Written from the code. Pinned by the code.
A giant of infrastructure is a network others run and a protocol others implement. Avano's protocol is specified section by section from the source it describes, and sixteen known-answer vectors are computed by the crates that ship each construction and held equal to the published files by a test. A second implementation checks its bytes against them before it talks to anything. This page is the map of both.
Nine sections, each from the code of the day it was written.
Identity and devices
The account from the words: an Ed25519 key and an ML-DSA-65 key that sign together; device credentials; retiring the words; moving to a new phone; the attestation a third party verifies.
Pairing
No directory: the invitation carries the keys, signed by the identity, sealed in a one-time link that alarms on a second fetch.
The relay, its channel and its queues
The hybrid post-quantum channel to the relay, the signed directory, the 4,096-byte block seal, lanes and circuits, the memory-only spool, bridge bundles, placement across a swarm.
Anonymous tokens
The blind token minted and spent once, the proof-of-work gate that prices it, and the blind licence a seat is.
Groups
The group id bound to its creator, equivocation detection, the authority chain, franking, read tickets that say "r of k" and name nobody.
Storage, vault, recovery
The sealed store, deleting by destroying a key, the vault, recovery packets split among friends, the migration bundle.
Calls
The media values from two contributions, the datagram, the routing header, admission by call token.
Cipher suites and agility
The registry, negotiation, signatures, the per-peer record.
Release integrity
What a build attests and how a phone checks it.
Writing the specification from the code was an audit: most sections record a defect or an overclaim found while writing them, with the change that fixed it or the argument for leaving it.
Sixteen files, each computed by the crate that ships the construction.
Each vector is one flat file of inputs and outputs: the 24 words of a published test phrase to the keys and the address they make; a device credential; an attestation; an invite link and its sealed blob; a two-relay directory and its two-of-two signatures; one transport block; a token's whole transcript and a redemption; a seat's three moves and the licence; a group id; an authority hand-over; a franking commitment; the store's passphrase key and a sealed row; a recovery return key; the ten media values of a call; what this build advertises and negotiates. Nothing is re-derived in the vectors crate: a vector that came from a second copy of the code would prove only that two copies agree.
The test that holds them regenerates every vector and refuses a file that differs, a field that moved, or a file no generator produces. When a construction changes on purpose, the vectors are regenerated with it and the change says which vector moved, because every implementation that held to the old one is wrong by exactly that much.
Nine sections, in the published source.
Computed by the shipping code, held equal by a test, in the published source.
What a second implementation does with this.
Derive the same keys and address from the same words; encode the same directory bytes; open the same block; verify the same proof; refuse what the vector says is refused. Where a move draws randomness, the file names the seeded stream it was drawn from and the transcript is checkable without reproducing the draw. An implementation that passes the sixteen has the identity, the pairing seal, the directory, the block, the token, the seat, the groups' id and authority, the franking, the store, the recovery return, the call values and the negotiation right; what it does not yet have a vector for is listed below. The licence is the same as the source's, and a second implementation is welcome to it.
What is specified and not yet pinned, and why.
The pairing material itself (the invitation's identity binding and the completion) needs a full session to produce and is specified in prose only. The sealed recovery payload's split is random and its vector would pin nothing. The derived per-contact mailbox is built, specified, and has no vector on purpose: nothing may call it until its founder says so, and a guard holds that. A standards-body submission, with the document in that body's form, is a step for after the consumer product is launched and audited.