There is a beautiful, dangerous idea at the heart of how groups stay in sync here: gossip. A message about a shared group does not go to a server and get handed out. It spreads. Each member who hears it relays it to others, the way a rumor moves through a room, until everyone has it. No central machine holds the master copy; no single point can fail or censor. It is an epidemic, in the good sense — fast, resilient, serverless.

It is also exactly the kind of thing a thoughtful attacker loves. An epidemic broadcast network will carry a lie across a whole group with the same cheerful efficiency it carries the truth. A relay does not know or care whether the message it is passing along is real. So the question that makes gossip safe is not "how do we move messages fast?" — that part is easy. It is: when a message lands on your machine, why should you believe a single byte of it?

The answer is that you don't — not on arrival. Every gossiped message runs a gauntlet of five checks, in a fixed order, before it is allowed to change anything. Each layer stops a different attacker, and the order is not cosmetic: a cheaper check guards a more expensive one. Let us walk down the five, naming what each one is for.

A note on who is attacking

Before the checks, it helps to name the cast, because the layers map onto them.

There is the remote network attacker, who can fire arbitrary packets at your machine but cannot read your files or your memory. There is the malicious peer — someone who holds a perfectly legitimate key, is genuinely known to you, and is nonetheless lying. This second one is the subtle adversary: their signatures are valid. The naive defense ("only accept signed messages") does nothing against them, because they can sign. Several of the five layers exist specifically because "it's signed" is not the same as "it's allowed."

Check one: the envelope

The first layer is the cheapest, and it runs first on purpose, so a flood of garbage costs almost nothing to reject.

Every gossiped message is wrapped in a small envelope. Before anything else, the system checks the envelope's structure, its cryptographic signature, and its timestamp freshness — the message must be recent, within a short window of the past and a tiny tolerance into the future. A message claiming to be from last week, or one with a mangled wrapper, dies here without further thought. This is the bouncer at the door checking that you have a ticket at all, before anyone bothers reading what is on it.

The freshness window matters more than it looks. Without it, an attacker could capture a real, validly-signed message and replay it later to confuse the group's state. The timestamp turns a signed message into a signed-and-current message.

Check two: do I know this sender?

Passing the envelope check means the message is well-formed and signed by somebody. The second layer asks: somebody I should be hearing from?

The sender's identity must be one of a short list: yourself, one of your own devices, an active relationship of yours, or a co-member of the specific group this message is about. A signed message from a stranger — someone you have no relationship with — is dropped here. The network is not an open broadcast you passively receive; it is a graph of people you have deliberately connected to. If you and the sender share no edge, their message is not your problem.

Check three: the signer is the sender

Here is the clever one, and it stops an attack the first two layers wave right through.

Imagine an attacker who relays a real message they intercepted from one of your friends. The envelope is valid (your friend signed it). The sender appears known (it came in over a connection). What is wrong? The relayer is not the author. So the third check binds them together: the identity that signed the content inside must match the identity on the outer envelope. A relay cannot wrap someone else's signed content in their own envelope and pass it off — because then the inner signer and the outer sender disagree, and the message is rejected.

This is the difference between "this message is signed" and "the person handing it to me is the one who wrote it." Without this binding, any relay in the gossip network could impersonate any author. With it, the act of relaying cannot launder authorship.

Check four: are you allowed to talk about this?

Now we reach the malicious-peer problem head on, because the sender here is genuinely known, genuinely signing, genuinely themselves — and still might not be allowed.

The fourth check is topic authorization, and it depends on what kind of conversation the message belongs to. For a one-to-one relationship, it verifies the message really came over that specific peer's connection. For a group, it verifies the sender holds current, active membership in that exact group. Being known to you (which check two confirmed) is not the same as being a member of this group (which check four confirms). A person you have a relationship with does not thereby get to write into a group they are not in. Membership is checked per message, against the present state — not "were they ever a member," but "are they one now."

Check five: does the content make sense?

The final layer is the deepest, and it assumes everything above passed: the message is fresh, from a known sender, who really wrote it, and who is authorized to speak on this topic. Even then, one question remains — is the content legitimate?

The fifth check runs the message through type-specific business rules: does this event follow validly from the history it claims to extend, does it obey the rules of its kind, do the package-level validators that guard sensitive operations approve it? A member who is fully authorized can still try to write something that violates the rules of the thing they are writing to, and this layer is what catches that. It is the difference between "you are allowed in the room" and "what you just said is actually true and well-formed."

Why the order, and one honest gap

The order is a defense in itself. The cheap checks come first so that the expensive ones — the membership lookups, the content validation — are never spent on traffic that a one-microsecond envelope or timestamp check could have killed. An attacker who wants to exhaust your machine has to get past the cheap gates first, and they are designed to be unforgeable, not merely fast. There is also a rate limit ahead of the cryptography, checked before signatures are verified, precisely so that signature-checking itself cannot be turned into an amplification weapon.

And the honest part, because a security piece that oversells itself is its own vulnerability: the layered checks above are about who and what on the gossip plane. There remain, by our own published accounting, places where a higher-level authorization gate is not yet as tight as the design wants — work we name openly rather than paper over. The five-layer gossip pipeline is real and it is the load-bearing wall for group sync. It is not the only wall the system needs, and we say so.

The thing to carry away is the inversion. On most networks a message is believed because it showed up. Here, arrival earns a message nothing. It is fresh, then known, then truly-authored, then authorized, then valid — five times asked to prove itself — and only a message that survives all five gets to change what you believe.

Related: Why Gossip Must Never Move Your Big Files · No by Default: How Four Independent Gates Decide Who Sees Your Data.

Written by AI agents from real project logs; owned and edited by Mujo.