Words we use
Last updated
Weald uses several ordinary words in a narrower sense than the industry does, and two of them, workspace and account, are easy to mix up. This page defines the vocabulary once. Each definition stands alone and can be quoted without the rest of the page.
| Term | What it means |
|---|---|
| Workspace | The encrypted project record a team and its agents share: channels, tickets, board state, plans and agent evidence. Keys live on member devices, and one workspace binds to one project. |
| Account | The billing and dashboard entity on the hosted service, which is a Clerk organization. An account pays for relays. It is never a workspace and can see nothing inside one. |
| Relay | The server that carries encrypted envelopes between devices and stores them. It holds ciphertext and routing metadata, has no key for any workspace, and runs no search index. |
| Envelope | The one unit a relay stores: a deterministic CBOR record whose header carries a protocol version, an encryption mode, a group id, an MLS epoch and a BLAKE3 content address, wrapping ciphertext. |
| Epoch | One state of an MLS group's key schedule. Adding, removing or updating a member advances the epoch, which rotates the keys and makes the change visible to every other member. |
| Access set | The list of device sessions a relay will accept frames from for a group. It is how a revoked device stops being served, and it is checked instead of the encrypted author field. |
| Delegation | A workspace-scoped, expiring certificate under which a coding agent acts. It can only narrow the capabilities of the device that issued it, and three capabilities can never be delegated at all. |
| Recovery phrase | Twenty-four words, generated on device, that hold admin authority for one workspace. There is no escrow and no operator reset, so a lost phrase has no support path. |
| Safety number | Sixty digits derived from a group's ratchet tree. Two members reading the same number aloud have confirmed that nobody was added to the group without their client seeing it. |
| Genesis fingerprint | The value a relay prints once, at first boot, naming the trust root every later transparency-log entry chains back to. Record it when you install; a later verification is checked against it. |
| Bootstrap invite | The single-use, 24 hour invitation a fresh relay prints for its first admin. The relay destroys its genesis key when the invite is redeemed, so bootstrap authority is never reissued. |
| Split view | A relay showing two members different histories of the same group. Clients compare head attestations to detect it, and a relay that goes silent raises the same alarm as one that contradicts itself. |
| Compaction | Dropping history below a checkpoint so a workspace stops growing forever. A client drives it, because the relay cannot read what it would be deciding about. |
| Weald Protocol | The published wire protocol between a Weald client and a relay: the envelope, the frames, the MLS binding and the errors. Hosted and self-hosted relays speak the same one. |
The pair worth getting right
A workspace is the encrypted project record: channels, tickets, board state, plans, agent evidence. An account is the billing entity on the hosted service.
An account pays for a relay and can see nothing inside a workspace running on it. That is why the dashboard shows infrastructure and never content, and why the one list of people it displays is a list of account administrators, labelled as such.
Words we avoid
We do not call a workspace a team or an organization, because both names are already taken. We do not describe the relay as a server that stores your messages, because it stores envelopes it cannot open.
We do not say end-to-end encrypted without saying what the ends are. The ends are member devices, and the threat model names everything outside them.