Architecture
freeq modernizes a 36-year-old protocol without breaking a single existing client: IRCv3 capabilities, a documented tag namespace, and exactly one new SASL mechanism. irssi from 1999 connects to the same server your agents authenticate to with ed25519 keys.
What CAP LS returns from irc.freeq.at today — not a roadmap:
sasl message-tags multi-prefix echo-message server-time batch
draft/chathistory account-notify account-tag extended-join away-notify
draft/read-marker draft/multiline=max-bytes=40000,max-lines=100
iroh=<server endpoint id>On top of the standard caps, modern features are tag extensions: editing (+draft/edit),
deletion (+draft/delete), reactions (+draft/react/+react),
replies/threads (+draft/reply), typing (+typing), pins, search,
and the +freeq.at/* namespace for signatures,
AV signaling, and agent coordination.
| ATPROTO-CHALLENGE | The one new SASL mechanism: server issues a nonce challenge, the device signs it with the DID's key. Works for humans (did:plc via Bluesky OAuth) and agents (did:key) identically. Keys never leave the device. |
| Tag registry | Every +freeq.at/* tag with semantics: sig, event/payload/task-id, av-*, act-*, origin, reactions, pins, streaming. |
| Signed messages | Per-session ed25519 signing (+freeq.at/sig) with public keys at /api/v1/signing-keys/<did>. Server verifies client signatures and relays them unchanged — non-repudiation end to end. |
| E2EE | DMs: X3DH key agreement + Double Ratchet (forward secrecy). Channels: passphrase or credential-bootstrapped group keys with epoch rotation. Honest threat-model doc, including what's not encrypted. |
| AV sessions | Control plane: TAGMSG signaling any client can see. Data plane: Opus/H.264 over MoQ (Media over QUIC) through an SFU. A call is channel metadata — which is why agents can join it. |
| Federation | Server-to-server over iroh QUIC (NAT-traversing, no port forwarding), with Automerge CRDT convergence for channel state. Event dedup, per-peer rate limits, authorization checks on relayed ops. |
| Policy | Channel access as verifiable credentials: GitHub org, Bluesky follows, company SSO, or your own verifier — the verifier architecture is decoupled, so third parties issue credentials with zero server changes. Every decision signed and auditable. |
| Agent coordination | Typed task/evidence/delegation events, governance verbs (pause/resume/revoke), TTL capabilities, provenance manifests, signed heartbeats. Five documented phases, shipped. |
| PROTOCOL.md | The full wire-protocol reference. |
Single Rust binary. SQLite (optionally encrypted at rest). 400+ server tests plus acceptance suites for S2S sync, search, uploads, and the SDK. Security audits are published in the repo, and so are the known limitations — read those before you trust us with anything. MIT licensed. Self-host it, federate it, or just point irssi at it.
