amadan

eleven / messenger Public

docs: memory — log the SQLite-alternatives decision (staying) (#589)

* Add docs/comparison.md: how Eleven compares to other messengers

Honest side-by-side with Signal, Matrix/Element, SimpleX and Session:
each pillar of the Eleven model exists somewhere, the combination
exists nowhere. Snapshot as of July 2026.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: memory — log the SQLite-alternatives consideration (staying on modernc.org/sqlite)

Records why alternatives were evaluated (team-ethics concern), why each
lost (libSQL = cgo, KV stores = no SQL, chai = pedigree, Postgres = ends
one-file deploy), and the revisit trigger (a practical governance problem
plus a no-cgo libSQL binding).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Paul Campbell 6fca4038756306014f58b2924e1a2d91b66d420b parent 8e61e3d
3 files changed, +110 −0
  • .claude/memory/MEMORY.md +1 −0
  • .claude/memory/sqlite-choice.md +38 −0
  • docs/comparison.md +71 −0
diff --git a/.claude/memory/MEMORY.md b/.claude/memory/MEMORY.md
index cd0e95d..9daf3ad 100644
--- a/.claude/memory/MEMORY.md
+++ b/.claude/memory/MEMORY.md
@@ -2,3 +2,4 @@
- [deterministic-scripts-and-runbooks.md](deterministic-scripts-and-runbooks.md) — Server tasks must produce idempotent scripts with runbooks, secrets stored in 1Password
- [event-contract.md](event-contract.md) — Cross-platform event vectors for chat/todo/remind, organized by app
+- [sqlite-choice.md](sqlite-choice.md) — Considered SQLite alternatives (team-ethics concern), staying on modernc.org/sqlite; libSQL-without-cgo is the escape hatch to watch
diff --git a/.claude/memory/sqlite-choice.md b/.claude/memory/sqlite-choice.md
new file mode 100644
index 0000000..a9a1892
--- /dev/null
+++ b/.claude/memory/sqlite-choice.md
@@ -0,0 +1,38 @@
+# 🤖 SQLite: considered alternatives, staying (2026-07-10)
+
+**Decision: lchat stays on SQLite via `modernc.org/sqlite`.** Alternatives were
+considered (prompted by discomfort with the SQLite core team's public persona —
+the Benedictine "Code of Ethics" page) and rejected. Don't re-litigate this
+without new facts; the escape hatch to watch is noted below.
+
+## Why we looked
+
+The SQLite team's [Code of Ethics](https://sqlite.org/codeofethics.html) (the
+Rule of St. Benedict, adopted by D. Richard Hipp partly as a statement against
+boilerplate CoCs) gives some people pause. Context that defused it: it governs
+the three-person core team only, not users or contributors, and the code itself
+is **public domain** — no license terms, nothing ideological attaches to the
+artifact. Our build dependency is also one step removed already:
+`modernc.org/sqlite` is Jan Mercl's machine translation of the C source into
+pure Go.
+
+## Alternatives rejected
+
+- **libSQL (Turso)** — the real "same engine, different governance" option: MIT,
+ open-contribution fork, same file format + SQL. **Rejected because its Go
+ bindings (`go-libsql`) require cgo**, which breaks the single-static-binary
+ `CGO_ENABLED=0` deploy that the whole per-instance architecture rests on.
+ Turso's ground-up Rust rewrite (ex-"limbo") is not production-ready and also
+ not Go-native.
+- **Pure-Go KV stores** (bbolt, Badger, Pebble) — no SQL; every query in `db.go`
+ becomes hand-rolled index management.
+- **Pure-Go SQL engines** (chai/genji) — nowhere near SQLite's testing pedigree;
+ unacceptable as the sole datastore of an E2EE messenger.
+- **Postgres** — ends the one-file, one-disk deploy model.
+
+## If this ever needs revisiting
+
+The trigger would be governance becoming a *practical* problem (licensing
+change, abandonment) — not the ethics page. First option to re-check:
+**libSQL's cgo situation** (a pure-Go or no-cgo binding would make it a
+near-drop-in). File format compatibility means migration would be low-drama.
diff --git a/docs/comparison.md b/docs/comparison.md
new file mode 100644
index 0000000..1edf6fb
--- /dev/null
+++ b/docs/comparison.md
@@ -0,0 +1,71 @@
+# 🤖 How Eleven compares
+
+Where Eleven sits among the private messengers, honestly. Every pillar of
+the Eleven model — no identifiers, end-to-end encryption, easy self-hosting,
+a mainstream-grade app — already exists *somewhere* in this landscape.
+Eleven's bet is the **combination**.
+
+## At a glance
+
+| | Signal | Matrix / Element | SimpleX | Session | **Eleven** |
+|---|---|---|---|---|---|
+| End-to-end encrypted | Yes | Yes (rooms) | Yes (double ratchet) | Yes | **Yes** |
+| Identifier required | Phone number | Username + account | None | Random Session ID | **None — invite link** |
+| Onboarding | Install + phone verify | Pick a server, register | One-time invitation link | Generate an ID | **Click a link, you're chatting** |
+| Server topology | Centralized, one operator | Federated homeservers | Relay queues | Community onion-routed nodes | **Many small instances + thin glue** |
+| Self-hosting | No | Yes, but a sysadmin job | Yes (relays) | Not really | **Yes — one binary, [designed to be simple](self-hosting.md)** |
+| What a hacked server exposes | Little (sealed sender) | Membership, timing, server addresses | Very little — no IDs to correlate | Little (onion routing) | **Ciphertext only** |
+| Mainstream UX | Excellent | Improving, still heavy | Privacy-enthusiast | Decent | **A design goal, not a nice-to-have** |
+
+## The nearest neighbours
+
+**[SimpleX Chat](https://simplex.chat/)** is the nearest philosophically —
+the first messaging network with
+[no user identifiers of any kind](https://github.com/simplex-chat/simplex-chat):
+no phone number, no username, not even a random ID. Contact happens through
+one-time invitation links, encryption is the Signal double-ratchet, and
+relays are self-hostable. Where we differ: SimpleX is built on
+per-conversation [message queues](https://simplex.chat/docs/simplex.html)
+rather than small shareable instances, and it's aimed at privacy
+enthusiasts. Eleven aims at your family group chat.
+
+**[Matrix / Element](https://matrix.org/)** is the nearest architecturally —
+genuinely federated, self-hostable, encrypted, many servers forming one
+network. But it keeps accounts and usernames, running a homeserver is real
+operational work, and federated rooms leak metadata: participating servers
+see room membership, message timing, and server addresses. That's exactly
+what "if the server got hacked, nothing on the server should expose
+anything" rules out.
+
+**[Signal](https://signal.org/)** is the gold standard for audited
+mainstream e2ee — and proof that a private messenger can feel like a normal
+app. It's also centralized under one operator and requires a phone number,
+which ties every conversation back to a government-issued identifier.
+
+**[Session](https://getsession.org/)** drops the phone number and routes
+messages over an onion network, cutting metadata exposure. But you don't run
+your own piece of it, and the network's incentives are tied to its token
+rather than to its members.
+
+## What only the combination gives you
+
+- **No sign-up and no identifier** (SimpleX has this; Signal and Matrix
+ don't) — so there's nothing to subpoena, leak, or sell.
+- **Self-hosting as a right, made easy** (Matrix has the right, not the
+ easy) — one static binary, a €4 VPS, [ten minutes](self-hosting.md).
+- **Small instances that still form one network** (Signal is one big
+ instance; SimpleX has no instances) — invites and chats
+ [cross servers](cross-instance-relay.md).
+- **Ciphertext-only servers** (Matrix leaks metadata) — push and key backup
+ run as [thin, optional, replaceable glue](push-relay.md).
+- **A mainstream app** (SimpleX and Session ask you to care about privacy
+ first) — groups, photos, reactions, replies, bots. Nothing to relearn.
+
+## Sources
+
+- [Comparison of instant messengers (Eylenburg)](https://eylenburg.github.io/im_comparison.htm)
+- [Signal vs SimpleX vs Session (Cunicula, 2026)](https://cunicula.com/en/articles/encrypted-messaging-comparison)
+- [Messenger showdown: Signal, Session, SimpleX, Matrix, XMPP, Briar (Simplified Privacy)](https://simplifiedprivacy.com/messengers/)
+- [SimpleX platform design](https://simplex.chat/docs/simplex.html)
+
+*Snapshot as of July 2026 — the neighbours ship fast; corrections welcome.*