diff options
Diffstat (limited to 'docs/FOG-MESSAGING.md')
| -rw-r--r-- | docs/FOG-MESSAGING.md | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/docs/FOG-MESSAGING.md b/docs/FOG-MESSAGING.md index 69b1ffd..6ac8456 100644 --- a/docs/FOG-MESSAGING.md +++ b/docs/FOG-MESSAGING.md @@ -74,6 +74,19 @@ recipient. Fixed envelope size also does not hide timing, polling, retries, or conversation activity unless the external traffic profile supplies sufficient cover and scheduling. +### 3.1 Asynchronous dead-drop model + +`fog-drop` is one cryptographic digital dead drop. `fog-mailbox` and `fog-im` +use sequences of rotating capability-addressed dead drops in FOG-STORAGE. The +sender and recipient do not need to be online together, and the recipient +Composer does not connect directly to a sender or replica. + +A blind relay MAY transmit bounded opaque polling work prepared earlier by the +Composer and queue opaque results for later controlled import. It cannot hold +mailbox capability roots, derive new semantic operations, decrypt results, or +turn relay receipt into a message acknowledgment. FOG-MESSAGING is +asynchronous and does not promise real-time delivery. + ## 4. Protocol Invariants ### MSG-INV-01: No global contact identifier @@ -141,6 +154,13 @@ Copying Composer files, restoring a stale backup, or adding a second device MUST NOT create two active copies of one ratchet. Restored conversation state enters recovery and requires a new authenticated session. +### MSG-INV-11: Ephemeral sessions do not resume + +A RAM-only Ephemeral Composer MUST NOT resume an identity, ratchet, voucher, +capability sequence, deduplication window, acknowledgment stream, or pending +delivery after shutdown. Continuing `fog-mailbox` and `fog-im` sessions require +the Persistent Composer state contract defined by `FOG-COMPOSER`. + ## 5. Contact Model ### 5.1 Pairwise identity |