convene-core

The root descriptor for the core crate. It declares a library; its domain artifacts are the Data, Projection, and Context drafts under this directory. This is the encrypted backbone's pure domain: an end-to-end encrypted communication substrate for a network whose members' safety depends on the content never leaking — to the swarm that carries it, to the surface that presents it, or to anyone who was never let in.

Two ideas carry the whole design. Access is bounded by epoch: a group never edits its membership — every change mints a new immutable GroupRevision with a fresh GroupKey, and members hold exactly the keys of the epochs they were accepted into. A removed member keeps what they could already read and gets nothing after; a new member gets the new epoch and nothing before. There is no server at all, and no shared feed either: a sender delivers a fresh sealed copy to each recipient it is for and never posts to a feed they share, and a recipient collects only what is theirs — so the swarm sees copies move but no rendezvous that ties a sender to a recipient, and a member's collecting reveals nothing about who sent to them. Everything travels this way — messages, key deliveries, sealed revisions. The swarm carries what it cannot read, refuses nothing, and keeps no order. Order rides inside the sealed messages as parent message ids; membership travels sealed too, so structure is checked in the reading, where a forked lineage is substitution evidence; and nothing outside a seal says who sent what. There is no cleartext message anywhere in the system; reading is a computed view on the member's device, and holding the right key is what being entitled to read means.

The core reaches no IO directly — it names one seam, the Relay port, whose whole vocabulary is deliver to a recipient and give a recipient what is theirs. This layer says only who may read (the epoch keys) and who a message is for (the recipients). How a sealed thing actually reaches a recipient — unlinkably, against an observer of the whole wire — is a domain in its own right, one layer down, with its own experts and its own enabling specification: the transport layer (mix), which implements Relay and is modeled in full, not hidden behind an adapter. The seam is deliberate, not a place where modeling stops.

Build

kind: library

Depends on

(none) — the core is self-contained; every name its drafts reference resolves within core/.

Contains

• data/ — what the system is: the members, conversations, epochs, keys, messages and their sealed envelopes, message identities, wrapped keys, and alarms. Stable — a message is a message regardless of what carries it.
• projections/ — the read-only views computed on a member's device: the group as its members think of it, and the timeline a member can actually read.
• contexts/ — what the system does: founding a group, bringing a member in, taking a member out, collecting a rotated key, sending, and receiving. Carrying a sealed message to its recipients — the Channel, in the book's word — is not a context here: it is the seam to the transport layer below, the Relay port, realised by the mix crate.
• ports/ — the group-keyed relay the core depends on but never reaches directly.