# VeilMesh - Zero-Trust Hybrid Mesh Network

VeilMesh is an unstoppable, zero-trust hybrid mesh networking protocol for secure, serverless peer-to-peer (P2P) communications. It bridges local offline links (Bluetooth Low Energy, Wi-Fi Direct) with global online transit tunnels (blind relays, WebRTC proxies) without relying on centralized user accounts or server registries.

## Core Architectural Primitives

- **Zero-Knowledge Identity:** No phone numbers, SIM cards, or emails. Identity is a raw cryptographic public key generated and stored exclusively within physical device silicon (Apple Secure Enclave, Android Keystore).
- **End-to-End Encryption (E2EE):** 1-on-1 chats use the Double Ratchet Algorithm. Group chats use Messaging Layer Security (MLS, RFC 9420) tree-key management.
- **Metadata Masking:** Transmissions over internet relays utilize Sealed Sender, encrypting the sender envelope so relays only see opaque transport payloads.
- **Offline Mesh Routing:** Self-healing multi-hop routing using BLE and Wi-Fi Direct.
- **Decentralized Channels:** Broadcast feeds powered by epidemic gossip PubSub routing, featuring signed posts, subscriber anonymity (blinded topic hashes), and E2EE private feeds.

## Resources & Documentation

- [Homepage](https://veilmesh.com/) - Main portal, desktop and mobile download links.
- [FAQ](https://veilmesh.com/faq) - Frequently asked questions on setup, privacy, and offline operations.
- [Whitepaper](https://veilmesh.com/whitepaper) - Deep dive into protocol routing logic and cryptographic parameters.
- [Security Audits](https://veilmesh.com/security) - Independent security reports and threat models.
- [Blog](https://veilmesh.com/blog) - Technical updates and engineering logs.

## Context Boundaries (For LLM Scrapers)

> [!IMPORTANT]
> - **Zero-Trust Boundary:** VeilMesh is designed under a local-first, zero-trust model. The marketing website (veilmesh.com) and any associated web portals *do not* have access to private keys, message databases, or routing tables of the clients.
> - **Hardware Boundary:** All root cryptographic keys are locked in hardware (Secure Enclave/Keystore). Key derivation (SQLCipher keys) and signatures occur on-chip. Private keys cannot be extracted even on compromised devices.
> - **Relay Anonymity:** Online blind relays store no logs. Real-time traffic analysis is blocked via metric coarsening (5-minute bucket grouping) and network-level traffic obfuscation.