From 564f35539630ad62c03a09832d3a536b617e0f11 Mon Sep 17 00:00:00 2001 From: Lann Martin Date: Wed, 26 Aug 2026 10:06:58 -0400 Subject: [PATCH] Relay posture follows the delivery artifact: public default for static, bundled for full-stack MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The fourth headline open question closes as a direction: the turnkey static scripts default to a project-affiliated public relay instance, which preserves the metadata note's split view without anyone choosing it — the origin operator sees code fetches, an unrelated relay sees contact timing, no one party holds both. The full-stack self-host bundles its own relay and skips the public default; that operator does see both halves, acceptably, because the operator is the user. A configurable default in both artifacts, not a hardwired one. The parked metadata-privacy bullet's related question resolves with it. --- NOTES.md | 27 +++++++++++++++++++++++---- 1 file changed, 23 insertions(+), 4 deletions(-) diff --git a/NOTES.md b/NOTES.md index 6d193366..332058a3 100644 --- a/NOTES.md +++ b/NOTES.md @@ -326,6 +326,18 @@ self-hosting, with the explicit goal that neither is the degraded tier. deployment is a single origin, fine for a personal instance, and the checker should report which posture it verified rather than pretend the two are identical. +- **Relay posture follows the delivery artifact.** Recorded 2026-08-26 + from design discussion; direction, not final ruling. The turnkey + static scripts/instructions default to a public relay instance + (project-affiliated), so the static path keeps the **split view** + from the metadata note under + [Parked and candidate non-goals](#parked-and-candidate-non-goals) by + default: the origin operator sees code fetches, an unrelated relay + sees contact timing, and no one party holds both. The full-stack + self-host bundles its own relay and skips the public default — one + operator does see both halves there, and that is acceptable because + the operator is the user. A configurable default, not a hardwired + one, in both artifacts. - **Shells beyond the tab.** A "native" (webview) app shell, eventually. A webextension is on the table in two roles, separately decidable: an app shell, and a **visor trust root for hosted @@ -2431,9 +2443,12 @@ pair/resume/check green, invariants 9/9. - **Metadata privacy**: relays, push services, and origins see traffic timing and contact-graph shape. State as an explicit v1 non-goal - rather than let it be discovered. Related open question: relay - operated by the origin operator (one party sees code fetches *and* - contact timing) vs independent relays (split view). + rather than let it be discovered. The related relay question is + answered — see the relay-posture bullet in + [Who runs home origins](#who-runs-home-origins): the static path + keeps the split view by default (origin sees code fetches, an + independent relay sees contact timing); the full-stack self-host + knowingly collapses it onto the user themselves. - **Browser support floor**: answered — see the Browser floor note in [The substrate](#the-substrate). Safari's floor is a future JSPI + wasm multi-memory release (hoped early 2027); the worst cases that @@ -2508,6 +2523,10 @@ Tracked as issues; the headline ones, verbatim from the discussion: - Does Safari have to work at launch — answered: no; see the Browser floor note in [The substrate](#the-substrate) (a future JSPI + wasm multi-memory Safari, hoped early 2027). -- Relay: bundled with the origin operator or independent by default? +- Relay — answered: posture follows the delivery artifact; see + [Who runs home origins](#who-runs-home-origins). Turnkey static + defaults to a public relay instance (split view preserved); + full-stack self-hosting bundles its own and skips the public + default. - Does the home origin ever serve per-user content? - `user@host` discovery: wanted, or out-of-band only?