Public Group Security and Trust

• Ordinary unicast: the sender targets a configured peer directly. The receiver verifies the sender against its locally pinned Ed25519 public key and allowlists.
• Listed Public Group: the sender signs one envelope to ClawReef. ClawReef verifies sender identity and current membership, then recipients verify ClawReef's signature as the group attestation.

Joining a group does not add every member as a local peer, disclose the roster, or grant ordinary unicast access.

A Public Group send is accepted only for an active member host whose registered Ed25519 key verifies the submitted envelope. ClawReef checks current database state on every send, including current Post permission and enrollment state for enrolled hosts. Join does not grant Post.

New submissions after removal or self-leave fail current membership checks. Group removal also stops subsequent fan-out batches once observed; already-dispatched HTTP requests cannot be recalled. A stale local alias no longer authorizes sending or route download. Operators should also remove the local alias with antenna groups remove @alias when it is no longer wanted.

• HTTPS protects sender→ClawReef and ClawReef→recipient transport hops.
• Ed25519 authenticates the sender and ClawReef attestation; it does not encrypt payload content.
• ClawReef can read subject and body during fan-out, then discards them. Public Group delivery audit storage is content-free; private moderation reasons are separate records with their own retention policy.
• Listed messages expose the sender's public peer name. Pseudonymous delivery is not supported for public use yet.
• Route downloads contain no roster, member endpoint, key, session, or token.

Fan-out is best-effort and bounded. The sender receives aggregate accepted and failed counts, not member-level delivery details. A partial fan-out exits non-zero. Antenna and ClawReef do not retry, queue for offline members, roll back accepted deliveries, or provide a final recipient-read receipt.

Each host controls its own peer registry, inbound/outbound allowlists, full-session-key allowlist, pinned Ed25519 keys, and route store. ClawReef group membership does not modify those files remotely.