# ADR-001: Rust core + native UIs + Tor-only v1

## Status

Accepted

## Date

2026-05-30

## Context

pvtcoms must run on Android, Desktop (and later iOS) while being a security-critical, anonymous, post-quantum messenger.
A cross-platform UI framework (Flutter/React-Native) for the secure surface, or a pure-Rust GUI, were considered. Research
(Codex + Gemini + web) found every leading secure messenger (Signal, SimpleX, Session, Molly, Briar) separates a single
shared core from per-platform native UIs, and that `arti` (Tor) is itself a Rust crate. See `DESIGN.md` §14.

## Decision

- One **Rust core** (crypto, `arti` Tor transport, oblivious mailbox, protocol state, SQLCipher storage) exposed via a
  narrow **UniFFI** JSON command/event API.
- **Native UIs**: Jetpack Compose (Android), Tauri 2 (Desktop), SwiftUI (iOS, v2).
- **v1 transport = Tor only** (one uniform path; identity-bound, never per-contact). Nym deferred to v3.
- Rust owns bytes + Tor logic; the **native layer owns lifecycle/scheduling/power** (no always-on Rust daemon).

## Consequences

### Positive
- Proven model; PQ crypto written once, inherited by all platforms; `arti` composes natively.
- Small auditable core; UniFFI spares hand-written JNI/Swift bridges.

### Negative
- Two+ native UI codebases to maintain.
- iOS background limits force a v2 oblivious APNs relay; iOS deferred.

### Neutral
- Desktop via Tauri (web UI) vs native is a separable later choice.
- A change to a crypto primitive or the transport model requires a new ADR.