RELAY

Relay is the second-generation successor to the GhostComm prototype, and a clean-room rebuild rather than a refactor: new protocol, new core architecture, new trust model, new product surface. Nothing is inherited except the lessons.

A small, hard, portable core engine owns identity, cryptography, framing, routing, the message store and the power scheduler. Below it sits a thin platform transport — Kotlin on Android, Swift on iOS — that does nothing but move opaque byte arrays over BLE. Above it sits a presentation layer that renders state and dispatches intents, and is never trusted with a key, a plaintext or a routing decision.

Each of the three layers can be replaced without touching the other two, and the core can be exercised end to end in a deterministic simulator with zero radios present.

Ten invariants govern the design; a change that violates one is rejected regardless of how well it is written. No server, ever — not for bootstrap, not for discovery, not for the first message. No internet dependency of any kind at runtime. No identity: no phone number, no account — identity is a keypair that never leaves the device. No location services. Encrypted at every hop: relays carry ciphertext they cannot read, addressed to recipients they cannot identify, from senders they cannot name. Local-only, hardware-backed storage. Zero telemetry — the app never phones home because there is no home to phone. Fail closed. The battery is a user-facing feature. And honesty about limits.

Relay is in specification. The protocol, RLY/3, is at draft; the core engine is a compiling scaffold; the applications are skeletons. It has not been independently audited, and its own documentation says so plainly: it protects nobody yet. That sentence is removed only when it stops being true.