Linka · a place to be

Home and the square

Linka is an independent Brazilian social ecosystem, created by Raphael M. Franco, in closed beta. Squares organize topics; Circles express closeness and permission. Posts, carousels, conversations, calls, radio and shared presence belong to the same place. Advertising is not its business model. It is not a federated network: Linka still operates the infrastructure.

Ghost, Shell and Gabriel

Ghost means the person as the subject of identity, will, memory and relationships. Shell is the authority architecture and technical constitution intended to preserve that agency. Gabriel connects rights to mechanisms and tests in the repository, continuous integration and startup. It does not read conversations and is not an independent auditor. A documented rule does not, by itself, establish coverage throughout the product.

STCC: continuity matters

Shell Transcendent Cryptography Chain is Linka’s name for the composition joining identity, device authorization, cryptographic state and continuity. v5 is a Linka protocol version, not Signal’s fifth version. On Android, hybrid establishment combines X25519 and ML-KEM-768. Double Ratchet and SPQR evolve in parallel; their contributions are combined through a KDF before AES-256-GCM. A Rust provider holds state sealed by a non-exportable Android Keystore key.

The server transports encrypted envelopes and stores public bundles, receipts and checkpoints. Persistence, idempotent retry, an append-only witness and checkpoint gossip aim to detect broken continuity, rollback and conflicting histories within the tested scenarios. WebSocket carries events; it does not replace the state machine or independently guarantee delivery or decryption. The production witness belongs to the Python/PostgreSQL authority, not to an independent organization.

Signing in is not restoring a key

Login session, device authorization and cryptographic authority are distinct states. The local candidate preserves a JNI callback that R8 renamed in APK 137. An isolated test reproduced failure after process termination, then passed after an update without data deletion, including restarts with preserved identities. This does not establish real conversations for every tester. Clearing data or reinstalling is not an acceptable recovery procedure to conceal this defect.

New passwords require at least 15 characters; phrases, spaces and Unicode are accepted. Strength guidance is an estimate, not a mathematical guarantee. Optional passkeys verify challenges; Linka does not receive or store fingerprints. Recovering account access does not automatically recreate lost message keys.

Every flow has a boundary

Protected chat media is encrypted before upload. Public post media follows a different path and may be transformed by the media service. Calls use WebRTC and DTLS-SRTP with authenticated negotiation; their media is not claimed to be post-quantum. Native notification previews use an auxiliary classical P-256/HKDF/AES channel. Reading a push notification does not establish that the chat opened the same v5 envelope.

Translation occurs after decryption on the device. Human chat is not automatically sent to DAMA; content chosen for an AI session may be processed by an external provider and is not E2EE during inference. PostgreSQL is the source of truth; Redis/Valkey coordinates events and presence. These boundaries remain distinct.

The next set, without claiming delivery early

The candidate includes native v5 resumption, password guidance, Light/Automatic themes, typography and frames, invitation links, message replies, safe-area adjustments, radio and a synthesized sound signature. Ghost Mode still requires completion of viewer-side content admission and proof that capture is blocked before exposure. Local changes are not presented as available in the store. The observed version, its date and the evidence are recorded in the public facts file.

The limits of the promise

There is no claim of operational equivalence with Signal or iMessage, independent cryptographic audit, authentication resistant to an active quantum adversary, or native v5 in browsers. The server still sees metadata. Capture blocking depends on the client and operating system; it cannot prevent an external camera, a compromised device or copies already obtained. Isolated tests, bounded integration and end-to-end verification are different evidence levels. No test count erases that distinction.