Ferry

There's no trusted third party. A few things follow from that:

An unverified peer can do nothing. Deny-by-default, enforced at the Noise handshake before any frame is parsed as a command — never in the UI. Discovery isn't trust; a hostname on a network is an unauthenticated claim. Pairing needs an out-of-band short code and a verification phrase a human confirms, and it can't be skipped.

Sending is a local write, not a network call. The outbox row is written in the same transaction as the state change, and a dispatcher drains it when the peer is reachable. It's a familiar pattern used differently: usually an outbox exists so a failed side effect can't roll back a write, but here the peer being offline is the normal case, so it's the core abstraction rather than a safety net.

Expiry runs on the receiver's monotonic clock, starting at delivery. Two laptops on a hotspot disagree about the time, and the sender's clock is attacker-controlled. A ten-minute secret that sat queued for twenty minutes still gets its ten readable minutes once it lands.

Crypto is assembled from audited primitives, never designed. age, Noise XK, SPAKE2, ed25519. No novel constructions and no hand-rolled key derivation.

Dependency direction: daemon/cli → core → net/store/crypto → proto. Never the reverse. core can't import the daemon, an IPC type or anything UI-related, because it has to be drivable from the daemon, the CLI or a test harness with a fake network without changing.

The networking crate can't import the crypto crate, so the roster check arrives as an injected predicate over raw key bytes. Networking enforces it mechanically and never enters transport mode without a pass; the domain layer supplies the actual roster-backed decision. Neither layer can accidentally be changed into trusting the other.

proto holds types, enums and error codes only — no logic. The 37 TypeScript binding types are generated from it with ts-rs rather than hand-transcribed, and CI fails the build on any diff.

The daemon is the only thing that speaks the peer-to-peer protocol. Everything a human touches — the CLI, a VS Code extension, and a Tauri desktop shell over a 22-component React UI — talks to it over a length-framed local socket, and never to another machine directly.

That's why pairing lives in the CLI rather than the daemon. It needs a human to read a verification phrase aloud, and the daemon is headless with no guaranteed terminal. A step that requires a person can't live in a process that can't reach one.

The test bar is a docker compose harness that runs two daemons on a network and drives a genuine send, disconnect and reconnect between them. An in-memory two-node test tells me about the state machine; this tells me about a hotspot with a sleeping laptop on it.