The sealed channel: analysed, not exempted

The sealed channel: analysed, not exempted

Encryption hides a surface; TEPP recovers it. The engine's question is who, never what — it reads the plaintext to find out, then discards it.

Reduction: peeling a private message

Reduction: peeling a private message

gift wrap · kind 1059
signed by a one-time key — verified, but never the author

gift wrap · kind 1059signed by a one-time key — verified, but never the author

seal · kind 13
signed by the sender → the recovered author

seal · kind 13signed by the sender → the recovered author

rumor · kind 14 — the message itself
unsigned; its pubkey must equal the seal's signer

["p", "<recipient>"] · replies, quotes, npubs in the text

rumor · kind 14 — the message itselfunsigned; its pubkey must equal the seal's signer["p", "<recipient>"] · replies, quotes, npubs in the text

Recovered surface
who sent it · everyone it names · everything it references — gated like any event, admitted only on the terms at right.
Then the plaintext is discarded: never stored, never logged, never published.
Layer by layer until nothing further decrypts (by default at most 8). One layer that will not decrypt leaves the whole message unreduced — and denied. NIP-04 is recognised, never decrypted.

Recovered surfacewho sent it · everyone it names · everything it references — gated like any event,admitted only on the terms at right.Then the plaintext is discarded: never stored, never logged, never published.Layer by layer until nothing further decrypts (by default at most 8). One layer that willnot decrypt leaves the whole message unreduced — and denied. NIP-04 isrecognised, never decrypted.

A TEPP signer
A client reaches the subject's key only through these three — so switching clients bypasses nothing.

A TEPP signerA client reaches the subject's key only through these three — so switchingclients bypasses nothing.

sign_event(template [, disclosure])
Runs output evaluation in full. An encrypted template is reduced first: its counterparty comes from the disclosure, the locus's record, or a search over the people it may talk to.

sign_event(template [, disclosure])Runs output evaluation in full. An encrypted template is reduced first: itscounterparty comes from the disclosure, the locus's record, or a search overthe people it may talk to.

nip44_encrypt(recipient, plaintext)
Runs output evaluation up to coverage: the recipient is an element and needs an interact grant. Ciphertext only on permit.

nip44_encrypt(recipient, plaintext)Runs output evaluation up to coverage: the recipient is an element and needsan interact grant. Ciphertext only on permit.

nip44_decrypt(counterparty, ciphertext)
Runs the input verdict over the recovered surface, seeking the hit on the recovered author. On permit it returns the plaintext of the layer it was asked for — nothing on deny.

nip44_decrypt(counterparty, ciphertext)Runs the input verdict over the recovered surface, seeking the hit on therecovered author. On permit it returns the plaintext of the layer it was asked for— nothing on deny.

The policy read: decrypting TEPP's own sealed artifacts — a current guardian's sealed carrier or offer, the subject's association — is answered without a verdict.
Every other key-using method is refused, NIP-04 included.

The policy read: decrypting TEPP's own sealed artifacts — a current guardian'ssealed carrier or offer, the subject's association — is answered without a verdict.Every other key-using method is refused, NIP-04 included.

The regime of the sealed channel

The regime of the sealed channel

Inbound — gated at every enforcing locus. A private message is admitted only through an interact grant on its recovered author, or as the subject's own copy — never because of the relay it arrived on.

Outbound — exactly as permissive as the open channel: a sealed send needs what a public mention needs, no more and no less.

Narrowing — only by restriction, written with opacity: opaque:
• on one permission — e.g. school friends can be tagged in public but not messaged privately;
• in the global set — no private messages to anyone, guardians included.

No middle setting — a permitted private channel is private, guardians included. Nothing copies a guardian into it.

Storage is not correspondence — what the subject encrypts to itself (a private list, a draft) is not reached by the opacity axis.

Inbound — gated at every enforcing locus. A private message is admittedonly through an interact grant on its recovered author, or as the subject'sown copy — never because of the relay it arrived on.Outbound — exactly as permissive as the open channel: a sealed sendneeds what a public mention needs, no more and no less.Narrowing — only by restriction, written with opacity: opaque:• on one permission — e.g. school friends can be tagged in public but notmessaged privately;• in the global set — no private messages to anyone, guardians included.No middle setting — a permitted private channel is private, guardiansincluded. Nothing copies a guardian into it.Storage is not correspondence — what the subject encrypts to itself (aprivate list, a draft) is not reached by the opacity axis.

The engine reads — then forgets
Where it can reach the key, the engine reads the subject's private messages, both ways, to learn who they involve, and discards the plaintext. The engine is the subject's own: nothing is hidden from the subject by it.

The engine reads — then forgetsWhere it can reach the key, the engine reads the subject'sprivate messages, both ways, to learn who they involve, anddiscards the plaintext. The engine is the subject's own: nothing ishidden from the subject by it.

The household keeps who, never what
The trace at the device names the correspondents. The locus's reduction record remembers recipients and surfaces, never content — and never leaves the locus.

The household keeps who, never whatThe trace at the device names the correspondents. The locus'sreduction record remembers recipients and surfaces, nevercontent — and never leaves the locus.

Oversight sees volume and timing
Where a permission routes a monitor copy, a sealed send reaches it as ciphertext — but signed by the subject: a public, attributable record that a message was sent, then.

Oversight sees volume and timingWhere a permission routes a monitor copy, a sealed sendreaches it as ciphertext — but signed by the subject: a public,attributable record that a message was sent, then.

Honest limits
Recognition is structural: an unknown scheme, or a message hidden in an ordinary-looking note, is not detected. Where the guardian is the threat, TEPP is not the remedy.

Honest limitsRecognition is structural: an unknown scheme, or a messagehidden in an ordinary-looking note, is not detected. Where theguardian is the threat, TEPP is not the remedy.

TEPP Zeta · diagram 13 · statements: OPQ-001–OPQ-127, SURF-033–SURF-044, IN-019–IN-025, OUT-037, RESTR-032–RESTR-036, TOOL-036–TOOL-042, NF-063–NF-081