Both lists, in one place
What the bytes guarantee, and what they do not.
Eight things the bytes guarantee on every ask. Ten more are deliberately left out, and they are on the same page, because a promise is only worth what its limits say.
What the bytes guarantee.
Each is a property of the bytes, on every ask.
Authenticity
Every ask and reply is signed and checked against the bytes as received. A reply is signed over the lid of its ask, so it answers that ask and no other.
Stated in The signature
Confidentiality
Every ask is sealed to the ward's padlock under a fresh key, every reply to that key alone. Method, args, answer and the heir's name travel inside the box.
Stated in Sealing
A stolen seed alone opens no relation's asks
An ask's body is sealed under the agreement and the edge key it came under, and nothing derives an edge key from the seed. A thief of what the door keeps is another matter: it opens asks under the keys that state holds, the open and offered edge keys and any kept at removal. A key that is neither open nor offered after a move is forgotten, so what a door keeps reaches back only as far as its current keys.
Stated in The edge key
A broken curve does not open a relation's asks
Their edge keys descend from ML-KEM-768. Replies are sealed under X25519 alone, so a broken curve opens recorded replies. Asks on the zero head are sealed under the zero edge key, thirty-two zero bytes anyone can write, so a broken curve opens their bodies too.
Stated in The edge key
No replay
A number a door has honoured on a relation is never honoured again. Which numbers below the highest it still honours is the door's own, so a door chooses how much reordering it accepts and nothing it accepts is a second honouring.
Stated in The count
Ownership at a choice on the knock
Once a door makes a choice on the knock, the relation belongs to the key the knocker minted; nobody who saw the invitation, the inviter included, can speak on it. Until then the channel that carried the invitation is trusted.
Stated in What a knock binds
Revocation
A door may keep the keys of a relation it stopped holding, and for how long is its own. While it keeps them, the holder hears removed and learns the relation ended. Afterwards that holder hears silence, like everyone else, and nobody else ever hears anything different.
Stated in The keys of a relation
No oracle
Every stranger's case is one reply text of one length, sealed and signed, so the bytes tell nothing apart. Time is a kit's, and the spec puts no time on the wire. A carrier may still say that no ward stands under a pk.
Stated in What a door tells apart
What they do not guarantee, by design.
Each is left to a kit, a carrier or the world outside, on purpose.
A stolen seed
Whoever holds a ward's seed and what its door keeps is that ward.
Stated in The ward key
A guessed seed
A text seed is hashed once, and the ward pk is public. Whoever guesses the text stands the ward, so a text seed is as strong as its text and no stronger. Thirty-two drawn bytes are the seed nobody guesses.
Stated in The ward key
A relation after keys are lost
A door admits two signing keys and takes two edge keys, so the two ends may stand one move apart. An asker that moves further than its door has no way back in the bytes, and what it keeps of the keys it moved from is a kit's.
Stated in The move
Keeping a ward
Storage, backup and copies are a kit's. A door put back to an earlier moment, or two copies that write apart, break the relations they diverge on.
The zero head and every head
Both are sealed to the padlock alone, so a later theft or a broken curve learns which heir a recorded ask named, never what it said.
Stated in The zero head
Signatures after a broken curve
Ed25519 alone: forgery from then on, never in the past.
Stated in The signature
Load and timing
Whoever knows a ward pk can make its door work, and a door equalises bytes, not time.
Discovery, identity and a directory
Outside Quo.