From 419af660eeb8a4403e37a63c54a15586d04d5a8e Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 02:06:35 +0200 Subject: feat(cli): chat — Tier 2 check on the signing device, interactive room MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Each message's signing device is checked against the group's roster as the page checks it (a port of transport-roster.js, held to it by the parity test): chains of countersignatures walked from each account's roots, the keys accepted per account and node kept in the store, the roster read again once before a key is called changed. Only "changed" is said, under the message; --json carries every verdict. chat with no group opens the interactive chat: the groups, then one group's conversation IRC-style with pushed messages arriving live and a line to write in; Esc or /part goes back to the groups, /quit or Ctrl+Q quits. Like the bare command, it opens on the sign-in screen when nothing is stored. Co-Authored-By: Claude Opus 5.5 --- docs/MESHBAY_DESIGN.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'docs/MESHBAY_DESIGN.md') diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 799b162..561ac82 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -3056,9 +3056,13 @@ epoch key from `chat_keys_req`, a message sealed under the current epoch through the sending device's derived subkey and signed with its key on the node, which must be the device `device_hello` named. A stored message is read signature first, then key, then content, and one that fails any of them is shown as -unreadable, never left out. The name shown is the one sealed by the sender; the -roster check that the signing device belongs to the account the node names -(Tier 2, §3.3) is the application's and not done here. +unreadable, never left out. The name shown is the one sealed by the sender, and +the signing device is checked against the group's roster as the application +checks it (Tier 2, §3.3): chains of countersignatures walked from each account's +roots, the keys accepted per account and node kept in the store, the roster read +again once before a key is called changed — and only "changed" is said, under +the message. `chat` alone opens the interactive chat: the groups, one group's +conversation IRC-style with what the node pushes arriving live, and back. **Deleting** (`rm`) is `file_delete` signed with the machine's key on the node (§5.4): the node accepts the uploading account's devices and the operator's. -- cgit v1.2.3