Take the e2e update that corrects the Android claims (relay#46) #144

2026-09-07T19:48:04Z

paulhitt commented

2026-09-07 19:48:04 +00:00

(Migrated from gitlab.com)

Closes #46 (the relay half). Bump, regenerate, one MR — the rule in .e2e-ref.md, minus part three because this update needs no source change here.

.e2e-ref d2ebcdf → 4626d2e (flamenet-e2e!30), and spec.leaf regenerated from it.

/spec no longer tells people Android is v1 only, has no ML-KEM, and has never been checked against another engine. All three were wrong.

The evidence, so it lives in this repo too

node test/interop-swift-kotlin.mjs
→ 77 passed, 0 failed          (executed 2026-09-07)

Swift driver compiled from the iOS app's own Sources/E2E; the Kotlin side driven through session_*, so bundle.proto >= 3 is E2ESession's decision and not the harness's. It asserts proto 3 with a capability signature, and at least six distinct pqdh values — a fresh ML-KEM key each turn, which is the §13 claim rather than "the messages decrypted".

The ticket's rule was flip a claim because a run proved it, and say which run. That is the run.

Two things done deliberately

Regenerated, not hand-edited. spec.leaf carries a source-sha256 and the doc-pages gate compares it — editing the page directly passes review and fails CI, which is a trap this repo has already fallen into once.

Not a clean sweep. Android's sealed sender is still engine-verified and not wired end to end, and pqMode stays "optional": requiring post-quantum would refuse first contact with any peer that cannot answer, including the Android 0.6 in somebody's hand today. The ticket warned against overcorrecting and both caveats survive.

Worth watching

This is the first bump since the pin landed, so it is also the first live exercise of the -head advisories: they were red on main while e2e was ahead, and should go green with this.

Closes #46 (the relay half). Bump, regenerate, one MR — the rule in `.e2e-ref.md`, minus part three because this update needs no source change here. `.e2e-ref` **d2ebcdf → 4626d2e** (flamenet-e2e!30), and `spec.leaf` regenerated from it. `/spec` no longer tells people Android is v1 only, has no ML-KEM, and has never been checked against another engine. **All three were wrong.** ## The evidence, so it lives in this repo too ``` node test/interop-swift-kotlin.mjs → 77 passed, 0 failed (executed 2026-09-07) ``` Swift driver compiled from the iOS app's own `Sources/E2E`; the Kotlin side driven through `session_*`, so `bundle.proto >= 3` is `E2ESession`'s decision and not the harness's. It asserts proto 3 **with a capability signature**, and at least **six distinct `pqdh` values** — a fresh ML-KEM key each turn, which is the §13 claim rather than "the messages decrypted". The ticket's rule was *flip a claim because a run proved it, and say which run*. That is the run. ## Two things done deliberately **Regenerated, not hand-edited.** `spec.leaf` carries a `source-sha256` and the `doc-pages` gate compares it — editing the page directly passes review and fails CI, which is a trap this repo has already fallen into once. **Not a clean sweep.** Android's sealed sender is still engine-verified and not wired end to end, and `pqMode` stays `"optional"`: requiring post-quantum would refuse first contact with any peer that cannot answer, including the Android **0.6** in somebody's hand today. The ticket warned against overcorrecting and both caveats survive. ## Worth watching This is the first bump since the pin landed, so it is also the first live exercise of the `-head` advisories: they were red on `main` while e2e was ahead, and should go green with this.

paulhitt (Migrated from gitlab.com) merged commit 417ce1f6ef into main

2026-09-07 22:12:16 +00:00

paulhitt commented

2026-09-07 22:12:17 +00:00

(Migrated from gitlab.com)

mentioned in commit 417ce1f6ef

mentioned in commit 417ce1f6effe36bfe9a24a86572d8adbde1d60ec

paulhitt commented

2026-09-08 15:03:14 +00:00

(Migrated from gitlab.com)

mentioned in issue #56

paulhitt commented

2026-09-09 18:58:44 +00:00

(Migrated from gitlab.com)

changed the description

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#144