convene

The root of the convene drafts tree — the sealed case-work chat the Nordhavn team builds. The platforms the book names (Convene, Plenum, Quorum) are fiction; this is the real thing under them, modeled as a stack of domains, floor to top. Every message is sealed on the member's device and delivered to each recipient it is for — there is no shared group feed, so no server anywhere sees a rendezvous that ties a sender to a recipient, membership is sealed too, and nothing outside a seal says who sent what or to which group. A sender delivers a fresh sealed copy to each recipient; a recipient collects only what is theirs; and how that delivery is carried on the wire — the Channel, in the book's word — is not a thing the comms layer does, but the seam to the transport layer below it, which can go as far as a traffic-analysis-resistant mix. The whole crate tree lowers from here: one directory per crate, the directory tree is the crate tree.

A directory under drafts/ is a crate exactly when it carries a root descriptor — lib.md for a library, app.md for a runnable. Directories without one are not crates.

The domain has layers

The domain is not one business layer sitting on top of undifferentiated "implementation." It is a stack of domains, each with its own professional experts and its own enabling specification in their vocabulary, each realising the layer above through a port. Anne and Laura are the experts of the top layer (case work, who may read); the team are the experts of the transport layer (how a sealed thing reaches a recipient unlinkably). Both layers are modeled here, in their own crates, in their own words. Modeling stops at the floor — the existing crates a bottom port binds to (a peer-to-peer transport, an OS entropy source, a crypto primitive) — which we consume, not spec.

Members

• core → core/ — lib.md — the comms domain (Anne and Laura's): the members, epochs, keys, and sealed messages the system is; the readable views computed on a member's device; the sending, receiving, and membership contexts the system does. Declares the Relay port — "deliver to a recipient" — the seam to the layer below.
• mix → mix/ — lib.md — the transport domain (the team's): how "deliver to a recipient" is realised as a traffic-analysis-resistant mix — cells, tumblers, detection, routing. Implements core's Relay; declares its own downward ports (Wire, Entropy) — the seam to the floor. Depends on core.
• surface → surface/ — lib.md — the presentation domain (the UI professionals'): what a person touches — the message list a reading becomes, the composer their words wait in, the session that is their seat. Consumes core's projections and performs core's contexts; declares its own downward port (Screen) — the seam to the rendering floor. Depends on core.
• host → host/ — lib.md — the floor bindings: the thin adapters that bind the mix layer's downward ports to existing crates (a peer-to-peer wire, an OS entropy source). This is where the modeled stack meets the substrate it consumes. Depends on core and mix.
• app → app/ — app.md — Entry. the runnable demonstration: one case group's life, from founding through removal, read back per member, over the whole stack. Depends on core, mix, host.

Build

The workspace produces the convene binary (the entry), over the core, mix, surface, and host libraries. This parses into a Workspace whose entry is app; the crate tree and package manifests lower from it.