diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-10-15 02:06:35 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-10-15 02:06:35 +0200 |
| commit | 419af660eeb8a4403e37a63c54a15586d04d5a8e (patch) | |
| tree | b0c0cdd831a5fb2864d5bedf581681aa0ec86023 /docs/MESHBAY_DESIGN.md | |
| parent | 47583c5e405f3011a526df73cc9485c46598f214 (diff) | |
| download | meshbay-419af660eeb8a4403e37a63c54a15586d04d5a8e.tar.gz | |
feat(cli): chat — Tier 2 check on the signing device, interactive room
Each message's signing device is checked against the group's roster as the
page checks it (a port of transport-roster.js, held to it by the parity
test): chains of countersignatures walked from each account's roots, the
keys accepted per account and node kept in the store, the roster read again
once before a key is called changed. Only "changed" is said, under the
message; --json carries every verdict.
chat with no group opens the interactive chat: the groups, then one group's
conversation IRC-style with pushed messages arriving live and a line to
write in; Esc or /part goes back to the groups, /quit or Ctrl+Q quits. Like
the bare command, it opens on the sign-in screen when nothing is stored.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 799b162..561ac82 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -3056,9 +3056,13 @@ epoch key from `chat_keys_req`, a message sealed under the current epoch through the sending device's derived subkey and signed with its key on the node, which must be the device `device_hello` named. A stored message is read signature first, then key, then content, and one that fails any of them is shown as -unreadable, never left out. The name shown is the one sealed by the sender; the -roster check that the signing device belongs to the account the node names -(Tier 2, §3.3) is the application's and not done here. +unreadable, never left out. The name shown is the one sealed by the sender, and +the signing device is checked against the group's roster as the application +checks it (Tier 2, §3.3): chains of countersignatures walked from each account's +roots, the keys accepted per account and node kept in the store, the roster read +again once before a key is called changed — and only "changed" is said, under +the message. `chat` alone opens the interactive chat: the groups, one group's +conversation IRC-style with what the node pushes arriving live, and back. **Deleting** (`rm`) is `file_delete` signed with the machine's key on the node (§5.4): the node accepts the uploading account's devices and the operator's. |