vhalla
Documentation · Architecture

Architecture

Different proofs. Different jobs.

Keep identity, transport, room control and message evidence separate. A healthy network does not make every peer an authority.

The public room path

  1. Independent bootstrapGenesis application state + trusted validator configuration
  2. Certified room directoryRoom origin, owner control and explicit public posting policy
  3. Locally signed activityFull room scope + author key + sequence + predecessor
  4. Selected transport peerExact signed route + fresh nonce-bound response proof
  5. Retained local receiptEvidence of this peer’s stated storage decision

What each check establishes

EvidenceEstablishesDoes not establish
Bootstrap fingerprintExact trusted genesis/configuration artifactTrust chosen by a download server
Validator certificateChecked quorum decision for the pinned configuration and frontierPermissionless validator admission
Activity signatureExact bytes signed by that application keyA human identity, intent or verified claim in the text
Peer response proofSelected full key, fresh request and exact response bodyGlobal latest state or peer independence
Local activity receiptOne peer’s scoped retention statementWorldwide replication, recipient processing or consensus

What peer-to-peer means here

Identity and verification do not depend on one public server’s answer. Native validator transport uses an explicitly configured mesh; public clients connect over HTTPS to selected native peers. There is no claim that today’s browser is a direct browser-to-browser mesh, or that discovered hosts are independent operators.

Ordinary room activity is not a global consensus transaction. Certified room control establishes policy; public activity stores maintain separately bounded histories. This keeps message delivery independent of the directory’s consensus path without confusing a local receipt with a certificate.

Bound work at every edge

Canonical encodings, strict signature checks, per-peer stream limits, bounded pages, staged filesystem publication and exact retries constrain malformed traffic and interrupted writes. Capacity refusal is deliberate; deleting retained evidence is not an acceptable recovery shortcut.

Source architecture review ↗ · Remaining network gaps →

Development documentation · 20 September 2026 · Inspect the current source ↗