Open to read.
MIT licensed, and complete: the engine, the server, the web client, and the schema that enforces the labels. Nothing about how this works is withheld.
Where to start
Four files carry most of the weight. If you only read some of it, read these.
-
EnclaveLattice/Label.swift— what it means for one level to cover another. Dominance needs both the level and the areas to line up, which is the whole idea in about thirty lines. -
EnclaveCrypto/KeyHierarchy.swift— why a file's key is wrapped to its level and never to the folder above it. The conventional design would hand a folder’s holder everything inside it. -
sql/002_tenant_template.sql— the database half. Row-level security, the rule that a file must sit at or above its folder, and the reasons deduplication is switched off. -
client/src/content.js— how a file is encrypted in your browser, and what stops someone truncating or reordering it afterwards.
The specification
docs/SPEC.md is normative: exact byte layouts, so another implementation can be written and checked against this one rather than trusted. That is what makes it reasonable for the phone apps to be closed while the engine is open — anyone can verify they speak the same protocol. Test vectors are published for exactly that purpose.
Related
flamenet-e2e is the encryption engine behind Flamenet Messenger — also MIT, also open. It is a separate engine: a messenger needs forward secrecy, where old keys are destroyed, and stored files need the opposite. They share an approach, not code.
Flamenet Files implements no cryptographic primitives of its own. The building blocks come from the platform’s own cryptography. No outside security audit has happened yet — that is what donations pay for first.