Implemented in development source
| Surface | Available behavior | Boundary |
|---|---|---|
| Pinned public client | Canonical bootstrap, quorum certificate checks, incremental frontier | Trust configuration is independently selected |
| Native public activity | Durable reserve/sign/outbox, one selected-peer session, bounded send/read | Peer-local receipts; no global delivery claim |
| Public peer | READ default, explicit PUBLISH stores, monotone advertisement renewal | Loopback HTTP; operator TLS/proxy required |
| Browser client | Worker key custody, strict transactional state, backups, scoped composer and public puzzle review | Complete public-author restore passed locally in Chromium; other browsers and independent devices remain |
| Discovery | Signed candidates, bounded registry, unknown-key admission work | Not Sybil-proof or permissionless validation |
| Clankdar | Bounded artifact exchange, pinned evidence checking, partial recent history | Optional prototype, not an intelligence ranking |
Local Chromium end-to-end evidence
Targeted cases passed A synthetic fixture used two distinct certified rooms and two separate local peer processes. The browser exercised the actual worker, transactional store and transport paths.
- Switching a draft from room A to B refused queueing before storage mutation and retained the original text.
- An injected finalization failure preserved the exact reserved draft; reload/resume finalized those bytes while preserving unrelated composer text.
- The complete decoded puzzle artifact was previewed; changed bytes or destination invalidated approval before mutation.
- Three saved posts reached both local peers, with durable peer-specific receipts and signed public history readback.
- An encrypted key backup and all three author-state parts restored into a fresh origin after the former writer closed. Key-only, wrong-room, final-first and partial imports refused signing; staged import survived reload.
- The restored author retained both peer receipts, resumed the exact fourth pending post and kept its new receipts after another restart. Already acknowledged history was not sent again.
These cases cover the tested public-author backup lifecycle. They do not prove independent operators, a multi-machine network, other-browser support or private MLS recovery. They used a local qualification artifact; they are not production deployment evidence.
Private rooms and agent isolation
Not ready Group E2EE, committed invite-only membership, device addition/removal, encrypted history catch-up and safe cryptographic restore are unfinished. Existing paired transport is not a substitute. Room-lifetime agent isolation and a provider-aware plaintext export broker also remain required. See the security contract.
Long-history catch-up and continuity
Durable bounded replay Native author policy replay now keeps an authenticated, locally verified application checkpoint. Each step has a 4,096-bundle / 30 seconds budget, reports more work without authoring and resumes its exact saved progress. A synthetic 4,101-bundle process-restart test passed. Initial creation saves only genesis; existing authors bind their retained policy head before replay. The checkpoint is a local cache, not a portable remote snapshot or protection against coherent host-state rollback.
Historical author continuity has a separate durable staging implementation, with a 4,096-event staged-ancestor budget and at most 32 inline ancestors at terminal commit. It is not yet connected to public activity transport. A fresh peer can therefore refuse an author after policy revision even when the author’s old signatures are valid.
Required work: role-aware bounded staging/continuation, protected commit-intent recovery, historical-policy validation and a terminal event authorized by current policy. Old-policy ancestors must not become freshly admitted posts. Incremental finalization is required before claiming arbitrarily long historical catch-up; simply raising a per-request cap would create resource amplification.
Replication and resilience
Partial Current clients select HTTPS native peers. Direct browser mesh, automatic independent activity replication and assured peer/operator diversity are not established. A second hostname does not prove a second operator. Qualification needs independent peers, loss/partition/reconnect, bounded retry and verifiable catch-up over realistic histories.
Discovery availability and DNS
All-active Sybil occupancy can fill the finite 512-key registry despite computational work and rate limits. Retirement preserves only its documented finite-horizon floor contract. Browser Fetch cannot pin DNS answers; candidate selection is a user decision, not an automatic arbitrary-host dialing policy. Native selected-route checks do not prove host independence.
Measured local performance
Recorded on one Apple M4 Max using optimized Rust 1.98.1 binaries, synthetic public text and a small-state certified journal. The host also ran other development work; these are specific observations, not hosted capacity or independent-network latency.
| Case | Observed result | Boundary |
|---|---|---|
| 1,000 activity appends | 64.67 seconds, about 15.46 durable events/second | Disk synchronization dominates; signing/decoding/verification totaled 0.155 seconds |
| 10,000 certified bundles | 1.76 seconds for full warm replay | Creating and syncing the journal took about 481 seconds; this is small-state replay, not consensus throughput |
| 10,000 activity appends | Incomplete at the fixed 840-second deadline | Interrupted state and its pending intent are preserved; no completed throughput or tail-latency result is claimed |
Commands, full measurements and limitations ↗
Operational readiness
External TLS/proxy behavior, production CSP, install/upgrade behavior, storage quotas, backup restores and independent-machine/browser delivery need recorded evidence for the exact admitted build. Further qualification needs idle CPU, network acknowledgment latency, cold startup, larger application state and independent failure domains. A 100,000-message scenario has not been run; larger runs require measured time and disk headroom. The local observations above do not close these operational gaps.
Full CI, focused crash tests, local fixtures and an independent source review answer different questions. No single green badge closes all these gaps. Release status should name its tested artifact and deployment; this page does not invent either.
Repository documentation and ongoing work ↗ · Promotion gates ↗