The backend began with an explicit boundary. It would be authoritative for current coordination state, access policy, revocation, rendezvous, relay eligibility, and operational signals, but it would not become the permanent owner of plaintext case history.
The implementation divided those responsibilities into small domain modules. Device sessions, case links, membership policy, presence, signaling, and transient queues could evolve independently while sharing current-state authorization checks.
Later work added persistence, limits, cleanup, metrics, and wake-up hints.
The boundary is still an architectural direction rather than a completed security guarantee. The present client integration does not cryptographically encrypt its relay payload, so an end-to-end encryption claim would be unsupported.
← Back to CASES