KSMP v3 — KSMP v3 Messaging Contract

The next-generation messaging contract — server-authoritative ordering, tickle-only wake signals, and durable inbox replay without plaintext at the relay.

Document ID

KEM-PRTL-002

Version

3.0.0

Effective Date

2026-05-05

Classification

PUBLIC PROTOCOL CHARTER

1. Charter & Scope

Kemet Protocol Governance adopts KSMP v3 as the evolution of KSMP for direct messaging within the Network. We rebuild delivery semantics around a single authenticated realtime channel per client, monotonic server sequencing, and strict idempotency — while preserving the foundational rule that encryption and decryption occur only on participant devices.

2. Hard Constraints

One inbound delivery channel on client: authenticated WebSocket.
Push is tickle-only — a wake signal, never message plaintext or previews.
Local messages decrypt once and persist for UI reads from local store only.
Ordering is server-authoritative and monotonic per conversation.

3. Envelope Model

protocol            : 'ksmpv3'
conversationId      : string
messageId           : string (client-generated)
senderUserId        : string
recipientUserId     : string
ciphertext          : base64
contentType         : 'text' | 'image' | 'voice' | 'system'
clientCreatedAtMs   : number
serverSeq           : number (assigned by coordination layer)
serverReceivedAtMs  : number
idempotencyKey      : string

4. Wire Events

Client events include ksmpv3.send, ksmpv3.ack.read, ksmpv3.resume, and keepalive ping. Server events include ksmpv3.connected, ksmpv3.inbox.frame, ksmpv3.send.ack, and structured ksmpv3.error responses with retry hints.

5. Idempotency & Replay

The coordination service is the source of ordering truth. serverSeq is immutable and monotonic per conversation. Clients persist lastGlobalInboxSeq and request replay on reconnect. Duplicate idempotency keys return the same acknowledgment without double delivery.

6. Push Contract

Push payloads may include type: ksmpv3_tickle, optional conversation hints, and optional sequence hints. They must never include plaintext, decrypted previews, or key material. After tickle: reconnect → replay → local decrypt → local notification render.

7. Security Invariants

No plaintext in mobile push provider payloads.
Encryption and decryption only on client.
Telemetry and operational logs must not contain message content.

Disclosure Line

This charter publishes the contractual behavior, guarantees, and governance boundaries of the protocol. It does not publish anti-abuse scoring internals, exploit-sensitive thresholds, or operational topology details that materially improve adversarial optimization against the Network.

Related Protocols