# Original Echo Nearby → portable protocol

Reviewed the original https://moneymusk.space/nearby and its source at main
`0205825584e76fb1fae12aef62e70903c0ed6f59`, against the protocol/request draft
starting at `951e083e11a1185fa5bb8490f95fa51575cfd361`. This is a source and UX
comparison, not a security audit or physical-device certification.

The original has a strong teaching model: show the handoff, make tampering
visible, answer four questions on every queued payment, and distinguish an
offline promise from finality. The new protocol should carry these ideas forward
while keeping its signed objects independent of any single client.

| Original idea | Portable update | Boundary / remaining work |
| --- | --- | --- |
| Four payment questions | Readable cards for checked and saved intents, including full keys, exact integer amount, asset/scale/network, declared times and Pending Sync | Signed times are payer claims; a saved signature is not current context, trusted identity or settlement |
| Watch the handoff | Expandable four-step guide plus receiver request → payer authorization → independent comparison | QR/file/text transfer is real; proximity and delivery are not proven |
| Tamper in transit | Explicit altered-copy exercise changes an amount and runs the actual inspector; BAD_SIGNATURE is required | Original bytes and signature remain untouched; this is not a double-spend test |
| Durable local queue | Public signed objects survive reload, with byte-preserving file export for every retained intent and request pair | Browser storage can be erased or rolled back; memory-only temporary signing keys do not survive hiding/reload |
| Twin and Cyber identity | Existing visual language, fonts, colors, coin, local Twin, reason text and Pending Sync | Static English Cyber client; site-wide languages/themes and consented audio are not integrated |
| Authority cap and permission display | A separate Node signer enforces exact-intent HAP permits; the new authority inspector checks detached historical evidence | The old local cap remains separate. The new test-only profile uses exact tickets, durable local counters and five-second permits; detached evidence cannot establish complete budget history, current revocation or rollback safety |
| Nearby discovery / Bluetooth | QR images, exported files and copied packets work in the reference clients | Browser demo discovery is simulated. The native BLE permission companion uses a separate protocol; no native OPI adapter, NFC or local-network exchange is claimed |
| Echo ID address | Full Ed25519 public-key addresses, with separately supplied confirmation context | Stable Echo ID bindings, device keys, rotation, backup and recovery remain work; names and scanned keys are not identity proof |
| Sync, balances and conflict rejection | Portable intents stay Pending Sync | The old balance/spent-nonce model is local demo state. A real rail needs atomic admission, authenticated receipts, durable idempotency and outcome-unknown recovery; payer timestamps must not choose global priority |
| Network receipt log / Claim Proofs | No new publication path is added | Old publication accepts a hash and amount; it is not independent signature/balance/settlement verification. Amounts are public. Define privacy-preserving receipts before connecting a log or Claim Proofs; OpenTimestamps can attest existence, not settlement truth |

## What changed in this comparison pass

- Restored four-question cards in the intent lab and signed exchange, with full
  object IDs in an expandable section. Rendering uses text nodes only.
- Added export for retained/imported intents after reload, alongside existing
  request-pair exports. Export preserves the original signed bytes.
- Added a copy-only tamper exercise after an explicit successful check. It never
  signs, stores, sends, or replaces an original, nor changes the Twin's verdict
  about that original. Editing/importing/hiding clears the exercise context.
- Made the original `/nearby` page the home for the new signed exchange and
  intent verifier, preserving its navigation and surrounding design. The
  standalone tools remain available for independent and prepared offline use.
- Reframed the native companion as optional, with its introduction in ten
  languages, and removed the App Store launch announcement from this page.
- Made the old local-balance demo an explicit, lazily mounted section, so opening
  Nearby no longer initializes that demo's keys or state automatically.
- Kept the portable client cache separate from the surrounding site. Only bounded
  layout/scroll messages connect the embedded client and its current host; no
  keys, packets, trust pins, verdicts or signing commands are passed.

## Next integration gates

1. **Physical use:** complete both roles on an actual iPhone and desktop:
   QR capture, export/copy/import, independent key confirmation, refusal,
   reload and prepared offline reload. Automated WebKit is not iPhone Safari.
2. **Authority:** the test-only OPI-to-HAP adapter, local signer, detached evidence
   and hostile tests are specified in `AUTHORITY.md`. Physical acceptance, a second
   authority-inspector implementation and an independent review remain pending.
   Do not treat historical evidence as permission to settle or recover state.
3. **Identity and transport:** specify recoverable device-key bindings and
   authenticated native OPI handoff; measure device/platform support. Add
   confidentiality deliberately because signatures do not encrypt packets.
4. **Settlement:** choose and review an actual rail and receipt trust model
   before exposing balances, synchronization success or finality. A database
   insert, hash, timestamp anchor or matching pair cannot substitute for this.
5. **Client parity:** integrate reviewed translations, themes and optional
   voice without adding dependencies to the offline verifier. Audio provider
   access/cost and real-device listening remain separate release gates.

## Source trail

- `app/nearby/page.tsx`: original page, handoff stages and four questions.
- `components/nearby-console.tsx`: local demo, cap, Twin, tamper exercise and queue.
- `lib/echo-nearby.ts`, `lib/echo-pay.ts`: legacy signed packets and local balances.
- `lib/twin-authority.ts`: existing demo authority decisions.
- `app/actions/nearby.ts`, `lib/nearby-receipts.ts`: publication and retry behavior.
- `native/ios/README.md`: separate permission/revocation BLE reference and its
  physical-device limitations.
- `SPEC.md`, `REQUESTS.md`, `client/`: portable wire formats and current clients.

Legacy Echo Pay signatures, native permission evidence and ECHO-OPI/1 are
different formats. Do not silently reinterpret or migrate them as equivalent.