Trust model

The Chronicle is a convergence mechanism, not an authority. In peer mode, each client can author state and the relay only transports messages. Relay peer IDs are connection-scoped and are not durable authenticated identities.

In an authoritative room, the server owns an Engine and can serialize dispatch and project per-client views. Its projection boundary limits disclosure, but the server and its host process must be trusted. Projection does not authenticate peer-authored CRDT updates and does not protect raw P2P sync.

Treat every client payload, claimed sender field, and persisted document as untrusted input. Establish application identity and authorization separately; bind any key exchange to that identity. Use an authority when cheating, privacy, or settlement matters more than offline autonomy.