Roadmap

What is not done, in roughly the order it matters. Listed here rather than left for someone to discover in the source. Items move to features when they ship, not when they are started.

An Android client

iOS now carries the protocol in full: end-to-end encryption, post-quantum key agreement and identity, key-log verification and gossip. It has still never shipped — there is no signing team and no release channel — but the engine is there and is checked against the web engine on every test run.

Android does not exist at all. Not a partial implementation: no engine, no client, no interop harness entry. Until one exists, a conversation gets these guarantees only when both ends are web or iOS, and the specification's status tables mark every Android column accordingly rather than leaving it implied.

Private group membership

The relay stores group rosters and enforces them, so it knows exactly who is in every group — the largest remaining metadata leak. The design that fixes it is now written down in §22: membership as an anonymous credential the relay can verify without enumerating. What §22 also records is the part that does not follow from it — fan-out is per device, so a relay that cannot read a roster can still reconstruct one by watching who receives the traffic. That second half is larger than the first.

Anonymous sender credentials

Sealed sending is gated by a delivery key, which is a shared secret: cutting off one person means rotating for everyone. §21 specifies the construction that fixes it properly, and — more usefully — records why the obvious shortcut is a trade rather than a win. Per-contact keys would buy selective revocation at the cost of giving the relay a stable pseudonym for each sender, which is a metadata regression. It is not implemented for that reason, not because nobody thought of it.

External audit

No third-party audit has been done. This is the one item on this list that cannot be closed by writing code — it needs a firm and a budget, which is what donations are for.

What has been done is the preparation: a scope document setting out the trust boundaries, the assets in order of consequence, what is deliberately out of scope, and five falsifiable claims we would like attacked. Auditors spend their first hours working out what a system is; that part is now given away rather than paid for twice.