Lattice PM Networking Design

Status: Split design set, self-reviewed draft
Scope: Cross-network and offline-capable synchronization for KDBX-backed vaults
Primary MVP decision: v2 record/resource sync remains the authoritative production MVP protocol. Opaque full-KDBX snapshots are not the MVP sync path; they are a later availability, export, or repair mechanism.

This document is the index for the networking design. The previous single architecture draft has been split into smaller documents so each responsibility can be reviewed independently.

Design Documents

1. Principles and Scope

   • Threat model boundaries
   • Service roles
   • Availability limits
   • Goals and non-goals

2. Online Transport MVP

   • libp2p transport responsibilities
   • discovery order
   • relay fallback
   • application protocol boundaries
   • MVP defaults

3. Identity, Membership, and Keys

   • device identities
   • pairing requirements
   • sync epochs
   • key wrapping
   • revocation
   • anti-rollback persistence

4. Revision Protocol and Merge

   • v2 record/resource sync
   • manifests and heads
   • tombstones
   • conflict handling
   • optional future snapshot layer

5. Offline Services

   • mailbox semantics
   • object storage semantics
   • quotas
   • privacy limits
   • excluded MVP service modes

6. Product Modes and Roadmap

   • user-facing modes
   • phase boundaries
   • production MVP exit criteria

7. Self-Review and Follow-Ups

   • review findings
   • resolved design changes
   • questions delegated to subagents
   • remaining follow-up items

Non-Negotiable Rules

• Relays are stateless transport helpers. They do not store mailbox messages, vault objects, or canonical heads.
• Mailboxes store short-lived encrypted hints only. They do not store KDBX snapshots, attachment payloads, or durable history.
• Object storage stores immutable encrypted objects only. Clients verify signatures, hashes, epochs, and local anti-rollback state.
• Peers remain authoritative. Infrastructure improves reachability and availability but is never trusted for confidentiality or correctness.
• Any server that sees ciphertext may retain it forever. Server-side deletion and TTL are operational controls, not cryptographic guarantees.
• Public DHT, public gossipsub, public proof-of-work mailbox, and public unauthenticated durable storage are outside the production MVP.

Review Status

The split design has been reviewed for the main issues found in the original broad draft:

• The v2 sync path is now explicit and no longer competes with opaque snapshots for MVP scope.
• Transport identity and vault membership identity are separated.
• Offline mailbox/storage features are phased after online sync and membership hardening.
• Rollback, revocation, and local state loss are documented as first-class protocol concerns.
• Public discovery and unauthenticated stateful services are excluded from default MVP behavior.

The remaining design questions, if any, are tracked in Self-Review and Follow-Ups.