost, and TACo behind replaceable adapters and benchmarks.
The conclusion is a recommendation for bounded experiments, paired with a no-decision on the future protocol. That is the useful result: the project can test product-critical invariants without silently promoting a package, relay, storage provider, or threshold primitive into TalkCo authority.
#How to read this register
The register uses four labels so a newcomer can scan it without losing the technical distinction:
- Fact — directly stated by a repository source, a primary specification, or an observed tool behavior.
- Inference — a conclusion drawn from one or more facts; it can change when the threat model or product constraint changes.
- Working direction — the current composition to spike, not a locked dependency or protocol commitment.
- Unknown — not established by this register. Each material unknown has a smallest next check.
Product meaning appears before mechanism. A tool can implement a seam, but it cannot decide what a contextual profile means, whether publication was consentful, or whether a threshold action is socially legitimate.
#Scope and freshness policy
| Boundary | Included | Excluded | Freshness rule |
|---|---|---|---|
| Application/protocol overlap | The eight P0/P1 boundary questions that can invalidate a vertical slice or future protocol handoff | Rewriting the numbered application chapters or settling product copy that is already clear | Repository anchors checked at 38c9051 and re-read on 2026-09-07 |
| Candidate stack | Current primary evidence for the runtime, local store, serialization, group prototype, shell, transport, storage, notifications, and release checks most likely to block the slice | Freshly rescoring every named candidate in the 182-name inventory | Version, support, advisory, license, service, and repository claims must be rechecked immediately before adoption |
| Transport, storage, operations | Metadata, failure, recovery, notification, and release gates that can falsify the candidate composition | A launch authorization, legal conclusion, or production migration | Current docs and source repositories retrieved 2026-09-07; observed tests must record their own environment |
| Inventory relationship | Link to the existing canonical inventory and its qualification disclosures | Duplicate tables that restate all named candidates | The inventory remains the coverage surface; this register is the decision register |
The source policy is primary evidence required when available and freshness-gated for volatile claims. A current documentation page can establish what a tool claims to provide; it cannot establish that the tool satisfies TalkCo's product invariants. That requires a protocol or integration test.
#Decision matrix: application promise to protocol obligation
Every row has the same shape: product meaning first, then the candidate options, disqualifier, smallest decisive check, dependencies, priority, confidence, and decision impact. “Difficulty” is expressed as the missing work and check size rather than a false precision score.
| ID / priority | Product-facing question and options | Current direction | Disqualifier | Smallest decisive test or spec check | Dependencies | Confidence / decision impact |
|---|---|---|---|---|---|---|
| ID-01 · P0 | Can one person keep several profile spheres without a default cross-context locator? Options: one global namespace; per-sphere namespaces; a hybrid device root with per-sphere protocol identifiers. | Hybrid is the working candidate: the device may know that spheres belong together, while protocol-visible identifiers, keys, endpoints, and artifacts stay sphere-scoped. | A copied or public identifier silently joins spheres; recovery cannot restore one sphere without widening another. | Produce a sphere namespace/key/recovery matrix covering creation, reveal, device addition, loss, export, and revocation. | PRIV-01, AUTH-01, CLIENT-01 | Medium. Blocks honest contextual-identity claims and recovery design. |
| PUB-01 · P0 | When may a conversation become a publication? Options: client convention; signed consent events reduced deterministically; a central publication sequence. | A signed event reducer is the working direction; meaningful-participant consent remains a product rule. | A replay, out-of-order, duplicate, or audience-widening event can publish without valid consent. | Build a deterministic reducer with consent, replay, duplicate, out-of-order, withdrawal, and audience-widening vectors. | AUTH-01, OWN-01, content lifecycle | High for the product rule, low for exact wire form. A failed reducer blocks publication work. |
| AUTH-01 · P0 | How do readers, publishers, moderators, and stewards receive bounded authority? Options: object-level envelopes (A0); MLS groups (A1); conditional release/threshold services (C). | A0 for bounded objects, A1 for group-shaped collaboration, and C only after a named offline/policy requirement. | A carrier or storage node can decrypt; revocation rewrites old history; a grant cannot be audited or scoped. | Implement an A0/A1/C grant-envelope-revocation harness with expiry, replay, removal, offline, and forward-only tests. | ID-01, PUB-01, GOV-01 | Medium. Blocks access-control and moderation claims; no package can substitute for this contract. |
| PRIV-01 · P0 | What can an observer learn from identifiers, topics, endpoints, timing, size, repair, and access patterns? Options: provider-local minimization; onion/mix/cover-traffic profile; global-observer resistance. | Start with a declared budget against individual providers; treat global-observer resistance as a separate, expensive profile. | A first-class global index or enumerable graph endpoint makes contextual identity or bounded discovery false by construction. | Trace an observer, crawler, and aggregator against the same event flow; record identifiers, topics, endpoints, timing, size, and repair metadata. | CARRIER-01, ID-01, CLIENT-01 | Medium. Material privacy risk; determines whether the product can state its anti-correlation boundary. |
| CLIENT-01 · P1 | Which state is device-local, user-synced, or protocol-visible? Options: sync everything; keep everything local; an explicit three-way classification. | Use an explicit matrix. Recipient notification choices, local aliases, feed order, and reveal presentation default to client policy unless a product promise requires synchronization. | A remote peer or service can silently change local attention, identity presentation, or safety policy. | Write the state matrix and run device-loss, reinstall, offline, background, and multi-device replay tests. | ID-01, PRIV-01, notification adapter | Medium. Material expectation and recovery risk; prevents shell features becoming authority. |
| GOV-01 · P1 | How can technical custody be shared without presenting it as social rank or governance legitimacy? Options: single keyholder; threshold custody; threshold custody plus separate consent/governance records. | Threshold custody plus separate social governance records. | A threshold signature is rendered as a popularity vote, public status badge, or proof that a decision was legitimate. | Test absent-steward, emergency, consent objection, fork, export, and recovery scenarios with technical authority and social meaning shown separately. | AUTH-01, OWN-01, §09 governance | Medium. Material capture and accountability risk; affects community account wire format. |
| CARRIER-01 · P1 | What must every carrier preserve while remaining replaceable? Options: one integrated transport; a narrow carrier interface; a high-anonymity overlay as a requirement. | Narrow carrier interface first: opaque objects/events, bounded addressing, expiry, retry, and receipt semantics. | Carrier identity becomes membership, relay metadata becomes a global graph, or transport availability is mistaken for authorization. | Send the same signed object through iroh+dumb relay and a second adapter; compare integrity, expiry, duplicate handling, and metadata traces. | PRIV-01, AUTH-01, storage manifest | Medium. Blocks transport replacement and honest distribution claims. |
| OWN-01 · P0 | Where is the normative home for shared invariants and the future wire contract? Options: numbered application spec; research/options pages; a later protocol specification with conformance tests. | The numbered pages own product meaning; this register and the research hub own candidates; a later protocol specification owns exact wire formats and conformance. | A package page or a local chapter silently settles key domains, object schemas, or migration behavior. | Create one pilot handoff: invariant → protocol obligation → candidate mechanism → conformance test → named owner. | All rows | High for document architecture. Without it, every tool comparison can be misread as a decision. |
#Decision matrix: implementation and operations gates
| ID / priority | Candidate options and applicability | Missing pieces / difficulty | Disqualifier | Smallest decisive check | Current posture / impact |
|---|---|---|---|---|---|
| STACK-01 · P1 | Rust/Tokio core with Tauri 2 shell; Flutter shell as a broad-platform countercandidate; browser/WASM as an explicit release gate. | Native keystores, background execution, FFI, browser storage, packaging, signing, and lifecycle tests remain application work. | A shell requires a different authority model on each platform or cannot preserve the state matrix. | Build the same two-device encrypted-event slice in Tauri and Flutter; record suspend/resume, key storage, and push behavior. | Rust/Tokio/Tauri is conditional; Flutter stays viable. Shell choice is not protocol choice. |
| STACK-02 · P1 | OpenMLS 0.9.0 for group prototype; object-level AEAD/HPKE for bounded objects; direct libsignal only as a comparative reference. | Group membership metadata, credentials, external joins, recovery, and TalkCo publication/access semantics remain outside MLS. | The prototype exposes membership or assumes MLS provides product revocation, audience consent, or carrier privacy. | Run group churn, offline commit, removal, metadata trace, and platform target tests against the A1 harness. | OpenMLS is prototype-only; object AEAD remains the default countercandidate. |
| STACK-03 · P1 | Protobuf/Buf for control messages; COSE + deterministic CBOR for signed canonical events; JSON only for human/debug surfaces. | Schema evolution, canonical field rules, signature domains, unknown-field behavior, and cross-language vectors must be frozen by the protocol spec. | A deterministic Protobuf byte stream is treated as a timeless canonical signing input. | Generate cross-language vectors and mutate field order, unknown fields, numeric forms, and map ordering; verify one signed representation. | Protobuf/Buf is conditional control-plane tooling; COSE/CBOR leads signed-event prototyping. |
| STORE-01 · P1 | SQLite/FTS5 local store; SQLCipher and platform keystore as gated adapters; CRDTs only for draft/projection state. | Migration, corruption recovery, WAL/backup metadata, key rotation, index rebuilding, and local deletion semantics. | Local indexes or a CRDT are treated as protocol authority, or deleted plaintext remains recoverable through an unexamined index. | Crash/restore/rebuild test with ciphertext-only sync and FTS5 secure-delete decisions recorded. | SQLite/FTS5 is first-slice candidate; SQLCipher and CRDTs require gates. |
| TRANS-01 · P1 | iroh plus dumb relay; libp2p adapter; Session/SimpleX/Lokinet/Tor/Katzenpost behind benchmarks. | Freeze traffic classes, addressing, expiry, retry, relay trust, endpoint rotation, and metadata budget. | Persistent endpoint IDs or topic names create a stable cross-sphere graph, or the carrier authorizes reads. | Identical-object carrier test with an observer trace, endpoint rotation, relay outage, and duplicate delivery. | iroh is first harness; no global DHT or mixnet economics decision. |
| CUSTODY-01 · P1 | Opaque client-encrypted S3-compatible objects with signed manifest; Storj/Tahoe/IPFS/Ceph/Garage as adapters/benchmarks. | Define EncryptedBlob, ShardSetManifest, leases, tombstones, repair epochs, provider receipts, and legal/operational roles. | Provider sees plaintext or manifest authority can widen read access. | Upload, rotate, revoke, repair, delete, and restore a ciphertext object across two providers; compare metadata. | Narrow opaque storage direction; no storage vendor lock. |
| NOTIFY-01 · P1 | One adapter for Web Push, APNs background updates, and FCM data messages; opaque wake hints only. | Token rotation, deduplication, expiry, offline replay, background limits, and user-visible notification policy. | Push payload contains plaintext, audience, or a durable activity feed; provider response changes local policy. | Send an opaque hint through each platform adapter and prove that the client fetches/decrypts only after local policy permits. | Adapter is required; provider behavior remains a platform constraint. |
| OPS-01 · P1 | TLA+/TLC; fault injection with Testcontainers, Toxiproxy, netem; metadata traces with TShark; OSV/Syft/Grype; Cosign/SLSA; restricted OTel. | Reproducible lockfiles/image digests, advisory timestamps, signature/provenance records, model scope, fault schedule, and metadata-leak results. | “Tests passed” without a declared observer model, build inputs, or failure schedule. | Produce one release evidence bundle from a disposable slice and fail the gate on missing provenance or unknown advisories. | Required validation surface; it does not choose architecture. |
#Lane A — the application/protocol boundary gaps
The repository already contains the boundary; the remaining research is to make each overlap executable. The numbered pages own the human promise. The future protocol must preserve the shared invariant across clients and carriers. The exact anchors below are the current source of truth for the product meaning and existing constraints.
| Boundary question | Product promise that stays local | Protocol obligation that crosses implementations | Existing repository anchors | Decisive artifact |
|---|---|---|---|---|
ID-01 profile-sphere isolation, continuity, and recovery | A person can show different contextual faces; a cold contact sees little; a deliberate reveal can add access. | Sphere-scoped identifiers, keys, reach paths, recovery and device succession must not create an ambient global locator. | §03 identity, §03 reveal grants, §12 identity queue | Namespace/key/recovery matrix with loss, reveal, export, and revocation cases. |
PUB-01 conversation → publication | A conversation-born artifact becomes a publication only after meaningful participant consent; provenance and audience meaning remain visible. | Signed consent, promotion, revision, withdrawal, replay, and audience widening reduce to one deterministic state. | §05 message lifecycle, content lifecycle, §12 protocol queue | Reducer and property-test vectors. |
AUTH-01 grants, envelopes, authority, forward-only revocation | A person can read, publish, reply, moderate, or steward only in the context where that action means what the product says it means. | Grants are scoped, auditable, expiry-aware, and bound to envelopes/epochs; future reads can be revoked without pretending old plaintext was erased. | access-control research, §10 access mapping, §12 access contract | A0/A1/C harness and conformance table. |
PRIV-01 anti-correlation and anti-enumeration | Contextual identity and bounded discovery should not quietly become a global directory, follower graph, or crawler-friendly endpoint. | Every protocol-visible identifier, topic, endpoint, size, timing, repair, and receipt must sit inside a declared observer budget. | §03 cold contacts, §06 discovery, distribution metadata | Observer/crawler/aggregator trace with a declared budget. |
CLIENT-01 device-local vs user-synced vs protocol-visible state | Recipient-controlled notification, local aliases, feed order, and reveal presentation should remain the person's policy. | Only states that require cross-device continuity become protocol objects; local policy cannot be remotely overwritten. | §05 local state, §07 notifications, §10 client boundary | Three-way state matrix and device-loss/reinstall replay tests. |
GOV-01 governance meaning vs threshold custody | A technical steward is not automatically a facilitator, public leader, or legitimate decision-maker. | Threshold custody, role grants, consent records, and emergency/fork/export operations are separate typed objects. | §09 stewardship, §09 custody, §09 anti-status | Scenario suite proving technical authority is not rendered as rank. |
CARRIER-01 carrier-independent transport contract | Hosting and transport can vary without changing what a publication, grant, or withdrawal means. | Carriers carry opaque objects and receipts under bounded addressing, retry, expiry, and deduplication rules; they do not authorize reads or define membership. | §10 carrier boundary, distribution axes | Same-object test through two carriers plus metadata trace. |
OWN-01 normative home for shared invariants | Readers should know whether a sentence describes a product promise, a protocol obligation, a client choice, or a tool candidate. | One future protocol specification owns exact schemas, signature domains, key hierarchy, migration, and conformance; research pages remain options. | §12 where decisions live, §12 spec sequence, research hub | Pilot handoff with owner, invariant, candidate, and test. |
The important overlap is not “the app uses cryptography.” It is the smaller statement: a product promise becomes protocol work when another client, carrier, or future implementation must preserve it. That sentence keeps a technical reader from under-reading the product and keeps a newcomer from mistaking a package for the design.
#Lane B — current primary evidence for high-impact tools
These are the candidates that can block or accelerate the first vertical slice. The links are primary specifications, official documentation, or the project repository. They establish capabilities and limits; they do not establish TalkCo adoption.
| Candidate | Fact established by current primary evidence | What TalkCo still has to supply | Disposition |
|---|---|---|---|
| Rust + Tokio | Tokio is an asynchronous Rust runtime with multi-threaded and single-threaded runtime options; its license is separately visible. | Event authority, cancellation policy, mobile lifecycle, memory/battery budgets, and protocol schemas. | Leading implementation direction, not an authority decision. |
| SQLite + WAL + FTS5 | SQLite supplies embedded storage; FTS5 supplies local full-text indexing; WAL is a local persistence mode. FTS5 can retain old index entries unless secure-delete choices are made. | Encrypted schema, migrations, event reducer, corruption/restore semantics, local deletion policy, and a decision about what index material may exist. | First-slice local store, with explicit threat-model gates. |
| SQLCipher + database key material | SQLCipher can encrypt SQLite database files and documents key-material handling and licensing. | Platform build reproducibility, key rotation, keystore backup behavior, recovery, and metadata outside the file. | Gated adapter, not a complete key lifecycle. |
| Protobuf + Buf | Protobuf and Buf support schema/tooling workflows; the official serialization guidance explicitly says deterministic serialization is not canonical and can vary with schema, application, build, or library changes. | A canonical signed representation, signature domain, unknown-field policy, cross-language vectors, and migration rules. | Control-message candidate; do not sign raw Protobuf bytes. |
| COSE + CBOR | COSE defines signed/encrypted structures such as COSE_Sign1; CBOR defines deterministic encoding considerations and requires protocol-specific choices for tags, numbers, and map ordering. | Event schema, domain separation, canonical field policy, key lifecycle, replay/ordering, and cross-language conformance vectors. | Leading signed-event candidate, pending protocol specification. |
| RFC 9420 MLS + RFC 9750 architecture | MLS defines group epochs, membership changes, forward secrecy, and post-compromise security. The architecture warns that transport metadata and unencrypted group operations can expose group state and membership. | TalkCo consent/promotion semantics, profile spheres, metadata budget, external joins, recovery, moderation grants, and carrier contract. | Architecture input and A1 prototype, not the whole protocol. |
| OpenMLS 0.9.0, API, security, license | The 0.9.0 release and current API expose an implementation path; the API documents a WASM feature. Recent advisories are part of the reason to pin and recheck the release rather than treating the package as self-proving. | Target matrix, Android/iOS/WASM support and test coverage, credential model, metadata trace, upgrade policy, and integration audit. | Disposable group prototype only; freshness-gated. |
| Tauri 2, distribution, prerequisites | Tauri describes Rust-backed desktop/mobile applications, native webviews, platform packaging, and signing requirements. | Rust/JS boundary review, keystore plugins, background execution, push, platform accessibility, and browser parity. | Conditional shell candidate. |
| Flutter supported platforms + platform integration | Flutter documents current Android, iOS, desktop, and web support plus platform-specific plugins/bridges. | Rust FFI, keystore/key recovery, background delivery, binary size, and the same protocol/state tests as Tauri. | Broad-platform countercandidate. |
| Signal specifications, PQXDH, Sesame and libsignal | The specifications are valuable protocol references. The libsignal repository says use outside the official Signal products is unsupported, APIs/bridges can change, and the repository is AGPLv3. | A TalkCo-owned interface, license/support decision, profile spheres, publication authority, bounded revocation, and cross-platform maintenance. | No direct dependency decision. Preserve as comparative evidence. |
| Automerge, Yjs, Yrs, cr-sqlite | These tools provide merge/convergence or synchronized local-state mechanisms. | Authentication, consent, membership, revocation, privacy-preserving actor/history handling, and canonical publication authority. | Draft/projection adapters or benchmarks; not authority core. |
| ElectricSQL, PGlite | Electric/PGlite explore Postgres/SQLite-shaped local and sync workflows; the repositories and advisories remain freshness-gated, and PGlite sync is not a complete TalkCo authority model. | Ciphertext-only sync, metadata budget, outage/migration behavior, access revocation, and replacement proof. | Benchmark/deferred; not a source of truth. |
| AEAD + HPKE | These standards provide low-level authenticated encryption and hybrid public-key encryption constructions. | Replay/ordering, grants, membership, revocation, publication consent, recovery, and metadata policy. | Building blocks only; never the access-control contract by themselves. |
| FROST, UCAN, and Biscuit | FROST addresses threshold Schnorr signing; UCAN and Biscuit describe capability/authorization forms. | Social governance meaning, encryption/key release, forward-only revocation, recovery, and TalkCo-specific authority domains. | Narrow custody/authorization experiments only; no substitution for MLS or the grant/envelope contract. |
#Counterevidence inside the tool lane
Several attractive readings fail under the actual product boundary:
- MLS is not metadata erasure. RFC 9420 and RFC 9750 describe group epochs, membership, headers, and the need for a protected transport. An OpenMLS spike must measure what the chosen transport and credentials expose.
- Deterministic Protobuf is not canonical signing input. The official Protobuf guidance explicitly lists schema, application, build, and library changes that can alter bytes. Protobuf/Buf therefore stays in the control plane unless a separate canonicalization layer is specified.
- libsignal is not a neutral library choice. The repository's current README says external use is unsupported and identifies AGPLv3 licensing. This is a support and distribution gate, not a claim that the Signal specifications are unsound.
- CRDT convergence is not authorization. A CRDT can help a draft or projection converge; it does not prove who may read, publish, revoke, moderate, or widen an audience.
- HPKE, AEAD, FROST, UCAN, and Biscuit solve narrower jobs. Calling any one of them “the protocol” would hide replay, ordering, grant scope, key epochs, recovery, and social legitimacy work.
- Shell support is not lifecycle support. Tauri and Flutter document platform paths and integration mechanisms, but key storage, background delivery, push semantics, and local-policy preservation remain TalkCo acceptance tests.
#Lane C — transport, storage, notifications, and operations
Transport and storage are where “distributed” most easily becomes a misleading product claim. The current direction is deliberately narrow: carry and preserve ciphertext while keeping authority in signed application objects and local policy.
| Surface | Current evidence and useful comparison | Missing/difficulty gate | Working direction |
|---|---|---|---|
| iroh endpoints and relays | Endpoint IDs are cryptographic identities and can persist when their secret key is stored. Relays carry encrypted traffic and can authenticate endpoint access, but authentication is not privacy and relay metadata remains a concern. | Endpoint rotation, relay choice, addressing scope, expiry, retry, direct-vs-relay trace, and observer budget. | First carrier harness paired with a dumb relay; endpoint IDs never become TalkCo membership by implication. |
| libp2p, Session, SimpleX, Tor, Lokinet, Katzenpost, Nym | These projects provide useful routing, onion, mix, or message-queue comparison points. Lokinet currently documents Windows/Linux availability while macOS/mobile are in development. Katzenpost threat model and Tor padding overview make stronger observer models explicit. | Threat model, mobile reliability, battery, latency, bootstrap/discovery, operator role, and metadata measurement per candidate. | Adapters/benchmarks; no global DHT, mixnet, token economics, or overlay becomes a launch dependency without a named requirement. |
| Opaque object custody | AWS client-side encryption establishes the basic pattern: encrypt locally before sending; the service receives already-encrypted objects. Storj Satellite, Tahoe-LAFS, IPFS privacy, and IPFS persistence are comparison evidence, not authority decisions. | Freeze EncryptedBlob, ShardSetManifest, leases, tombstones, repair epochs, provider receipts, quotas, and legal/operational roles. | S3-compatible opaque objects with a signed manifest; provider replacement test before any storage preference. |
| Notifications | Web Push uses a subscription endpoint; APNs background updates and FCM message types impose platform-specific behavior. FCM notification messages can be displayed by the SDK in the background. | Token rotation, deduplication, expiry, background limits, opaque payloads, offline replay, and recipient-declared local policy. | One adapter carrying opaque wake hints; never put content or social priority in push payloads. |
| Model checking and fault injection | TLA+ tools, Testcontainers, Toxiproxy, and netem cover complementary state, dependency, proxy, and network-fault checks. | Declare invariants, fault schedule, seeds, partitions, retry bounds, and what “fail closed” means for recovery and key release. | Required validation lane before protocol lock; use for the reducer, grants, carriers, and storage repairs. |
| Network/metadata observation | TShark can make packet traces reproducible; Waku's content-topic guidance is direct counterevidence that topic names and filters can link interests to network observations. | Define observer, crawler, aggregator, and global-observer models; record identifiers, topics, endpoints, timing, size, retries, and repair. | Metadata-leak tests are a release gate, not an optional privacy audit. |
| Supply chain and release | OSV-Scanner, Syft/Grype, Cosign, SLSA provenance, and Podman Quadlet provide pieces of scan, inventory, signing, provenance, and reproducible service setup. | Lockfiles, image digests, advisory timestamps, signatures, provenance, model scope, fault schedule, and disclosure of unknowns. | Evidence bundle generated per disposable release; no “green build” claim without these records. |
| TACo | Access-control concepts, testnet entry, and taco-web support a conditional research path. | Maintained implementation, DKG/cohort model, liveness, authorization/revocation, legal role, license, and mobile/client integration. | Keep behind the C adapter; do not treat threshold release as routine messaging or a governance vote. |
#What is settled, provisional, and explicitly no-decision
| State | Current conclusion | What would change it |
|---|---|---|
| Settled in the application spec | Product chapters own social meaning and user-visible behavior. Contextual identity, meaningful-participant publication consent, bounded comments/discovery, recipient-controlled attention, layered safety, community exit, and the distinction between technical custody and governance are the current product constraints. | A deliberate product-spec change in the owning chapter and roadmap; a tool result alone cannot supersede it. |
| Settled as document architecture | The research hub and tools inventory compare candidates. A future protocol specification owns exact schemas, signature domains, key hierarchy, migration, conformance, and final package/carrier choices. | The OWN-01 pilot handoff can narrow the owner, but not move wire decisions into a candidate table. |
| Provisional working direction | Rust/Tokio + SQLite/FTS5; Protobuf/Buf control messages; COSE/deterministic CBOR event signatures; OpenMLS 0.9.0 group prototype; Tauri 2 conditional with Flutter comparison; iroh+dumb-relay; opaque S3-compatible custody; opaque notification adapter; TLA+/fault/metadata/supply-chain evidence. | Any named decisive check can falsify a component; no component is locked by this register. |
| No-decision: protocol | Sphere namespaces/recovery, publication reducer semantics, A0/A1/C choice, grant/envelope/revocation schemas, metadata budget, client state synchronization, governance custody encoding, and carrier-independent object contract. | The P0/P1 checks above, followed by a protocol-spec acceptance review. |
| No-decision: dependencies | Direct libsignal, PRE/Umbral for routine messaging/storage, FROST as generic release/consensus, UCAN/Biscuit as encryption/MLS/revocation substitutes, CRDTs as authority core, and Electric/PGlite as source of truth. | A new requirement that specifically needs one of these jobs, plus a scoped adapter and evidence bundle. |
| Recheck/deferred | The lower-impact entries of the 182-name inventory, global DHTs, mixnet economics, Filecoin/Sia/Codex economics, p2panda authority, and final hosting/legal topology. | A vertical-slice requirement or threat-model change that makes one a blocker. |
#Prioritized next-check sequence
This order is chosen by dependency and falsification power, not by package popularity. Each check should leave an artifact that can be handed to the future protocol specification.
| Order | Check | Done when | Unblocks |
|---|---|---|---|
| 1 | Normative handoff (OWN-01) | One pilot row names product promise, shared invariant, protocol obligation, candidate mechanism, conformance test, owner, and destination. | All later work has one home and cannot silently settle the wire. |
| 2 | Sphere matrix (ID-01) | Creation, reveal, device addition, loss, export, recovery, and revocation are explicit for two spheres and two devices; no default cross-sphere locator appears. | Profile, trust, recovery, and metadata experiments. |
| 3 | Publication reducer (PUB-01) | Consent, replay, duplicate, out-of-order, withdrawal, revision, and audience-widening vectors produce deterministic results across two implementations. | Signed event format and publication UX. |
| 4 | Authority harness (AUTH-01) | A0, A1, and conditional C paths are compared for expiry, removal, offline operation, replay, forward-only revocation, and auditability. | Access-control interface and group/object selection. |
| 5 | Observer trace (PRIV-01) | The declared observer, crawler, and aggregator can be replayed; identifiers, topics, endpoints, size, timing, repair, and receipts have a measured budget or an explicit failure. | Honest privacy language and carrier choice. |
| 6 | Carrier/storage invariant (CARRIER-01) | The same signed object and manifest survive two carriers and two custody backends with equivalent integrity, expiry, dedupe, repair, and receipt semantics. | Adapter contract and hosting experiments. |
| 7 | Client state/notification matrix (CLIENT-01, NOTIFY-01) | Device-local, user-synced, and protocol-visible states are tested through reinstall, device loss, background delivery, token rotation, and local-policy overrides. | Shell choice and mobile/web scope. |
| 8 | Stack comparison (STACK-01–STORE-01) | The Rust/Tauri and Flutter slices produce the same vectors; SQLite/FTS5, SQLCipher/keystore, Protobuf/Buf, COSE/CBOR, and OpenMLS gates are recorded with versions and licenses. | A bounded implementation plan, not a protocol lock. |
| 9 | Release evidence bundle (OPS-01) | Lockfiles, image digests, SBOM, advisory timestamps, signatures, provenance, model scope, fault schedule, and metadata results are reproducible. | A decision review that can safely promote provisional components. |
#Evidence and maintenance notes
- Primary-source links in the Lane B and Lane C tables were retrieved or checked on 2026-09-07. Tool versions, advisories, support matrices, hosted-service behavior, and licenses remain freshness-gated.
- Repository constraints were re-read against
38c9051; the most important anchors are §12 where decisions live, §12 later protocol spec, §10 carrier boundary, and the round-6 boundary audit. - This register does not replace the 182-name inventory. Use the tools page for candidate coverage and qualification notes; use this page for the narrow set of checks that can change the next build decision.
- Generated HTML and strict Mermaid rendering were not treated as evidence for the research conclusion. Repository build and link checks are reported with the implementation commit; any environment-limited rendering step must remain explicitly marked pending.
#Open blockers
The register is intentionally not a dependency lock or production authorization. The material blockers are the ID-01, PUB-01, AUTH-01, PRIV-01, and OWN-01 checks. Until those have passing artifacts, the project can build disposable experiments but should not publish exact wire formats, promise global observer resistance, or present a package/carrier as the owner of TalkCo authority.