QERYX COMING SOON
OBSERVATORY

Trust Center

Check every claim on this page.

Posture in the present tense: what is true today, what is pending, and what unlocks each absent artifact.

Status as of 2026-10-21 Every value true or absent

Read the verdict unvarnished

QERYX maintains a consolidated evaluator dossier: a Security Target skeleton, a Protection-Profile conformance matrix, a tiered assurance-gap ledger, and an honest-claim ledger. Its verdict is quoted here exactly — including the part that says no.

The composite TOE is ready to enter formal evaluation and is not signable today. A reviewer’s signature can rest on this dossier once the code-closed cluster lands and the accredited lab attests — and not one moment before the lab attests.

QERYX evaluator dossier · closing statement · condensed without softening

That separation — what we close ourselves, what only a lab can issue — is the discipline of this whole page. The dossier text publishes at /trust/dossier after its publication ceremony; the load-bearing tables from it ship below, verbatim.

Check the posture, program by program

One wording per program. It ships unedited, everywhere.

CNSA 2.0 — canonical wording

CNSA 2.0 — asymmetric core conformant (ML-KEM-1024 + ML-DSA-87 at Category V; SHA-512 at or above the hash floor). The AEAD is ChaCha20-Poly1305 (RFC 8439), a documented deviation; the AES-256-GCM NSS suite is implemented and reserved as suite 0x0002. Pre-evaluation checklist (internal self-assessment against the NIAP Common Criteria bar, latest pass 2026-06): 0 algorithm-layer non-conformances, 5 documented deviations; no accredited-laboratory evaluation has begun.

Standing posture — stated as of this revision
ProgramStatusWhat is pending
NIAP / Common Criteria READY WITH DEVIATIONS on our own pre-evaluation — not a completed EAL 4+ certification. The deviations are enumerated; no accredited-laboratory evaluation has begun, and the evidence bundle is being completed for one. Formal evaluation at an accredited facility.
FIPS 140-3 Algorithm-conformant, not module-validated. ML-KEM-1024, ML-DSA-87 and AES-256-GCM execute in a library whose validated configuration is not the one we link; ChaCha20-Poly1305, HKDF-SHA-512, X25519 and the hash functions execute in separate audited implementations. Every primitive passes a pinned known-answer test at every launch of the app and every start of the relay, and a failed test stops the process. No QERYX module holds a FIPS 140-3 certificate. CMVP validation of the QERYX module boundary.
FIPS 203 / 204 Algorithm-conformant constructions; known-answer tests pinned and run at every boot. CAVP / ACVP validation for the release build.
Formal verification Symbolic protocol models pass 5 of 5, with non-vacuous negative controls that fail when the model is sabotaged. Model coverage grows with each protocol revision.
Entropy (SP 800-90B) A conditioned multi-source pool folded into group sender-key roots; device keys are drawn from the OS CSPRNG. SP 800-90B health-test assessment on the primary path.

The five documented deviations behind the CNSA count, on the record — cited once, from audits/NIAP_2026_05_24/06_cnsa2_conformance.md as amended, and identical wherever the register is printed.

Deviation 1 — ChaCha20-Poly1305 as default AEAD

ChaCha20-Poly1305 is the default AEAD; AES-256-GCM is implemented and reserved as suite 0x0002.

X25519 is the classical half of the hybrid key agreement; the classical component of a CNSA hybrid is otherwise ECDH P-384, and the hybrid is what every session runs.

SHA-256 and HMAC-SHA-256 survive in a small set of integrity paths — the persisted ratchet-state tag, the Profile-ID derivation, per-item vault keys and the distress time-based code — below the SHA-384 floor; each moves to a new versioned label.

SHA-1 survives in exactly one place: the HMAC that RFC 8489 TURN requires for its message-integrity attribute. It is never part of the message plane or any QERYX-designed construction — and the distress time-based code runs HMAC-SHA-256, not SHA-1.

SLH-DSA is present as fail-closed scaffolding for a future suite and cannot be invoked.

The dossier enumerates what we close ourselves before entering formal evaluation: the recipient-blinding envelope (sealed-sender wire v2, specified and refused by default), the AES-256-GCM lane and its strict byte-framing flip, claim-versus-code corrections, fail-open backend defaults, and a zeroization sweep. Every item ships as a versioned format — zero interop-breaking changes.

CMVP module validation, CAVP/ACVP algorithm certificates, the SP 800-90B entropy assessment, on-silicon leakage testing, and AVA_VAN-class penetration testing are issued by accredited facilities. Our review readies them; it cannot issue them, and this site never claims otherwise.

Hold us to the maximal claim

The strongest sentence each primitive has earned. Nothing rounds up.

Honest-claim ledger — the claim we make today, pre-lab
PrimitiveThe claim we make today
ML-KEM-1024 Key encapsulation is ML-KEM-1024 as specified in FIPS 203 — 1,568-byte encapsulation keys, 3,168-byte decapsulation keys, 1,568-byte ciphertexts, 32-byte shared secrets, every size enforced at the boundary, implicit rejection on every decapsulation. The boot known-answer test checks a pinned decapsulation answer, not a round-trip. CAVP validation of the implementation is a laboratory step we have not taken.
ML-DSA-87 FIPS 204-conformant parameters, hedged signing, unique domain-separated contexts; strict byte-framing lands with a staged, versioned flip; ACVP pending.
Hybrid KEX X25519 + ML-KEM-1024 through an SP 800-56C-shaped combiner, ML-KEM-first keying material, contributory check on the default path. Secure if either component holds.
ChaCha20-Poly1305 RFC 8439 AEAD, verify-before-release, key-committing — a partitioning-oracle defense on by default.
AES-256-GCM No claim yet. Implemented and reserved as suite 0x0002; claimable once sessions select it and CAVP validates it — not before.
HKDF-SHA-512 RFC 5869 / SP 800-56C Rev 2 extract-then-expand under frozen QERYX- domain separation; anchored by boot known-answer tests.
QSEED / QRNG A conditioned multi-source pool the relay refills and the client folds into group sender-key roots; device keys are drawn from the OS CSPRNG. Each refill records the name of every source that contributed and the reason any source was rejected. SP 800-90B assessment on the primary path pending.
Q-Entangle-Bell A session key can additionally be bound to a CHSH-verified, Tsirelson-window-validated Bell-game transcript both peers seed and any auditor can verify — after both peers complete the Entanglement Ceremony. The operator-signed quantum-processor lane is designed and not active on any deployment. Bell-binding sits above the X25519 + ML-KEM-1024 floor, never below it.
Key transparency (KTS) 2-of-3 multi-witness quorum that starts dormant — all three ML-DSA-87 slots and all three external Ed25519 auditor slots hold placeholder keys, so no cosignature is carried and no witness check runs yet. Every root, until the witnesses enroll, is signed by one operator ML-DSA-87 key, which your device verifies against a SHA-384 anchor compiled into the app and cross-checks peer-to-peer through gossiped log roots. Enrolling a witness takes a new app release, by design.
Zero-knowledge relay The relay is content-blind: message, channel, and mail payloads are ciphertext-only bytes it never decrypts, and the iPhone vault’s items never reach it at all — a synced vault sends only a sealed, padded manifest. Metadata claims stay qualified — see the storage row below.
Sealed sender The stored row carries no author, and the relay’s own log lines on that path carry none either. The relay does authenticate every send, so this is a property of the record and the logs, not of the moment of sending. An envelope that blinds the recipient as well is implemented and refused by default. We do not market operator-blindness until it carries traffic.
Server storage Group names and descriptions and all content are end-to-end encrypted; the group avatar, the admin and owner identifiers, and the roster of accounts each conversation delivers to are held by the relay for routing. Sender identifiers are stripped from the stored message row (sealed sender), though the relay authenticates the sender at send time and keeps a per-direction pair counter for up to 180 days. Sealed sender covers text-class messages and small payloads: an image, and any voice or video frame over the envelope budget, is delivered on a lane that does name the sender to the relay for as long as the row lives. Undelivered messages queue with routing metadata under a published retention ladder.
Onion routing (QLEAP) QLEAP is in development; this row scopes the construction, never a built feature. As built: unlinkable against network observers and a compromised hop subset; operator-unlinkability arrives with multi-operator federation, and is not claimed before it.
Software updates No update-authenticity claim. The build-attestation manifest format (ML-DSA-87, ctx QERYX-attest-v1) is in the tree; the public trust-root registry is not yet claimed.
Deniable constructions No deniability claim. The construction is present in the tree, not claimed.

Read the canary, and know how to read it

A canary only works if silence is loud. So here is the silence.

Stale — treat as revoked by its own semantics

The last canary statement is dated 2026-04-18. The monthly reissue it promises has not followed. By the published semantics below, a canary not renewed by the 15th of the following month is a revocation signal — so until a fresh dual-signed statement publishes, read this canary as revoked and weigh the architecture on its own terms. The canary badge returns when the reissue ceremony completes and the monthly cadence resumes — then, and only then.

Last statement
2026-04-18
Promised cadence
Monthly, renewed by the 15th of each following month.
Signing scheme
Dual signatures — an offline-held classical key plus a parallel ML-DSA-87 key; either failing to verify is itself a revocation.
Clauses affirmed
Five, independently revocable: no national-security letters; no FISA 702 directives; no gagged production or preservation orders; no compelled key disclosure, backdoor, weakened algorithm, or targeted build; no compelled silent companion-device link.
Reading the canary — the published semantics
ObservationMeaning
Fresh statement monthly All five clauses present, both signatures verify — all clear.
No update by the 15th Revocation signal. Assume compelled silence. This is the current state.
A clause disappears Targeted revocation — a process in that category has been received.
Signature fails Key compromise or impersonation. Do not trust the statement.
Log entry unresolvable The statement may be presented off the append-only transparency log. Do not trust it.
Freshness proof stale The embedded news fingerprint is older than 7 days — possible replay. Do not trust it.

The canary is additional to the architecture, never a substitute for it. Even with every clause dropped, the relay could not produce plaintext — it never held any. What it does hold is on the record in the storage row above and the retention ladder on /messenger/privacy.

Take the artifact, or read the gate holding it

An artifact appears here signed and dated, or it appears as the gate that is holding it. Never as a dead link.

  1. 01 PUBLICATION PENDING

    Evaluator dossier

    The consolidated internal pre-evaluation dossier — our own self-assessment: Security Target skeleton, Protection-Profile conformance matrix, assurance-gap ledger, per-requirement verdicts, honest-claim ledger.

    Unlocks: the publication-mode ruling (full text + digest, or summarized). Its verdict and load-bearing tables already ship on this page. The dossier page states its own absence.

  2. 02 V2.0 REISSUE PENDING

    Evaluation kit

    Nine documents for an evaluator’s cryptographer — conformance maps with file-and-line citations, threat model, attack surface, benchmarks, audit history, FAQ.

    v1.0 (2026-05-01) is archived: it predates the dossier and carries one wording its own audit later corrected. Unlocks: the v2.0 reissue pinned to the current tree. Intake through the evaluation channel.

  3. 03 REGENERATION PENDING

    SBOM

    A reproducible software bill of materials generated by a script in the tree, covering the Rust and client dependency graphs with license review.

    The last generated SBOM (2026-04-30) is pinned to an older commit and unsigned — stated, not hidden. Unlocks: regeneration against the release tree plus a release-key signature.

  4. 04 TRUST ROOT NOT YET CLAIMED

    Build attestation

    The attestation manifest format is in the tree (ML-DSA-87, ctx QERYX-attest-v1) and signs build outputs.

    Unlocks: the public update-authenticity trust-root registry. Until it ships, no verified-update-chain claim appears anywhere on this site.

  5. 05 SUMMARIZED ABOVE

    Internal pre-evaluation

    Our own self-assessment behind the CNSA wording, latest pass 2026-06: 0 algorithm-layer non-conformances, 5 documented deviations — always cited together, never split. It is not a laboratory report.

    The full self-assessment ships inside the evaluation kit reissue.

  6. 06 DISCLOSURE RULING PENDING

    Subprocessor register

    A register that hides its entries is not a register. This site names no outside vendors anywhere — the register will be the one place that does.

    Unlocks: the naming-exception ruling. It then lists every subprocessor, its role, and its jurisdiction — complete or not at all.

Name the twelve adversaries

The threat model is a published register: capability, mitigation, and the residual risk we did not delete.

A1 — State-actor cryptanalyst

Assumes full source access, a decades-long harvest, and a cryptanalytic budget. Mitigation: hybrid X25519 + ML-KEM-1024 with ML-DSA-87 identity signatures — a break of either key-agreement leg alone does not expose payloads.

Pinned dependency set, a reproducible SBOM script, weekly dependency audit, and a build-attestation manifest format in the tree. Residual: a fresh dependency vulnerability can land between regenerations, and the update-authenticity trust root is not yet claimed — both stated in the artifact ledger above.

Spectrum-wide denial of cellular service. The transport layer fails over across six bearers; sustained denial degrades to text-only throughput. That degradation is documented behavior, not a hidden edge.

Every payload byte crossing the wire is end-to-end ciphertext, and the relay itself holds none of the keys. Residual: traffic shape — mitigated by the fixed padding-bucket ladder, and never claimed solved.

A peer is verified once, in person, through the Entangled pairing, where the two devices compare the check themselves. That pairing, a key-transparency Merkle log, and a pinned operator-key anchor close the first-contact window. The log’s 2-of-3 witness quorum is designed and not yet running: until the witnesses enroll, one operator ML-DSA-87 key signs every root.

An insider with full backend root reads ciphertext-only stores: no message bodies, no group names or membership plaintext, no session keys. Residual: timing and routing-identifier correlation at the metadata layer — under active remediation, and not marketed away.

Forward secrecy plus signed destruction roots mean the relay cannot retroactively decrypt rotated sessions — the ratchet heals when the next ML-KEM-1024 epoch opens, and there is nothing current to hand over. Residual: one escrow-shaped surface exists in the tree; it is disabled by build flag in release builds and disclosed in the audit history.

The ratchet heals at the next epoch — at most 100 messages1 — and long-term keys sit behind hardware-backed wrapping. Residual: an adversary with sustained device control reads until that next step; we say so.

Every long-lived ciphertext class that crosses the network — messages, pre-key bundles, group keys, a synced vault’s relay manifest — is wrapped with ML-KEM-1024, ahead of the standards deadline it answers to. The iPhone vault’s items never cross it: they stay on the iPhone.

Constant-time equality on every secret comparison and a constant-time backend for the post-quantum suite. Residual: on-silicon leakage assessment is an accredited-lab step — our posture today is structural, and labeled structural.

A decoy PIN opens a decoy vault under its own key, derived with its own salt, and never counts as a wrong attempt. Residual: a forensic copy of the phone shows that a second vault exists, and a captor who knows the mechanism can demand both PINs. No duress scheme deletes that fact; ours declines to pretend.

The power-up known-answer battery refuses to operate from an error state, device attestation folds into the root key, and volatile zeroization forecloses cold-boot residue on freed key memory.

Trace every number to its method

Every stat shipped on this site resolves here: how it is computed, where it comes from, and what it does not cover.

Measured
Benchmarked on named hardware with the harness in the tree. Raw-run tables publish only when they can publish true.
Counted from source
Computed from the pinned tree while the page builds. A missing tree fails the build — a stale count cannot ship.
Enforced constant
A protocol or wire constant the code pins. The number is the constant, checkable at the named module.
Observed behavior
What the system answers. Verifiable with any client once QERYX arrives, no trust in this page required.
Negative capability
A zero that states what the system cannot do — verified by reading the path that would have to exist.
Design target
A stated KPI for a product still in development. Explicitly not a measurement, and labeled on its page.
Record
A dated fact about our own artifacts — fleet counts, review scores, document counts — cited to the artifact.
External figure
Published third-party research, quoted approximately and at category level, for context only.
Homepage — the deadline algorithms

built on the deadline algorithms Counted from source

ML-KEM-1024 and ML-DSA-87 run under pinned known-answer tests at every boot (crypto-core/src/fips_module.rs); the deadline is the published CNSA 2.0 transition timeline.

Scoped by the canonical wording in section 02: asymmetric core, with the AEAD deviation documented.

100 messages · 7 days Epoch trigger

The Q-Ratchet epoch triggers: a fresh ML-KEM-1024 encapsulation is requested at a hundred messages or seven days, whichever the epoch owner reaches first (crypto-core/src/quadruple_ratchet.rs).

The peer that owns the epoch exit opens it on its next send, so a conversation with nothing sent back does not rotate on schedule.

9 buckets · 256 B – 64 KiB Enforced constant

The nine-step payload ladder MessageBucket in ios/Qeryx/Services/WebSocketService.swift, applied to every content payload and to typing and receipt frames before they leave the device.

Hides length within the ladder, not the existence of traffic; cover frames use their own size policy.

10–25 min Enforced constant

The delivered-row grace default and the sweep interval in the relay’s purge job; the row is removed by a hard SQL DELETE, not a flag.

During the grace the ciphertext still exists. The app’s Server-erased line rises only after the relay answers that its copy of your newest delivered message is gone (probeMessageErased, under VanishRulings.surfaceV2). A message read with Stealth Mode on or read receipts off, and a sealed group message, is retired without a receipt the relay can match, so its row waits for the offline horizon instead (confirm_delivery_scoped, the retire lane). A photo, video or file is not on this clock: it is stored apart and kept until its own expiry, 45 days after upload by default (file_blob_retention_days), unless its sender deletes it sooner.

20 ms Enforced constant

One ChaCha20-Poly1305 key per voice packet, derived on a 10 ms frame clock with a symmetric chain ratchet every 200 packets (ios/Qeryx/Services/CryptoService.swift, crypto-core/src/evs.rs).

3,000 frames Enforced constant

The ML-KEM-1024 rebase interval on the video plane, counted in frames rather than seconds so a paused sender cannot stretch it by idling.

Voice keys its ML-KEM-1024 half once per call; the in-call rebase for voice is a protocol-revision item, and this page will carry its number when it ships.

0 public-IP candidate paths Negative capability

Call media routes relay-only by construction; the path that would expose a peer address is not offered.

1 ciphertext per member Enforced constant

Every Q-GroupCipher rotation issues one fresh ML-KEM-1024 ciphertext per member — no shared shortcut.

100 messages per epoch Enforced constant

The group post-quantum rotation epoch — the same law as the 1:1 ratchet window above.

10 min Enforced constant

The delivered-row hard-purge grace default in the relay’s purge job, published by the relay at /api/v1/transparency/retention and read from the same constant at build time.

During the grace, ciphertext still exists. The page says so in the same sentence as the number.

30 days Enforced constant

The offline-queue horizon for undelivered ciphertext, operator-tunable between 1 and 90 days; the stated value is the default the relay publishes.

ML-DSA-87 destruction roots Counted from source

Erasure roots are signed with FIPS 204 signatures you will be able to verify against the published context string.

vault: m ≥ 128 MiB · t ≥ 3 · p = 4 Enforced floor

The in-app vault calibrates Argon2id on the device to a time budget; the calibrator clamps its result up to ARGON2_PROFILE_BALANCED in crypto-core/src/argon2_password.rs so a manipulated clock can only raise the cost.

It is the cost of each guess at a vault's PIN. A vault draws its key at random, so a right PIN yields that key still sealed by the iPhone's Secure Enclave, or, where the Enclave refused the key, in a software envelope a copied keychain also opens. The calibrator errs only on a malformed call or a panic (qeryx_vault_argon2_calibrate); then the app seals at its own fallback floor, which is lower.

local backup: m = 256 MiB · t = 4 · p = 2 Enforced constant

argonMemoryKiB = 256 * 1024, argonIterations = 4 in ios/Qeryx/Services/Backup/Argon2idLocalBackupService.swift — the passphrase-sealed local backup.

relay: m = 64 MiB · t = 3 · p = 4 Enforced constant

ARGON2_M_COST_KIB = 65536 in backend/src/services/mod.rs — the relay sign-in hash, with a rolling rehash on sign-in.

≥6× the floor · 19 MiB hard reject Record

The 128 MiB vault floor against the 19 MiB Argon2id memory floor in the OWASP password-storage guidance, rounded down; anything below 19 MiB is refused outright by the library.

The guidance floor can move; the comparison is dated to this revision.

≥384 MiB-passes · 0 vault items the iPhone app sends the relay Negative capability

Net work at the vault floor is m × t = 128 MiB × 3. The iPhone app sends the relay no vault item: its items stay on the iPhone, and a synced vault sends only a sealed, padded manifest.

3 ms · ~600 ns Measured

Full three-hop post-quantum circuit handshake and per-packet three-layer onion wrap, measured on a flagship-class phone with the crypto-core bench harness over the QLEAP modules (crypto-core/src/qleap_pq.rs, qleap_hybrid.rs), over repeated runs.

Device-scoped. Raw-run tables publish here when they can publish true; until then the method is stated and the number stays scoped to its hardware.

84 B per packet Enforced constant

The fixed layered framing — three onion layers of AEAD tag plus nonce material — computed from the wire format, not measured.

4 relays · 2 circuits Record

The relays listed in the ML-DSA-87-signed relay directory on the build date.

A directory count, not a capability claim. Status and latency stay absent until they can publish true.

one read · 4 states · 0 content keys Observed behavior

The burn-after-read portal consumes its key at first unlock; its state machine enumerates locked, decrypting, decrypted, invalid; the mail plane holds no content keys — the decryption happens on your device.

t-of-n · 1 signature · 0 custodial Negative capability

Threshold signing: no single device holds a spendable key, the verifier sees one aggregate signature, and QERYX holds no accounts, balances, or keys.

0 lines of C/C++ · ≤2 bits Design target

Wadjet is in development. The trust-boundary language target and the fingerprint-entropy KPI are stated design constraints, and the page labels them design targets in the same breath.

Nothing on the Wadjet page is a QERYX measurement.

~70% of memory-safety CVEs External figure

Published analyses of memory-safety bug shares across major browser and systems codebases; quoted approximately, at category level, for context.

Not a QERYX measurement and not a claim about any named product.

94 / 100 Enforced constant

The app audits its own cellular privacy and refuses itself the last six points while the server reports rotationReal: false. The cap is the honesty mechanism, in code.

6 bearers · 0 invented coverage figures Counted from source

The HYDRA transport registry (crypto-core/src/hydra.rs); coverage numbers appear only when a real coverage source exists — none do, so none appear.

100% listed = built Record

The capability list on the page is the contract: everything listed is built, nothing unlisted is claimed, and the assistant’s prompt path is disclosed rather than hidden — see the privacy policy, section 03.

1 auth layer · 0 bytes persisted · 9 buckets Counted from source

QSEAL’s compartment gate is a single authentication layer; the Shadow ID surface writes nothing to app storage, the keychain, or disk; and text envelopes on the messenger socket snap to nine fixed sizes (ios/Qeryx/Services/WebSocketService.swift). Decoy frames are shaped against recent real traffic rather than snapped to that ladder — the Underground compartment is in development.

crypto-core label / test / KAT counts Counted from source

The /stack/crypto-core page recomputes its three headline counts from the tree on every build — registered QERYX- domain separators in labels.rs, test functions across the library, and the boot known-answer battery. A missing tree fails the build.

The numbers move with the tree by design; they are correct for the build you are reading.

0 plaintext columns · 10 min · 5 min Enforced constant

The ledger’s write path is ciphertext-only by schema; hard-purge grace and timestamp coarsening are ledger constants — five minutes is the finest time the ledger will persist.

24 h · 5 min sweep · 6 AAD fields · 256 KB · 0 keys Enforced constant

Cache TTL classes and sweep cadence are configuration constants; the storage layer binds six fields into every blob’s AAD, chunks at 256 KiB (MEDIA_CHUNK_BYTES, crypto-core/src/q_pad_ladder.rs), and never holds a key.

1 ritual + 1 extract per epoch · 3 hops · 32 B Counted from source

Bell-binding adds one CHSH ritual and one HKDF extract per epoch; the bench that measures it is in crypto-core/benches/bell_integration.rs (cd crypto-core && cargo bench --bench bell_integration). Hop count and the 32-byte HKDF-SHA-512 session key are protocol constants.

94/100 · 11 of 13 closed Record

The internal adversarial review of 2026-04-30: a scored checklist with findings tracked to closure in the audit history.

An internal review run to an external-reviewer standard — not an independent lab result. Independent evaluation is the pending step, stated in section 01.

0 algorithm-layer non-conformances · 5 deviations Record

Counted from our own pre-evaluation, not an independent lab result — the same separation stated in section 01, and always shipped together with the deviation list, never split.

A number you cannot trace here is a defect. Report it through /contact and it is corrected or removed.

08The evaluator's questions — asked of this page itself

Interrogate this page.

Where is the full dossier?

Written, versioned, and pending its publication ceremony — the ruling on whether it ships as full text with a digest or as a summary. Its verdict and both load-bearing tables already ship on this page, verbatim. /trust/dossier states its own absence rather than pretending.

Because the mechanism only works if silence is loud. A canary section that quietly disappeared when stale would train you to ignore exactly the signal it exists to send. The honest state is printed, with the semantics that make it legible.

Internal adversarial reviews on a scored checklist, symbolic protocol verification with negative controls, and a boot-time known-answer battery in code. Independent, accredited evaluation is the pending step — that separation is stated in section 01 and never blurred.

Group names and descriptions and all content are end-to-end encrypted; the group avatar, the admin and owner identifiers, and the roster of accounts each conversation delivers to are held by the relay for routing. Sender identifiers are stripped from the stored message row (sealed sender), though the relay authenticates the sender at send time and keeps a per-direction pair counter for up to 180 days. Sealed sender covers text-class messages and small payloads: an image, and any voice or video frame over the envelope budget, is delivered on a lane that does name the sender to the relay for as long as the row lives. Undelivered messages queue with routing metadata under a published retention ladder.

Yes — that is the point. Every claim in the evaluation kit cites file and line in a pinned tree, the reproduction commands ship with it, and the boot battery re-proves the primitives on your own hardware. Start at the evaluation channel.

Next: Evaluation — bring your cryptographer