Messaging & Comms Platform

Nishi vs the field — every Nishi cell is measured against real organ source at emit time; each gap names the watch contract that will close it.

Nishi live comms (nishifamily.com/video + relay + sovereign codec + E2EE) vs Telegram and WhatsApp and Signal and Discord -- rivals re-grounded to Aug-2026 research (Discord DAVE, Signal SPQR)

Layer 1 · Executive

Where we are. Measured and live at nishifamily.com/video: group video on our own codec (two measured profiles, 640x480 adaptive live ceiling), lossless LPC voice, in-room chat and reactions over the sovereign relay wire, ChaCha20 relay-blind E2EE on video+audio+chat, screen share, keyed private rooms, SFU with simulcast and last-N, split-horizon relay cascade, Reed-Solomon FEC, video circles, self-healing clients. C1 store-and-forward LANDED 2026-08-16: nx_chat_store on the seg-store plane, gate 21/21 GREEN by forking, first production room live. C2 multi-device sync LANDED the same day (nx_msg_sync, gate 15/15 GREEN, consumer-certified convergence) -- the MESSENGER CORE IS DONE. Still open async: channels, bots, the in-call client wiring, and the games wire (measured 2026-08-16: the /games titles are static single-player with no comms wiring -- C12 is what changes that). The crypto is real but first-generation: the room key is static per session, so PFS/PCS, post-quantum and metadata privacy are all open. The counts below this line are measured at emit.

Where we need to go. THE OPERATOR'S SPEC (2026-08-16, verbatim intent): bring people together online without snooping and without bad performance, superior to Telegram, Discord, Roblox and Steam on privacy AND capability -- from a family on their own LAN, to a private conversation between lovers, to a client-and-lawyer privileged relationship, to big interest-group communities like a reddit -- ALWAYS avoiding the middleman. The technical shape of that spec: Telegram-class async messaging on the sovereign stack (M0 DONE), Discord-class calls (closest already), game interplay through the same store (C12), and the axis NO major ships -- E2EE by default with an MLS-class ratchet and post-quantum hybrid on chat AND calls, sealed-sender metadata privacy, conf-named retention for the privileged tiers, one auditable stack down to the compiler ON FAMILY HARDWARE. Discord's DAVE excludes text; Signal has crypto but no platform; Telegram has platform but opt-in E2EE; Roblox and Steam route everything through their clouds. The exceed is holding all of it at once with no company in the middle.

The unit. 1 u = one measured session-leg, calibrated in the mangagen lane where R1-R4 each landed in one leg (organ + gate + live flip). RECALIBRATED ON C1 (2026-08-16): estimated 2 u, landed in ONE leg -- organ, gate 21/21 and the live flip in a single session-leg -- so organ-class estimates here carry a measured ~2x pessimism; figures republish as each rung lands.

Cost to the messenger core: DONE. M0 reached 2026-08-16: C1 (gate 21/21) and C2 (gate 15/15) both landed inside one session against a 3.5 u estimate -- the gap this page always named as THE core messenger gap is closed and measured. Next costed answers: platform (C5+C6) 3.5 u, crypto exceed (C7-C9) 6.5 u.

Cost to product parity: 11 u. C1-C6 plus C10-C11: core, rich media, channels, bots, call polish, AI assist. Channels and bots ride the same store the core builds.

Cost to the exceed: 6.5 u more. C7 MLS-class ratchet + C8 PQ hybrid + C9 sealed sender, on chat AND calls. Independent of parity: the crypto arc needs the wire and the relay, not channels or bots. Program total 17.5 u -- the two figures sum.

Research bar. Discord DAVE (MLS, RFC 9420) is measured on group-call E2EE at platform scale: MLS group key exchange, per-sender frame keys via encoded transforms, audited by Trail of Bits. Theirs: E2EE default on ALL calls, every platform, since 2026-03 -- and text messages explicitly excluded, with no plans stated. Ours: C7+C8 land the ratchet on chat AND calls with a PQ hybrid behind it (Signal SPQR class, Oct-2025) -- the two axes the deployed bar excludes, on a stack with no WebRTC underneath [@dave].

20 of 28 capabilities measured|7 of them measured exceeds|8 open|coverage 714/1000|adoption 9 full / 11 partial

Layer 2 · Roadmap

Do this next — computed by the ranker, never chosen by a seat

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: the cheapest closures on this board, listed before any new work. Stamp: # asof=1787883364 domain=comms target_version=0.1 rungs=13 done=7 open=6 finish=7 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
F	FINISH	Store-and-forward history (C1) cs_store_forward	PROMOTED-UNREGISTERED	a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	Multi-device sync (C2) msy_devsync	PROMOTED-UNREGISTERED	a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	MLS-class group ratchet (C7) mls_epoch_advance	PROMOTED-UNREGISTERED	a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	Post-quantum hybrid ratchet (C8) pqh_kex	PROMOTED-UNREGISTERED	a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	Sealed sender (C9) ss_seal	PROMOTED-UNREGISTERED	a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	Retention and disappearing messages (C13) cs_retention	PROMOTED-UNREGISTERED	a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
F	FINISH	Game-session chat (the games wire) (C12) gc_room_wire	REGISTERED-DARK	callable, authorised, no MCP invocation on record (a direct fork logs the runner, so this is not proof it never ran); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
#1	0.1	File and media attachments (C4) cs_file_attach	6000	v=6 m=2 c=2
#2	0.1	Voice notes (C3) cs_voice_note	3600	v=9 m=2 c=5
#3	later	Channels and broadcast (C5) cc_broadcast	1866	v=14 m=2 c=15
#4	later	Bot platform (C6) bot_dispatch	1200	v=12 m=2 c=20
#5	later	AI assist (C11) cai_summarize	666	v=5 m=2 c=15
#6	later	Noise suppression in the live path (C10) ds_denoise_stream	600	v=6 m=1 c=10

Critical path — contract, done-rule, executor, cost

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Store-and-forward history (C1)	cs_store_forward	LANDED 2026-08-16, done-rule PROVEN by nx_chat_store_gate 21/21 GREEN: offline delivery byte-identical and in order across process death, cursors never regress (cm_advance), additive-only soft-delete, budgets refuse loudly by conf-row name, absence is never read as empty. Composes the seg-store plane + nx_chatmsg; production room live	Organ	2 est, 1 actual u
Multi-device sync (C2) after C1	msy_devsync	LANDED 2026-08-16, done-rule PROVEN by nx_msg_sync_gate 15/15 GREEN: a fresh device pulls the full history, increments move only the missing rows in ONE commit, convergence is certified BY THE CONSUMER (nx_chat_store reads both roots byte-identically), tombstones travel, and split-brain / device-ahead / absent-source all REFUSE with nothing written. Cursors stay device-local by design	Organ	1.5 est, same-session actual u
Voice notes (C3) after C1	cs_voice_note	Record, store, replay through the sovereign lossless audio path; a note survives sender disconnect and replays byte-identical	Organ	1 u
File and media attachments (C4) after C1	cs_file_attach	Any file round-trips byte-identical through the store; the size budget is named in conf, not code, and refusal ANNOUNCES the budget	Organ	0.5 u
Channels and broadcast (C5) after C1	cc_broadcast	One-to-many fan-out at a declared scale with per-subscriber delivery counted and the partition summed; Telegram channels are the reference	Organ	1.5 u
Bot platform (C6) after C1	bot_dispatch	A bot registers over the open wire protocol, receives events and posts messages under a scoped minted cap -- capability-gated by construction, never a shared secret	Organ	2 u
MLS-class group ratchet (C7)	mls_epoch_advance	LANDED 2026-08-16, gate 12/12 GREEN by FORKING THE REAL CRYPTO (est 3 u, one leg actual): RFC 9420 key schedule [@rfc9420] on x25519+sha256+chacha20, zero WebRTC/OpenSSL. Member removal is a commit that advances the epoch; the removed member -- holding the OLD epoch secret -- is absent from the new roster so no commit-secret is wrapped to it (T5), and it provably CANNOT open the next ChaCha20 frame because the MAC fails under its stale secret (T7, the done-rule end-to-end). FORWARD SECRECY proven (T8: the epoch-1 secret cannot open an epoch-0 frame; one-way HKDF) with an anti-vacuity control (T9: the epoch-0 secret DOES open its own frame). POST-COMPROMISE proven (T10: an update commit rotates past a leaked secret). Wraps are AUTHENTICATED (T11: a flipped byte fails the HMAC). HONEST SCOPE: flat O(n) commit distribution; TreeKEM's O(log n) tree is the efficiency follow-on, NOT a security gap -- every property here is the RFC 9420 property. Discord DAVE runs MLS for CALL keys only, never text; this is one ratchet for chat AND calls	Organ	3 est, 1 actual u
Post-quantum hybrid ratchet (C8) after Organ	pqh_kex	LANDED 2026-08-16, gate 7/7 GREEN by forking real crypto (est 2 u, one leg actual): the C7 commit-secret transport is now the X25519MLKEM768 HYBRID KEM (FIPS 203 ML-KEM-768 + X25519, the estate's own implementations, no liboqs) [@fips203]. The wrap key is derived from ml_kem_ss(32)		x25519_ss(32), so recovery needs BOTH. PROVEN: with both halves the secret recovers exactly (T3 anti-vacuity); a classical-only break -- an attacker holding only the X25519 shared secret -- recovers NOTHING (T4, MAC fails); a KEM-only break recovers NOTHING (T5). Because the commit secret drives every future epoch, this is harvest-now-decrypt-later defence on the whole forward chain -- PQ RATCHETING not just a PQ handshake, the Signal SPQR Oct-2025 property [@spqr]. Deterministic + authenticated wraps (T6/T7). WIRING NOTE: C8 proves the hybrid transport standalone; folding it into C7's mg_wrap as the default (hybrid roster) is the integration step, filed as kdf-lib-extract + c7-hybrid-transport u
Sealed sender (C9) after C7	ss_seal	LANDED 2026-08-16, gate 10/10 GREEN (est 1.5 u, one leg actual): the full sealed-sender shape [@sealed-sender] -- the relay envelope is an opaque routing token (a keyed hash of the room key, revealing neither room name nor members) + a delivery seq + ciphertext + MAC. The sender's Ed25519 identity, the content, and the room name are ALL inside the sealed payload. PROVEN BY SCANNING THE ACTUAL ENVELOPE FILE: the sender pubkey (T3) and the plaintext (T4) appear in ZERO relay-readable bytes; the route verb models the relay and shows its entire view is token+seq (T5). The recipient recovers a SIGNED, AUTHENTICATED sender (T6 anti-vacuity) that is provably alice not mallory (T7); a forgery opens as the forger's OWN key, never a claimed one (T9, no-spoof); wrong room key (T8) and tamper (T10) refuse with nothing decrypted. Composes ed25519+sha256+chacha20; rides the C7 room key so sealed sender inherits forward secrecy and (with C8) post-quantum protection, with NO relay changes. HONEST SCOPE: delivery ordering (seq) is relay-visible by design, as in Signal -- what is absent is SENDER, CONTENT, ROOM NAME. Signal is the only major with sealed sender, and none pairs it with sovereign group video on family hardware	Organ	1.5 est, 1 actual u
Noise suppression in the live path (C10)	ds_denoise_stream	The spectral-subtraction substrate already in tree (ds_spectral_gate composing nx_fft) wired into the live voice path as a stream API; SNR gain measured on real captured frames against a pre-declared floor, never asserted	Organ	1 u
AI assist (C11) after C1	cai_summarize	Summaries and translation over the sovereign LLM lane, opt-in, judged before wiring; Telegram's 2026 AI editor is the reference and Signal's refusal is the counter-argument to honor -- E2EE content never leaves the device boundary unencrypted	Local model	1.5 u

Milestones

Milestone	Rungs	Cumulative
M0 · Messenger core usable -- REACHED 2026-08-16	C1,C2	3.5 u
M1 · Rich messaging	C3,C4	5 u
M2 · Platform class (channels + bots)	C5,C6	8.5 u
M3 · The crypto exceed published	C7,C8,C9	15 u
M4 · Full parity plus polish	C10,C11	17.5 u
M5 · Comms visible in the games -- REACHED 2026-08-16 (engine + published match + portal section; in-page client still open)	C12	19.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Retention and disappearing messages (C13) after C1	cs_retention	LANDED 2026-08-16, gate 26/26 GREEN (the 4 retention teeth joined C1's 21 with zero regression): per-room retention is PLANE DATA (setretention writes meta:retention_ms; conf row retention_default_ms=0 makes the family archive the default and disappearing opt-in), the sweep tombstones everything past the window in ONE commit and announces the full partition (expired/already-hidden/kept, summed), keep-forever announces itself, a second sweep expires nothing. HONESTY HELD BY A TOOTH: T21 proves hidden is NOT erased -- bytes remain, and byte-erasure exists only as the separate explicit-confirm purge rung (filed below) so the disappearing-messages claim cannot overstate itself	Organ	1 est, same-leg actual u
Game-session chat (the games wire) (C12) after C1	gc_room_wire	LANDED 2026-08-16, gate 13/13 GREEN (RED first on a real one-letter mode-parse defect -- the referee earned its keep): nx_game_chat runs turn-based multiplayer THROUGH the C1 store -- the log is the game, the board is a deterministic replay, injected out-of-turn rows are counted and ignored (the wire is untrusted by construction), game definitions are conf DATA (a new grid game is one row), emits are byte-deterministic. First production match (connect four, elder vs winnie, chat interleaved, won by four-in-column-3) is PUBLISHED at /games/live/ and the /games portal now carries a data-driven Play-together section that enumerates live matches at emit time. REMAINING HALF, named: the interactive in-page browser client (play from the page, not the CLI) -- that is the client wiring rung and it composes this engine unchanged	Organ	2 est, 1 actual u

Layer 3 · Engineering

How this is scored. Every Nishi mark is measured: the generator reads the real organ source on disk and requires the implementing symbol to exist (no self-grading). A watching tag names the organ and symbol contracted to close a gap — the mark flips itself on the next compare beat when that workstream ships, and the comparewatch- plane row flips with it. The flip is necessary, not sufficient: it proves the symbol exists, never that the capability is good. The bar is the rung's pre-declared done-rule, proven by its gate — a symbol shipped without the behaviour behind it is a defect, and the flip is exactly what makes that defect visible instead of quiet. Competitor marks record documented capability presence — presence, not depth or scale. Adoption is measured too: every measured row carries where its organ stands on the estate's ladder (source → built → promoted → registered → invoked; libraries by importer reach minus validation importers; gates by the execution surfaces that run them). A row is fully adopted only at the top of its ladder; anything short is tagged partial with the exact remedy, so a build nobody promoted can no longer read as shipped. Census stamps: importers asof 1787849099, gate census asof 1787855507 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ leads / measured exceed● present◐ partial○ absent · click any capability for its evidence

Capability	Nishi	Telegram	WhatsApp	Signal	Discord
LIVE
Group video calls Measured: `vv_enc_rct8` exists in `runtime/nx_video_codec_wasm.nx`, verified at emit. OUR OWN codec end to end; Discord group calls are Best-in-class UX; others license/embed WebRTC Adoption: `LIB-WIRED importers=62 nonval=17` — fully adopted (top of its ladder).	●	●	●	●	◉
Voice (lossless LPC audio) Measured: `queueAudioL` exists in `../sites/nishifamily/video/app.v2.js`, verified at emit. Sovereign lossless voice path; majors use Opus [rfc6716] Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. adoption ABSENT	●	●	●	●	●
Screen share Open — no implementing organ is measured for this axis yet. Discord screen share is the reference	○	●	●	●	◉
SFU + simulcast + last-N Measured: `sfu_set_lastn` exists in `runtime/nx_sfu_select.nx`, verified at emit. Per-receiver layer verdicts + seq rewrite + dynacast-class suspension -- Discord-class infra, ours sovereign Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder).	●	●	●	●	◉
Relay cascade (multi-relay scale) Measured: `SIG2_DG_CASCADE` exists in `runtime/_hdl_build/nx_signaling_v2.nx`, verified at emit. Octo-class split-horizon inter-relay; majors run planetary fleets (Best) Adoption: `RUN-BY:daemon` — fully adopted (top of its ladder).	●	◉	◉	●	◉
Media FEC resilience Open — no implementing organ is measured for this axis yet. Reed-Solomon 8-of-10 on frames	○	●	●	●	●
Noise suppression during speech Open — watching `runtime/nx_denoise_spectral.nx` : `ds_denoise_stream`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Discord Krisp is the reference. The spectral-subtraction substrate is already in tree (ds_spectral_gate composing nx_fft, RNNoise-class direction); C10 wires it into the live voice path as a stream API with a measured SNR floor watching ds_denoise_stream	○	●	●	●	◉
MSG
Real-time group chat Measured: `rxChat` exists in `../sites/nishifamily/video/app.v2.js`, verified at emit. In-room chat over the sovereign relay; Telegram chat UX is the reference Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. adoption ABSENT	●	◉	●	●	●
Reactions / message interactions Measured: `vc_react_pack` exists in `runtime/nx_video_client_wasm.nx`, verified at emit. SOVEREIGN protocol + emoji set in the core (wire 0x45); floating emoji live on every tile (800) Adoption: `LIB-WIRED importers=9 nonval=2` — fully adopted (top of its ladder).	●	◉	●	●	◉
Video messages (circles) Measured: `sd2_circle_upload` exists in `runtime/_hdl_build/nx_sites_daemon_v2.nx`, verified at emit. Telegram video messages equivalent, self-hosted Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder).	●	●	●	●	○
Message history / offline delivery Measured: `cs_store_forward` exists in `runtime/nx_chat_store.nx`, verified at emit. THE core messenger gap: chat is in-call ephemeral today; no store-and-forward. C1 -- everything async depends on it Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption PROMOTED-UNREGISTERED	●	◉	●	●	◉
Multi-device sync Measured: `msy_devsync` exists in `runtime/nx_msg_sync.nx`, verified at emit. Telegram cloud sync is the reference; nothing on our side yet. C2 Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption PROMOTED-UNREGISTERED	●	◉	◐	●	◉
Voice notes (async) Open — watching `runtime/nx_chat_store.nx` : `cs_voice_note`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Top-3 daily-use format on Telegram and WhatsApp; ours rides the C1 store and the sovereign lossless audio path. C3 watching cs_voice_note	○	◉	◉	●	●
File and media attachments Open — watching `runtime/nx_chat_store.nx` : `cs_file_attach`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Telegram 4GB files are the reference; byte-identical round-trip through the C1 store, size budget in conf. C4 watching cs_file_attach	○	◉	●	●	●
CRYPTO
E2EE for calls AND chat Measured: `mcw_xform` exists in `runtime/nx_media_crypt_wasm.nx`, verified at emit. ChaCha20 relay-blind on video+audio+chat; Signal is the E2EE reference [doubleratchet]; Telegram E2EE is opt-in secret chats [telegram-e2e]; Discord DAVE encrypts ALL calls by default since Mar-2026 but explicitly excludes text [dave] Adoption: `LIB-UNIMPORTED` — PARTIAL: nothing imports it: wire it into a consumer or retire it. adoption LIB-UNIMPORTED	●	◐	●	◉	◐
Private keyed rooms (invite links) Measured: `rk_token` exists in `runtime/nx_room_key.nx`, verified at emit. sha256 token wall = private invite links Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder).	●	●	●	●	●
Ratcheting group E2EE (MLS-class PFS/PCS) Measured exceed: `mls_epoch_advance` in `runtime/nx_mls_group.nx`, verified at emit. The 2025/26 group-crypto bar (RFC 9420) [rfc9420]. LANDED 2026-08-16, gate 12/12 GREEN by forking the real crypto: epoched group keys, member removal forces an epoch advance and the removed member -- holding the old secret -- provably CANNOT open the next ChaCha20 frame (MAC fails); forward-secrecy and post-compromise teeth pass. Pure composition of sovereign x25519+sha256+chacha20, no WebRTC/OpenSSL. Discord DAVE runs MLS for CALL keys only (never text); ours is one ratchet for chat AND calls -- the EXCEED no major holds Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption PROMOTED-UNREGISTERED	◉	○	●	◉	◐
Post-quantum hybrid ratchet Measured exceed: `pqh_kex` in `runtime/nx_pq_hybrid.nx`, verified at emit. Signal SPQR triple ratchet (Oct-2025) [spqr] raised this bar from PQ handshake to PQ RATCHETING; iMessage PQ3 class. LANDED 2026-08-16, gate 7/7 GREEN by forking real crypto: the C7 commit secret is sealed under X25519MLKEM768 (FIPS 203 ML-KEM-768 + X25519) [fips203], and the gate PROVES a classical-only break recovers nothing (T4) AND a KEM-only break recovers nothing (T5) -- both families must break, on the ratchet not just the handshake. Composes the estate's own ML-KEM; no liboqs. EXCEED: nobody ships PQ ratcheting on group chat AND calls on a sovereign stack Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption PROMOTED-UNREGISTERED	◉	○	◐	◉	○
Metadata privacy (sealed sender) Measured exceed: `ss_seal` in `runtime/nx_sealed_sender.nx`, verified at emit. Signal-only frontier capability [sealed-sender]. LANDED 2026-08-16, gate 10/10 GREEN: the relay envelope carries only an opaque routing token + delivery seq; the sender's Ed25519 identity and the content appear in ZERO relay-readable bytes (T3/T4 scan the actual envelope file). The recipient recovers a SIGNED, authenticated sender (T6/T7); forgery opens as the forger's own key not the claimed one (T9); wrong-key and tamper refuse. Composes ed25519+sha256+chacha20; rides the C7 room key so it inherits forward secrecy + PQ. EXCEED: Signal is the only major with this, and none pair it with sovereign group video Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption PROMOTED-UNREGISTERED	◉	○	○	◉	○
PLATFORM
Bot / programmable platform Open — watching `runtime/nx_bot_api.nx` : `bot_dispatch`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Telegram Bot API + Discord bots are the references; our wire protocol is open but has no bot surface. C6 -- cap-gated by construction watching bot_dispatch	○	◉	◐	○	◉
Channels / broadcast at scale Open — watching `runtime/nx_channel_cast.nx` : `cc_broadcast`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Telegram channels are the reference; WhatsApp Channels arrived 2023-25. C5 watching cc_broadcast	○	◉	◐	○	◐
AI assist (summaries, translate) Open — watching `runtime/nx_chat_ai.nx` : `cai_summarize`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Telegram's 2026 AI editor + channel summaries are the reference; Signal refuses by design -- ours must be sovereign-LLM, opt-in, and never move E2EE content off-device unencrypted. C11 watching cai_summarize	○	◉	●	○	●
Game-session chat Measured: `gc_room_wire` exists in `runtime/nx_game_chat.nx`, verified at emit. Discord is THE games-chat reference; Telegram has gaming bots. Our /games titles are static single-player today (measured 2026-08-16) -- C12 wires rooms per game session through the C1 store + relay Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, no MCP invocation on record (a direct fork logs the runner, so this is not proof it never ran); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption REGISTERED-DARK	●	●	○	○	◉
SOVEREIGN
Self-hosted on family hardware -- LAN-local, zero middleman Measured exceed: `SIG2_DG_CASCADE` in `runtime/_hdl_build/nx_signaling_v2.nx`, verified at emit. Every major routes every message through their cloud [whatsapp-wp]; this stack runs on the family NAS, so a LAN conversation never leaves the LAN and there is no company in the middle to breach, subpoena or monetize -- the operator's spec from family LAN to private pair to privileged client to interest-group communities Adoption: `RUN-BY:daemon` — fully adopted (top of its ladder).	◉	○	○	○	○
CRYPTO
Disappearing messages / retention control Measured: `cs_retention` exists in `runtime/nx_chat_store.nx`, verified at emit. Signal disappearing messages are the reference; ours rides the C1 store as conf-named retention with additive tombstone expiry (never silent rotation) -- the lovers and client-lawyer tiers of the spec. C13 Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). adoption PROMOTED-UNREGISTERED	●	●	●	◉	○
SOVEREIGN
full stack -- own codec, relay, crypto, language, no WebRTC/OpenSSL anywhere Measured exceed: `vv_enc_rct8` in `runtime/nx_video_codec_wasm.nx`, verified at emit. Every major sits on WebRTC/licensed codecs/TLS libraries; ours is one auditable stack down to the compiler Adoption: `LIB-WIRED importers=62 nonval=17` — fully adopted (top of its ladder).	◉	○	○	○	○
Integer bit-exact media + recon-hash conformance Measured exceed: `vc_recon_hash` in `runtime/nx_video_codec_wasm.nx`, verified at emit. Per-frame decode-truth verification is impossible on float pipelines Adoption: `LIB-WIRED importers=62 nonval=17` — fully adopted (top of its ladder).	◉	○	○	○	○
Self-healing ops (drift badges, auto-fallback, self-upgrade) Measured exceed: `driftCheck` in `../sites/nishifamily/video/app.v2.js`, verified at emit. The call diagnoses and heals itself; majors ship opaque failures Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. adoption ABSENT	◉	○	○	○	○

Debt register

Id	Sev	What it is	Unblock
kdf-lib-extractnot in this scope	2	C7 (nx_mls_group) and C8 (nx_pq_hybrid) each carry the same HMAC-SHA256 + HKDF-Expand-Label + hex + file-io helpers (mg_/pqh_ prefixed). Correct OO move is one shared nx_kdf_lib both import -- named here rather than left as a silent copy. Not done in-leg because it re-opens two just-gated crypto binaries; a focused rung.	Extract the shared helpers to nx_kdf_lib.nx, rebuild+re-gate C7 and C8 against it, byte-prove nothing else changed.
c7-hybrid-transportnot in this scope	3	C8 proves the X25519MLKEM768 hybrid transport standalone (gate 7/7). Folding it into C7 as the DEFAULT commit distribution (members carry a hybrid identity: X25519 pub + ML-KEM ek; mg_wrap becomes pqh_wrap) makes every epoch PQ-safe by construction, not just provable in isolation.	Add a hybrid roster mode to nx_mls_group whose commit wraps go through nx_pq_hybrid; gate the removal + PQ-both-families teeth together on one flow.
purge-rungnot in this scope	4	DISCHARGED SAME DAY (2026-08-16, gate 29/29 GREEN first run): `purge confirm=yes` is live -- confirm-gated (refuses and describes without the literal token), REDACT-IN-PLACE (tombstoned rows keep seq/epoch/kind/sender so cursors and the seq==ordinal invariant survive; visible history byte-identical, proven), then re-seed, COMPACT (ss_compact called with our lock released -- it takes the plane lock itself, verified from source), then the superseded segment FILES are UNLINKED, because a purge that leaves the secret in an unreachable-but-on-disk file has not purged. THE PROOF IS AT THE RAW DISK: T24 shows the secret's hex present in the segment files before (the fixture provably reached the condition), T25 shows it ABSENT from every segment file after. Partial compaction announces PURGE-PARTIAL and the re-run -- a partial destruction never reports complete.	Done. The disappearing-messages story for the lovers and client-lawyer tiers is now hidden-by-retention AND destroyable-on-demand, both gated.
room-sfu-unauthorisednot in this scope	3	nx_room_sfu is REGISTERED-UNAUTHORISED (S4, measured by nx_catalog 2026-08-16): on the MCP surface, no cap ever minted, so no seat can drive it.	One scoped /api/cap/mint call per the banked recipe; then a smoke invocation, and the catalog rereads LIVE.
static-room-keynot in this scope	5	The live room E2EE key is static per session -- named on this page since admission and still true. No PFS, no PCS: one compromised key reads the whole session.	C7 is the fix. Until it lands this row stays open and the page keeps saying so.

Risk register

Risk	Likelihood x impact	Mitigation
Messaging logic drifting into app.v2.js instead of organs	possible x medium	C1 ships organ-side with a wire protocol; the JS stays a presentation shim per the interop law.
Store-and-forward creates durable user data on the relay box	certain x medium	Additive-only with soft-delete, a conf-named size budget that refuses loudly before the cliff, retention an operator decision -- never silent rotation.
A crypto rung regresses the relay-blind property while adding features	possible x high	Every C7-C9 gate carries a negative control that reads the relay's own capture; the relay and a removed member must BOTH fail to decrypt.
A watch contract flips on symbol existence, so a stub reads green	possible x high	The done-rule proven by a gate is the bar; the flip is the receipt (standing hive law -- no rung counts without its gate).
Estimates calibrated in another lane	certain x medium	C1 recalibrates the unit natively; actual-vs-estimate republishes on every landed rung.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The coverage above is capability presence measured against source — not depth, scale, or polish, where mature rivals may lead. Exceeds are claimed only where a mechanism backs them. Every open gap is a watch contract: it names the organ and symbol that closes it, and this page flips the cell itself when that workstream ships.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/comms.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain comms, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[rfc9420] Barnes, Beurdouche, Robert, Millican, Omara, Cohn-Gordon. The Messaging Layer Security (MLS) Protocol. IETF RFC 9420, July 2023. publisher · read in our library knowledge/fetched/cmp_comms_rfc9420.html · pin h158ab3ce6241c8bb8516bebe57a27d316846d34e62099d6feab2992a90110827 · accessed 2026-08-18 · published-standardGrounds: The CRYPTO: Ratcheting group E2EE (MLS-class PFS/PCS) row and rung C7: the RFC 9420 key schedule, epoch advance on commit, member removal, forward secrecy and post-compromise security are the properties nx_mls_group_gate proves 12/12; TreeKEM O(log n) is named there as the efficiency follow-on, not a security gap.
[dave] Discord. DAVE Protocol Whitepaper: Discord Audio and Video End-to-End Encryption -- MLS group key exchange, per-sender frame keys via encoded transforms, external audit. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_comms_dave.html · pin h1f7eaee3da73953bc424a71efd5d8fe841c3f9a6ecf6b7d4c1e9e957f7ad2389 · accessed 2026-08-18 · vendor-docGrounds: The comms.plan bar row (Discord DAVE, MLS RFC 9420) and the Discord column on CRYPTO: E2EE for calls AND chat (Part) and Ratcheting group E2EE (Part): DAVE encrypts calls by default and runs MLS for CALL keys only, never text -- the axis the exceed (one ratchet for chat AND calls) is defined against.
[spqr] Signal. Signal Protocol and Post-Quantum Ratchets: introducing the Sparse Post Quantum Ratchet (SPQR), the triple ratchet. Signal blog, October 2025. publisher · read in our library knowledge/fetched/cmp_comms_spqr.html · pin h2d697627c4948c56326c336df8b952784f64a33ebe474026dcc27bcc044a83da · accessed 2026-08-18 · vendor-docGrounds: The CRYPTO: Post-quantum hybrid ratchet row and rung C8: Signal SPQR (Oct-2025) raised the bar from PQ handshake to PQ RATCHETING, which is why C8 seals the C7 commit secret on every epoch (harvest-now-decrypt-later defence on the whole forward chain) rather than only at key agreement.
[sealed-sender] Lund, J. (Signal). Technology preview: Sealed sender for Signal. Signal blog, October 2018. publisher · read in our library knowledge/fetched/cmp_comms_sealed-sender.html · pin hf1a9f8a8b56ae99a479b7c7171a1c18b00ba956e6c3d71bf7dcef70eab047530 · accessed 2026-08-18 · vendor-docGrounds: The CRYPTO: Metadata privacy (sealed sender) row (Signal-only frontier capability) and rung C9: the relay sees only a routing token plus delivery seq, sender identity and content are inside the sealed payload -- the shape nx_sealed_sender_gate scans the actual envelope file for (T3/T4).
[doubleratchet] Perrin, Marlinspike. The Double Ratchet Algorithm. Signal Protocol specification, revision 1, 2016. publisher · read in our library knowledge/fetched/cmp_comms_doubleratchet.html · pin hf3b65d15f3c2364a83d8afd48e396526a76fe968c73127d87e375f5204d172d9 · accessed 2026-08-18 · published-standardGrounds: Signal is the E2EE reference on the CRYPTO: E2EE for calls AND chat row, and this specification defines the forward-secrecy and post-compromise vocabulary the ratchet rows and the static-room-key debt use (one compromised key reads the whole session until C7 lands).
[fips203] NIST. FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM). Federal Information Processing Standards Publication, August 2024. publisher · read in our library knowledge/fetched/cmp_comms_fips203.html · pin h8ee4108f5d9ccf76d058a1848b7ba221b4c998623eccb7dc0674aef73e105203 · accessed 2026-08-18 · published-standardGrounds: Rung C8 and the Post-quantum hybrid ratchet row: the commit secret is sealed under X25519MLKEM768, i.e. FIPS 203 ML-KEM-768 plus X25519 from the estate's own implementations (no liboqs); the gate proves both families must break (T4 classical-only, T5 KEM-only recover nothing).
[telegram-e2e] Telegram. End-to-End Encryption, Secret Chats (MTProto API documentation). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_comms_telegram-e2e.html · pin h9a584762bf0aff9ded117d5f24b230a1233334ebbb45037f6d37e78706cd1818 · accessed 2026-08-18 · vendor-docGrounds: The Telegram column on CRYPTO: E2EE for calls AND chat (Part -- Telegram E2EE is opt-in secret chats) and the goal line (Telegram has platform but opt-in E2EE); cloud chats are the reference for MSG: Multi-device sync and Message history.
[whatsapp-wp] WhatsApp (Meta). WhatsApp Encryption Overview: Technical white paper, revision February 2026 -- Signal Protocol based end-to-end encryption for messages, calls and groups -- re-fetched COMPLETE 2026-08-20 at 1879555 B after the stored mirror was proven truncated at 255260 B; the document own title reads WhatsApp Encryption Overview - 2026-02 (confirming the February 2026 revision) and its outline covers Defining End-to-End Encryption, Exchanging Messages, Calculating a Chain Key from a Root Key, Group Messages, Call Setup and Group Calling. publisher · read in our library knowledge/fetched/cmp_comms_whatsapp-wp.pdf · pin h4cc7bf38d91abf7fefd1957fc9259f63fcc8aaa2d79c97d2bed3d11948e3a386 · accessed 2026-08-20 · vendor-docGrounds: The WhatsApp column on CRYPTO: E2EE for calls AND chat (Yes) and Ratcheting group E2EE (Yes): WhatsApp runs the Signal Protocol by default, and every message still routes through Meta's servers -- the middleman the SOVEREIGN: Self-hosted on family hardware row removes.
[rfc6716] Valin, Vos, Terriberry. Definition of the Opus Audio Codec. IETF RFC 6716, September 2012. publisher · read in our library knowledge/fetched/cmp_comms_rfc6716.html · pin hc82a8f3977bf8320ed47c2f3b6376d32ba2b85600054d090c6f3e683f25ee245 · accessed 2026-08-18 · published-standardGrounds: The LIVE: Voice (lossless LPC audio) row: majors use Opus -- this RFC is the codec every rival column embeds (SILK plus CELT, lossy), against which the sovereign lossless LPC voice path is the different-path claim.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/comms.matrix · every Nishi cell verified against organ source at emit time · watch cells re-measured on every compare beat · zero JS, zero trackers