┌───────────────────────────────────────────────────────────────┐
│                    USER APPLICATIONS                           │
│  (Figma-like, Notion-like, Game Engine, ML Dashboard, etc.)   │
├───────────────────────────────────────────────────────────────┤
│                  TNP: Temporal Navigation                      │
│     Fork/Merge/Navigate, Timeline Semantics, Temporal ACLs     │
├───────────────────────────────────────────────────────────────┤
│                WEAVE: Real-Time Mesh Collaboration             │
│    P2P Routing, LCB Broadcast, <8ms Local Convergence         │
├───────────────────────────────────────────────────────────────┤
│              VEST: Verifiable Audit & Integrity                │
│   Cryptographic Signatures, Threshold Witnesses, Sealed Trees  │
├───────────────────────────────────────────────────────────────┤
│            Cryptographic Primitives & Infrastructure            │
│  Ed25519, BLAKE3, Roughtime, Tessera/Trillian, Automerge     │
└───────────────────────────────────────────────────────────────┘

Step 1: User A types "hello"
  └─ Application captures input
     └─ WEAVE creates Operation_A (id, content="hello", causal_deps=[prev_op], sig_A)
        └─ WEAVE broadcasts to mesh via LCB (<8ms to User B's device)
           └─ TNP receives Operation_A, adds to timeline DAG
              └─ VEST computes signature (BLAKE3 hash of op_chain)

Step 2: User B types "world" (concurrently)
  └─ User B's device hasn't seen Operation_A yet (concurrent)
     └─ WEAVE creates Operation_B (id, content="world", causal_deps=[prev_op], sig_B)
        └─ WEAVE broadcasts to mesh
           └─ TNP detects: Operation_A and Operation_B have same parent
              └─ TNP creates fork: Timeline_A (with A's op), Timeline_B (with B's op)
                 └─ VEST signs both timelines independently (dual-sig proof)

Step 3: Network eventually delivers both operations
  └─ User A receives Operation_B
     └─ WEAVE merges using CRDT semantics
        └─ TNP applies CRDT merge logic
           └─ UI shows: "Two versions of this line. Choose A, B, or merge."
              └─ User A navigates Timeline_B (temporal navigation)
                 └─ VEST provides proof: "Timeline_B authored by User B"

Step 4: User A merges the two versions
  └─ Application calls TNP.merge(Timeline_A, Timeline_B)
     └─ TNP uses CRDT semantics to produce merged state
        └─ WEAVE broadcasts merged operation to mesh
           └─ VEST seals the merged timeline (immutable proof)
              └─ Both users converge to same state (canonical timeline)

struct WEAVEOperation {
    id: OpID,                           // Content-addressed (BLAKE3)
    user_id: UserID,                    // Public key or did:peer
    timestamp: Timestamp,               // Roughtime-verified
    content: EditPayload,               // Application data
    causal_deps: Vec<OpID>,             // Vector clock refs
    signature: Ed25519Signature,        // User's sig
}

struct TNPNode {
    weave_op: WEAVEOperation,           // ← Original WEAVE op
    timeline_id: TimelineID,            // Which timeline does this belong to?
    parent_nodes: Vec<NodeID>,          // DAG edges (causal dependencies)
    state_hash: Blake3Hash,             // Hash of accumulated state
    node_index: u64,                    // Position in timeline
}

struct TemporalDAG {
    nodes: HashMap<NodeID, TNPNode>,    // All nodes in the graph
    timelines: HashMap<TimelineID, Vec<NodeID>>, // Paths through DAG
    canonical: TimelineID,              // Official timeline
    forks: HashMap<OpID, Vec<TimelineID>>, // Which ops created forks?
}

struct VESTProof {
    timeline_id: TimelineID,            // Which timeline?
    merkle_root: Blake3Hash,            // Root of Merkle tree
    user_sigs: Vec<Ed25519Signature>,   // User signature
    server_witness_sig: BLS12381Sig,    // Threshold witness signature
    timestamp: Roughtime,               // Timestamp proof
    sealed: bool,                       // Is timeline immutable?
}

struct VESTTimeline {
    nodes: Vec<VESTProof>,              // Proof for each node
    sealed_at: Option<Timestamp>,       // When sealed (if ever)
    seal_sigs: Vec<BLS12381Sig>,        // t-of-n signatures for seal
}

S_canonical ≈ n_ops × s_op + n_ops × s_sig
            ≈ 1,000 ops × 200 bytes + 1,000 × 128 bytes
            ≈ 328 KB per document

S_total ≈ S_canonical + Σ(delta_ops × s_delta)
        ≈ 328 KB + 10 × (100 delta_ops × 50 bytes)
        ≈ 328 KB + 50 KB
        ≈ 378 KB  ← Only 15% overhead with 10 alternatives!

S_final ≈ 378 KB × 0.3 compression ratio
        ≈ 113 KB  ← Practical storage cost very low

S_vest_proofs ≈ n_nodes × (s_sig + s_merkle_ref)
              ≈ 1,000 × (128 bytes + 32 bytes)
              ≈ 160 KB

S_total_with_proofs ≈ 113 KB + 160 KB ≈ 273 KB

// WEAVE broadcast handler
impl WEAVEBroadcaster {
    fn on_operation_received(&mut self, op: WEAVEOperation) {
        // Forward to TNP
        self.tnp.ingest_operation(op);
    }
}

// TNP ingestion
impl TemporalNavigationProtocol {
    fn ingest_operation(&mut self, op: WEAVEOperation) {
        // Step 1: Check if operation creates a fork
        let parent_ops = &op.causal_deps;
        let concurrent_ops = self.find_concurrent_ops(parent_ops);

        if !concurrent_ops.is_empty() {
            // Fork detected
            for concurrent_op in concurrent_ops {
                let new_timeline_id = self.fork(concurrent_op);
                self.timelines.insert(new_timeline_id, vec![op.clone()]);
            }
        } else {
            // No fork, add to current timeline
            self.add_to_canonical(op.clone());
        }

        // Step 2: Forward to VEST for signing
        self.vest.sign_node(op.id, self.current_state_hash);
    }
}

// TNP calls VEST to sign
impl TemporalNavigationProtocol {
    fn seal_timeline(&mut self, timeline_id: TimelineID) {
        let timeline_nodes = self.timelines.get(&timeline_id).unwrap();

        // Compute Merkle root of all nodes
        let merkle_root = self.compute_merkle_root(timeline_nodes);

        // Call VEST to create threshold signature
        let vest_proof = self.vest.create_seal(
            timeline_id,
            merkle_root,
            threshold_t,  // t-of-n signature
            witness_nodes  // n threshold witnesses
        );

        // Store proof
        self.sealed_timelines.insert(timeline_id, vest_proof);
    }
}

// VEST signs and appends to log
impl VESTAuditLog {
    fn create_seal(
        &mut self,
        timeline_id: TimelineID,
        merkle_root: Blake3Hash,
        threshold_t: usize,
        witnesses: Vec<WitnessID>,
    ) -> VESTProof {
        // Step 1: Create Merkle proof (RFC 6962)
        let merkle_proof = self.create_merkle_proof(merkle_root);

        // Step 2: Collect t-of-n signatures from threshold witnesses
        let sigs = self.collect_witness_signatures(
            timeline_id,
            merkle_root,
            witnesses,
            threshold_t
        );

        // Step 3: Append to Tessera log
        let entry = VESTEntry {
            timeline_id,
            merkle_root,
            sigs,
            timestamp: Roughtime::now(),
        };
        self.tessera.append(entry);

        // Step 4: Return proof
        VESTProof { /* ... */ }
    }
}

User edits
    ↓
WEAVE broadcasts operation
    ↓
TNP receives operation
    ├─ Detects fork? → Fork timeline
    ├─ No fork? → Add to canonical
    ├─ Either way → Forward to VEST
    ↓
VEST signs operation (dual-sig: user + server witness)
    ├─ User signature: Already in WEAVE op
    ├─ Server witness: Threshold BLS12-381 signature
    └─ Append to Tessera log
    ↓
TNP stores proof reference
    ↓
UI receives confirmation: "Operation broadcast + signed"

User A: [Op1, Op2]
User B: [Op1, Op3]  ← Op3 concurrent with Op2

After convergence (≤300ms):
Both have: [Op1, {Op2, Op3 coexist}]

Timeline A: [Op1, Op2, Op4]
Timeline B: [Op1, Op2, Op3, Op5]

Merge algorithm must produce same result on every peer:
- User A merges → Timeline_merged = [Op1, Op2, Op3/Op4 coexist, Op5]
- User B merges → Timeline_merged = [Op1, Op2, Op3/Op4 coexist, Op5]  ← Same!

User A edits
    ↓
Operation signed with User A's private key (Ed25519)
    ↓
VEST threshold witnesses also sign (BLS12-381 threshold)
    ↓
Proof: "This operation was definitely from User A at this timestamp"
    ↓
Later, even if User A is compromised, proof stands

Timeline A: "This path was authored by User A"
Timeline B: "This path was authored by User B"
Merged Timeline: "This path is consensus between A and B"

pub trait TemporalNavigationAPI {
    // Observation
    fn current_state(&self) -> DocumentState;
    fn get_timeline(&self, timeline_id: TimelineID) -> Vec<Operation>;
    fn list_timelines(&self) -> Vec<TimelineID>;
    fn get_canonical(&self) -> TimelineID;

    // Navigation
    fn navigate_to(&mut self, timeline_id: TimelineID, timestamp: Timestamp) -> DocumentState;
    fn compare_timelines(&self, t1: TimelineID, t2: TimelineID) -> Diff;

    // Mutation
    fn edit(&mut self, content: EditPayload) -> OperationID;
    fn fork(&mut self, from_timeline: TimelineID, at_op: OperationID) -> TimelineID;
    fn merge(&mut self, t1: TimelineID, t2: TimelineID) -> TimelineID;
    fn seal_timeline(&mut self, timeline_id: TimelineID) -> VESTProof;

    // Subscription
    fn on_fork(&self, callback: Box<dyn Fn(TimelineID, TimelineID)>);
    fn on_merge(&self, callback: Box<dyn Fn(TimelineID, TimelineID, TimelineID)>);
    fn on_state_change(&self, callback: Box<dyn Fn(DocumentState)>);
}

pub trait WEAVEIntegration {
    // WEAVE → TNP
    fn on_operation(&mut self, op: WEAVEOperation);  // TNP listens
    fn on_convergence(&mut self);                    // TNP learns mesh converged

    // TNP → WEAVE
    fn broadcast_operation(&self, op: WEAVEOperation);  // TNP triggers broadcast
    fn get_peer_states(&self) -> Vec<PeerState>;       // TNP queries for reconciliation
}

pub trait VESTIntegration {
    // TNP → VEST
    fn sign_operation(&mut self, op: WEAVEOperation, state_hash: Blake3Hash) -> Signature;
    fn seal_timeline(&mut self, timeline_id: TimelineID, merkle_root: Blake3Hash) -> VESTProof;
    fn get_proof(&self, op_id: OperationID) -> VESTProof;

    // VEST → TNP
    fn on_seal_complete(&self, timeline_id: TimelineID);  // VEST notifies seal done
}

┌─────────────────────────────────────────────────────┐
│              User Device (Peer)                     │
├─────────────────────────────────────────────────────┤
│ Application Layer (Figma, Notion, Game, etc.)       │
├─────────────────────────────────────────────────────┤
│ TNP: Temporal Navigation (fork/merge/navigate)      │
├─────────────────────────────────────────────────────┤
│ WEAVE: Mesh Collaboration (P2P sync)                │
├─────────────────────────────────────────────────────┤
│ VEST: Audit Layer (local signature verification)    │
├─────────────────────────────────────────────────────┤
│ Storage: Automerge + IPLD (local immutable store)   │
└─────────────────────────────────────────────────────┘

Connectivity:
- WebRTC ↔ Peers (P2P)
- QUIC ↔ Peers (fast, UDP-based)
- BLE ↔ Nearby peers (low power)
- Wi-Fi Direct ↔ Peers (no internet needed)
- Internet Gateway (optional, for server features)

┌──────────────────────────────────┐
│     Witness Server (Optional)    │
│    (t-of-n BLS12-381 signer)     │
├──────────────────────────────────┤
│ Tessera/Trillian Log Backend     │
├──────────────────────────────────┤
│ VEST Proof Verification          │
├──────────────────────────────────┤
│ Roughtime Timestamp Authority    │
├──────────────────────────────────┤
│ Compliance Audit Trail           │
└──────────────────────────────────┘

Connection:
- Peers send final states to witness (async, no latency to collab)
- Witness appends to Tessera log (immutable proof)
- Witness returns seal (proof of non-repudiation)
- Audit trail available for compliance review

Failure mode:
- If witness is down: Peers continue collaborating (WEAVE works)
- Seals will be created once witness recovers (backfill)