Privacy, identity and the loom

Status: proposed architecture and research agenda. Evidence checked on 20 September 2026. Cryptography, peer discovery, messaging, plugin isolation and loom activation described here are not implemented RURAL features. Database implementation remains paused. Links identify primary sources; recommendations are RURAL design proposals unless explicitly attributed.

The promise and its boundaries

RURAL should let a person understand their entire working world without publishing that world. Documents, repository crystals, governance, analytics, relationships and conversations belong in one inspectable environment, with different access policies. “Everything visible” means visible to an authorized observer. A public scene, an activity counter or a similarity suggestion must not expose a private relationship accidentally.

The intended promise is durable user control, independently inspectable security and useful collaboration. “Uncrackable” cannot be an engineering guarantee. Post-quantum algorithms address particular mathematical attacks; compromised devices, coercion, malicious updates, metadata and authorized recipients remain relevant.

Cryptographic architecture: separate the jobs

Use symmetric authenticated encryption for document chunks, indexes, archives and message bodies. A key-encapsulation mechanism establishes shared secret material; it does not itself authenticate an identity or encrypt a database. NIST standardizes ML-KEM in FIPS 203, ML-DSA signatures in FIPS 204, and hash-based SLH-DSA signatures in FIPS 205. Its KEM recommendations guide correct use. Implementation profiles must track published errata as well as standard identifiers.

The proposed initial profile combines classical and post-quantum key establishment through a specified, reviewed combiner, with authenticated negotiation and downgrade rejection. Select exact algorithms, encodings and transcript binding through a separate reviewed protocol specification. Do not construct a hybrid by casually concatenating secrets. The target identity profile must include reviewed post-quantum authentication, such as ML-DSA signatures; classical Ed25519 authentication alone does not satisfy that target. Post-quantum confidentiality, post-quantum identity authentication and recovery after compromise are separate acceptance claims.

Use distinct keys for account identity, device authentication, storage epochs, messaging sessions, discovery, index encryption and release activation. An account root authorizes device keys; a device grant states allowed operations, expiry and authority epoch. Contacts can inspect identity fingerprints and device changes. Identity creation does not require a founder-issued private key or a hosted account.

Encrypt each object revision using an audited key-and-nonce strategy that remains unique across concurrent writers and restores. Associated data binds the logical store, object, revision, format and cryptographic suite. Remote identifiers should be opaque; global plaintext content hashes would expose equality across users. Any deduplication is confined to an explicitly authorized domain. Algorithm migration rewraps keys or rewrites affected ciphertext deliberately; a bad ciphertext never triggers a weaker fallback.

What dependency-free Zig can actually supply

The repository pins Zig 0.16.0. Static inspection of that release's lib/std/crypto.zig, crypto/ml_kem.zig, crypto/ml_dsa.zig and crypto/hybrid_kem.zig found the following primitives; the official release record identifies the toolchain version. The inspected crypto.zig has SHA-256 fa1d7e3a94a94f74e32be2bb6a0591225ea6eb57b0541b7ba3b02ea487c5c3ff. This is a source inventory, not an executed security assessment or certification.

The separate kem.kyber_d00 export is draft-era Kyber; it must not be confused with final ML-KEM. The inspected hybrid module references the CFRG concrete hybrid KEM draft, observed as revision 04. A draft reference requires exact version pinning, not a claim of settled interoperability.

Using Zig's standard library and operating-system randomness fits the no-third-party-runtime rule. Building an original application protocol still entails substantial cryptographic engineering. It does not make Signal interoperability, private set intersection, private approximate search or a sandbox appear automatically. Production gates include independent cryptographic review, reference-vector and differential tests, parser fuzzing, entropy-failure handling, side-channel assessment on supported targets, and compiler-version regression checks. No new cipher or home-designed cryptographic primitive is proposed.

Private messaging with database correctness

Signal is a protocol reference, not a component RURAL can claim to have embedded. PQXDH supports asynchronous establishment and post-quantum forward secrecy, but its published revision explicitly retains classical mutual authentication. The current ratchet specification includes the Triple Ratchet, combining classical and sparse post-quantum ratchets; ML-KEM Braid supplies a concrete sparse continuous key-agreement construction. Adopting these ideas requires a pinned, reviewed RURAL protocol profile. A classical Double Ratchet alone does not establish the complete desired post-quantum claim.

A proposed one-to-one send has four steps:

1. Check the current contact/device grant and select a verified session. Treat changed identities as a visible trust event.

2. Prepare the next ratchet state, authenticated ciphertext and unique outbox identifier.

3. Durably commit the state advance and exact outbox bytes together. Only after that commit may a transport send them.

4. Retry the stored ciphertext without advancing the ratchet again. The receiver durably couples accepted session state, message receipt and duplicate suppression before acknowledging.

This prevents a crash between “encrypt” and “remember” from reusing state incorrectly. It does not create exactly-once network delivery. Receipts distinguish locally committed, relay accepted, recipient received and recipient displayed. Bound skipped-message keys, ciphertext sizes, pending prekeys and expired sessions so hostile reordering cannot exhaust memory. Sesame explains why asynchronous multi-device session management and restored backups require their own design.

A database fork must never fork an active messaging identity. Fractal branches may inspect authorized historical records; their runtime sessions, nonce spaces and external outboxes need fresh identities or epochs. Backup restoration must re-establish live sessions under a restore procedure, not resume stale counters. An encrypted history archive intentionally preserves messages under an archive key; that retention weakens the erasure benefits one might otherwise expect from deleted message keys.

Group messaging is a later protocol track. MLS, RFC 9420, offers a group-security architecture, but its original suites are not a blanket post-quantum solution. Membership authentication, offline members, malicious delivery services and an audited post-quantum profile remain separate work. Neither encrypted messages nor sender-metadata reduction guarantee anonymity: Signal's sealed-sender design addresses one metadata exposure, not every traffic-analysis channel.

Finding common ground without publishing private thought

Private discovery should help two people decide to connect, then ask what they wish to share. A matching sentence is not permission to reveal its document, author, repository, embedding or surrounding context.

Start with local exact and semantic indexing. Opt-in discovery publishes a small discovery card containing a deliberately shareable topic or statement, intended audience, purpose, expiry and contact route. Users can preview precisely what leaves their device. A match opens a consent request; reciprocal consent creates a narrowly scoped grant. Documents remain private until separately shared. Card withdrawal stops future authorized use; it cannot erase a recipient's memory.

A plain hash of an identical sentence is not adequate protection. Guessable sentences can be enumerated, and stable hashes correlate people. Public salts do not prevent that attack. Normalization rules also need versions: case, Unicode normalization, whitespace and language handling determine what “identical” means.

An oblivious PRF can be a building block for a later exact-discovery protocol. RFC 9497 defines OPRF variants over prime-order groups; it is an IRTF informational specification, not a complete private-intersection service. Its defined elliptic-curve constructions are classical. Transporting them through an ML-KEM channel does not make their discovery guarantee post-quantum. A RURAL profile needs purpose and epoch separation, query budgets, malicious-peer analysis and a clearly stated leakage function.

Embeddings are sensitive derivatives, not anonymized text. Text Embeddings Reveal (Almost) As Much As Text demonstrates inversion attacks; its particular experimental results should not be generalized into a universal recovery rate. Do not upload a global embedding directory under the label “private matching.”

Advanced protocols are credible research paths, with explicit topology assumptions. Private Approximate Nearest Neighbor Search with Sublinear Communication uses two database replicas operated by non-colluding servers. That is not interchangeable with an arbitrary peer network. RURAL should benchmark concrete confidential-search candidates against local matching and deliberate disclosure, including bandwidth, adaptive-probing leakage and collusion. No performance number transfers automatically from a paper.

Offline connections, recovery and deletion

An offline connection remains a useful cached relationship, not a claim that the remote peer is present or consenting now. Its local record contains the peer pseudonym, last verified identity epoch, grant scope and expiry, content cutoff, revocation version and synchronization status. The world can show a muted connection and cached objects with an “as of” marker. Opening uncached private content waits for an authorized peer or an explicitly delegated encrypted mirror.

Freshness is an authority property. Cached permission must not authorize new network spending, ownership transfers or disclosure beyond its lease. Local operations on one's own data can continue. On reconnection, reconcile revocations and identity changes before delivering queued privileged actions. An expired lease cannot reliably be enforced against a hostile offline recipient who already has plaintext or its key; leases constrain compliant clients and future service access.

Recovery should offer understandable choices: an offline high-entropy recovery secret, another verified device, or an explicitly selected custodian arrangement. Recovery material unlocks account/storage continuity; it must not silently impersonate old messaging sessions. A password-derived wrapper requires memory-hard derivation and an honest offline-guessing threat model. Lost keys without a recovery path mean lost access, not a hidden founder override. Custodial recovery is an optional trust contract, never described as sole user custody.

Revocation stops future grants, rotates future key epochs and removes accessible cached derivatives where controlled. It cannot retract plaintext already learned. Deletion must track original objects, branch references, indexes, embeddings, archives, backups and replicas. Shared immutable blocks cannot be erased while another authorized retained object still needs them. Cryptographic erasure depends on eliminating every usable key copy and applicable recovery path; NIST SP 800-88 Rev. 2 provides the sanitization framework. A deletion receipt states which domains were erased, scheduled, retained or beyond control.

Do not place plaintext, personal identifiers or guessable sentence hashes on an immutable public chain. Optional commitments require a separate privacy analysis. Visible accounting can show the owner detailed activity while exposing only the minimum externally verifiable statement required by an economic protocol. Meter resource counts and scoped operation identifiers without copying message text or search embeddings into a billing ledger. Counts, timestamps and payment links can themselves reveal relationships, so aggregation and retention policies also need a disclosure budget.

Plugins and agents operate through grants

The extensibility goal is powerful tools without ambient access to a person's world. Prefer declarative transformations and typed queries first. Reviewed native Zig modules inside the database process are trusted code: they can access process memory and bypass application ACLs. “Written in Zig” and “dependency-free” are not security boundaries.

Untrusted executable plugins run outside the engine with narrowly framed IPC and operating-system enforcement. Grant explicit object sets, operations, network destinations, output limits, CPU/memory budgets and expiry; open only the needed handles. Linux Landlock and Apple's App Sandbox illustrate platform-specific facilities, not identical portable guarantees. Landlock's ABI capabilities and already-open descriptors require care; macOS packaging and entitlements require their own integration. If a promised isolation boundary is unavailable, refuse that plugin mode. A new WebAssembly runtime would be a separate engineering and audit commitment.

An agent receives task capabilities, never account roots or authority to grant itself more access. Evaluate current authorization when reading, expanding retrieved evidence and committing a mutation. A saved database branch or quoted governance document cannot resurrect a revoked grant. Repository text, peer messages and tool output are untrusted input to an agent; instructions found there do not authorize network calls or data export. Logs and Oracle context inherit the source data's privacy class. External model use requires a specific disclosure decision, with destination and material visible to the user.

The loom: sole activation authority, bounded meaning

The proposal preserves a privately held loom whose sole activation authority belongs to the founder. It controls when named platform capabilities become available: for example a marketplace, ownership-transfer protocol or economic mode. Its private location and signing material need not be public. Clients nevertheless need a verifiable public activation statement.

An activation manifest should bind a protocol version, network identifier, named capability, scope, monotonic activation epoch, policy and release hashes, validity interval, predecessor hash and migration requirements. Canonical encoding and domain-separated signatures prevent cross-protocol reuse. The founder can keep separate offline activation and release keys, with backups or multiple devices still under that same person's control. This does not introduce another political activation authority.

Release-distribution defenses should follow reviewed patterns such as separated metadata roles, expiry and rollback checks from The Update Framework specification, version 1.0.33. RURAL-specific activation remains a separate policy. Retained high-water marks must survive ordinary database forks; a restored installation must re-establish freshness before privileged network actions. Signed manifests alone cannot prevent equivocation: independent comparison or transparency witnesses must detect conflicting histories. Offline clients cannot know immediately that a key or policy was revoked.

Feature authority is not data authority. Activation cannot by itself decrypt another person's records, sign their transfer or make the founder their data owner. If “loom” instead means unilateral ownership or decryption of all private data, that conflicts with exclusive user custody. It would require an explicit, different custody contract; the whitepaper does not quietly assume one.

There is also an unavoidable software trust boundary: a founder trusted to sign executable updates could distribute code that exfiltrates keys after users install it. Narrow manifests do not prevent that. Reproducible builds, public review, delayed adoption, pinned versions, permission re-consent and independent verification reduce exposure. They do not justify claiming the founder is cryptographically incapable of abuse. Sole activation is deliberate central governance, even when storage and communications are decentralized.

Stages and falsifiable release gates

1. Local privacy foundation: specify encrypted formats, authority epochs, device roots and recovery. Test corruption, wrong keys, truncated objects, memory exhaustion and restore procedures. Measure encrypted CRUD latency and memory overhead before promising speed.

2. Verified two-party collaboration: reviewed session protocol, encrypted outbox and inbox, explicit device changes, limited relay. Crash at every state/send boundary; inject duplicate, reordered and delayed traffic; restore both peers; verify no nonce/state reuse and bounded resource use.

3. Consensual discovery and plugins: local similarity plus discovery cards; sandboxed tools on named platforms. Attempt dictionary probing, cross-tenant searches, path/handle escapes, malicious tool responses and permission changes during a query.

4. Advanced privacy: audited exact intersection, selected confidential semantic-search topology and post-quantum group protocol. Publish leakage contracts, adversary assumptions and reproducible benchmarks before deployment claims.

5. Loom-enabled network capabilities: independently review manifest verification, recovery and update authority. Test rollback, forked activation histories, stale clocks, revoked devices and founder-key loss. User export and local operation must survive unavailable activation services.

Each gate needs documented evidence and external review proportionate to its risk. Post-quantum primitives, a private repository and passing unit tests are useful foundations; none establishes a complete secure social system. The practical advantage is a coherent authority model that lets ordinary CRUD, branches, analytics and collaboration share one inspectable environment without sharing every secret.