spec: multi-recipient (group) encryption, To/Cc roles, and agreement workflow

[asherp]

Summary

Extends the Nostr-Mail Protocol Specification (docs/nostr-mail-spec.md, bumped to v0.3.0-draft) to support multi-recipient encryption and a DocuSign-style agreement workflow — the foundation for delivering SIGit-style signed contracts over ordinary email.

The design generalizes the existing hybrid attachment scheme (random AES-256 key wrapped with NIP-44) from one recipient to N, so it reuses crypto already shipped in crypto.rs rather than introducing anything new.

What's in the spec

New normative sections

• §10 Multi-Recipient Encryption — per-message Content Encryption Key (CEK), RECIPIENTS armor block (<role> <pubkey> <wrapped-cek>), sender self-stanza for Sent-folder access, single-recipient gating for backward compatibility, per-level recipients in reply chains, forward-only access control, and the privacy trade-off vs. NIP-59.
• §11 Recipient Roles & Agreement Workflow — signer/viewer semantics, the agreement message, reply-as-signature signing rounds, "M of N signed" completion accounting, and offline verification.

Integrating edits

• §2.1 — HYBRID ENCRYPTED BODY and RECIPIENTS block types
• §3.6 / §3.6.1 — multi-recipient and multi-recipient-reply formats
• §4.2 — signature now covers the canonicalized recipients block (membership/roles tamper-evident)
• §6.1 — optional X-Nostr-Agreement filtering header
• §6.3 — To→signer / Cc→viewer mapping; signed armor is authoritative over spoofable headers; Bcc handling
• §8 — decoder algorithm branches pairwise vs. envelope decryption

Key decisions to review

1. Body cipher = AES-256-GCM under a random CEK, NIP-44 wraps the CEK — reuses the shipped attachment hybrid.
2. To/Cc is role, not access — both decrypt; only the signed role token is authoritative.
3. Envelope format gated to >1 recipient; single-recipient mail keeps the existing pairwise format (old decoders unaffected).
4. Per-level RECIPIENTS, never inherited — required by per-level CEKs; gives forward-only access for late-added parties.

Scope

Spec-only — no code changes. Suggested follow-up: land plain Cc support end-to-end (types → lettre .cc() → IMAP Cc parse → compose UI) before implementing the envelope crypto.

https://claude.ai/code/session_018dPQuMh5vwZDW1Hqy7jTQp

---

Generated by Claude Code