Muster — diagrams

Architecture and pipeline figures for Muster, a local-first client for coordinating multi-party transactions inside conversations. Every figure declares where its facts came from, and which of its content is measured, read from source, or illustrative.

Also here: the action atlas — every action a person can take in Muster, and every multisig family it has built, plans, watches or rejected, and exactly how each one differs.

Interactive

One labelled substrate, a list of named traversals over it. Pick a view; everything else dims. Each view is also exported as a static frame for embedding.

Muster on the Logos stack — interactive interactive

Muster on the Logos stack: three entry points over app backends, modules, network and runtime, with a dark band for the infrastructure the user does not run. Seven selectable views, including the demo build and the specified build as an A/B.

BOTH 7 exported framesfrom sourceillustrative source
The pipeline, against the infrastructure that runs it — interactive interactive

The keystone: seven pipeline stages against what runs each conventionally and who operates that, what ran it in Muster's September 2026 demo build (labelled in the figure as a dated status of that build, not Muster's scope), and who still sees what. Nine views — per-use-case retellings, three that select by observer rather than by stage, and one that marks the two stages left unassessed.

BOTH 9 exported framesfrom sourcemeasuredillustrative source

Deployment and packaging

How the thing is put together, and what actually pins it.

One instance of Muster, running

One running instance: the isolated ui-host process holding the QML view and a QtRO replica, the app process holding Logos Core and every module, per-instance state on disk, and the two live remote dependencies that leave the machine.

BOTHfrom source source
What is generated, and what is written by hand

The two codegen paths and the hand-written region each ends in: muster.lidl through the lidl_c.h JSON bridge to a generated Nim surface, and ui/metadata.json plus muster_ui.rep through logos-module-builder to the plugin entry point and QtRO glue, ending in MusterUiBackend and the QML.

BOTHfrom sourceillustrative source
What the module declares, and what the flake pins

The declared runtime module set against the flake inputs that resolve it: chat_module pinned to a release tag with two inputs following it, and lez_core pinned to no release at all.

BUILDfrom source source
How the module reuses the Nimbus Nim stack

The reuse toolchain: metadata.json's pinned nim.packages closure -> the builder's nim.packages hook (fetchFromGitHub + --path) -> the Nim staticlib compile, with the reused Status/Nimbus stack against what is kept ours (dcbor, curve25519) and why.

BUILDfrom sourcemeasured source

The pipeline, and what leaks

Seven stages, the infrastructure that runs each, and who is positioned to see what.

A private-to-private transfer, traced through the Logos stack

A private-to-private transfer traced step by step through the real stack components — chat_module and delivery_module for the conversation and the address exchange, lez_core for the shielded value — with, at each hop, what leaves the device and which outside party (the store node, the zone) learns it. The flow companion to the substrate-pipeline keystone: where that correlates stages to infrastructure as a table, this walks one payment down the stack and marks the leak at every step.

BOTHmeasuredfrom source source
Three kinds of leak, and why collapsing them is the mistake

The three leak classes — chosen by you, chosen for you by the stack, chosen by nobody and inherited — each with a worked example from this build, the fix, and the obligation on whoever describes it.

POSTmeasuredfrom source source
Four rails, one payment, and exactly one difference

The four transfer directions against what each discloses — amount, payer, payee — and what each costs in time, over a floor that holds on all of them.

BOTHfrom sourcemeasured source
Agreeing to pay: a hosted service, or the room

A hosted transaction service against the encrypted room: what an operator sees before anything reaches a chain, and what a store node sees instead — with the room-not-chain threshold limit in the same frame.

BOTHmeasuredfrom source source
What each step of the journey actually costs in time

Every step of one payment on a logarithmic time axis, against the thresholds where an interaction stops feeling like one — and the 20-second sync-client timeout that sits in the middle of it.

BOTHmeasuredfrom sourceillustrative source
Privacy costs you the ability to ask about your own address

The account-id derivation drawn: id = sha256(prefix ‖ npk ‖ vpk ‖ identifier). The recipient publishes the key node; the sender picks the identifier; every payment therefore mints a fresh account found only by scanning. What that buys, what it costs, and the retraction of our own report of it as a bug.

POSTfrom sourcemeasured source
Findable or unlinkable: two discovery models on one stack

Two ways to be found: shielded receiving keys handed over in band (wired into the build), against a public on-chain name anyone resolves, a pattern no part of the stack ships. Each column names its cost.

POSTmeasuredfrom source source
The transaction pipeline: seven stages, and where privacy argument actually lands

All seven stages with their leak descriptions, the four that precede a transaction, the three the chain is in, and the one the argument concentrates on.

POSTfrom sourceillustrative source
Muster scored on its own matrix

The September 2026 demo build scored closed/partial/leaks on Muster's own seven-stage matrix, with Ordering and Enforcement deliberately left unassessed. A dated status of that build, labelled as such in the figure, not Muster's scope or today's status; contracting's ◑→● marks F-4 re-derivation built since in Muster's own client.

POSTmeasuredfrom source source
Discovery with a directory, and without one

Introduction with a directory against without — who learns the edge.

POSTmeasuredillustrative source
Content is hidden. Metadata is not.

Content against metadata across the journey: what end-to-end encryption covers, and what it does not.

POSTfrom source source
What a shielded payment costs in time

Shielded-transfer proving time against human-interaction thresholds.

POSTmeasuredillustrative source

Muster's own guarantees

Mostly built now. Every figure carries its status on its face, above the content: built, part built, or specified.

The intent lifecycle, and which of it exists today

The seven lifecycle states with the four teaching questions each of them answers, and which states the demo actually reaches.

BOTHfrom sourcemeasured source
Effect and materialization: the check that cannot be disabled

What a participant reviews against what actually gets signed, the client's independent re-derivation between them, and the requirement that the check cannot be turned off.

BOTHfrom sourceillustrative source
What a signing payload commits to, and what each field defeats

The fields a signing payload commits to and the specific reuse each one defeats, each row marked built or not, with the two versioned fields marked apart from the invariant property, and the provenance record F-20 adds to the same payload.

POSTfrom sourceillustrative source
Where the data came from, and why re-derivation does not answer it

Why re-deriving a materialization does not answer where its inputs came from, what F-20's provenance record commits to for each input class, the refusal that gives it teeth, and the two different boundaries it does and does not defend.

BOTHfrom sourceillustrative source
State is a fold over a content-addressed, hash-linked log

Events reduced to state, with idempotence, order-independence and cold-start re-derivation as the three properties that follow — and what the demo folds instead.

BUILDfrom sourcemeasured source
Membership epochs: joining does not grant the past

Three epochs across a join and a removal: what a joining member cannot read, what a departing member keeps, and why the seam drawn in the thread is a cryptographic claim.

BOTHfrom sourceillustrative source
The driver seam: the core never interprets contribution bytes

F-6's seven driver methods and where the build puts each (the Driver, the core's Collection, the Settlement seam, or for a split settlement in parts), the axes describe returns, three of the registry's drivers behind one interface, and the conformance suite that gates them.

BUILDfrom source source
Two bound identities: the F-14 decision (ADR-010 revisited)

The identity decision at ADR-010 as revisited (2026-08-23): two bound keypairs — a secp256k1 authorization identity and an Ed25519/X25519 encryption identity, joined by a signed binding the room verifies (F-9) — replacing the one-curve ideal, which hid ECDSA+ECDH key reuse.

BOTHfrom sourcemeasured source
Plugins emit typed blocks and nothing else

A plugin as a pure function to typed blocks, the closed render vocabulary, what it may never do, how it is distributed, and the lying-plugin test that proves the boundary.

BUILDfrom source source
One wallet, any chain — the settlement seam

A Wallet aggregate over a ChainAdapter seam, drawn with its first two adapters (EVM, mock shielded) of the five it has today, the four divergences the seam keeps distinct (account model, assets, finality, failure), and where signing (FS-4) and the untrusted RPC (inv 8) sit.

BOTHfrom sourcemeasured source
You don't have to trust the RPC — verify the balance

The verified-read path: an untrusted RPC's eth_getProof checked with nim-eth verifyMptProof against a trusted state root, the three outcomes (valid/absent/invalid), the attested-vs-verified-locally grades, and the deferred light-client anchor.

BOTHfrom sourcemeasured source
How to write a driver — the contract and its conformance suite

The Driver contract (describe/canonicalize/verifyContribution plus a declared manifest and profile), the driver-generic core it plugs into, the conformance suite that grades any driver, and the recipe for adding a new driver without touching the core.

BOTHfrom source source

Muster — diagrams

Interactive

Muster on the Logos stack — interactive interactive

The pipeline, against the infrastructure that runs it — interactive interactive

Deployment and packaging

One instance of Muster, running

What is generated, and what is written by hand

What the module declares, and what the flake pins

How the module reuses the Nimbus Nim stack

The pipeline, and what leaks

A private-to-private transfer, traced through the Logos stack

Three kinds of leak, and why collapsing them is the mistake

Four rails, one payment, and exactly one difference

Agreeing to pay: a hosted service, or the room

What each step of the journey actually costs in time

Privacy costs you the ability to ask about your own address

Findable or unlinkable: two discovery models on one stack

The transaction pipeline: seven stages, and where privacy argument actually lands

Muster scored on its own matrix

Discovery with a directory, and without one

Content is hidden. Metadata is not.

What a shielded payment costs in time

Muster's own guarantees

The intent lifecycle, and which of it exists today

Effect and materialization: the check that cannot be disabled

What a signing payload commits to, and what each field defeats

Where the data came from, and why re-derivation does not answer it

State is a fold over a content-addressed, hash-linked log

Membership epochs: joining does not grant the past

The driver seam: the core never interprets contribution bytes

Two bound identities: the F-14 decision (ADR-010 revisited)

Plugins emit typed blocks and nothing else

One wallet, any chain — the settlement seam

You don't have to trust the RPC — verify the balance

How to write a driver — the contract and its conformance suite

Series chrome

The generator for the per-post 'you are here' strips: the seven stages with one lit, one file per stage.

What the marks mean