What works today

Built and exercised end to end

• Independent copies of your media

  Files get a SHA-256 content address, the owner picks which Blossom hosts receive a copy, every copy carries a receipt, and an exported manifest can be played by a standalone resolver with no Dues Vult API involved.

  Code: BuiltSetup: No setup neededChecked: Exercised in the appRunning: Running in this build

  • Public content only in this installment: paid or private files are never replicated to third-party hosts.
  • Failover is proven against two local test hosts, not against genuinely independent production operators.
  • Operator independence is a claim you make about your chosen hosts; it is not cryptographically proved.
  • Deletion is a request to each host with a receipt. Nothing can erase copies everywhere.

Built, but not verified end to end

• Guest activity on this device

  Browsing, posting, saving, comments, Q&A and playback progress work without an account and stay in this browser.

  Code: BuiltSetup: No setup neededChecked: Unit testedRunning: Running in this build

  • Guest data never leaves the device and is lost if storage is cleared.

• Hosted accounts, profiles and follows

  Email sign-in with a profile, follow list and posts stored in the Dues Vult backend so they survive across devices.

  Code: BuiltSetup: UnknownChecked: Exercised in the appRunning: Running in this build

  • Identity depends on Dues Vult infrastructure; it is not yet portable to another operator.
  • Google sign-in needs operator-supplied OAuth credentials before it will work.

• Hosted member video

  Signed-in members upload MP4, WebM or MOV up to 200 MB and play it back from private storage.

  Code: BuiltSetup: UnknownChecked: Exercised in the appRunning: Running in this build

  • Single-provider storage: no independent replication, no transcoding ladder, no captions pipeline.

• Browser camera and screen broadcasting

  Hosts start a real WebRTC session from the browser and viewers join the session page.

  Code: BuiltSetup: No setup neededChecked: Adapter built, unverified externallyRunning: Running in this build

  • Public STUN only — no TURN relay, so restrictive networks can fail.
  • Peer-to-peer fan-out, so audience size is small. No SFU, recording or replay yet.

• External encoder (OBS) sessions

  Requests an RTMPS ingest address and HLS playback URL from a streaming provider.

  Code: BuiltSetup: UnknownChecked: Never exercisedRunning: Unknown

  • Never exercised against a live provider account in this build.

• Reports, moderation cases and appeals

  Signed-in members report hosted content; scoped moderators review cases, decide, and removals actually hide content for everyone. Members can appeal.

  Code: BuiltSetup: UnknownChecked: Unit testedRunning: Running in this build

  • Staffing, on-call rotation, legal escalation and response-time commitments are organisational, and code cannot create them.
  • Moderator roles must be granted by an operator running the bootstrap SQL against a known account.
  • Row-level policy behaviour is covered by review and unit tests, not by an automated end-to-end database test suite.

• Encrypted private messages (NIP-17)

  Text-only one-to-one messages sealed and gift-wrapped with NIP-44/NIP-59 through your own NIP-07 signer. Dues Vult never holds your keys or plaintext.

  Code: BuiltSetup: No setup neededChecked: Protocol tested in isolationRunning: Running in this build

  • Requires a browser signer that implements nip44.encrypt and nip44.decrypt.
  • Verified against an in-process test relay only — not against live public relays in this build.
  • No forward secrecy, no metadata hiding beyond gift wrapping, no groups, no attachments.
  • A relay receipt means the relay accepted the envelope, not that a person read it.

• Public Nostr rail

  Relay connection checks, signature-verified bounded reads and explicit signed publishes with OK receipts.

  Code: BuiltSetup: No setup neededChecked: Adapter built, unverified externallyRunning: Running in this build

  • Publishing depends on relays choosing to accept your event.

• Scalable live sessions (LiveKit SFU)

  Sessions run through a LiveKit media server: the host publishes once, viewers get subscribe-only access, and join permission is decided on the server from session ownership, moderation state and paid access.

  Code: BuiltSetup: UnknownChecked: Unit testedRunning: Not deployed

  • The media server is a separate deployment. The hosted Dues Vult app cannot run the UDP media workers itself.
  • Never connected to a running LiveKit server in this build: no real join, no real recording, no load or failover test.
  • Audience size is bounded by the participant cap you configure, not unlimited.

• Session recording and replay

  With the owner's explicit opt-in, a session is recorded to your own S3-compatible storage and a verified finished file becomes exactly one private replay draft linked to the session.

  Code: BuiltSetup: UnknownChecked: Unit testedRunning: Not deployed

  • Recording stays off until the session owner turns it on and the operator storage settings are present.
  • Callback handling, de-duplication and the single-replay rule are covered by unit tests only — no provider has ever called this endpoint.

• Creator commerce (test mode)

  Stripe Connect direct charges: creators onboard their own account, sell memberships, tickets or paid videos, and paid access is enforced by the server on playback and on joining a paid session.

  Code: BuiltSetup: UnknownChecked: Unit testedRunning: Not deployed

  • Test mode by default. Live money requires operator enablement plus a configured provider account and is switched off.
  • No real Stripe account has been connected and no charge, refund or payout has ever been made from this build.
  • Webhook, refund and out-of-order reconciliation logic is covered by offline signed fixtures, not by live events.
  • Dues Vult never holds funds: payouts and compliance stay with the payment provider.

Not built yet