Nym-native anonymous submission system (SecureDrop-style), using the Nym mixnet as transport instead of Tor. https://git.virebent.art/virebent/nymdrop/atom?h=main 2026-07-12T17:48:39+00:00 2026-07-12T17:48:39+00:00 Gab Virebent gabriel1@virebent.art 2026-07-12T17:48:39+00:00 urn:sha1:41d3abd30cb30be8a8e95c8396da5bb84ab72881 Extract reader logic (key management, embedded nym-client lifecycle, receive loop, decrypt, save) into internal/reader as a Hooks-driven package, shared by both the existing headless CLI and a new --gui mode built with Fyne. Add --data-dir to make a reader instance fully self-contained: privkey, inbox, and the embedded nym-client's own state (normally fixed to $HOME/.nym) all live under the given directory via a HOME override on the subprocess, enabling zero-trace USB operation. CLI default behavior is unchanged (same paths, same protocol) so the pietro deployment is unaffected. 2026-07-06T14:34:47+00:00 Gab Virebent gabriel1@virebent.art 2026-07-06T14:34:47+00:00 urn:sha1:16854e8b24a3b00d9d5dbd285bbe3b93ee47ce1c Reader now keeps the private key bytes and the per-submission ECDH/HKDF secrets in memguard.LockedBuffer (mlock + guaranteed wipe) instead of a manual zero loop. Added a regression test for the decrypt path. Message field gets a self-hosted Markdown toggle preview (no external library): headers, bold/italic, inline code, code blocks, blockquotes, lists, links. Output is HTML-escaped and link schemes are whitelisted before rendering. Submitted content is still the raw Markdown source, unchanged on the wire. 2026-06-20T01:07:45+00:00 Gab Virebent gabriel1@virebent.art 2026-06-20T01:07:45+00:00 urn:sha1:aa459e3b84cc4c5d908f3781c9253848c18640c3 End-to-end verified pipeline (browser -> HTTP relay -> Nym mixnet -> reader). Client-side X25519+HKDF+AES-GCM-256, no-log blind relay, AGPL-3.0.