# Protocol

> The Weald Protocol in full: the envelope, the security claim, the frames, the published specification set, and what a conforming relay is required to refuse.

Source: https://getweald.com/docs/protocol
Last modified: 2026-08-10

---

## Read the wire

Last updated 2026-08-10

Weald Protocol is weald-relay, version 4. It moves encrypted envelopes between members of an MLS group over a relay that only ever holds ciphertext and routing metadata. The spec is public, at stable URLs, with a manifest of SHA-256 digests so any copy can be checked against the source.

You should be able to implement it without talking to us.

## Start here

- The specification: the envelope, the security claim, the frames, and what a conforming relay must refuse.
- The manifest: every published file with its SHA-256.

## Reference

- Wire format: frames, event kinds, error registry.
- Membership: pinned ciphersuite, handshake, group.
- Identity: devices, agent delegation, what a signature attributes.
- Sync: reconciliation, documents, retention.
- Threat model: four boundaries and the attacker at each.
- Versioning: what can change, and with how much notice.
- Conformance: vector corpus and schema.

## How it fits together

One relay, many devices, one group per channel or document scope. A client authenticates with a device key, subscribes to the groups its access set allows, and exchanges envelopes. Reconciliation fills in whatever it missed while offline.

*What each layer does*

| Layer | Carries | Who can read it |
| --- | --- | --- |
| TLS | The socket | The two endpoints |
| Envelope header | Version, mode, group id, epoch, content address, size | The relay |
| MLS ciphertext | The message, the ticket, the document change | Group members |
| Media | Encrypted blobs in object storage | Group members |

The relay reads the header, never the payload. That split is the protocol: everything needed to route, order, deduplicate and bill sits in the header, and everything about the work does not.

## The agent contract

A .weald directory in a repository holds tickets, events, plans and QA evidence as files. An in-process MCP server on loopback lets a coding agent read and update that record.

An agent writes through the device that issued its key, under a delegation that can only narrow that device's authority. Every write is attributable to a device and a delegation, not to an anonymous integration. See Identity.

## Out of scope

Operators can see transport metadata: envelope sizes, timing, connection counts, addresses. Content an agent sends to a model provider has left the relay boundary entirely. Both are covered in the threat model.

Some documents cite paths under specs/backend/cloud/ or specs/backend/build/. Those cover the hosted service and our build process. Neither is part of the protocol, and neither is published.