lockbitchat
113bb107d3
A group call is N-1 ordinary 1:1 calls, one to each other member, each riding the pairwise session that member already has — a transport a human already authenticated by comparing the safety code. No mixer, no SFU, no point at which two people's media meets anywhere but on a device. Call control is separate from call media, because the two reach different sets of people. Who opened a call, who joined and who left travels as group frames signed with the sender's group identity key, so it reaches members currently reachable only through a relay — and a relaying member can drop one but cannot write one. Media flows only where a direct link exists, so a member without one shows as connecting rather than being omitted. Frames carry a per-sender sequence checked before the action, so a captured leave cannot end a later call, and simultaneous calls converge on the lower random call id. One capture is shared across every leg rather than one getUserMedia per member, and legs answer without prompting: the flag permitting that is set only locally, only while this user is in the call, and cleared when they leave. UI: a gallery that sizes itself from the space it has, a spotlight view, an active-speaker indicator read from the waveform, and the call surface in the same visual language as the 1:1 one. Also in this commit, the v6.5.0 language-suggestion work that had not been pushed yet; its notes are in the changelog. And two fixes: the safety-code input asks for digits rather than text, and starting a new chat from inside a group no longer creates it behind the group where it cannot be seen — which had made it impossible to connect to anyone new, or to add anyone to a group, while a group was open. Claude-Session: https://claude.ai/code/session_01XSxAkET3hQTkYDQfbjCQwZ
Documentation
Technical documentation for SecureBit.chat. Start with the project README if you are looking for an overview or a quick start.
| Document | What it covers |
|---|---|
| ARCHITECTURE.md | How a session is established, verified and torn down, and where each guarantee comes from |
| CRYPTOGRAPHY.md | Key schedule, the Double Ratchet, SAS verification, memory handling |
| DESCRIPTOR-SBQ2.md | The invitation format: wire layout, why it is small, the in-band key exchange, decoder rules |
| CONFIGURATION.md | Deployment, ICE and TURN setup, privacy modes, file transfer policy |
| CALLS.md | Voice and video: codec choices, adaptation, and why each value was picked |
| API.md | Internal interfaces of the WebRTC manager and file transfer system |
| CONTRIBUTING.md | Development workflow and what needs extra review |
| USE-POLICY.md | Terms of use, intended use, and the limits of what the software can protect |
Security policy and vulnerability reporting live in SECURITY.md at the repository root, where GitHub expects to find them.
Keeping this accurate
These documents describe the current release and are expected to change with it. Every value quoted here (limits, timeouts, algorithm parameters) is taken from the source rather than restated from memory, so if you change one in code, change it here in the same commit. CONTRIBUTING.md lists which documents are affected by which areas of the code.