Audit, telemetry and trade-offs

Every call is audited

Append-only and hash-chained, recording refusals as loudly as successes. “What did my node actually do” has an answer, and it is not one that can be quietly edited.

No telemetry, ever

The node contacts nothing except what you configured. No phone-home, no crash reporter, no analytics, and no build flag that turns one on.

---

Honest trade-offs

Written down because they do not disappear by going unmentioned:

• Tunnels and edges see metadata — which node is called, size, timing. Sealed content stays ciphertext to them; the fact of a conversation does not.
• No forward secrecy at the envelope layer. A compromised leaf key opens envelopes an attacker kept from while it was current — bounded by the leaf’s life, at most 398 days, and shorter if you renew.
• Lose your root, lose that identity. The root lives in your wallet and nowhere else — no host holds a copy and nobody can mint you another. Losing the host’s leaf key is different and recoverable: your wallet issues a new one.
• Card trust is channel trust. A card handed over a hostile channel is a hostile card. The fingerprint is the thing to check.