bChat
one conversation surface · three trust lanes — the lane is payload, not decoration
connection info — every light, and the receipt behind it
Every row is folded from the receipts below; a light turns green only on
its receipt. Times are named application events, not network ping.
this page renders from local state alone — connect is a click
No request leaves this page to render it. The relay probe below is opt-in
and learns that something answered, never reads a byte (the rub law). Publication is proven
by relay event id on OK true, never by "sent" prose.
identity — the BNR lane's key
This identity is a nostr keypair generated on-device. It never derives from a phone number and never touches the SMS lane — the handset is not a root-key holder (E5 law).
your public identity (x-only):
The secret stays in this browser's localStorage
(
bchat.sec). Export it if you want the identity on another device; there is no
recovery — losing the browser profile loses the identity, by design.threads
prove the encryptor
cite-or-silent: the encryptor's claim is the
NIP's own published vectors, run in front of you — the same battery CI runs
(e2e/bchat-core.test.mjs).
conversation
an AUTONOMI attachment sends the
capability (address · bytes · sha256) inside the encrypted envelope — never the
bytes. Retrieval is a measured state: descriptor-only today;
the retrieval adapter is Building (capability-truth — never claimed as live).
SIMULATED. Carrier transport cannot run from a browser and never
will from this surface — the SMS lane arrives with the Android messaging surface, built on
GrapheneOS
Messages' open-source plumbing (MIT — opens a new tab). What this lane teaches today:
carrier text is display-only, low trust, and nothing BNR-private ever routes
through the telephony stack. A send button here would be theater; there is none.
the relay door
·
MEASURED 2026-10-03 (corrected): the relay gates reading AND
publishing behind NIP-42 member auth — a correctly-signed AUTH from a fresh key draws the
relay's own words,
restricted: not a relay member (rendered verbatim) until
the invite lane mints this identity in. The lanes below the door stay fully provable
offline.the wire, verbatim (cypherpunk register stands this open)
receipts — events, never contents
bMeter shape: a receipt records the event,
the reference and the clock — message contents never enter a receipt. SETTLE (paid lanes)
is founder-gated and absent here.
envelope inspector
select a message to inspect its envelope v1.
where the Android surface comes from
GrapheneOS Messages is open source (MIT) and already carries the Android ergonomics we
would otherwise build — conversation lists, notifications, camera/media sharing,
ACTION_SEND intents, contact integration, default-SMS machinery. We reuse that
plumbing around a separate BNR envelope, identity, encryption and storage layer; we
do not inherit its trust model, and SMS stays a visibly separate low-trust lane.
Spec: SPEC-BCHAT-1 ·
GrapheneOS/Messages (opens a new tab) ·
NIP-44 (opens a new tab) ·
NIP-17 (opens a new tab)