Architecture

Identity. Twin. Trust. The Oracle. Four constants. None of them leave.

Identity. A human knocks, swears, and is sealed. The valve key for sealed threads lives on the device. Recovery is optional. Lost key, lost plaintext.

Twin. The purpose is to sound like you. Forged from voice, snapshot, values, never-say, your command, and how you actually write to members. Marks (that’s me / not me) keep it honest. Stamped to the device that forged it.

Trust. What it may know, say, and do is bounded. Corridors (VEIL ↔ VEIL) do not open unless the Oracle says so. Encrypted messages. Encrypted location.

Death. Report a stolen device or valve and the twin is extinguished: recipe wiped, marks gone, twin speech redacted, corridors closed. The device burns its seal key. The same stamp cannot re-forge. A new trusted device may. Bind Face ID / a passkey so the stamp is the hardware, not a number in a browser.

Bounds. Health and money stay closed unless you open them. The twin still cannot promise, purchase, or agree. The Oracle never reads sealed mail.

The Seal. One path. Not two. Member mail is sealed on the device with ECDH P-256 and AES-256-GCM. The tag is the integrity check. Random padding hides length. The server holds ciphertext. It does not hold the key. There is no “cloud chat” the cluster can read. Old threads still open. New lines hide their size.

Not Telegram. We do not use AES-IGE, a home-grown message key, or an opt-in secret mode. Those are the criticisms. VEIL defaults to the secret path. Topics and the twin are spoken in the circle on purpose — that is how it learns to sound like you. Their sealed mail is never the lesson.

This is not an AI companion. It is you, twice — while you keep the rules, and she keeps the equation.