extant2000/flamenet-relay
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

Privacy wave 0: per-device digests, intros, Unlisted, anonymous reads, padding groundwork, SimpleX comparison #245

Merged
paulhitt merged 13 commits from privacy/wave0-relay into main 2026-10-07 19:47:00 +00:00
Conversation 7 Commits 13 Files Changed 55
+5791 -227
paulhitt commented 2026-10-07 16:25:31 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

Privacy plan, relay wave 0 (owner-approved 2026-10-07, docs 60 and 61). Additive and reversible except the two stage 2-A backfills, which drop data nothing reads.

Pairs stage 2-A: invite redemption forgets who used it (issuer zeroed, used_by no longer written; ForgetVouchProvenance backfill); star/archive refused with 409 kept_on_device (ClearConversationFlags backfill); notifications expire (read 7 days, all 30).

Padding stage 1.1: poll stops at ~2 MiB with "more": true; count-only ladder metrics; FN_PAD_ENFORCE (off by default); features.padAttachments (off).

Per-device digests (DA4a): delivery-key and roster-tag digests kept per device, so two devices no longer overwrite each other; constant-time check padded to FN_MAX_DEVICES + 1; features.perDeviceDigests. Account deletion now removes roster tags and delivery tokens.

Wave 0b: POST /e2e/intro (one token, 10 min, meters per IP/network/target; proof of work via GET /e2e/intro/challenge for intros by handle), handle certificates (GET /e2e/handle-cert), anonymous reads /e2e/anon/* and GET /e2e/devices/me (device times no longer in the public directory), Unlisted (users.discoverable, five username doors answer like a missing name with a 5 ms floor), reusable contact links (/e2e/contact-links, max 5, hashes only). Refusal-only recipient send bucket plus a per-(recipient, IP) limit.

Docs/pages: /metadata (en, es) states measured access-log retention (about a day on the box, 90 days encrypted off-site); README and CONFIGURATION defaults corrected (600/60/3000).

Comparison page: SimpleX column (every cell sourced), lede and closing no longer claim uniqueness SimpleX shares, Signal's Automatic Key Verification noted, audit cell says a grant was applied for, Spanish contact cell matches English, column widths fixed (WhatsApp was squeezed to 70 px).

Tests: 853 tests / 95 suites + 61 XCTest, 0 failures, SQLite and Postgres, upgrade tests on populated databases, intro-token races; timing floors measured (500 samples per arm); every new test falsified. Linux build not run locally (CI covers it).

Merging does not deploy.

🤖 Generated with Claude Code

Privacy plan, relay wave 0 (owner-approved 2026-10-07, docs 60 and 61). Additive and reversible except the two stage 2-A backfills, which drop data nothing reads. **Pairs stage 2-A:** invite redemption forgets who used it (issuer zeroed, `used_by` no longer written; `ForgetVouchProvenance` backfill); star/archive refused with 409 `kept_on_device` (`ClearConversationFlags` backfill); notifications expire (read 7 days, all 30). **Padding stage 1.1:** poll stops at ~2 MiB with `"more": true`; count-only ladder metrics; `FN_PAD_ENFORCE` (off by default); `features.padAttachments` (off). **Per-device digests (DA4a):** delivery-key and roster-tag digests kept per device, so two devices no longer overwrite each other; constant-time check padded to FN_MAX_DEVICES + 1; `features.perDeviceDigests`. Account deletion now removes roster tags and delivery tokens. **Wave 0b:** `POST /e2e/intro` (one token, 10 min, meters per IP/network/target; proof of work via `GET /e2e/intro/challenge` for intros by handle), handle certificates (`GET /e2e/handle-cert`), anonymous reads `/e2e/anon/*` and `GET /e2e/devices/me` (device times no longer in the public directory), Unlisted (`users.discoverable`, five username doors answer like a missing name with a 5 ms floor), reusable contact links (`/e2e/contact-links`, max 5, hashes only). Refusal-only recipient send bucket plus a per-(recipient, IP) limit. **Docs/pages:** /metadata (en, es) states measured access-log retention (about a day on the box, 90 days encrypted off-site); README and CONFIGURATION defaults corrected (600/60/3000). **Comparison page:** SimpleX column (every cell sourced), lede and closing no longer claim uniqueness SimpleX shares, Signal's Automatic Key Verification noted, audit cell says a grant was applied for, Spanish contact cell matches English, column widths fixed (WhatsApp was squeezed to 70 px). Tests: 853 tests / 95 suites + 61 XCTest, 0 failures, SQLite and Postgres, upgrade tests on populated databases, intro-token races; timing floors measured (500 samples per arm); every new test falsified. Linux build not run locally (CI covers it). Merging does not deploy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
paulhitt (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2026-10-07 16:25:48 +00:00
paulhitt commented 2026-10-07 17:02:10 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

aborted the automatic merge because the source branch was updated. Learn more.

aborted the automatic merge because the source branch was updated. [Learn more](https://gitlab.com/help/ci/pipelines/merge_trains.md#merge-request-dropped-from-the-merge-train).
paulhitt commented 2026-10-07 17:02:10 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

added 1 commit

  • bd6ac783 - Keep the limiter fallback key as Data so the relay builds on Linux

Compare with previous version

added 1 commit <ul><li>bd6ac783 - Keep the limiter fallback key as Data so the relay builds on Linux</li></ul> [Compare with previous version](/extant2000/flamenet-relay/-/merge_requests/182/diffs?diff_id=2084674141&start_sha=e9e3f99d4f3161738718b3b0cb256a87ca5e0840)
paulhitt (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2026-10-07 17:02:32 +00:00
paulhitt commented 2026-10-07 18:37:51 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

aborted the automatic merge because the source branch was updated. Learn more.

aborted the automatic merge because the source branch was updated. [Learn more](https://gitlab.com/help/ci/pipelines/merge_trains.md#merge-request-dropped-from-the-merge-train).
paulhitt commented 2026-10-07 18:37:51 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

added 15 commits

  • bd6ac783...fa06c9a3 - 3 commits from branch main
  • fa06c9a3...ea3e3348 - 2 earlier commits
  • aca12ca7 - Keep delivery-key and roster-tag digests per device (DA4a)
  • 378de4f6 - Pick a provably wrong nonce in the proof-of-work refusal test
  • 4095ca60 - Wave 0b: introductions, Unlisted, contact links, anonymous reads
  • 114fadbc - Document wave 0b: introductions, Unlisted, contact links, anonymous reads
  • b4bf1458 - Match SPEC 8.11 and 14.5 where the brief left the wire open
  • 78b0a576 - One token per introduction, and a small proof of work by handle
  • a55af454 - Say how long the edge access log really lives, and fix README defaults
  • dd0d4e66 - Comparison: add SimpleX, drop the uniqueness claims it ended, fix column widths
  • 5ac00417 - Keep the limiter fallback key as Data so the relay builds on Linux
  • 025ac20f - Pin flamenet-e2e e5c9cb8: the star test accepts kept_on_device

Compare with previous version

added 15 commits <ul><li>bd6ac783...fa06c9a3 - 3 commits from branch <code>main</code></li><li>fa06c9a3...ea3e3348 - 2 earlier commits</li><li>aca12ca7 - Keep delivery-key and roster-tag digests per device (DA4a)</li><li>378de4f6 - Pick a provably wrong nonce in the proof-of-work refusal test</li><li>4095ca60 - Wave 0b: introductions, Unlisted, contact links, anonymous reads</li><li>114fadbc - Document wave 0b: introductions, Unlisted, contact links, anonymous reads</li><li>b4bf1458 - Match SPEC 8.11 and 14.5 where the brief left the wire open</li><li>78b0a576 - One token per introduction, and a small proof of work by handle</li><li>a55af454 - Say how long the edge access log really lives, and fix README defaults</li><li>dd0d4e66 - Comparison: add SimpleX, drop the uniqueness claims it ended, fix column widths</li><li>5ac00417 - Keep the limiter fallback key as Data so the relay builds on Linux</li><li>025ac20f - Pin flamenet-e2e e5c9cb8: the star test accepts kept_on_device</li></ul> [Compare with previous version](/extant2000/flamenet-relay/-/merge_requests/182/diffs?diff_id=2084914685&start_sha=bd6ac7832e4482164c6310250346c4eba672c34f)
paulhitt (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2026-10-07 18:38:17 +00:00
paulhitt commented 2026-10-07 18:49:05 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

aborted the automatic merge because the source branch was updated. Learn more.

aborted the automatic merge because the source branch was updated. [Learn more](https://gitlab.com/help/ci/pipelines/merge_trains.md#merge-request-dropped-from-the-merge-train).
paulhitt commented 2026-10-07 18:49:05 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

added 1 commit

  • f1d79d4b - Hold the two pairs 2-A clean-ups behind FN_PAIRS_CLEANUP

Compare with previous version

added 1 commit <ul><li>f1d79d4b - Hold the two pairs 2-A clean-ups behind FN_PAIRS_CLEANUP</li></ul> [Compare with previous version](/extant2000/flamenet-relay/-/merge_requests/182/diffs?diff_id=2084940781&start_sha=025ac20f145299b8a696979aeeb6507a470fb4e9)
paulhitt (Migrated from gitlab.com) scheduled this pull request to auto merge when all checks succeed 2026-10-07 18:49:21 +00:00
paulhitt commented 2026-10-07 19:47:01 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

mentioned in commit da05d6d87f

mentioned in commit da05d6d87fc821eb750e7e7e9e3413a04d74c588
paulhitt (Migrated from gitlab.com) merged commit da05d6d87f into main 2026-10-07 19:47:01 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
accuracy
A public page claims something the code does not do
 architecture
blocked:apple
Waiting on App Store review
 bug
ci
deploy
docs
federation
hardening
idea
investigation
ops
Deploy, CI, infrastructure
 parity
One platform has it and the other does not
 planning
privacy
Changes what is stored, or what we say is stored
 reliability
scalability
security
self-hosting
signup
stability
tech-debt
tooling
unwired
Built in the engine, not reachable from the UI
 verification
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
extant2000git
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: extant2000/flamenet-relay#245