Four boundaries
Last updated
Weald draws four trust boundaries and names the attacker at each one. The published threat model states what is in scope, what is out of scope, and which residual risks are accepted rather than mitigated. This page is the summary; the document is the normative version.
The four boundaries
| Boundary | Attacker | What holds |
|---|---|---|
| Relay | A relay operator, or somebody who took one | Content stays closed. Sizes, timing and connection patterns do not |
| Control plane | Whoever runs the hosted billing and provisioning layer | It holds accounts and storage totals, and no key for any workspace |
| Bootstrap handoff | Somebody watching the channel a first invite travels over | The invite is single use, expires in a day, and its two halves travel separately |
| Third party | A subprocessor, or a model provider an agent talks to | Named explicitly, along with what leaves the boundary |
What an operator sees
Envelope sizes and timing, connection counts and addresses, storage totals per workspace, and, on the hosted tier, the billing account and its email. That is the complete list, and it is on the security page as a table.
What stays closed: message bodies, ticket text, media, filenames, channel names and workspace member lists.
What is out of scope
- A compromised member device. It holds plaintext. Nothing in the protocol survives an attacker who has the device and its keychain.
- A model provider. Anything an agent sends to one has left the Weald boundary. That is a property of using an agent, and the fix is scoping what the agent is given, not encryption.
- Traffic analysis. The relay is not a mixnet. A determined observer learns when a workspace is busy and roughly how large its messages are.
- Runtime attestation. Verifying a digest catches deployment drift. A modified binary can misreport its own digest, so it does not prove what a remote host executes.
Accepted residual risks
Two, both stated rather than mitigated.
A workspace whose admin devices stay offline accumulates uncompacted history and a stale access set, and no server-side process fixes it. And a relay that goes silent toward one member has to be detected by that member's client rather than prevented, which is why silence raises the same alarm as contradiction.
What refuses rather than degrades
A client refuses a plaintext connection rather than downgrading it. A protocol version below a client's pinned floor aborts the connection rather than continuing. A relay running without access-set enforcement says so in its readiness output and in every connected client's encryption panel.
The pattern is deliberate. A system that quietly does the weaker thing has guarantees nobody outside it can check.
The document
The full model, boundary by boundary, is in the published conformance document set, alongside the state machines and the registries an implementer needs.