wesh/v0 package

Package wesh is an on-chain directory and device sigchain for Wesh protocol (weshnet / Berty) identities.

It exists to give weshnet the three things a peer-to-peer network cannot give itself, and which a chain is uniquely good at:

1. Resolution. A Berty identity travels out of band as a QR code or a https://berty.tech/id# link, and there is no way to look one up. Here a name resolves to a contact, and Render emits the real, scannable link.
2. Rotation with a paper trail. Resetting the public rendezvous seed silently kills every link ever shared; there is no revocation channel. Here every rotation is a numbered, timestamped, signed entry, and the superseded seeds stay visible, so a stale link resolves to a redirect instead of to nothing.
3. Device revocation. The Wesh protocol documentation states plainly that a device, once linked to an account, can never be revoked: the account metadata log is append-only and no authority can void an entry. This realm hosts the log that was missing: a hash-chained, account-signed roster whose every entry the chain verifies with ed25519 before accepting it.

What this realm does not do, and will not

It never stores a secret. Group secrets, device chain keys, message keys and ciphertexts stay off chain, permanently. The library this realm is built on, p/moul/x/wesh(/p/moul/x/wesh/v0), has no type that can hold one.

It also does not pretend to enforce revocation inside weshnet. A revoked device's ratchets are already distributed and forward secrecy is a local property; no chain can reach into a group and forget them. What revocation buys here is that it becomes public, ordered, and attributable to the account key, which is strictly more than weshnet has today.

Publishing is a deliberate act

A published rendezvous seed lets anyone derive the account's rotating rendezvous point and watch the DHT for it. That is the same exposure as printing your Berty QR code on a billboard, and it is the right trade only for an identity that wants to be found: a support line, a shop, a public channel.

RegisterCommitted is the alternative. It publishes H(seed ‖ salt) instead, so the chain attests that a seed handed over out of band really belongs to the named account, without broadcasting where that account listens.

Authentication

Every state-changing call carries an ed25519 signature made with the Wesh account private key over a canonical statement that names this chain, the caller's gno address, and a monotonic revision or sequence number. Without it, anyone could publish anyone else's account key next to a seed of their choosing and harvest the contact requests that followed.