newDevice's header said this engine has no ML-KEM and therefore always
publishes proto 1. It gained ML-KEM, the command gained a `pq` flag, and
the comment stayed — so it now reads as a statement of a limitation that
no longer exists, on the one file whose job is to be the honest account
of what the Kotlin engine can do.
Also names the distinction a reader of this file needs: these low-level
commands wire X3DH and the ratchet together by hand, and the session_*
commands go through E2ESession, which is the layer the app calls and the
layer that owns the negotiation decision.
versionCode 7. Never reused, and never backwards: it is the only thing that
tells an install a newer build exists, and Android refuses an APK numbered below
what is already on the phone.
What a person gets:
Making a group now seals its member list. The relay is handed a blob it has no
key for and one opaque token per member, instead of a readable `gid -> user_id`
row each. A group made before this can be sealed too, by whoever owns it, from
the group's info screen — everyone stays in and nobody else has to do anything.
⚠️ What that does NOT buy, and the app says so where the button is: it protects
the list if the database is stolen or handed over. It does not hide the group
from whoever runs the server, because messages are addressed to each device and
watching who receives a group's traffic still gives the group away.
Also in this build, and invisible: post-quantum key agreement now runs through
every ratchet step rather than only the handshake (§13), and this engine
advertises v3. A conversation only gets it when both ends do, so today that is
Android to Android on 0.7 — iPhone has it built and is still with Apple.
Verified before publishing: cert 791fc826… unchanged, so this installs over 0.6;
version read back out of the artifact as 7 / 0.7; 609 tests, 28 announced skips,
0 failures; cross-engine 56 passed.
Paul Hitt