The design from the previous commit gets its first code: strongly
typed identifiers, a versioned envelope with a strict binary codec, a
freshness gate that fails closed on conflicting checkpoints, a
protected outbox that refuses to seal or upload before freshness
confirmation, the authoritative group-state machine, real
Ed25519/X25519 account identity with domain-separated signatures, an
Argon2id-bounded password vault, purpose-bound AES-256-GCM local
record protection with atomic snapshots, encrypted file manifests and
chunk streams, and a two-stage opaque Telegram document carrier. All
of it sits behind replaceable boundaries; the MLS engine itself stays
deliberately unselected, and nothing here is production cryptography
yet.
The library lands as an OBJECT target linked into Telegram. Its cmake
file has to be added by force: a bare "cmake" pattern in .gitignore
swallows any new file under Telegram/cmake, and a build recipe that
exists locally but never reaches the repository is exactly the kind of
breakage that only shows up on someone else's machine.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
8ab3566031