A private world
over a relay that can't read it.

The same shared world as /world-shared/, in an end-to-end encrypted room. Enter here and in a second tab: each tab becomes a member of the room's MLS group (RFC 9420), and seals every op under the group's keys before it signs the op's receipt and sends it. The relay routes, checks and receipts ciphertext only; the members open the ops and replay them to the same session hash. A member that joins later cannot open what was sealed before it joined, so the others carry every op they hold into its first epoch. A third visitor watches as a viewer: outside the group, it receives the sealed objects, verifies their receipts and opens none.

not in the room you are — click the canvas, then ↑ ↓ ← →
agents 0 ops 0 frame hash — session hash — receipts ✓ 0 opened 0 not opened 0 epoch —

What happens to each op

Entering, this tab makes its own Ed25519 key, the room service grants it an actor's place, and the room's clock proposes adding it to the room's MLS group; a member commits, and this tab joins the group from the Welcome, all carried in order by the room service's log. Each op is signed by the tab's key, sealed as an MoQ secure object under the tab's keys of its current epoch, and only then signed into its track's receipt chain, so the receipt covers the sealed bytes. The relay checks each receipt against its owner's key and forwards ciphertext. A member verifies each receipt, opens the object, then checks each op's signature, its actor and its place before it replays the merged log. In each epoch it reaches, a member first publishes every op it holds, sealed in that epoch: what a member that joins later opens of the world's past.

Energy: not metered in this demo. This tab measures nothing, so each receipt it signs carries the unmetered marker, and the page shows no figure.

Where it lives

  • In the standard: the confidentiality extension (wai.live.e2ee), which seals a room's tracks under keys from one MLS group per room, and the live-worlds extension (wai.live.world), whose private worlds seal the world tracks and carry their ops into each epoch, with the wai.world.model capability and the integer world engine this tab runs.
  • The room: the reference room service, the relay and the browser client this page loads, Apache-2.0, in the open-standards repo, as the live room at /room/ runs them.
  • Transport: Media over QUIC Transport (draft-ietf-moq-transport-22), an IETF working-group Internet-Draft. This browser reaches the relay over its WebSocket binding.