nx_sealed_sender.nx

nx_sealed_sender.nx -- C9 of the comms lane: SEALED SENDER (metadata privacy). Contract symbol ss_seal == the /compare/comms C9 watch. REFEREE: nx_sealed_sender_gate. DONE-RULE (comms.plan): the relay routes a message whose sender identity appears in no relay-readable byte, proven by reading the relay's own capture in the gate. SIGNAL'S FRONTIER, sovereign. A relay must be able to DELIVER a message without learning WHO sent it. The envelope the relay sees carries only an opaque per-room ROUTING TOKEN (a keyed hash of the room key -- reveals neither the room name nor its members) plus ciphertext and a MAC. The sender's identity, the content, and the room name are ALL inside the E2EE payload. The recipient (who holds the room key) opens it and learns the sender -- authenticated by an Ed25519 signature the relay never sees, so within the group the sender is UNFORGEABLE, while to the relay it is INVISIBLE. This is the full sealed-sender shape: a sender certificate (the Ed25519 pubkey) + a signature over (routing_token || seq || plaintext), sealed inside the encrypted envelope. HONEST METADATA SCOPE: the delivery SEQUENCE (seq) is relay-visible by design -- ordering is delivery metadata, not sender identity, exactly as Signal's sealed sender still carries envelope timing. What is provably ABSENT from every relay-readable byte is the SENDER, the CONTENT, and the ROOM NAME. The gate proves that by scanning the envelope bytes. PURE COMPOSITION, no new crypto: ed25519 (RFC 8032 sign/verify) + sha256 (HMAC/HKDF) + chacha20 (RFC 8439). No WebRTC, no OpenSSL. In production the room key is the C7 epoch secret, so sealed sender rides the ratchet -- forward-secret and (with C8) post-quantum -- with no relay changes. DEBT: the HMAC/HKDF/hex/file helpers are shared with C7 and C8; extraction to nx_kdf_lib is filed (comms.plan kdf-lib-extract, now three consumers) -- named, not silently re-copied. license_tier: ORIGINAL No hw writes (Rule 26).