flit/PROTOCOL.md

flit protocol

flit speaks a trimmed subset of YAW/2.1 (forward-secret signaling) — see ../waste-go/PROTOCOL.md for the full spec. This file only notes where flit diverges.

What's reused as-is

• Ed25519 device identity; id = hex(pubkey).
• Signaling: WebSocket join/challenge, sealed to/from relay (§5).
• yaw/2.1 ephemeral-key (ekey) forward-secret signaling, falling back to static (yaw/2.0) seal if the peer doesn't send one (§6′, §6.1).
• The hello identity-confirm bind over DTLS fingerprints (§6).
• File transfer: file-offer / file-accept / file-cancel, chunked 64 KiB binary DataChannel labeled f:<xid> (§9).

What's dropped

flit has no chat, presence, multi-peer mesh, or file browsing — every session is exactly one peer, ends after one transfer (or a cancel/close). chat, pm, reaction, peer_gossip, browse/get/files message types are not implemented.

What's flit-specific

• Room naming: flit never uses a human-chosen network name. Rooms are 16 random bytes (128 bits), hex-encoded, generated fresh per pairing — net = sha256("yaw2-net:" + random_hex). This is deliberately different from yaw2's named-network convention: a flit room must not be guessable or brute-forceable from the anchor's point of view, since pairing is the only trust mechanism (no keyring-gated network name to fall back on for an ephemeral session).
• Invite encoding: flit:<base64url(json)> where the JSON is {"anchor": "<wss url>", "room": "<hex>"}. Distinct from waste-go's waste: invite format (which carries a network name, not a random room). See pwa/src/pairing/ephemeral.ts and cli/cmd/flit/main.go.
• Pairing trust: two independent flows —
  • Ephemeral (above): trust is "whoever shows up in this freshly generated, never-reused room," confirmed by the hello signature.
  • Persistent keyring (pwa/src/pairing/keyring.ts): optionally remember a peer's id after a verified session, for repeat pairing without re-scanning. Not yet wired into the join flow to pin sessions to a specific id — currently advisory/UI-only.
• TURN credentials: short-lived, minted server-side by the anchor's GET /turn-credentials (coturn use-auth-secret HMAC; see waste-go/cmd/anchor/main.go). The PWA fetches from there. The CLI computes the HMAC locally from FLIT_TURN_SECRET env (acceptable for a native binary — unlike browser JS, it isn't visible to anyone who opens the page source).