protocol/atsam
ATSAM describes Raven’s pairing, private discovery, live peer confirmation, encrypted forwarding, and optional Vault Mode. This is a protocol overview; the supported terminal profile determines which parts are available.
implementation/status
The Rust terminal path does not yet establish full post-quantum interoperability. Review the current profile, implementation limits, and conformance evidence before relying on a protocol feature.
Peer setup and verification are performed from the Raven CLI. Use the command surface documented for the build you run.
raven contact add --help raven contact verify --tag alice raven status
The Alice tag must already identify a saved peer. Compare the public fingerprint through a trusted channel before pinning it. Node status does not imply that every ATSAM profile is available.
atsam/layer-01
The ATSAM design combines X25519 with ML-KEM-768. Full post-quantum pairing is not established across the current Rust terminal path; check the implementation’s supported profile.
Hybrid key agreement combines classical and post-quantum inputs through the specified derivation. Security depends on the combiner, implementation, peer authentication, randomness, and key handling. Algorithm selection alone does not establish deployment readiness.
atsam/layer-02
Paired Raven nodes can recognise authenticated discovery material without broadcasting a stable public identity. Local discovery depends on the carrier implementation.
Discovery material allows a paired peer to recognise another node without advertising a permanent name or public key in every beacon. It is not a guarantee that a network observer cannot detect or correlate traffic.
atsam/layer-03
Fresh challenge–response binds a presence check to the current exchange and helps reject replayed discovery material.
A fresh exchange challenges the peer to prove possession of current authenticated state. Replay handling and freshness bounds must match the specification and the enabled transport.
atsam/layer-04
Routing tags and sealed envelopes let a relay forward protected payloads. Network observations, endpoint compromise, and traffic analysis remain separate concerns.
The routing design uses protected payloads and rotating recipient tags. Relays forward opaque data under queue and expiry rules. The carrier can still expose timing and connectivity information.
atsam/layer-05
The protocol describes one-time-pad protection under strict conditions: secret random pads, sufficient length, secure distribution, and no reuse. This is not a blanket claim about the terminal build.
One-time-pad secrecy requires truly random secret pad material at least as long as the message, secure distribution, and no pad reuse. Erasure, delivery, authentication, and endpoint compromise require separate controls.
protocol/evolution
Post-quantum ratchet and hybrid-signature proposals have separate roles. A key agreement protects the establishment of a shared secret; a signature authenticates an assertion. A signing algorithm does not itself encrypt message content.
Use the specified state transitions and conformance gates. A published draft or test vector does not mean a profile is enabled in the terminal release.
Recovery and key rotation need explicit support in the selected implementation. A social-recovery design is not evidence that a lost terminal profile can be recovered automatically.
An RVN1 envelope can move through supported carriers without giving relays its decryption key. Bluetooth is one optional carrier; ATSAM is not a requirement to own Bluetooth hardware.
A compromised host is outside the confidentiality guarantees of endpoint encryption.
Restrict operating-system access, protect the profile and supported credential store, apply software updates, and maintain physical custody.
Vault Mode describes additional content protection under strict pad conditions. Host access control and local policy remain separate requirements; no graphical unlock workflow is implied.
source/reference
Use the protocol documents and implementation together. Test evidence must name the profile and path it covers.