Part 9: Bonus - when there is no box at all
Bonus Part 9 of a series introducing Mesaĝkesto, a protocol for secure messaging between self-certifying identifiers.
The series was supposed to end at eight. This one is a bonus, because the nicest property of the design isn't something anyone designed — it's something left over.
Go back to Part 1. We said a box exists because data isn't like physical goods: it doesn't need carrying, it needs holding, since the two people communicating are almost never awake, online and reachable at the same moment.
The box is a workaround for absence.
Which raises the question nobody asks: what happens when the absence isn't there? When both parties are present — same room, same building, same local network?
Then you don't need the box. You talk directly. And the remarkable part is that nothing has to change for this to work.
Why it just works
Ask what a message's validity actually depends on.
It's signed by its author, using keys committed to in a log you can verify.
It names itself by its own content hash, so tampering is detectable and duplicates are recognisable.
Its contents are encrypted for the recipient. Its authorization to arrive is a token the recipient issued.
Every one of those is a property of the message, not of the path it took. At no point in this series did anything depend on where a message came from — that was the entire argument of Part 3, and the reason part 4's box could be blind and part 6's federation could skip the peer lists. A message that arrives over the open internet, over a federated hop between two boxes, over the office wifi, over Bluetooth, over a cable, or on a USB stick in someone's pocket is the same message with the same guarantees.
So the protocol never actually required a box. It required a counterpart. When you can reach the counterpart directly, the box is simply not part of the conversation — not disabled, not bypassed, not a special offline mode. Absent, because it had nothing to contribute. This is what "independent of the transport" means, and it's the sort of property you only get by not letting the infrastructure be trusted in the first place. You cannot bolt it onto a system whose security depends on the server, because there the server is the protocol.
Three situations where this stops being academic
The conversation that shouldn't leave the building
A family at home. Colleagues in an office. A classroom, a clinic, a workshop. People a few metres apart, whose messages currently travel to a data centre in another country and back — because that's where the app lives, not because anyone needed them to.
With direct transport they don't. The bytes go across the local network and stop there. Nothing to intercept upstream, nothing logged elsewhere, nothing retained by anyone, no dependence on a link being up. For a company this is a compliance story that writes itself: internal communication that provably never crossed the perimeter. For a household it's just obviously correct — your kitchen conversation shouldn't need a round trip to Virginia.
And the same client, the same identities and the same conversation history work either way. Reach the person locally, it stays local. Reach them from a train, it goes through boxes. Nobody chooses a mode.
When the infrastructure is gone
Earthquake, flood, storm, cable cut, power failure, war. Towers down, backhaul severed, the network that everything assumed is simply not there — and this is precisely when coordination matters most, and precisely when every mainstream messenger becomes an icon that spins. Here you set up whatever radio you have. A phone hotspot. A wifi access point on a generator. Direct device-to-device links. A single laptop in a shelter that everyone associates to. None of it routes anywhere, and it doesn't need to: identities still verify, messages still authenticate, groups still work, because none of that ever depended on reachability. The people in range are the network. Add one more move and it gets better. Because messages are sealed and self-verifying, anybody can carry them without being trusted. A volunteer who drives between two shelters collects everything at one and hands it over at the other — they can't read it, can't alter it undetected, can't forge an entry, and don't need any permission to help. That's the postal metaphor from Part 1 taken literally: a courier moving sealed envelopes, on foot, with no infrastructure at all.
When the infrastructure is the adversary
The harder case, and the one this matters most for. Journalists, human rights defenders, organisers, lawyers, medics working where the network is monitored, filtered or switched off deliberately. Internet shutdowns during elections and protests are routine now — not exotic, routine. Where the state operates the network, the questions "who did she message" and "who was in that group" are answered by asking the operator, and no amount of content encryption changes that. Take the box out and the questions have no addressee. Two phones over a direct link produce no record at a provider, because there is no provider. There is no account to subpoena, no server logs to seize, no operator to compel, and — from Part 2 — no registrar or carrier who can revoke the identities involved. When the network comes back, the same conversations continue through boxes as if nothing happened, and the history that accumulated during the blackout syncs normally. The threat model shifts rather than disappearing, and it's important to say so: radio is physical. Bluetooth and wifi announce themselves, devices can be located by their transmissions, proximity is itself evidence, and a seized device is a seized device. This buys you a great deal against network surveillance and nothing at all against someone standing next to you. Anyone whose safety depends on it should understand which of the two they're facing.
The box is a role, not a company
The middle ground is where most real deployments will sit, and it follows from the same observation. A "box" is not a business — it's a role something plays: hold messages for people who aren't here right now. A laptop that's usually on. A cheap single-board computer in a cupboard. A machine in the office. A community server on a mesh network. None of these needs to be reachable from the internet, sell anything, or be operated by a company. So a household can run its own for the members who are out, an office can run one so people on the road get their internal messages, and a village mesh can run one that never touches an upstream link. Part 7 argued that boxes should be commodity infrastructure that institutions can run without becoming platforms.
The bonus is that "institution" scales all the way down to a Raspberry Pi belonging to nobody in particular. And you can have several, because your log can publish more than one place to reach you. Local first, remote as a fallback: the pattern almost every distributed system eventually reinvents, available here without inventing anything.
What direct mode costs you
Being straight about it, as always. Both parties have to be present. This is the original problem, unchanged. No box means no store-and-forward: if the other person isn't reachable when you send, nothing is delivered. That's the whole reason boxes exist, and why the sensible arrangement is a local box in the building rather than pure peer-to-peer.
Freshness is limited. Verifying that someone's keys are currently valid means seeing their latest published events. Cut off from the network, you can verify against the history you already hold — fine for people you know, weaker for a rotation you haven't seen and awkward for a first contact you can't look up. In person this mostly resolves itself: you're standing next to them, which is the strongest introduction there is.
Ordering is weaker. A box gives a conversation one authoritative sequence (post 3). Without one, you have each author's own ordering plus content hashes for deduplication — enough to converge and never lose a message, not enough to give everyone an identical view of interleaving. For a chat this is imperceptible; it's a real difference, so it's worth naming.
Range, battery and scale. Direct radio is short-range, power-hungry, and doesn't gracefully become a thousand-person network. This is a tool for people in the same place, and pretending otherwise helps nobody.
The part worth remembering
Most communication systems have a graceful degradation story that amounts to a spinner and a retry. This one degrades to talking directly to the person, which is what communication was before we put a company in the middle of it. That isn't a feature list item. It's what's left over when nothing in the design was allowed to depend on the infrastructure being trustworthy, present, or even alive. Build a system where the server is not a party to the conversation, and you discover you have built one that works when there is no server at all.
The box, it turns out, was always optional. It's just usually convenient.
