Supported workflows and limits

Implemented in development source

Local Chromium end-to-end evidence

Targeted cases passed A synthetic fixture used two distinct certified rooms and three separate local peer processes. The browser exercised the actual worker, transactional store and transport paths.

• Switching a draft from room A to B refused queueing before storage mutation and retained the original text.
• An injected finalization failure preserved the exact reserved draft; reload/resume finalized those bytes while preserving unrelated composer text.
• The complete decoded puzzle artifact was previewed; changed bytes or destination invalidated approval before mutation.
• Three saved posts reached both local peers, with durable peer-specific receipts and signed public history readback.
• A fixed-target continuity session replicated an exact signed prefix to a dedicated v2-mode peer; terminal-admission and contiguous-retention receipts verified through two explicit targets, including ordered intermediate admissions under a narrowed bound.
• A certified mid-run policy revocation stranded an unsigned pending draft: current-policy resume refused it twice unchanged, then explicit recovery signed it under its retained enabling revision.
• An encrypted key backup and all three author-state parts restored into a fresh origin after the former writer closed. Key-only, wrong-room, final-first and partial imports refused signing; staged import survived reload.
• The restored author retained both peer receipts, resumed the exact fourth pending post and kept its new receipts after another restart. Already acknowledged history was not sent again.

These cases cover the tested public-author backup lifecycle. They do not prove independent operators, a multi-machine network, other-browser support or private MLS recovery. They used a local qualification artifact; they are not production deployment evidence.

Private rooms and agent isolation

Not ready for general use The optional native and browser clients now implement committed invite-only membership, encrypted file exchange, owner controls and exact local retries. Actual Chromium worker and DOM journeys cover custody, two-account contact exchange, message/roster consent, ordered owner removal, same-account fresh-device rejoin, account-authorized owner succession to that device with the predecessor demoted to ordinary membership, signed-proof export and observation, a fabricated owner fork durably quarantining the observing member across a document teardown, an expired-caller-clock control refusal that leaves the identical envelope applicable under the real clock, retained output reopen and clearing on lock.

Archive recovery has native account-custody, process, and interrupted-file tests plus browser export/import/reopen journeys. A trusted native client can consume its room session into an account-owned fixed-room adapter with a fixed set of local room methods. That adapter does not enforce OS or provider isolation.

New private hosts use iroh with a saved endpoint identity, direct QUIC connections, and encrypted relay fallback. Local tests cover the native host, invitations, agent delivery, and gateway. A public-relay test exchanged synthetic ciphertext with client UDP disabled and checked that the connection stayed relayed. An advisory two-runner qualification then covered separate GitHub-hosted machines. Multiple-NAT, home/mobile-network, sleep/wake and long relay-outage behavior remain.

Earlier TLS tests covered two physical Macs on a LAN and through Tailcat, a Railway container over the public Internet, and headed Chromium on a second laptop through its gateway. Those results remain TLS evidence. A live Windows run, literal laptop sleep, active-device transfer, iroh mailbox generation transitions, and enforced limits on agent access remain unfinished. The private-room guide explains the flow; security and privacy describes its trust boundaries.

Long-history catch-up and continuity

Durable bounded replay Native author policy replay now keeps an authenticated, locally verified application checkpoint. Each step has a 4,096-bundle / 30 seconds budget, reports more work without authoring and resumes its exact saved progress. A synthetic 4,101-bundle process-restart test passed. Initial creation saves only genesis; existing authors bind their retained policy head before replay. The checkpoint is a local cache, not a portable remote snapshot or protection against coherent host-state rollback.

Historical author continuity now has a durable staging store, a typed peer route and explicit operator commands, with a 4,096-event staged-ancestor budget and at most 32 inline ancestors at terminal commit. The peer bounds verification, staging, response size and maintenance work. The native continuity client now persists fresh nonce-bound attempts, terminal admission and a separate exact-source Evidence floor. It advances one explicitly selected target through bounded calls while leaving ordinary v1 delivery receipts untouched.

The browser orchestrates the same session over the IndexedDB receipt store — per-room, per-peer-route, with a fixed terminal that only a strictly later selection replaces — and the local-Chromium journey completes two targets against a dedicated continuity-mode fixture peer, including ordered intermediate admissions under a narrowed qualification bound. A target beyond the peer's staged-ancestor bound advances through bounded intermediate terminal admissions of exact signed local events, each separately reserved and current-policy checked, without replacing the fixed selection.

Required work: independent-peer operational qualification. Native Status/Stage hints never advance permanent retention; completion requires terminal admission plus contiguous Evidence through the same target. The implemented server keeps historical ancestors distinct from a terminal event authorized by current policy. Old-policy ancestors must not become freshly admitted posts. Incremental finalization is implemented through ordered bounded admissions; claiming arbitrarily long historical catch-up still needs operational qualification over realistic histories, since simply raising a per-request cap would create resource amplification. An unsigned draft stranded by a policy revocation now has an explicit local recovery path on both clients: the unchanged request is checked against its retained enabling revision before signing, producing local continuity material only — never current posting permission, past admission or delivery.

Replication and resilience

Partial Current clients select HTTPS native peers. Direct browser mesh, automatic independent activity replication and assured peer/operator diversity are not established. A second hostname does not prove a second operator. Qualification needs independent peers, loss/partition/reconnect, bounded retry and verifiable catch-up over realistic histories.

Discovery availability and DNS

All-active Sybil occupancy can fill the finite 512-key registry despite computational work and rate limits. Retirement preserves only its documented finite-horizon floor contract. Browser Fetch cannot pin DNS answers; candidate selection is a user decision, not an automatic arbitrary-host dialing policy. Native selected-route checks do not prove host independence.

Measured local performance

Recorded on one Apple M4 Max using optimized Rust 1.98.1 binaries, synthetic public text and a small-state certified journal. The host also ran other development work; these are specific observations, not hosted capacity or independent-network latency.

Commands, full measurements and limitations ↗

What the optional private client adds

Local production packages recorded on 21 September 2026 used release builds with the committed lockfile: the default public browser, and the same browser with private-rooms enabled. Both excluded local qualification hooks.

These totals include the application and worker assets. Gzip totals are local compression estimates, not measured CDN transfer, startup latency or resident memory. The default public package size stayed unchanged by this private-client integration.

Operational readiness

External TLS/proxy behavior, production CSP, install/upgrade behavior, storage quotas, backup restores and independent-machine/browser delivery need recorded evidence for the exact admitted build. Further qualification needs idle CPU, network acknowledgment latency, cold startup, larger application state and independent failure domains. A 100,000-message scenario has not been run; larger runs require measured time and disk headroom. The local observations above do not close these operational gaps.

Full CI, focused crash tests, local fixtures and an independent source review answer different questions. No single green badge closes all these gaps. Release status should name its tested artifact and deployment; this page does not invent either.

Repository documentation and ongoing work ↗ · Promotion gates ↗