PROTOCOL NOTES / 02
Invitations & membership
From an out-of-band invitation to a fixed, approved group.
Implemented software · Physical qualification pending
An invitation is the first trust boundary
A new ride receives a random ride ID and admission token. The organizer’s persistent Ed25519 identity anchors the invitation. The native QR/paste flow validates the version, key-derived organizer identity, field sizes, and token before entering discovery. The token never belongs in a screenshot, log, or public example taken from a real ride.
The invitation is an out-of-band trust anchor, not a separately signed organizer object. Possessing it does not grant membership: a candidate still needs organizer approval. RWCP v1 invitations are incompatible with v2.
Approval turns a candidate into a member
The organizer assigns stable roster indexes from 0 to 11, with itself at index 0. Signed, increasing roster versions distribute membership. An unassigned index of 255 is admission state, not permission to send voice. At most 12 participants belong to a ride; pending candidates are separately bounded.
Membership is fixed before conversation
Closing admission seals the group. Each rider starts audio on their own phone. Source descriptors establish the authorized voice source, key material, clock, frame duration, and progress. Creating or joining a ride alone does not start microphone capture.
Leaving is local
An authenticated leave marks that rider’s source unavailable. It does not rewrite the sealed roster, rekey every source, or terminate all other riders’ sessions. Organizer departure after sealing is not a global authenticated stop command.
Authority: Native protocol; scenarios 01–06, 10. Public examples are synthetic. This guide is maintained against the private implementation; it does not imply access to its source.