Four boundaries
Last updated
Weald draws four trust boundaries and names the attacker at each one. The published threat model states the scope and lists the residual risks it accepts without mitigation. This page summarises it, and the published document is normative.
The four boundaries
| Boundary | Attacker | What holds |
|---|---|---|
| Relay | A relay operator, or somebody who took one | Content stays closed, while sizes, timing and connection patterns are visible |
| Control plane | Whoever runs the hosted billing and provisioning layer | It holds accounts and storage totals, and no key for any workspace |
| Bootstrap handoff | Somebody watching the channel a first invite travels over | The invite is single use, expires in a day, and its two halves travel separately |
| Third party | A subprocessor, or a model provider an agent talks to | Named explicitly, along with what leaves the boundary |
What an operator sees
An operator sees envelope sizes and timing, connection counts and addresses, and storage totals per workspace. On the hosted tier the operator also sees the billing account and its email. The operator sees nothing else.
Message bodies, ticket text, media, filenames, channel names and workspace member lists stay closed.
What is out of scope
- A compromised member device. It holds plaintext. Nothing in the protocol survives an attacker who has the device and its keychain.
- A model provider. Anything an agent sends to one has left the Weald boundary. This follows from using an agent, and the remedy is scoping what the agent is given.
- Traffic analysis. The relay is not a mixnet. A determined observer learns when a workspace is busy and roughly how large its messages are.
- Runtime attestation. Verifying a digest catches deployment drift. A modified binary can misreport its own digest, so it does not prove what a remote host executes.
Accepted residual risks
Two risks are stated and left unmitigated.
A workspace whose admin devices stay offline accumulates uncompacted history and a stale access set, and no server-side process fixes it.
A relay that goes silent toward one member cannot be prevented from doing so, and that member's client has to detect it. Silence therefore raises the same alarm as contradiction.
Refusals
A client refuses a plaintext connection. A protocol version below a client's pinned floor aborts the connection. A relay running without access-set enforcement says so in its readiness output and in every connected client's encryption panel.
A system that quietly falls back to the weaker behaviour has guarantees nobody outside it can check.
The document
The full model, boundary by boundary, is in the published conformance document set, alongside the state machines and the registries an implementer needs.