<mxfile host="Electron" agent="tepp-omega-visual" version="29.3.0">
  <diagram name="The sealed channel: analysed, not exempted" id="13-sealed-channel">
    <mxGraphModel dx="1600" dy="900" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="1860" pageHeight="1030" background="#ffffff" math="0" shadow="0">
      <root>
        <mxCell id="0" />
        <mxCell id="1" parent="0" />
        <mxCell id="13-2" value='&lt;font style="font-size:30px"&gt;&lt;b&gt;The sealed channel: analysed, not exempted&lt;/b&gt;&lt;/font&gt;' style="text;html=1;align=left;verticalAlign=middle;fontColor=#1f2933;fontFamily=Helvetica;" vertex="1" parent="1"><mxGeometry x="40" y="24" width="1780" height="44" as="geometry" /></mxCell>
        <mxCell id="13-3" value="&lt;font style=&quot;font-size:17px&quot; color=&quot;#52606d&quot;&gt;Encryption hides a surface; TEPP recovers it. The engine's question is who, never what — it reads the plaintext to find out, then discards it.&lt;/font&gt;" style="text;html=1;align=left;verticalAlign=middle;fontFamily=Helvetica;" vertex="1" parent="1"><mxGeometry x="40" y="68" width="1780" height="30" as="geometry" /></mxCell>
        <mxCell id="13-4" value='&lt;font style="font-size:18px"&gt;&lt;b&gt;Reduction: peeling a private message&lt;/b&gt;&lt;/font&gt;' style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=15;fontFamily=Helvetica;fontColor=#1f2933;spacing=0;strokeColor=none;fillColor=none;" vertex="1" parent="1"><mxGeometry x="40" y="118" width="580" height="30" as="geometry" /></mxCell>
        <mxCell id="13-5" value='&lt;b&gt;gift wrap · kind 1059&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:12px" color="#52606d"&gt;signed by a one-time key — verified, but never the author&lt;/font&gt;' style="rounded=1;arcSize=14;absoluteArcSize=1;whiteSpace=wrap;html=1;fillColor=#e3e7ee;strokeColor=#56657a;strokeWidth=2;dashed=1;dashPattern=8 5;verticalAlign=top;align=left;spacing=14;fontSize=15;fontFamily=Helvetica;fontColor=#1f2933;" vertex="1" parent="1"><mxGeometry x="60" y="160" width="560" height="400" as="geometry" /></mxCell>
        <mxCell id="13-6" value='&lt;b&gt;seal · kind 13&lt;/b&gt;&lt;br&gt;&lt;font style="font-size:12px" color="#52606d"&gt;signed by the sender → the recovered author&lt;/font&gt;' style="rounded=1;arcSize=12;absoluteArcSize=1;whiteSpace=wrap;html=1;fillColor=#eef1f5;strokeColor=#56657a;strokeWidth=2;verticalAlign=top;align=left;spacing=14;fontSize=15;fontFamily=Helvetica;fontColor=#1f2933;" vertex="1" parent="1"><mxGeometry x="90" y="236" width="500" height="300" as="geometry" /></mxCell>
        <mxCell id="13-7" value="&lt;b&gt;rumor · kind 14 — the message itself&lt;/b&gt;&lt;br&gt;&lt;font style=&quot;font-size:12px&quot; color=&quot;#52606d&quot;&gt;unsigned; its pubkey must equal the seal's signer&lt;/font&gt;&lt;br&gt;&lt;br&gt;&lt;font face=&quot;Courier New&quot;&gt;[&quot;p&quot;, &quot;&amp;lt;recipient&amp;gt;&quot;]&lt;/font&gt;  ·  replies, quotes, npubs in the text" style="rounded=1;arcSize=12;absoluteArcSize=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#56657a;strokeWidth=2;verticalAlign=top;align=left;spacing=14;fontSize=15;fontFamily=Helvetica;fontColor=#1f2933;" vertex="1" parent="1"><mxGeometry x="120" y="316" width="440" height="190" as="geometry" /></mxCell>
        <mxCell id="13-8" value='&lt;b&gt;Recovered surface&lt;/b&gt;&lt;br&gt;who sent it · everyone it names · everything it references — gated like any event, admitted only on the terms at right.&lt;br&gt;&lt;b&gt;Then the plaintext is discarded:&lt;/b&gt; never stored, never logged, never published.&lt;br&gt;&lt;font style="font-size:12px" color="#52606d"&gt;Layer by layer until nothing further decrypts (by default at most 8). One layer that will not decrypt leaves the whole message unreduced — and denied. NIP-04 is recognised, never decrypted.&lt;/font&gt;' style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#56657a;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=14;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="60" y="590" width="560" height="176" as="geometry" /></mxCell>
        <mxCell id="13-9" value="" style="endArrow=block;endFill=1;endSize=7;html=1;rounded=1;strokeColor=#56657a;strokeWidth=2;fontSize=13;fontFamily=Helvetica;fontColor=#1f2933;labelBackgroundColor=#ffffff;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="340" y="562" as="sourcePoint" /><mxPoint x="340" y="588" as="targetPoint" /></mxGeometry></mxCell>
        <mxCell id="13-10" value="&lt;font style=&quot;font-size:19px&quot;&gt;&lt;b&gt;A TEPP signer&lt;/b&gt;&lt;/font&gt;&lt;br&gt;&lt;font style=&quot;font-size:12px&quot; color=&quot;#52606d&quot;&gt;A client reaches the subject's key only through these three — so switching clients bypasses nothing.&lt;/font&gt;" style="rounded=1;arcSize=14;absoluteArcSize=1;whiteSpace=wrap;html=1;fillColor=#b0e3e6;strokeColor=#0e8088;strokeWidth=2;verticalAlign=top;align=left;spacing=16;fontSize=15;fontFamily=Helvetica;fontColor=#1f2933;opacity=100;" vertex="1" parent="1"><mxGeometry x="660" y="118" width="560" height="648" as="geometry" /></mxCell>
        <mxCell id="13-11" value="&lt;font face=&quot;Courier New&quot;&gt;sign_event(template [, disclosure])&lt;/font&gt;&lt;br&gt;Runs output evaluation in full. An encrypted template is reduced first: its counterparty comes from the disclosure, the locus's record, or a search over the people it may talk to." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#0e8088;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=12;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="684" y="204" width="512" height="136" as="geometry" /></mxCell>
        <mxCell id="13-12" value='&lt;font face="Courier New"&gt;nip44_encrypt(recipient, plaintext)&lt;/font&gt;&lt;br&gt;Runs output evaluation up to coverage: the recipient is an element and needs an interact grant. Ciphertext only on permit.' style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#0e8088;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=12;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="684" y="356" width="512" height="136" as="geometry" /></mxCell>
        <mxCell id="13-13" value='&lt;font face="Courier New"&gt;nip44_decrypt(counterparty, ciphertext)&lt;/font&gt;&lt;br&gt;Runs the input verdict over the recovered surface, seeking the hit on the recovered author. On permit it returns the plaintext of the layer it was asked for — nothing on deny.' style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#0e8088;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=12;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="684" y="508" width="512" height="136" as="geometry" /></mxCell>
        <mxCell id="13-14" value="&lt;b&gt;The policy read: &lt;/b&gt;decrypting TEPP's own sealed artifacts — a current guardian's sealed carrier or offer, the subject's association — is answered without a verdict.&lt;br&gt;&lt;font style=&quot;font-size:12px&quot; color=&quot;#52606d&quot;&gt;Every other key-using method is refused, NIP-04 included.&lt;/font&gt;" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#0e8088;strokeWidth=1.5;fontSize=13.5;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=10;arcSize=8;absoluteArcSize=1;dashed=1;dashPattern=6 4;" vertex="1" parent="1"><mxGeometry x="684" y="664" width="512" height="88" as="geometry" /></mxCell>
        <mxCell id="13-15" value='&lt;font style="font-size:16px"&gt;&lt;b&gt;The regime of the sealed channel&lt;/b&gt;&lt;/font&gt;' style="swimlane;html=1;startSize=34;fillColor=#e3e7ee;strokeColor=#56657a;strokeWidth=1.5;swimlaneFillColor=#ffffff;rounded=1;arcSize=8;absoluteArcSize=1;fontFamily=Helvetica;fontColor=#1f2933;align=center;verticalAlign=middle;collapsible=0;" vertex="1" parent="1"><mxGeometry x="1260" y="118" width="560" height="648" as="geometry" /></mxCell>
        <mxCell id="13-16" value="&lt;b&gt;Inbound&lt;/b&gt; — gated at every enforcing locus. A private message is admitted only through an interact grant on its recovered author, or as the subject's own copy — never because of the relay it arrived on.&lt;br&gt;&lt;br&gt;&lt;b&gt;Outbound&lt;/b&gt; — exactly as permissive as the open channel: a sealed send needs what a public mention needs, no more and no less.&lt;br&gt;&lt;br&gt;&lt;b&gt;Narrowing&lt;/b&gt; — only by restriction, written with &lt;font face=&quot;Courier New&quot;&gt;opacity: opaque&lt;/font&gt;:&lt;br&gt;• on one permission — e.g. school friends can be tagged in public but not messaged privately;&lt;br&gt;• in the global set — no private messages to anyone, guardians included.&lt;br&gt;&lt;br&gt;&lt;b&gt;No middle setting&lt;/b&gt; — a permitted private channel is private, guardians included. Nothing copies a guardian into it.&lt;br&gt;&lt;br&gt;&lt;b&gt;Storage is not correspondence&lt;/b&gt; — what the subject encrypts to itself (a private list, a draft) is not reached by the opacity axis." style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=top;fontSize=16;fontFamily=Helvetica;fontColor=#1f2933;spacing=0;strokeColor=none;fillColor=none;" vertex="1" parent="13-15"><mxGeometry x="10" y="40" width="540" height="602" as="geometry" /></mxCell>
        <mxCell id="13-17" value="&lt;font style=&quot;font-size:16px&quot;&gt;&lt;b&gt;The engine reads — then forgets&lt;/b&gt;&lt;/font&gt;&lt;br&gt;Where it can reach the key, the engine reads the subject's private messages, both ways, to learn who they involve, and discards the plaintext. The engine is the subject's own: nothing is hidden from the subject by it." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#b0e3e6;strokeColor=#0e8088;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=14;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="40" y="800" width="430" height="150" as="geometry" /></mxCell>
        <mxCell id="13-18" value="&lt;font style=&quot;font-size:16px&quot;&gt;&lt;b&gt;The household keeps who, never what&lt;/b&gt;&lt;/font&gt;&lt;br&gt;The trace at the device names the correspondents. The locus's reduction record remembers recipients and surfaces, never content — and never leaves the locus." style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffffff;strokeColor=#4d4d4d;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=14;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="490" y="800" width="430" height="150" as="geometry" /></mxCell>
        <mxCell id="13-19" value='&lt;font style="font-size:16px"&gt;&lt;b&gt;Oversight sees volume and timing&lt;/b&gt;&lt;/font&gt;&lt;br&gt;Where a permission routes a monitor copy, a sealed send reaches it as ciphertext — but signed by the subject: a public, attributable record that a message was sent, then.' style="rounded=1;whiteSpace=wrap;html=1;fillColor=#ffe6cc;strokeColor=#d79b00;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=14;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="940" y="800" width="430" height="150" as="geometry" /></mxCell>
        <mxCell id="13-20" value='&lt;font style="font-size:16px"&gt;&lt;b&gt;Honest limits&lt;/b&gt;&lt;/font&gt;&lt;br&gt;Recognition is structural: an unknown scheme, or a message hidden in an ordinary-looking note, is not detected. Where the guardian is the threat, TEPP is not the remedy.' style="rounded=1;whiteSpace=wrap;html=1;fillColor=#f8cecc;strokeColor=#b85450;strokeWidth=1.5;fontSize=14;align=left;verticalAlign=top;fontFamily=Helvetica;fontColor=#1f2933;spacing=14;arcSize=8;absoluteArcSize=1;" vertex="1" parent="1"><mxGeometry x="1390" y="800" width="430" height="150" as="geometry" /></mxCell>
        <mxCell id="13-21" value="" style="endArrow=none;html=1;strokeColor=#d9dee4;strokeWidth=1;" edge="1" parent="1"><mxGeometry relative="1" as="geometry"><mxPoint x="40" y="982" as="sourcePoint" /><mxPoint x="1820" y="982" as="targetPoint" /></mxGeometry></mxCell>
        <mxCell id="13-22" value='&lt;font color="#52606d"&gt;TEPP Zeta · diagram 13 · statements: OPQ-001–OPQ-127, SURF-033–SURF-044, IN-019–IN-025, OUT-037, RESTR-032–RESTR-036, TOOL-036–TOOL-042, NF-063–NF-081&lt;/font&gt;' style="text;html=1;whiteSpace=wrap;align=left;verticalAlign=middle;fontSize=12;fontFamily=Helvetica;fontColor=#1f2933;spacing=0;strokeColor=none;fillColor=none;" vertex="1" parent="1"><mxGeometry x="40" y="990" width="1780" height="26" as="geometry" /></mxCell>
      </root>
    </mxGraphModel>
  </diagram>
</mxfile>
