A sync-first, end-to-end encrypted messenger with a stateless Rust backend and client-owned data.
The server is a dumb relay and mailbox — clients own their keys, history, and trust.
No central message database.
No plaintext on the server.
No required phone numbers or email addresses.
This project treats documentation as the primary interface — for humans and agents alike.
- End-to-end encryption on the client, browser-first
- Megolm message encryption
- Backup-secret-derived key sharing
- Stateless Rust server
- S3-compatible storage for encrypted messages and media
- Sync-first delivery with explicit offline behaviour
- Invite-based identity discovery
Early development, but the wire format and storage layout are stable and well-tested — breaking changes are avoided, not expected.
June 2026 — the backend has been rewritten from Go to Rust (ADR-0019); v0.1.14 is the first Rust release, v0.1.13 the last on Go. The HTTP API and S3 storage layout are unchanged, so existing clients are unaffected — live devices stayed authenticated straight through the swap.
To run locally, see CONTRIBUTING.md.
Vision keeps the soul.
ADRs keep the why.
Specs keep the shape.
Invariants keep the truth.
Tasks keep the next step.
Tests keep the agent honest.
Commits keep the story readable.
Simple is better than clever.
Explicit is better than assumed.
Boring is better than surprising.
Small is better than sweeping.
Reliable is better than impressive.
Recoverable is better than magical.
Understandable is better than convenient.
Documented is better than remembered.
Tested is better than hoped for.
Deleted is better than unused.
Not yet is better than accidental.
Pragmatic is better than pure.
Agents optimise locally.
Architecture defines what "better" means globally.
The server is a relay, not a brain.
The client owns state.
Message identity is sacred.
Sync must be idempotent.
Failure must be explicit.
User experience must not expose infrastructure nonsense.
A local improvement that breaks vision, ADRs, specs, or invariants is a regression.
When in doubt, preserve the documented constraints.
This repository is public for transparency and reuse, not collaboration.
I'm not accepting pull requests or feature requests — the maintenance overhead is more than I can take on as a solo project.
You're welcome to fork and adapt under the Apache 2.0 license.
Apache License 2.0. See LICENSE for details.