Identity and Pseudonymity Sunday — August 23 2026 Weekly Update

The weekly companion to Overview - Identity & Pseudonymity, covering August 16–23, 2026 (since the August 16 weekly update). Three stories define the week. First: the foundation under last week's post-quantum identity keys survived its first live-fire test — Gupte, Ragavan and Zhandry's no-go refutation of Simon's DCP claim (ePrint 2026/1693, approved August 15, machine-checked in Lean 4) landed four days after nostr-wot-extension shipped ML-KEM-1024 identity keys, and the same week NDK merged the second independent PQ direct-message implementation (Dart, PR #713) — the open question "will the pattern get a second implementation?" is answered in six days. Second: relay authentication became the burning platform — Amber 6.5.0 closed a relay-auth confused deputy via four security advisories, Cambium shipped three releases of admission control to keep kind 22242 bursts from starving a hardware signer, Amethyst rebuilt its NIP-42 decision flow, and nostrord stopped connection churn that re-prompted signing — the same identity event (kind 22242) hammering every signer in the ecosystem at once. Third: Concord PR #18 merged — sharded community lists remove the 50-member cap, and Vector/Armada already did the cross-client review pass. Below: the detail, the architecture, and the ungovernable-tech takeaway.

TL;DR — This Week

• The Simon DCP claim is refuted — formally and machine-checked (Aug 15): Gupte (MIT), Ragavan (Google Quantum AI / MIT) and Zhandry (Google Quantum AI / Stanford) posted ePrint 2026/1693, "The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP." Not a critique of the proof — a no-go on the algorithm itself: after step 3 the algorithm never touches the classical Fourier labels again, and the step-3 state is reconstructible from roughly the top third of those labels, which is provably too little information to extract the secret's least-significant bit (distinguishing advantage ≤ poly(n)·2^(−n/3)). Either the algorithm is wrong or its runtime is Ω(2^(n/9)) — it cannot be both subexponential and correct. Lean 4 code is released. The kicker: Ragavan was one of the two personal-communication sources Simon's own paper cited. Nine days from claim to no-go. For identity: the ML-KEM-1024 keys that shipped in nostr-wot-extension 0.4.0 (Aug 11) now rest on assumptions that survived a community assault — full cryptanalysis in Post-Quantum Saturday — August 22 2026 Weekly Update and The Dihedral Coset Attack Line.
• NDK merges post-quantum hybrid DM encryption — the second implementation (PR #713, merged Aug 18): the Dart/Flutter development kit behind a large share of mobile Nostr clients now does hybrid ML-KEM-1024 beside classical key agreement for direct messages — the same construction nostr-wot-extension shipped, independently implemented in a different language and ecosystem. PR #712 (same day) replaces a GPL-3.0-only Dilithium dependency with fips204 (ML-DSA), removing a licensing constraint for embedded adopters. Last week's open question #1 — will the PQ pattern get a second independent implementation? — resolved in six days. The full three-key kind 10203 architecture still has one implementer; the encryption half now has two.
• Amber 6.5.0 (Aug 14): four security advisories, one release: a confused deputy in relay authentication let any caller obtain a kind 22242 NIP-42 event for relays the user never approved; a NIP-46 replay gap; plaintext connection secrets and local keys now envelope-encrypted at rest; and an eight-item hardening batch (caller authorization before decrypt, fail-closed permission parsing, plain-ws:// warnings, secure QR screens, log redaction, lazy key zeroing on logout, optional unlocked-device Keystore use). 6.4.0 made signing decisions explicit; 6.5.x changes what Amber will authorize at all.
• Cambium 0.4.0–0.4.3 (Aug 13–14): six releases in two days, three of them about kind 22242 load: the NIP-55 proxy to the Heartwood hardware signer extends signing to websites via a validated nostrsigner: callback that inherits no permissions from native apps (browser tab ↔ app isolation at the signer boundary), then builds admission control: reserved queue slots for user-visible operations ahead of relay auth, concurrent identical 22242 challenges sharing one hardware signature, one distinct challenge per identity, no internal retries, sixty-second per-identity cooldowns. Measured on a GrapheneOS phone driving Amethyst: a cold-start burst produced 33 immediate overload responses and 13 completed requests with zero signer timeouts. Hardware-key identity under relay-auth fire is now an engineering discipline.
• Concord PR #18 merged (Aug 15) — watch item resolved: the encrypted community list shards across kind 33302 events, the 50-membership cap is removed, and retired entries are pruned to stay inside relay limits. Vector 0.4.2/0.4.3 ship the client half — including a cross-client review pass with Armada (renames no longer inflate the list, ties resolve identically on both clients, unchanged data is not republished) and stacked ban settling: banning a wave of accounts now costs one key rotation instead of one per account. Two follow-up PRs opened: #22 (community-owned av_brokers, demoting untrusted member input from routing) and #23 (CORD-05 §1 root authentication at accept, codifying what Vector and Armada already did).
• nostrord ships NIP-4e: encryption keys decoupled from identity keys — in production, unmerged spec: kind 10044 announced encryption key, private half held locally, inbound DMs decrypted in-process (a bunker or browser extension leaves the read path entirely), kinds 4454/4455 device pairing, self-archive republishing of history addressed to the new key. The wire format follows the deployed Jumble implementation where it diverges from the open proposal — the spec's working definition now lives in shipped code. Third production instance this month of the binding-key/encryption-key split (after Mostro kind-14 and nostr-wot PQ keys).
• Citrine 3.1.0: the phone becomes the host: the on-device Android relay now speaks NIP-29 (a phone can host a relay-based group, not just join one), NIP-86 (authenticated JSON-RPC management with a settings screen), and NIP-5A (serving nsites to web clients) — plus ban-with-purge, a REJECTED_KINDS blacklist, and a rebroadcast tool that reseeds the network from a pocket-held archive.
• Nail launches (Aug 18): email as gift-wrapped Nostr events, with honest provenance: kind 1301 mail rumors inside kind 1059 gift wrap, delivery via NIP-17/NIP-65 relay lists, attachments over 60 KB to Blossom (NIP-44 caps plaintext at 65,535 bytes) — and a four-grade From provenance model (bridge-sealed / user-sealed / NIP-05-corroborated / uncorroborated-falls-back-to-sealing-key). Deployed at mailstr.app.
• Glow (Breez): passkey login derives a Nostr identity — wallet labels list from and save to relays under that identity, deduplicated byte-identically across partial relay coverage. Passkeys → npub is a new custody topology worth watching: platform biometric roots feeding key-rooted identity.
• Sidecar 1.9.0/1.9.1 (Aug 12/20): printable key backups, consent-first wallet reads, drafts encrypted at rest, and external security-audit remediation complete — alongside Amber's advisory-driven release, two competing models of signer assurance are now visible in one week.
• Formal-stack watch items: two quiet, one slipping: World ID 4.0 testnet still "launching soon" (no announcement found); Polkadot PoP mainnet still absent from OpenGov (latest referenda #1925–1930 are moderation bounties and treasury items — nothing PoP); Germany announced a January 2, 2027 state EUDI wallet launch, a week past the December 24, 2026 legal deadline, with private providers following in 2028. CRYPTO 2026 concluded Aug 20 — the Wen–Zheng Module-LWE ↔ EDCP bridge (peer-reviewed, ePrint 2026/155) stands independent of Simon's dead algorithm.
• NIPs: nothing merged this window; the identity-adjacent proposals are #2439 (NIP-86 assign/unassign — relay admin delegation without sharing the master key) and #2440 (decoupling NIP-29 roles from permissions). PR #2434 (PQ identity keys) and #2431 (NIP-07 pinning) show no movement since Aug 11 — implementations now lead the spec by two.

The freedom-tech takeaway: the week the identity layer's post-quantum bet was stress-tested from both directions — the math underneath (refuted attack, standing assumptions) and the shipping schedule above it (second implementation merged) — while the operational center of gravity moved to a place nobody planned: relay authentication is now the highest-frequency signing operation in Nostr, and every signer in the ecosystem discovered the same backlog at the same time. The kind 22242 event went from boilerplate to battleground in one week.

The Week in Detail

The DCP refutation, from the identity side: your PQ keys are standing on floor that held

The full cryptanalysis is in Post-Quantum Saturday — August 22 2026 Weekly Update and The Dihedral Coset Attack Line; this section covers what it means for the identity architecture shipped in the August 16 update.

Recall the stakes: nostr-wot-extension v0.4.0 (Aug 11) derives ML-KEM-1024 + ML-DSA-87 keys beside the secp256k1 identity, binds them with a kind 10203 attestation, and offers opt-in PQ direct messages — the first production PQ identity keys in Nostr, shipped while Simon's polynomial-time DCP claim (ePrint 2026/1591, Aug 3) was still open. If the claim had held and composed with the Wen–Zheng Module-LWE bridge, the ML-KEM half of those keys would have faced a theoretical poly-time quantum attack — the harvest-now-decrypt-later insurance would have been written on a burning policy.

The refutation (ePrint 2026/1693, approved Aug 15) removes that scenario for a structural reason, not a fixable one:

1. The algorithm discards too much. After step 3 it never touches the classical Fourier labels again, and step 3 uses them only through the top log n bits of each block's inner product. The step-3 state can be reconstructed from roughly the top third of each label.
2. The remainder is provably insufficient. Any algorithm following Regev's template and keeping only that much distinguishes the secret's least-significant bit with advantage at most poly(n)·2^(−n/3). Discarding as few as ω(log n) bits per label hides the answer information-theoretically — no cleverness recovers it.
3. The escape hatch is closed. Either the algorithm is wrong, or its expected runtime is Ω(2^(n/9)). It cannot be both subexponential and correct.
4. It's machine-checked. Lean 4 code formalizes the argument — the first major PQC no-go result with a machine-verifiable proof, a pattern worth hoping becomes standard.
5. The sociology is the vindication. Daniel Apon ("The Search for Simon," Aug 9) had already isolated Lemma 3; Simon revised Aug 11; Apon answered same-night with a one-page counterexample; the no-go landed Aug 15; Simon posted a fourth revision Aug 17 (post-refutation, still defending). Ragavan — cited in Simon's own paper as a personal communication supporting the SVP/LWE corollary — co-authored the refutation. Nine days, claim to no-go, in public, with code. That is how a permissionless research community should work.

The identity-layer reading: the ship-then-scrutinize order was correct. nostr-wot shipped the PQ keys while the attack claim was live; the community refuted the attack; the keys now rest on assumptions that are better tested than they were before the claim existed (the Wen–Zheng bridge got dragged through a live-fire review as a side effect). Nothing about the deployment decision would have changed either way — harvest-now-decrypt-later does not wait for conference proceedings — but the residue is instructive: deploying PQ confidentiality early cost ~3 KB per message and bought a foundation that has now survived its first coordinated assault. The NIPs PR #2434 standardization should cite the refutation in its threat-model section.

What did NOT change: event signatures remain secp256k1-only, and the authentication half of the PQ migration is still unsolved (see Hybrid KEM Migration for the sequencing logic). Kuperberg 2005 (2^O(√n)) remains the best actual DCP algorithm. Bernstein's observation stands: exponents of LWE attacks keep dropping; diversification (HQC, hash-based) remains the rational hedge — see HQC and SLH-DSA.

NDK PR #713: the second PQ DM implementation lands six days after the first

NDK — the Dart development kit behind a large share of Flutter/Dart Nostr clients — merged PR #713 on August 18 (created Aug 14): hybrid post-quantum encryption for direct messages using ML-KEM-1024, placed alongside the classical key agreement instead of replacing it.

This is the same architectural move nostr-wot-extension made (ML-KEM shared secret combined with the existing conversation key), implemented independently in a different language, a different crypto stack, and a different ecosystem segment (mobile SDK vs. browser extension). Last week's open research question #1 — will the kind 10203 pattern get a second independent implementation? — is now half-resolved in six days:

Two implementations make a pattern; the encryption half of the PQ identity architecture is now a pattern. The full three-key family (secp256k1 + ML-KEM + ML-DSA with a portable attestation) still has exactly one implementer, so PR #2434 remains ahead-of-fleet rather than behind-it. The natural next adopters are unchanged: Amber (Android signer), fips-ts (browser transport), and now any NDK-based client could grow the attestation layer on top of the merged encryption primitive.

PR #712 (same day) is smaller but strategically loud: NDK replaced a GPL-3.0-only Dilithium implementation with fips204 — the ML-DSA signature standard as FIPS 204 — removing a licensing constraint for applications embedding the kit. Note what this implies: a GPL Dilithium dependency existed before standardization finished propagating, meaning some Dart PQ work predates the current wave; and licensing hygiene around PQ primitives is now a real adoption variable (GPL contamination in an SDK is a non-starter for proprietary embedders). For the migration trackers in ML-DSA and PQC Deployment and Libraries Tracker: fips204 on pub.dev joins the approved list.

PR #710 (merged Aug 17) completes the identity-relevant trio: one identity per connection — each connection is scoped to a single identity rather than multiplexing, which simplifies both relay-side attribution and client-side permission reasoning.

Amber 6.5.x: the authorization-scope release

Amber v6.5.0 (Aug 14) is the most security-significant signer release since NIP-49 backups, and it arrived through the correct channel: four coordinated GitHub Security Advisories.

The confused deputy (GHSA-vx4h-56qj-wcp7). Any caller could obtain a kind 22242 NIP-42 authentication event for relays the user had never approved. The delegation model broke at the relay boundary: an app holding signing permission could authenticate itself to its own relays under the user's key, minting relay sessions the user never consented to. This matters beyond spam: kind 22242 events are challenge-bound, but a relay that receives a valid one treats the connection as the user — unapproved-relay auth is identity laundering with a legitimate signature on it. Post-fix, the approved-relay set is enforced before the event exists.

The replay gap (GHSA-h9fv-9247-3582) in NIP-46 — the bunker path that most remote-signing clients ride. Secrets at rest (GHSA-5fjp-ghh8-wch8): plaintext connection secrets and local keys are now envelope-encrypted on storage. The batch (GHSA-8844-q5vh-9j8f): caller authorization checked before decrypt (not after), fail-closed permission parsing (malformed policy = deny, not allow), warnings on plain ws://, secure QR approval screens, log redaction, lazy key zeroing on logout, optional unlocked-device Keystore use.

6.5.1 (Aug 14) fixed re-encryption of stored NIP-46 secrets when the Keystore key rotates after toggling the unlocked-device requirement — the class of bug you only find after encryption at rest exists. 6.5.2 (Aug 18) stopped decrypting columns the applications list never renders, cached the Keystore handle, warmed the account cache at startup, and debounced relay status notifications.

The trajectory across three weeks is the story: 6.3 (batch approval) → 6.4 (decision-explicit approvals) → 6.5 (what gets authorized at all, and where the secrets sleep). The Android signer stack is accruing the security maturity of a small HSM. The open question it surfaces is ecosystem-wide: do the other NIP-55/NIP-46 signers have the same confused-deputy class? Amber found it via disclosure; nothing requires other signers to look. Related: Nostr Key Custody and Recovery, Remote Signing.

Cambium and the kind 22242 wars: hardware identity under relay-auth load

If Amber's release was about what gets authorized, Cambium 0.4.0–0.4.3 (Aug 13–14, six releases in two days) is about whether the signer can authorize anything at all when relay authentication floods it.

Context: Cambium is an Android NIP-55 proxy to a Heartwood hardware signer over NIP-46 — keys live in dedicated hardware, and every signature is a hardware round-trip. Relay auth (kind 22242) is issued per-relay per-connection, and a modern client with a relay list plus a community or two generates auth events at a rate designed for software signers. The three admission-control releases:

• 0.4.1: reserved queue slots — reactions, posts, deletions, and encryption always have a path ahead of relay authentication and background decryption; queued calls are bounded, discarded once the caller has timed out, and overload returns a terminal unavailable result instead of opening a foreground signing screen the user can't reach in time.
• 0.4.2: timed-out or long-idle NIP-46 sessions are discarded before the next request, and concurrent copies of the same kind 22242 challenge share one hardware signature (identical auth events deduplicated at the signer boundary).
• 0.4.3: at most one distinct authentication challenge per identity enters the hardware worker; no internal retries; a sixty-second per-identity cooldown after a timeout — while exact cached duplicates are still answered instantly.

The measurements are from a GrapheneOS phone driving Amethyst: a cold-start burst produced thirty-three immediate overload responses and thirteen completed requests with no signer timeouts, and a fresh login during an authentication burst returned 1.254 seconds after approval. Graceful degradation with honest terminal errors — the "silence is a bug" principle (Aug 16 update) extended to load.

0.4.0 itself is identity-architectural: website signing via a validated nostrsigner: callback that inherits no permissions from native applications. A browser tab cannot borrow an Android app's approval — the permission boundary is drawn at the caller type, not just the caller identity. The same release fixes the minimal-event shape (an event carrying only kind and content now signs correctly, with Cambium supplying the paired NIP-46 identity, timestamp, and empty tag array) and makes rust-nostr instrumentation a required CI gate. 0.3.6 repaired pairing against spec-following signers (rust-nostr 0.44.2 → 0.44.8 accepts both ack and the secret-echo the current NIP-46 spec asks for — verified against live Heartwood hardware and nak bunker).

Why this is a theme, not a product note: the same week, Amethyst rebuilt its NIP-42 decision flow (redesigned permissions interface; auth waits for the challenge instead of timing out PR #3905; new accounts default to always-authenticating PR #3931; "always log in" honored for relays the account doesn't use PR #3937; NIP-29 groups and Concord communities recognized as joined venues so they stop looking like unfamiliar relays PR #3906), and nostrord stopped connection churn that produced repeated kind 22242 signing prompts (PR #268). Four independent projects hit the same wall in the same week. Relay auth is now the highest-frequency signing operation in Nostr, and the signer — the component whose whole value is rare, deliberate approvals — is the bottleneck. Client-side admission control is the correct immediate response (Cambium's design is genuinely good); the protocol-level responses (batch auth, longer-lived tokens, challenge caching in the spec) don't exist yet. That's an open NIP-42 question worth tracking (see below).

Amethyst's merged block also includes a guided first-run key backup (PR #3909) — the custody funnel that most clients still skip — and PoW mining that refreshes created_at while it mines, with GPU path analysis (PR #3911).

Concord PR #18 merged: the 50-member cap dies, and untrusted input leaves the routing path

Concord PR #18 merged August 15 — last week's watch item #5, resolved. The encrypted community list now shards across kind 33302 events, the 50-membership-per-list limit is removed, and retired entries are pruned so the list stays inside relay size limits. Concord's path from small communities to Discord-scale servers is now spec-complete; the empirical question moves to production (relay pagination under thousands of shards — see open questions).

The client half shipped immediately in Vector 0.4.2/0.4.3 (Aug 15), and it's the moderation-under-load release:

• Rapid bans queue, stack, and settle as a single operation — banning a wave of accounts costs one key rotation instead of one per account. This is the right cost model: an epoch rekey is the expensive primitive, and a spam wave should amortize to one of them.
• The sharded community list took a cross-client review pass with Armada (the other Concord client): renames no longer inflate the list, tie-breaking resolves identically on both clients, and unchanged data is no longer republished to relays. Two independent implementations agreeing on list semantics before the merge landed is the convergence discipline this library keeps flagging as the difference between spec-text and spec-truth.
• Dissolution lifecycle closed: accepting an invitation to a dissolved community now explains why and removes the invite from every device; dissolving a community you own clears it from your community list everywhere.
• Mutes moved out of the DM path (mute from a community with no prior message history; mutes apply to notifications and badges across channels and DMs while leaving messages visible); block lists, mutes, nicknames, and pinned chats sync across devices; 0.4.3 stops announcing typing when a different Nostr client is signed in as the same identity — multi-client identity coexistence is now an explicit UX surface, not an accident.

Two follow-up PRs opened the same window, both extending the authority model:

• PR #22 — community-owned av_brokers. The CORD-02 metadata entity would carry an optional broker list, and the CORD-07 rendezvous draws from it (or the member's own broker when the community publishes none), ordered by the existing room-keyed tie-break. The rationale sentence is worth quoting because it states a general principle: routing on the per-member broker tag "lets a fellow member's untrusted input outrank the community's own instruction." Community-signed configuration outranks member-asserted configuration wherever the two could disagree — the same defense-in-depth logic as CORD-02's control_root, applied to media routing.
• PR #23 — CORD-05 §1: authenticate the community_root at accept. Before persisting a join, the owner's genesis metadata edition must open under the delivered keys. The PR states plainly this was never a live vulnerability — Vector's bundle acceptance already refused, and Armada already dropped — but neither behavior was required. A specification-faithful client could have shipped the vulnerable version. Codifying deployed correct behavior as normative is how a spec earns trust.

Also in the encrypted-group orbit: MDK 0.9.12–0.9.14 (Aug 13–19) continued the fail-closed program — a missing fork anchor is a hard error (PR #1329), leave-proposals persist atomically so a crash can't half-apply a departure (PR #1360), storage format v2 with migration rails and delta writes (0.9.13, Aug 18), and group-creation polish including profile publication with account-owned relays (0.9.14, Aug 19; PR #1495) — group identity state anchoring to the account's own relay set. The Marmot spec itself gained a durability and restart contract (Marmot PR #416, merged Aug 13): restart equivalence, publish/convergence interruption boundaries, observer-atomic transitions, and crash/restart conformance scenarios per rule — no wire change, but the class of "implementation-dependent protocol results after a restart" is now specified away.

nostrord ships NIP-4e: key separation goes production for the third time

nostrord — the relay-scoped chat client — merged a full implementation of NIP-4e, the unmerged proposal to decouple message encryption from the identity key (PR #261):

• The account announces its own kind 10044 encryption key and holds the private half locally.
• Inbound direct messages are decrypted in-process — a bunker or browser extension leaves the read path entirely. Remote signing traditionally means the signer sees every plaintext you receive; NIP-4e splits that: the identity key keeps authorship duties (signatures, auth, reputation), the encryption key keeps confidentiality, and only the second one needs to be on the device you read on.
• Device pairing over kinds 4454/4455 moves the encryption key to a second device, with a follow-up fixing pairing that "negotiated successfully without handing the key over" (PR #271) — consent must complete the transfer, not just agree to it.
• A self-archive republishes history addressed to the new key — key rotation without message loss.
• Sending was addressed to the announced key first (PR #247), and the PR text notes the wire format follows the deployed Jumble implementation where it diverges from the open proposal.

Count the instances of the binding/encryption key split now in production: Mostro Core 0.14.2 (separate conversation-encryption and signing keys from a shared secret), nostr-wot-extension 0.4.0 (PQ encryption keys beside the identity signature key), nostrord/Jumble NIP-4e (announced encryption key decoupled from the identity key). Three implementations, two wire formats, one architectural thesis: monolithic single-key identities are dissolving into key families with roles (Aug 16 update's cross-cutting theme #3, now with a third data point and a fourth pending — NDK's hybrid encryption keeps the classical key in the KEX, which is the same separation one level down).

The nostrord batch also tightened group identity semantics: a group identifier is now unique only within its relay (PR #269) — the same identifier on two relays is two groups (PR #272). That is the correct scoping for relay-scoped groups and worth watching as NIP-29-adjacent proposals (#2441, "relays as groups") make the rounds.

Citrine 3.1.0 and the sovereign-host threshold

Citrine — the on-device Android relay — 3.1.0 adds three capabilities that change what a phone relay is:

1. NIP-29 support: the relay holds membership and moderation state for relay-based groups — a phone can host a group instead of joining one. The authority inversion matters: the group's root of trust is a device in someone's pocket, not a rented VM.
2. NIP-86 support: the relay management API over authenticated JSON-RPC, with a settings screen — allowlists and bans drivable programmatically. Administration becomes an API surface, not an app feature.
3. NIP-5A static websites: the relay serves nsites to web clients, with a modernized browse list (icons, search, sort-by-last-update, install progress) and a configurable fetch-relay set defaulting to nsite.run, nos.lol, and nostr.land.

The moderation surface grew to match: banning a pubkey locally now offers to purge that author's stored events, a configurable REJECTED_KINDS list blocks kinds the operator won't store, access control can import from existing lists, and — the offline-first flourish — a rebroadcast tool pushes stored events back out to selected relays, turning a phone-held archive into a network reseed source.

Pair this with Cambium (hardware signer in the pocket), Amber (the authorization layer), and Bark below (browser signer on Android): the full sovereign identity stack — keys, signer, relay, storage, hosting — now runs on one GrapheneOS device. This is the practical ungovernable answer to "where does your identity live": nowhere you don't hold. Related: Overview - Off-Grid Networks for the mesh side of the same thesis.

Nail: four grades of From, and Glow's passkey-derived npub

Two smaller launches with outsized identity-design signal:

Nail (Formstr team) launched August 18, deployed at mailstr.app — an MIT-licensed email bridge and web client that carries mail as Nostr events: kind 1301 mail rumors inside kind 1059 NIP-59 gift wrap, delivery relays from kind 10050 (NIP-17) inbox lists over kind 10002 (NIP-65) relay lists, folders as kind 1985 NIP-32 labels in a mail namespace, settings in kind 30078 (NIP-78) app-data, and attachments over 60 KB routed to Blossom because NIP-44 caps encrypted plaintext at 65,535 bytes. Addresses are npubs at domains; a local domain with no NIP-05 record is a mailbox that does not exist.

The identity lesson is the receive path's four-grade provenance model for From headers — the oldest dishonest field on the internet, graded honestly: (1) the configured bridge sealed it and refuses to relay senders it did not verify upstream; (2) the user sealed it themselves; (3) the address's NIP-05 record resolves to the sealing key; (4) nothing corroborates the header — in which case the UI falls back to displaying the sealing pubkey, the only identity the event can actually prove. Bridge API calls are NIP-98-authenticated. This is the right pattern for every bridge that must interoperate with a legacy identity field: grade the provenance, display the grade, never launder grade 4 into grade 1.

Glow (Breez): passkey login derives a Nostr identity, and wallet labels list from and save to relays under that identity, with byte-identical duplicates collapsed across partial relay coverage. The custody topology is new for this library's taxonomy: a platform-controlled biometric root (WebAuthn/passkeys) feeding a key-rooted identity (npub) — none of the passkey ceremony visible to the user, all of the Nostr-side properties (relay-portable state, key-addressed records) preserved. It trades the "keys you alone hold" property for "keys the platform holds for you" — the exact trade Nostr Key Custody and Recovery catalogues as the onboarding/custody spectrum's easy end. Watch whether passkey-derived npubs become a common onboarding funnel; if they do, the custody-recovery question (what happens when the platform root rotates or dies) becomes the field's next mass-scale failure mode.

Also custody-adjacent: Sidecar 1.9.0/1.9.1 (Aug 12/20) — printable key backups (the paper-wallet idea returning for npubs), consent-first wallet reads, drafts encrypted at rest, and external security-audit remediation complete. Two assurance models for signers now coexist: Amber's coordinated-advisory model (found internally, disclosed, fixed fast) and Sidecar's external-audit model (third party found it, remediation tracked to completion). Neither is sufficient alone; both together are the emerging bar.

Signers everywhere else: Bark, ClipRelay, Bray/Toll Booth, MDK-adjacent

• Bark 1.3.9: the NIP-07 window.nostr extension now declares Android support in the Firefox build — approvals fall back to a foreground tab where dismissing denies, review re-foregrounds, and background closes once settled (Firefox on Android implements no windows API; verified on a Pixel 10 Pro XL / GrapheneOS / Firefox 153.0.4; Chromium on Android compiles out the extension subsystem entirely, so no Chromium-derived browser can run it). 1.3.8 fixed the reverse-interop defect: the Heartwood compact-dialect probe (JSON-object form) was being sent to strictly-typed signers (nak, rust-nostr bunkers) that silently drop it — it's now sent only to signers that identified as Heartwood, and everyone else gets a standard sign_event from the first signature. Probe-then-degrade is the right interop pattern; silent-drop was the wrong failure mode.
• ClipRelay 0.2.0: nostrconnect:// QR login and camera-scanning of bunker URLs — no more pasting secret-bearing strings through messengers; sixty-second bunker timeouts instead of hangs.
• Bray 3.0.0 / Toll Booth 6.0.0: both adopt the shared nwc-kit library for NIP-47 wallet payments (Toll Booth drops its payer-credential flow in the same breaking change) — and both publish reproducible builds that were byte-identical across two independent runners, with the tarball hash printed in the release notes. Reproducible signing-adjacent infrastructure is exactly the supply-chain hygiene the agent-signer stack needs (see AI Agent Identity on Nostr).
• Zap Cooking quietly did the trio everyone should: NWC connection strings encrypted at rest in a NIP-44 envelope (PR #622), a spoofable public-key comparison on admin routes replaced with NIP-98 HTTP authentication (PR #626), and logout clears account data with bounded pending NIP-46 records (PR #627). A recipe site now has better admin-auth hygiene than most SaaS — the Nostr-native stack makes the right thing easy.
• rust-nostr: the rumor identifier is now computed before the gift-wrap seal is encrypted (PR #1444) — the same defect class Mostro fixed in mostro-core 0.14.5 (PR #164); the local relay rejects reposts of NIP-70 protected events (PR #1445) — the protection that spec exists to provide, now actually enforced at the relay layer.

Mostro completed its window with 0.18.4 (Aug 14, trade-timestamp persistence) and 0.18.5 (Aug 18: NIP-44 default, orderbook republication overhead, payout and bond-slash logic). Mostro Mobile 1.3.2 migrated dispute chat to kind 14 envelopes with durable per-conversation cursors; 1.3.3 adds taker reputation tracking — counterparty reputation as first-class client state, which is the WoT-adjacent surface this library tracks under Overview - Web of Trust.

Buzz Desktop reached 0.5.17 per the Freedom.Tech tracker (current through Aug 22): 0.5.14 → 0.5.17 over the window, fixing remote agent mention authorization (an agent-mention must not silently convey authorization — the same authority-scoping theme as everywhere else this week), presence retry timers, CPU burn in mounted views, and bumping h2 for security. Agent lifecycle management continues as standard workspace functionality (Buzz).

Protocol work: nothing merged, and the delegation grammar of the new PRs

No pull request merged into nostr-protocol/nips in this window. The newly-active proposals say something coherent about delegation as this cycle's protocol grammar:

• PR #2439 — NIP-86 assign/unassign: a relay administrator grants admin permissions to another pubkey without sharing the master key. Scoped, revocable authority at the relay management layer — the same primitive Concord's control_root gives communities and World ID 4.0's Authenticators give identities.
• PR #2440 — decoupling NIP-29 roles from permissions; #2316 — explicit role permissions and access schema on kind 39003. Relay-hosted groups are converging on RBAC-as-events.
• PR #2441 — relays as groups: formalizing what nostrord already scopes (see above).
• PR #2438 — NIP-9A comment-based patches: a patch is a kind 1111 comment whose content begins with PATCH, edit lines indexed in unicode characters (<index> -<deleted> +<inserted>), t-lines replacing human-facing tags — backwards-compatible (unaware clients render it as a labeled comment), and explicitly refusing patches that are too large, too numerous, or stale, to keep it from becoming a general edit channel for immutable events. Collaborative-edit authority without an edit event — authorship stays immutable; patches are claims about the content, verifiable and ignorable. Also PR #2436 (NIP-7D Djot formatting for forum threads) and PR #2437 (NIP-94 file encryption: encryption-algorithm/decryption-key/decryption-nonce tags; m = pre-encryption MIME, x = encrypted hash, ox = original hash — a public Blossom operator hosting the bytes cannot tell what they are; the same privacy property as NIP-17 DMs, extended to file metadata).
• #2303 (NIP-5D nostr web applets) is the most recently updated open PR (Aug 22) — the applet trust-boundary work continues its long march.

The two identity-critical PRs from last week — #2434 (PQ identity keys) and #2431 (NIP-07 pinning) — show no movement since Aug 11 (1 comment, 1 commit between them). The implementation layer is now two ahead of the specification layer on PQ DMs; if NDK-based clients ship PQ-encrypted DMs from the merged SDK before the NIP discussion resumes, the spec will be ratifying a deployed pattern with two wire formats to reconcile. That reconciliation is now the single most consequential open standards question in this stack.

Also worth recording: nostream (the TypeScript relay) merged a NIP-66 relay-monitor probe scheduler (PR #724), a CLI that mints NIP-43 invite codes — relay access metadata gating admission (PR #732) — and finally advertises the NIP-13 PoW support it already implemented (PR #680). Relay-side admission control (invites, PoW, auth) is maturing in parallel with signer-side; the two halves of the anti-Sybil problem are being built by different people, converging on the same events.

Formal stack: Germany slips, Polkadot is quiet, World ID is quiet, CRYPTO 2026 closes

EUDI Wallet — the first major slip is official. Germany announced a January 2, 2027 launch for its state-driven EUDI wallet, opening to private providers the following year (per Namirial's status check) — a week-plus past the December 24, 2026 legal deadline for member states to make at least one wallet available (Regulation 2024/1183), with mandatory acceptance by regulated entities a year later. France and Germany remain the only states with genuinely public sandboxes in the eideasy tracker taxonomy; Germany's slip is doubly informative because Germany was in the leading tier. The pattern this library predicted is materializing: legally on schedule, practically sliding — expect more Category-2 states to follow Germany's precedent of announcing a near-miss date rather than a miss. Q4 certification decisions remain the forcing function to watch. Verifiable Credentials / Overview - Decentralized Identity carry the architecture.

Polkadot PoP — silence with a deadline. The roadmap still ends "Polkadot Mainnet — Q3 2026" (full deployment by September 30), but the current OpenGov referenda (#1925–1930: moderation-team bounties, Orbinum treasury, staking items) contain no PoP deployment referendum, and no pallet announcement surfaced this window. Thirty-eight days remain. Either the referendum lands within weeks or the roadmap extends past its own deadline — both outcomes are informative about how L1-native PoP actually ships. Proof of Personhood and Sybil Resistance holds the deployment matrix.

World ID 4.0 — testnet still "soon." No testnet launch announcement found this window; the RFC and specs remain the live surface. The watch item carries over unchanged (the open question — whether independent RPs can register against RPRegistry without Tools for Humanity intermediation — stays the thing to test the moment it opens).

CRYPTO 2026 concluded August 20 (Santa Barbara; 189 papers). The identity-relevant residue: the Wen–Zheng Module-LWE ↔ IP-M-EDCP ↔ EDCP bridge (ePrint 2026/155) was presented as peer-reviewed mathematics that stands entirely independent of Simon's refuted algorithm — the attack-surface map now points at a target with no known poly-time solver. The DCP affair was the hallway conversation; the no-go settled it before the closing session. Identity-relevant sessions (anonymous credentials, threshold signatures, OPRF security) yielded no headline results that alter this library's trackers this week.

Cross-cutting themes

1. The PQ identity bet was stress-tested from both directions — and held

Last week the identity layer shipped PQ keys while the underlying lattice assumption was under active attack claim. This week both flanks resolved favorably: the attack died (no-go, machine-checked) and the deployment doubled (NDK). The sequencing lesson for ungovernable systems generalizes: confidentiality migrations don't wait for conference proceedings, and they don't need to — the hybrid construction (classical always present, PQ additive) means the worst case of shipping early is a few wasted kilobytes, while the worst case of waiting is retroactive decryption of everything sent in the interim. The remaining asymmetry: the full kind 10203 key-family architecture has one implementer while its encryption half has two; the second attestation implementer is the missing piece that turns a product feature into a standard.

2. Kind 22242 became the battleground nobody planned for

Four independent projects hit the same wall this week: Amber (confused deputy — auth events for unapproved relays), Cambium (hardware signer starvation under auth bursts), Amethyst (rebuilt decision flow), nostrord (connection churn re-prompting). Relay authentication is now the highest-frequency signing operation in Nostr, and it's structurally mismatched to signers — components designed around rare, deliberate approvals are being asked to sign boilerplate on every connection. Every fix this week is client-side admission control (correct, necessary, and Cambium's is exemplary). The protocol-level fixes — batch auth, challenge caching, longer-lived tokens — don't exist in NIP-42. Watch for an amendment PR; the pressure is now measurable (33 overload responses in a single cold-start burst).

3. Delegation without key sharing: the week's protocol grammar

Concord PR #22 (community-signed broker config outranks member-asserted), PR #23 (root authentication at accept), NIP-86 assign/unassign (#2439, admin grants without master-key sharing), Cambium 0.4.0 (website callbacks inherit no native-app permissions), Vector 0.4.3 (typing suppressed when another client holds the identity), Buzz 0.5.17 (agent mentions don't convey authorization). Six independent systems, one rule: authority is scoped, derivable, and never transitively acquired. This is the anti-confused-deputy principle stated positively — and its appearance across protocol specs, mobile signers, and agent workspaces in a single week suggests it's crystallizing into the community's shared design instinct, the way "fail closed" did for group state last month.

4. Sovereign-host threshold: the pocket now runs the whole stack

Citrine 3.1.0 (relay + groups + nsites on the phone), Cambium (hardware signer), Amber (authorization layer), Bark (browser signer on Android), Sidecar (printable backups). One GrapheneOS device can now be keys, signer, relay, community host, and website host simultaneously — with a rebroadcast tool to reseed the network from the pocket archive. None of these components is new this week; what's new is that they're all simultaneously production-grade. The ungovernable-deployment question is shifting from "can it be built?" (answered) to "can it be operated?" — which is a UX and durability question (MDK's restart contract and Marmot's PR #416 are the same answer from the group-messaging side).

Evidence at a Glance (August 16–23, 2026)

Open research questions (updated)

1. ~~Will the kind 10203 PQ pattern get a second independent implementation?~~ Resolved (half): NDK's hybrid ML-KEM-1024 DM encryption (merged Aug 18) is the second independent encryption implementation — but not the full three-key architecture with attestation. New question: will NDK's wire format and nostr-wot's converge or fragment? Two hybrid-PQ DM formats in production before the NIP discussion resumes means PR #2434 may need to standardize a compatibility layer rather than a single construction.
2. Can Nostr migrate event signatures without a hard fork? Unchanged. The refutation removes the near-term forcing function (the claimed poly-time break), which paradoxically narrows the window for voluntary migration — urgency was doing some of the coordinating work.
3. Is the TACEO OPRF federation the right trust root for World ID 4.0? Unchanged; testnet opening is the observation point.
4. Will the Linux kernel adopt OpenVTC at the Oct 8 Maintainer Summit? Unchanged; ~6 weeks out. No countervailing news this window.
5. ~~Can Concord's sharded lists hold relay limits at scale?~~ Merged; question shifts: now empirical — first production communities over 50 members, relay pagination behavior under shard fan-out. Vector/Armada did the semantics; no deployment data yet.
6. Does NIP-07 pubkey pinning (PR #2431) conflict with signer account-switching UX? Unchanged; PR still unmoved since Aug 11.
7. What does Pact's agent bond add over NIP-85 attestations? No news this window.
8. New — will kind 22242 pressure produce a NIP-42 amendment? Four projects shipped client-side admission control this week; the protocol offers no batch auth, challenge caching, or token lifetimes. The measurable strain (Cambium's 33-overload burst) is the strongest forcing function yet for relay-auth protocol work. Watch for an amendment PR in the next month.
9. New — what happens when a passkey-derived npub's platform root dies? Glow's onboarding topology makes recovery the failure mode. If passkey→npub funnels spread, the ecosystem inherits WebAuthn account-recovery semantics at the identity layer — the exact dependency this library exists to avoid, at the exact scale-onboarding layer that needs it.

What to watch in the next 7–14 days

1. Polkadot PoP referendum: 38 days to the Q3 roadmap end; a deployment referendum in OpenGov is the make-or-break signal. Absence is also a signal — the first L1-native PoP shipping late matters for the whole category.
2. World ID 4.0 testnet: the moment it opens, test whether independent RPs can register against RPRegistry without Tools for Humanity intermediation.
3. NIPs PR #2434 / #2431 movement: with two PQ DM implementations now live, the standardization conversation is either urgent or being settled by deployment. Any comment activity is signal.
4. Post-refutation PQC posture: watch NIST/IETF corridors for readouts from CRYPTO 2026 hallway discussions on the DCP affair — and whether the Lean-4-machine-checked-refutation pattern (2026/1693) gets cited as a new norm for cryptanalysis disputes.
5. Confused-deputy sweep: does any other NIP-55/NIP-46 signer disclose the Amber-class relay-auth issue? A second advisory would confirm it as an ecosystem class rather than an Amber bug.
6. Concord #22/#23 merges and the first >50-member communities: sharding is merged; production data is the next tracker row.
7. EUDI September checkpoints: Germany's Jan 2027 precedent — watch for other Category-1/2 states announcing near-miss dates, and for the Commission's response (guidance, tolerance, or enforcement posture).
8. Buzz 0.5.18+: agent-mention authorization hardening continues; the next step per the Aug 16 watch is signer-enforced usage budgets (NIP-AM foundation from 0.5.9).

Primary sources (this period)

The DCP refutation

• ePrint 2026/1693 — The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP — Gupte, Ragavan, Zhandry; approved Aug 15, 2026
• Lean 4 formalization of the refutation
• ePrint 2026/1591 — Simon's original claim (4th revision Aug 17)
• Apon's Lemma 3 objection (one-page counterexample)
• postquantum.com — Simon claim analysis with Aug 15 refutation update
• ePrint 2026/155 — Wen–Zheng Module-LWE ↔ structured EDCP (CRYPTO 2026)
• Cross-reference: Post-Quantum Saturday — August 22 2026 Weekly Update — the full cryptanalysis; The Dihedral Coset Attack Line

Post-quantum identity implementations

• NDK PR #713 — hybrid ML-KEM-1024 DM encryption (merged Aug 18)
• NDK PR #712 — GPL Dilithium → fips204 ML-DSA
• NDK PR #710 — one identity per connection
• nostr-wot-extension v0.4.0 — last week's first implementation
• NIPs PR #2434 — post-quantum identity keys

Signers and custody

• Amber v6.5.0 + advisories: GHSA-vx4h-56qj-wcp7 (relay-auth confused deputy), GHSA-h9fv-9247-3582 (NIP-46 replay), GHSA-5fjp-ghh8-wch8 (secrets at rest), GHSA-8844-q5vh-9j8f (hardening batch); v6.5.1, v6.5.2
• Cambium v0.4.0 / 0.4.1 / 0.4.2 / 0.4.3 (measurements) / 0.3.6 (interop fix)
• Bark v1.3.9 (Android Firefox) / v1.3.8 (probe fix)
• Sidecar 1.9.1 — printable backups, audit remediation complete
• ClipRelay 0.2.0 — QR signer pairing
• Amethyst relay-auth block: #3899, #3905, #3906, #3931, #3937, first-run backup #3909

Concord / encrypted communities

• Concord PR #18 — sharded community list (merged Aug 15)
• Concord PR #22 — community-owned av_brokers
• Concord PR #23 — CORD-05 §1 root authentication at accept
• Vector v0.4.2 / v0.4.3
• MDK 0.9.12 / 0.9.13 / 0.9.14
• Marmot PR #416 — durability and restart contract (merged Aug 13)

Sovereign hosting / bridges / discovery

• Citrine 3.1.0 — NIP-29/NIP-86/NIP-5A on a phone relay
• Nail — email as gift-wrapped events, deployed at mailstr.app
• Glow (Breez) — passkey-derived Nostr identity
• nostrord NIP-4e implementation: PR #261, #247, #271, #268, #269
• nostream NIP-43 invite minting: PR #732, NIP-66 monitor: PR #724
• rust-nostr: PR #1444 (rumor id before seal), PR #1445 (NIP-70 repost rejection)
• Mostro 0.18.5; mostro-core 0.14.5
• Bray 3.0.0 / Toll Booth 6.0.0 — nwc-kit, reproducible builds
• Zap Cooking security trio: #622/#626/#627

Protocol work

• NIPs PR #2439 — NIP-86 assign/unassign
• NIPs PR #2440 — decouple NIP-29 roles/permissions
• NIPs PR #2441 — relays as groups
• NIPs PR #2438 — NIP-9A comment-based patches
• NIPs PR #2437 — NIP-94 file encryption
• NIPs PR #2431 — NIP-07 pinning (unmoved)

Formal stack / events

• Namirial — EUDI status check (Germany Jan 2, 2027)
• eideasy — EUDI rollout tracker
• Polkadot OpenGov referenda (current) — no PoP referendum as of Aug 23
• Polkadot PoP roadmap
• World ID 4.0 RFC — testnet still pending
• Crypto 2026 program — concluded Aug 20

Aggregators

• Nostr Compass #36 (Aug 19) — the week's client/protocol detail
• Freedom.Tech Nostr release tracker — 263 releases, current through Aug 22 (Buzz 0.5.17, Sidecar 1.9.1, Mostro 0.18.5, Amber 6.5.2)