i18n: add English defaultValue fallback to key-only localized strings so no language shows raw keys

Non-en languages are each missing ~138 of 336 catalog keys, so a key
absent from that language's table renders as the raw dot-key on device
(no English fallback). This adds English defaultValues so every miss
resolves to English instead of a raw key.

- Class (a): 217 String(localized: "dot.key") calls missing defaultValue
  now carry defaultValue: "<en value>" pulled verbatim from the catalog
  (format specifiers preserved).
- Class (b): 41 SwiftUI LocalizedStringKey literals (Text/Button/alert/
  confirmationDialog/TextField) wrapped as
  Text(String(localized: "key", defaultValue: "en")) so they resolve to
  English too. Existing comments folded into the resolved String.

No catalog or en values changed; Swift source only. Both schemes build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitattributes

@@ -0,0 +1,20 @@
+# Prevent Github Languages stats skewing:
+
+# Binaries and assets
+**/*.xcframework/** linguist-vendored
+**/*.xcassets/** linguist-vendored
+
+# Generated files
+**/*.pbxproj linguist-generated
+**/*.storyboard linguist-generated
+Package.resolved linguist-generated
+
+# Downloaded CSVs
+relays/online_relays_gps.csv linguist-vendored
+
+# Docs
+**/*.md linguist-documentation
+
+# Configs
+Configs/*.xcconfig linguist-documentation
+**/*.plist linguist-documentation

.github/workflows/arti-provenance.yml

@@ -0,0 +1,85 @@
+name: Arti Binary Provenance
+
+# The Arti xcframework is a vendored binary; these checks turn the policy in
+# docs/ARTI-BINARY-PROVENANCE.md into an enforced gate:
+#  1. The checked-in binary must match the hash manifest in the provenance doc.
+#  2. A PR that changes the binary must also change at least one provenance
+#     input (Rust source, lockfile, build script, or the doc itself).
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "localPackages/Arti/**"
+      - "docs/ARTI-BINARY-PROVENANCE.md"
+  pull_request:
+    paths:
+      - "localPackages/Arti/**"
+      - "docs/ARTI-BINARY-PROVENANCE.md"
+
+jobs:
+  verify-hashes:
+    name: Verify xcframework hashes against provenance doc
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Compare artifact hashes with manifest
+        run: |
+          set -euo pipefail
+          doc="docs/ARTI-BINARY-PROVENANCE.md"
+
+          # Extract the manifest: lines of "<sha256>  <path>" from the doc.
+          grep -E '^[0-9a-f]{64}  localPackages/Arti/Frameworks/arti\.xcframework/' "$doc" \
+            | sort -k2 > expected.txt
+
+          if [ ! -s expected.txt ]; then
+            echo "::error::No hash manifest found in $doc"
+            exit 1
+          fi
+
+          # Hash the same file set the doc documents.
+          find localPackages/Arti/Frameworks/arti.xcframework -maxdepth 3 -type f -print0 \
+            | sort -z | xargs -0 sha256sum | sed 's/  \.\//  /' | sort -k2 > actual.txt
+
+          if ! diff -u expected.txt actual.txt; then
+            echo "::error::Checked-in arti.xcframework does not match the manifest in $doc. If the binary change is intentional, rebuild per the doc and update the manifest in the same PR."
+            exit 1
+          fi
+          echo "All $(wc -l < actual.txt) artifact hashes match the provenance manifest."
+
+  require-provenance-evidence:
+    name: Binary changes must ship with provenance inputs
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Check changed files
+        run: |
+          set -euo pipefail
+          base="origin/${{ github.base_ref }}"
+          git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
+          changed=$(git diff --name-only "$base"...HEAD)
+          echo "Changed files:"
+          echo "$changed"
+
+          if ! echo "$changed" | grep -q '^localPackages/Arti/Frameworks/arti\.xcframework/'; then
+            echo "No binary artifact changes; nothing to verify."
+            exit 0
+          fi
+
+          if echo "$changed" | grep -Eq '^(localPackages/Arti/(Cargo\.(toml|lock)|build-ios\.sh|arti-bitchat/)|docs/ARTI-BINARY-PROVENANCE\.md)'; then
+            echo "Binary change is accompanied by provenance inputs."
+            exit 0
+          fi
+
+          echo "::error::arti.xcframework changed without matching source, lockfile, build-script, or provenance-doc changes. See docs/ARTI-BINARY-PROVENANCE.md (\"Do not accept an xcframework-only update\")."
+          exit 1

.github/workflows/fetch_georelays.yml

@@ -0,0 +1,42 @@
+name: Fetch GeoRelays Data
+
+on:
+  schedule:
+    - cron: '0 6 * * 0'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-relay-data:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fetch-depth: 0
+
+      - name: Fetch GeoRelays
+        run: |
+          wget -q https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv
+          mv nostr_relays.csv ./relays/online_relays_gps.csv
+
+      - name: Check for changes
+        id: git-check
+        run: |
+          git diff --exit-code || echo "changes=true" >> $GITHUB_OUTPUT
+    
+      - name: Commit and push changes
+        if: steps.git-check.outputs.changes == 'true'
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          git add relays/online_relays_gps.csv
+          git commit -m "Automated update of relay data - $(date -u)"
+          git push
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/swift-tests.yml

@@ -0,0 +1,179 @@
+name: Build & Test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    name: Run Swift Tests (${{ matrix.name }})
+    runs-on: macos-latest
+    # A hung test must fail fast, not hold a runner for GitHub's 360-minute
+    # default (observed: intermittent app-suite hangs starving the queue).
+    # The long steps carry tighter individual bounds (5-minute test watchdog,
+    # 6-minute benchmark step, 10-minute floor gate that may re-run the
+    # benchmarks up to twice on a noisy runner); this is the backstop.
+    timeout-minutes: 25
+
+    strategy:
+      fail-fast: false # Don't cancel other matrix jobs when one fails
+      matrix:
+        include:
+          - name: app
+            path: .
+          - name: BitLogger
+            path: localPackages/BitLogger
+          - name: BitFoundation
+            path: localPackages/BitFoundation
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      # Use the Xcode-bundled Swift toolchain: it always matches the SDK on
+      # the runner image. A standalone swift.org toolchain (setup-swift) broke
+      # whenever the image's Xcode moved ahead of it ("this SDK is not
+      # supported by the compiler").
+      - name: Note toolchain version (cache key)
+        id: swift-version
+        run: echo "version=$(swift --version 2>/dev/null | head -1 | shasum | cut -c1-12)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache build artifacts
+        uses: actions/cache@v4
+        with:
+          path: ${{ matrix.path }}/.build
+          key: ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/*.swift', matrix.path), format('{0}/**/Package.resolved', matrix.path)) }}
+          restore-keys: |
+            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/Package.resolved', matrix.path)) }}
+            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-
+
+      - name: Build tests
+        # Built separately so the hang watchdog below times only test
+        # execution: a cold-cache coverage build on a slow runner can
+        # legitimately take several minutes, and is already bounded by the
+        # 15-minute job timeout.
+        run: swift build --build-tests --enable-code-coverage --package-path ${{ matrix.path }}
+
+      - name: Run Tests
+        # Perf benchmarks are excluded here and run in their own serial step
+        # below: measuring while parallel test processes contend for cores
+        # produces noisy numbers, and the XCTest measure machinery has hung
+        # intermittently under parallel workers on loaded runners. Excluded
+        # via --skip (not just the env guard): every app run since the
+        # baselines landed timed out at the 15-minute job limit with the
+        # baseline tests dispatched into the parallel phase.
+        #
+        # The watchdog samples any still-running test processes after 5
+        # minutes (the suite passes in seconds when healthy; the build is
+        # done by this step) and kills the run, so a hang fails fast with
+        # stacks in the log instead of a silent timeout.
+        env:
+          BITCHAT_SKIP_PERF_BASELINES: "1"
+        run: |
+          swift test --skip-build --parallel --quiet --enable-code-coverage \
+            --skip PerformanceBaselineTests \
+            --package-path ${{ matrix.path }} &
+          test_pid=$!
+          (
+            sleep 300
+            if kill -0 "$test_pid" 2>/dev/null; then
+              echo "::group::Tests still running after 5 minutes — sampling before kill"
+              for pid in $(pgrep -if 'swiftpm-testing|xctest|PackageTests' || true); do
+                echo "--- sample of pid $pid ---"
+                sample "$pid" 5 2>/dev/null || true
+              done
+              echo "::endgroup::"
+              pkill -KILL -P "$test_pid" 2>/dev/null || true
+              kill -KILL "$test_pid" 2>/dev/null || true
+            fi
+          ) &
+          watchdog_pid=$!
+          wait "$test_pid" && status=0 || status=$?
+          kill "$watchdog_pid" 2>/dev/null || true
+          exit "$status"
+
+      # Benchmarks run serially on an otherwise idle runner for stable
+      # numbers; BITCHAT_PERF_LOG captures the PERF[...] lines for the gate.
+      - name: Run performance benchmarks (serial)
+        if: matrix.name == 'app'
+        timeout-minutes: 6
+        env:
+          BITCHAT_PERF_LOG: ${{ github.workspace }}/perf-output.log
+        run: swift test --quiet --filter PerformanceBaselineTests
+
+      # Order-of-magnitude performance regression gate. Floors are deliberately
+      # generous (see bitchatTests/Performance/perf-floors.json) so this
+      # catches algorithmic regressions, never runner variance. If a metric
+      # still lands below floor (a saturated runner can dip one), the script
+      # re-runs the benchmarks — appending to the same log and keeping each
+      # benchmark's best value per metric — so noise clears on retry while a
+      # real regression fails every attempt. Floors are never lowered by this.
+      - name: Performance floor gate
+        if: matrix.name == 'app'
+        timeout-minutes: 10
+        run: ./scripts/check-perf-floors.sh perf-output.log
+
+      # Informational only: surfaces per-file and total line coverage in the
+      # job log so coverage trends are visible on every PR. No thresholds —
+      # this must never be the reason a build goes red.
+      - name: Coverage summary
+        run: |
+          BIN_PATH=$(swift build --show-bin-path --package-path ${{ matrix.path }})
+          PROF="$BIN_PATH/codecov/default.profdata"
+          XCTEST=$(find "$BIN_PATH" -maxdepth 1 -name '*.xctest' | head -1)
+          BINARY="$XCTEST/Contents/MacOS/$(basename "$XCTEST" .xctest)"
+          if [ -f "$PROF" ] && [ -f "$BINARY" ]; then
+            xcrun llvm-cov report "$BINARY" -instr-profile "$PROF" \
+              -ignore-filename-regex='(Tests|\.build|checkouts|Mocks|_PreviewHelpers)' || true
+          else
+            echo "No coverage data found; skipping summary."
+          fi
+
+  # SPM tests above only compile the macOS slice; this job covers the
+  # iOS-conditional code paths (UIKit, CoreBluetooth restoration, etc.).
+  ios-build:
+    name: Build iOS app (simulator)
+    runs-on: macos-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Build iOS (simulator, no signing)
+        # arm64 only: the vendored arti.xcframework has no x86_64 simulator slice.
+        run: |
+          set -o pipefail
+          xcodebuild -project bitchat.xcodeproj \
+            -scheme "bitchat (iOS)" \
+            -sdk iphonesimulator \
+            -destination 'generic/platform=iOS Simulator' \
+            ARCHS=arm64 \
+            CODE_SIGNING_ALLOWED=NO \
+            build
+
+  # Advisory only: SwiftLint reports style violations without ever failing the
+  # build. Runs in a pinned container (no Xcode plugin, no pbxproj changes) so
+  # it can never break the documented xcodebuild path or block a merge.
+  lint:
+    name: SwiftLint (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # This job runs a third-party container image, so give it the least
+    # privilege we can: a read-only token, and no credentials left in the
+    # checkout for the container to find.
+    permissions:
+      contents: read
+    container:
+      # Tag for readability, digest for immutability (tags can be repointed).
+      # Bump both together, deliberately — never a floating tag.
+      image: ghcr.io/realm/swiftlint:0.65.0@sha256:a482729f4b58741875af1566f23397f3f6db300372756fc31606d0a4527fab9e
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - name: Run SwiftLint
+        run: swiftlint lint --reporter github-actions-logging

.gitignore

@@ -8,9 +8,7 @@ plans/
 ## AI
 CLAUDE.md
 AGENTS.md
-
-## User settings
-xcuserdata/
+.claude/
 
 ## compatibility with Xcode 8 and earlier (ignoring not required starting Xcode 9)
 *.xcscmblueprint
@@ -57,7 +55,8 @@ iOSInjectionProject/
 
 ## Xcode project
 *.xcodeproj/project.xcworkspace/
-*.xcodeproj/xcshareddata/
+## Xcode User settings
+xcuserdata/
 
 ## Python
 __pycache__/
@@ -68,6 +67,16 @@ __pycache__/
 *.tmp
 *.temp
 
+## Cache
+.cache/
+
 # Local build results
 .Result*/
 .Result*.xcresult/
+TestResult.xcresult/
+*.xcresult/
+build.log
+*.log
+
+# Local configs
+Local.xcconfig

.swiftlint.yml

@@ -0,0 +1,33 @@
+# Build artifacts and generated sources; keeps local `swiftlint` runs clean
+# (CI checkouts are fresh, so this only matters in a working tree).
+excluded:
+  - .build
+  - .swiftpm
+  - .DerivedData
+  - DerivedData
+  - build
+  - localPackages/*/.build
+
+disabled_rules:
+  - line_length
+  - type_name
+  - identifier_name
+  - statement_position
+  - implicit_optional_initialization
+  - force_try
+  - vertical_whitespace
+  - for_where
+  - control_statement
+  - void_function_in_ternary
+  - redundant_discardable_let  # SwiftUI breaks without it
+  # To be enabled as we fix the issues
+  - trailing_whitespace
+  - cyclomatic_complexity
+  - function_body_length
+  - function_parameter_count
+  - type_body_length
+  - file_length
+  - large_tuple
+  - force_cast
+  - multiple_closures_with_trailing_closure
+  - nesting

BRING_THE_NOISE.md

@@ -37,7 +37,7 @@ This three-message pattern provides:
 #### NoiseEncryptionService
 The main service managing all Noise operations:
 ```swift
-class NoiseEncryptionService {
+final class NoiseEncryptionService {
     private let staticIdentityKey: Curve25519.KeyAgreement.PrivateKey
     private let sessionManager: NoiseSessionManager
     private let channelEncryption = NoiseChannelEncryption()
@@ -47,7 +47,7 @@ class NoiseEncryptionService {
 #### NoiseSession
 Individual session state for each peer:
 ```swift
-class NoiseSession {
+final class NoiseSession {
     private var handshakeState: NoiseHandshakeState?
     private var sendCipher: NoiseCipherState?
     private var receiveCipher: NoiseCipherState?
@@ -58,7 +58,7 @@ class NoiseSession {
 #### NoiseSessionManager
 Thread-safe session management:
 ```swift
-class NoiseSessionManager {
+final class NoiseSessionManager {
     private var sessions: [String: NoiseSession] = [:]
     private let sessionsQueue = DispatchQueue(label: "noise.sessions", attributes: .concurrent)
 }

Configs/Debug.xcconfig

@@ -0,0 +1,4 @@
+#include "Release.xcconfig"
+
+// Optional include of local configs
+#include? "Local.xcconfig"

Configs/Local.xcconfig.example

@@ -0,0 +1,5 @@
+// Your Apple Developer Team ID - https://stackoverflow.com/a/18727947
+DEVELOPMENT_TEAM = ABC123
+
+// Unique bundle id to be able to register and run locally
+PRODUCT_BUNDLE_IDENTIFIER = chat.bitchat.$(DEVELOPMENT_TEAM)

Configs/Release.xcconfig

@@ -0,0 +1,12 @@
+MARKETING_VERSION = 1.5.4
+CURRENT_PROJECT_VERSION = 1
+
+IPHONEOS_DEPLOYMENT_TARGET = 16.0
+MACOSX_DEPLOYMENT_TARGET = 13.0
+SWIFT_VERSION = 5.0
+
+DEVELOPMENT_TEAM = L3N5LHJD5Y
+CODE_SIGN_STYLE = Automatic
+
+PRODUCT_BUNDLE_IDENTIFIER = chat.bitchat
+APP_GROUP_ID = group.chat.bitchat

Justfile

@@ -14,16 +14,16 @@ default:
 # Check prerequisites
 check:
     @echo "Checking prerequisites..."
-    @command -v xcodegen >/dev/null 2>&1 || (echo "❌ XcodeGen not found. Install with: brew install xcodegen" && exit 1)
-    @command -v xcodebuild >/dev/null 2>&1 || (echo "❌ Xcode not found. Install Xcode from App Store" && exit 1)
-    @security find-identity -v -p codesigning | grep -q "Developer ID" || (echo "⚠️  No Developer ID found - code signing may fail" && exit 0)
+    @command -v xcodebuild >/dev/null 2>&1 || (echo "❌ xcodebuild not found. Install Xcode from App Store" && exit 1)
+    @xcode-select -p | grep -q "Xcode.app" || (echo "❌ Full Xcode required, not just command line tools. Install from App Store and run:\n   sudo xcode-select -s /Applications/Xcode.app/Contents/Developer" && exit 1)
+    @test -d "/Applications/Xcode.app" || (echo "❌ Xcode.app not found in Applications folder. Install from App Store" && exit 1)
+    @xcodebuild -version >/dev/null 2>&1 || (echo "❌ Xcode not properly configured. Try:\n   sudo xcode-select -s /Applications/Xcode.app/Contents/Developer" && exit 1)
+    @security find-identity -v -p codesigning | grep -q "Apple Development\|Developer ID" || (echo "⚠️  No Developer ID found - code signing may fail" && exit 0)
     @echo "✅ All prerequisites met"
 
 # Backup original files
 backup:
     @echo "Backing up original project configuration..."
-    @cp project.yml project.yml.backup 2>/dev/null || true
-    @# Backup other files that get modified by xcodegen
     @if [ -f bitchat.xcodeproj/project.pbxproj ]; then cp bitchat.xcodeproj/project.pbxproj bitchat.xcodeproj/project.pbxproj.backup; fi
     @if [ -f bitchat/Info.plist ]; then cp bitchat/Info.plist bitchat/Info.plist.backup; fi
 
@@ -44,13 +44,8 @@ patch-for-macos: backup
     @# Move iOS-specific files out of the way temporarily
     @if [ -f bitchat/LaunchScreen.storyboard ]; then mv bitchat/LaunchScreen.storyboard bitchat/LaunchScreen.storyboard.ios; fi
 
-# Generate Xcode project with patches
-generate: patch-for-macos
-    @echo "Generating Xcode project..."
-    @xcodegen generate
-
 # Build the macOS app
-build: check generate
+build: #check generate
     @echo "Building BitChat for macOS..."
     @xcodebuild -project bitchat.xcodeproj -scheme "bitchat (macOS)" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build
 
@@ -75,9 +70,7 @@ clean: restore
 # Quick run without cleaning (for development)
 dev-run: check
     @echo "Quick development build..."
-    @if [ ! -f project.yml.backup ]; then just patch-for-macos; fi
-    @xcodegen generate
-    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat (macOS)" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build
+    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat_macOS" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build
     @find ~/Library/Developer/Xcode/DerivedData -name "bitchat.app" -path "*/Debug/*" -not -path "*/Index.noindex/*" | head -1 | xargs -I {} open "{}"
 
 # Show app info
@@ -106,11 +99,9 @@ nuke:
     @echo "🧨 Nuclear clean - removing all build artifacts and backups..."
     @rm -rf ~/Library/Developer/Xcode/DerivedData/bitchat-* 2>/dev/null || true
     @rm -rf bitchat.xcodeproj 2>/dev/null || true
-    @rm -f project.yml.backup 2>/dev/null || true
-    @rm -f project-macos.yml 2>/dev/null || true
     @rm -f bitchat.xcodeproj/project.pbxproj.backup 2>/dev/null || true
     @rm -f bitchat/Info.plist.backup 2>/dev/null || true
     @# Restore iOS-specific files if they were moved
     @if [ -f bitchat/LaunchScreen.storyboard.ios ]; then mv bitchat/LaunchScreen.storyboard.ios bitchat/LaunchScreen.storyboard; fi
-    @git checkout -- project.yml bitchat.xcodeproj/project.pbxproj bitchat/Info.plist 2>/dev/null || echo "⚠️  Not a git repo or no changes to restore"
+    @git checkout bitchat.xcodeproj/project.pbxproj bitchat/Info.plist 2>/dev/null || echo "⚠️  Not a git repo or no changes to restore"
     @echo "✅ Nuclear clean complete"

PRIVACY_POLICY.md

@@ -1,6 +1,6 @@
 # bitchat Privacy Policy
 
-*Last updated: January 2025*
+*Last updated: June 2026*
 
 ## Our Commitment
 
@@ -9,7 +9,7 @@ bitchat is designed with privacy as its foundation. We believe private communica
 ## Summary
 
 - **No personal data collection** - We don't collect names, emails, or phone numbers
-- **No servers** - Everything happens on your device and through peer-to-peer connections
+- **No accounts or company servers** - Mesh chat works peer-to-peer; optional Nostr features use public or user-selected relays
 - **No tracking** - We have no analytics, telemetry, or user tracking
 - **Open source** - You can verify these claims by reading our code
 
@@ -17,11 +17,11 @@ bitchat is designed with privacy as its foundation. We believe private communica
 
 ### On Your Device Only
 
-1. **Identity Key** 
-   - A cryptographic key generated on first launch
+1. **Identity Keys**
+   - Cryptographic private keys generated on first launch or when optional Nostr identities are created
    - Stored locally in your device's secure storage
    - Allows you to maintain "favorite" relationships across app restarts
-   - Never leaves your device
+   - Private keys never leave your device; public keys are shared when needed for messaging
 
 2. **Nickname**
    - The display name you choose (or auto-generated)
@@ -38,12 +38,19 @@ bitchat is designed with privacy as its foundation. We believe private communica
    - Stored only on your device
    - Allows you to recognize these peers in future sessions
 
+5. **Optional Location Channel State**
+   - Your selected geohash channel, bookmarked geohashes, teleport flags, and bookmark display names
+   - Stored locally on your device so the location-channel UI can restore your choices
+   - Per-geohash Nostr identities are derived locally from a device seed stored in secure storage
+   - Exact latitude and longitude are not persisted by bitchat
+
 ### Temporary Session Data
 
 During each session, bitchat temporarily maintains:
 - Active peer connections (forgotten when app closes)
 - Routing information for message delivery
 - Cached messages for offline peers (12 hours max)
+- Your current location while optional location channels are enabled, used locally to compute geohash channels and friendly place names
 
 ## What Information is Shared
 
@@ -62,13 +69,21 @@ When you join a password-protected room:
 - Your nickname appears in the member list
 - Room owners can see you've joined
 
+### With Nostr Relays (Optional Features)
+
+If you enable Nostr-backed features:
+- Private fallback messages to mutual favorites are sent as encrypted NIP-17 gift wraps. Relays can see event metadata, but not message content.
+- Public location-channel messages, location notes, and presence are scoped with geohash tags. Relays and other participants can see the geohash tag, event kind, timestamp, and public key used for that geohash.
+- Exact GPS coordinates are not included in Nostr events by bitchat. The geohash precision you choose can still reveal an approximate area, from region-level to building-level.
+- Automatic presence heartbeats are limited to low-precision geohashes (region, province, and city). More precise geohash posts happen only when you use those channels or location notes.
+
 ## What We DON'T Do
 
 bitchat **never**:
 - Collects personal information
-- Tracks your location
-- Stores data on servers
-- Shares data with third parties
+- Sells or shares your exact GPS location
+- Stores data on servers we operate
+- Sells your data to advertisers or data brokers
 - Uses analytics or telemetry
 - Creates user profiles
 - Requires registration
@@ -84,19 +99,27 @@ All private messages use end-to-end encryption:
 ## Your Rights
 
 You have complete control:
-- **Delete Everything**: Triple-tap the logo to instantly wipe all data
-- **Leave Anytime**: Close the app and your presence disappears
-- **No Account**: Nothing to delete from servers because there are none
-- **Portability**: Your data never leaves your device unless you export it
+- **Delete Local State**: Triple-tap the logo to instantly wipe local keys, sessions, caches, and preferences
+- **Leave Anytime**: Close the app and local presence stops; relay-backed presence ages out
+- **No Account**: No account record exists for you to delete from us
+- **Portability**: Your local state stays on your device unless you send messages, use optional relay-backed features, or export it
 
 ## Bluetooth & Permissions
 
 bitchat requires Bluetooth permission to function:
 - Used only for peer-to-peer communication
-- No location data is accessed or stored
 - Bluetooth is not used for tracking
 - You can revoke this permission at any time in system settings
 
+## Location Permission
+
+Location permission is optional and is used only for location channels:
+- Used to compute local geohash channels and display names
+- Requested as when-in-use permission
+- Exact coordinates are not shared in messages or stored by bitchat
+- Selected and bookmarked geohashes may persist locally until you remove them, use panic wipe, or delete the app
+- You can revoke this permission at any time in system settings
+
 ## Children's Privacy
 
 bitchat does not knowingly collect information from children. The app has no age verification because it collects no personal information from anyone.
@@ -106,12 +129,15 @@ bitchat does not knowingly collect information from children. The app has no age
 - **Messages**: Deleted from memory when app closes (unless room retention is enabled)
 - **Identity Key**: Persists until you delete the app
 - **Favorites**: Persist until you remove them or delete the app
+- **Location channel choices**: Selected/bookmarked geohashes persist locally until removed, panic-wiped, or the app is deleted
+- **Nostr relay data**: Public geohash events and encrypted gift wraps may be retained by relays according to each relay's policy
 - **Everything Else**: Exists only during active sessions
 
 ## Security Measures
 
 - All communication is encrypted
-- No data transmitted to servers (there are none)
+- No accounts or company servers
+- Optional Nostr relays receive only the events needed for Nostr-backed private fallback or public location channels
 - Open source code for public audit
 - Regular security updates
 - Cryptographic signatures prevent tampering
@@ -121,7 +147,7 @@ bitchat does not knowingly collect information from children. The app has no age
 If we update this policy:
 - The "Last updated" date will change
 - The updated policy will be included in the app
-- No retroactive changes can affect data (since we don't collect any)
+- No retroactive changes can make us collect data already held only in your app
 
 ## Contact
 
@@ -132,7 +158,7 @@ bitchat is an open source project. For privacy questions:
 
 ## Philosophy
 
-Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no servers, no surveillance. Just people talking freely.
+Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no company servers, no analytics. Just people talking freely.
 
 ---
 

Package.swift

@@ -4,6 +4,7 @@ import PackageDescription
 
 let package = Package(
     name: "bitchat",
+    defaultLocalization: "en",
     platforms: [
         .iOS(.v16),
         .macOS(.v13)
@@ -12,25 +13,58 @@ let package = Package(
         .executable(
             name: "bitchat",
             targets: ["bitchat"]
-        ),
+        )
     ],
-    dependencies:[
-        .package(url: "https://github.com/21-DOT-DEV/swift-secp256k1", exact: "0.21.1"),
+    dependencies: [
+        .package(path: "localPackages/Arti"),
+        .package(path: "localPackages/BitFoundation"),
+        .package(path: "localPackages/BitLogger"),
+        .package(url: "https://github.com/21-DOT-DEV/swift-secp256k1", exact: "0.21.1")
     ],
     targets: [
         .executableTarget(
             name: "bitchat",
             dependencies: [
-                .product(name: "P256K", package: "swift-secp256k1")
+                .product(name: "P256K", package: "swift-secp256k1"),
+                .product(name: "BitFoundation", package: "BitFoundation"),
+                .product(name: "BitLogger", package: "BitLogger"),
+                .product(name: "Tor", package: "Arti")
             ],
             path: "bitchat",
             exclude: [
                 "Info.plist",
                 "Assets.xcassets",
+                "_PreviewHelpers/PreviewAssets.xcassets",
                 "bitchat.entitlements",
                 "bitchat-macOS.entitlements",
-                "LaunchScreen.storyboard"
+                "LaunchScreen.storyboard",
+                "ViewModels/Extensions/README.md"
+            ],
+            resources: [
+                .process("Localizable.xcstrings")
             ]
         ),
+        .testTarget(
+            name: "bitchatTests",
+            dependencies: [
+                "bitchat",
+                .product(name: "BitFoundation", package: "BitFoundation")
+            ],
+            path: "bitchatTests",
+            exclude: [
+                "Info.plist",
+                "README.md",
+                // CI perf gate data (read by scripts/check-perf-floors.sh),
+                // not a test resource.
+                "Performance/perf-floors.json"
+            ],
+            resources: [
+                .process("Localization"),
+                // Only the vector fixture: declaring the whole "Noise"
+                // directory would claim its .swift test files as resources
+                // and silently drop them from compilation.
+                .process("Noise/NoiseTestVectors.json")
+            ]
+        )
     ]
 )

README.md

@@ -2,87 +2,121 @@
 
 ## bitchat
 
-A decentralized peer-to-peer messaging app that works over Bluetooth mesh networks. No internet required, no servers, no phone numbers. It's the side-groupchat. 
+A decentralized peer-to-peer messaging app with dual transport architecture: local Bluetooth mesh networks for offline communication and internet-based Nostr protocol for global reach. No accounts, no phone numbers, no central servers. It's the side-groupchat.
 
 [bitchat.free](http://bitchat.free)
 
 📲 [App Store](https://apps.apple.com/us/app/bitchat-mesh/id6748219622)
 
-> [!WARNING]
-> Private messages have not received external security review and may contain vulnerabilities. Do not use for sensitive use cases, and do not rely on its security until it has been reviewed. Now uses the [Noise Protocol](http://www.noiseprotocol.org) for identity and encryption. Public local chat (the main feature) has no security concerns. 
-
-
 ## License
 
 This project is released into the public domain. See the [LICENSE](LICENSE) file for details.
 
-
 ## Features
 
+- **Dual Transport Architecture**: Bluetooth mesh for offline + Nostr protocol for internet-based messaging
+- **Location-Based Channels**: Geographic chat rooms using geohash coordinates over global Nostr relays
+- **Intelligent Message Routing**: Automatically chooses best transport (Bluetooth → Nostr fallback)
 - **Decentralized Mesh Network**: Automatic peer discovery and multi-hop message relay over Bluetooth LE
 - **Privacy First**: No accounts, no phone numbers, no persistent identifiers
-- **Private Message End-to-End Encryption**: [Noise Protocol](http://noiseprotocol.org)
+- **Private Message End-to-End Encryption**: [Noise Protocol](https://noiseprotocol.org) for mesh, NIP-17 for Nostr
 - **IRC-Style Commands**: Familiar `/slap`, `/msg`, `/who` style interface
 - **Universal App**: Native support for iOS and macOS
 - **Emergency Wipe**: Triple-tap to instantly clear all data
 - **Performance Optimizations**: LZ4 message compression, adaptive battery modes, and optimized networking
 
-
 ## [Technical Architecture](https://deepwiki.com/permissionlesstech/bitchat)
 
-### Binary Protocol
-bitchat uses an efficient binary protocol optimized for Bluetooth LE:
-- Compact packet format with 1-byte type field
-- TTL-based message routing (max 7 hops)
-- Automatic fragmentation for large messages
-- Message deduplication via unique IDs
+BitChat uses a **hybrid messaging architecture** with two complementary transport layers:
 
-### Mesh Networking
-- Each device acts as both client and peripheral
-- Automatic peer discovery and connection management
-- Adaptive duty cycling for battery optimization
+### Bluetooth Mesh Network (Offline)
+
+- **Local Communication**: Direct peer-to-peer within Bluetooth range
+- **Multi-hop Relay**: Messages route through nearby devices (max 7 hops)
+- **No Internet Required**: Works completely offline in disaster scenarios
+- **Noise Protocol Encryption**: End-to-end encryption with forward secrecy
+- **Binary Protocol**: Compact packet format optimized for Bluetooth LE constraints
+- **Automatic Discovery**: Peer discovery and connection management
+- **Adaptive Power**: Battery-optimized duty cycling
+
+### Nostr Protocol (Internet)
+
+- **Global Reach**: Connect with users worldwide via internet relays
+- **Location Channels**: Geographic chat rooms using geohash coordinates
+- **290+ Relay Network**: Distributed across the globe for reliability
+- **NIP-17 Encryption**: Gift-wrapped private messages for internet privacy
+- **Ephemeral Keys**: Fresh cryptographic identity per geohash area
+
+### Channel Types
+
+#### `mesh #bluetooth`
+
+- **Transport**: Bluetooth Low Energy mesh network
+- **Scope**: Local devices within multi-hop range
+- **Internet**: Not required
+- **Use Case**: Offline communication, protests, disasters, remote areas
+
+#### Location Channels (`block #dr5rsj7`, `neighborhood #dr5rs`, `country #dr`)
+
+- **Transport**: Nostr protocol over internet
+- **Scope**: Geographic areas defined by geohash precision
+  - `block` (7 chars): City block level
+  - `neighborhood` (6 chars): District/neighborhood
+  - `city` (5 chars): City level
+  - `province` (4 chars): State/province
+  - `region` (2 chars): Country/large region
+- **Internet**: Required (connects to Nostr relays)
+- **Use Case**: Location-based community chat, local events, regional discussions
+
+### Direct Message Routing
+
+Private messages use **intelligent transport selection**:
+
+1. **Bluetooth First** (preferred when available)
+
+   - Direct connection with established Noise session
+   - Fastest and most private option
+
+2. **Nostr Fallback** (when Bluetooth unavailable)
+
+   - Uses recipient's Nostr public key
+   - NIP-17 gift-wrapping for privacy
+   - Routes through global relay network
+
+3. **Smart Queuing** (when neither available)
+   - Messages queued until transport becomes available
+   - Automatic delivery when connection established
 
 For detailed protocol documentation, see the [Technical Whitepaper](WHITEPAPER.md).
 
-
 ## Setup
 
-### Option 1: Using XcodeGen (Recommended)
+### Option 1: Using Xcode
 
-1. Install XcodeGen if you haven't already:
-   ```bash
-   brew install xcodegen
-   ```
-
-2. Generate the Xcode project:
    ```bash
    cd bitchat
-   xcodegen generate
-   ```
-
-3. Open the generated project:
-   ```bash
    open bitchat.xcodeproj
    ```
 
-### Option 2: Using Swift Package Manager
+   To run on a device there're a few steps to prepare the code:
+   - Clone the local configs: `cp Configs/Local.xcconfig.example Configs/Local.xcconfig`
+   - Add your Developer Team ID into the newly created `Configs/Local.xcconfig`
+      - Bundle ID would be set to `chat.bitchat.<team_id>` (unless you set to something else)
+   - Entitlements need to be updated manually (TODO: Automate):
+      - Search and replace `group.chat.bitchat` with `group.<your_bundle_id>` (e.g. `group.chat.bitchat.ABC123`)
+
+### Option 2: Using `just`
 
-1. Open the project in Xcode:
    ```bash
-   cd bitchat
-   open Package.swift
+   brew install just
    ```
 
-2. Select your target device and run
-
-### Option 3: Manual Xcode Project
-
-1. Open Xcode and create a new iOS/macOS App
-2. Copy all Swift files from the `bitchat` directory into your project
-3. Update Info.plist with Bluetooth permissions
-4. Set deployment target to iOS 16.0 / macOS 13.0
-
-### Option 4: just
-
-Want to try this on macos: `just run` will set it up and run from source. 
+Want to try this on macos: `just run` will set it up and run from source.
 Run `just clean` afterwards to restore things to original state for mobile app building and development.
+
+## Localization
+
+- Base app resources live under `bitchat/Localization/Base.lproj/`. Add new copy to `Localizable.strings` and plural rules to `Localizable.stringsdict`.
+- Share extension strings are separate in `bitchatShareExtension/Localization/Base.lproj/Localizable.strings`.
+- Prefer keys that describe intent (`app_info.features.offline.title`) and reuse existing ones where possible.
+- Run `xcodebuild -project bitchat.xcodeproj -scheme "bitchat (macOS)" -configuration Debug CODE_SIGNING_ALLOWED=NO build` to compile-check any localization updates.

TestResult.xcresult/Data/data.0~-7fULinyfVkUrwXYGQcyd7_jDfA2DCJXOZHH0L2va894k6XuKecym0YBlxbYd0uoSMywlHQYHGMW3I9r6kqr0w==

@@ -1 +0,0 @@
-[{"type":1,"name":"C5C67AE61A322FBBC90B5C8FE31F44"}]

TestResult.xcresult/Data/data.0~-PeLX4WM386Z30felXAXxVYXyvHsfu-BuPbA2Irwe4dCepXJJr0hSe3mMbinGtl71s1W4HI1v_sox8vHChcJhQ==

@@ -1 +0,0 @@
-[{"type":1,"name":"E76911D1F63AFE862FE85FDD58BA22"}]

TestResult.xcresult/Data/data.0~-u26J_w3qM-ZXDihjicaAGm5KmrzTwsXRtKWpuZ7OJW9aD_1zSOorU2Thpo4ZWovXj6XCXLI5a3gH_hIQ1BtRg==

@@ -1 +0,0 @@
-[{"name":"2A06FD9C403255A7D7F7DD4C1D5411","type":1}]

TestResult.xcresult/Data/data.0~0RB4-HoshnNVYUoZYP6xUSYm7CABsubQF9jBVvbia00kObT8HggmI1tV-REqlAO3-HT7WN1tC-qN2W64RYoVgw==

@@ -1 +0,0 @@
-[{"name":"2B2DF013CC35109F0E84824218C371","type":1}]

TestResult.xcresult/Data/data.0~2NVoKS1u9uA1ANFtlcHmt1jmjJFc4DehZWxtP4uW89iadSaRXIlkvvXz2igcpsRIG-mLfXpAktCf93UkXO_tKg==

@@ -1 +0,0 @@
-[{"name":"272A5ACD643F35A14D9D0C7D97FDBD","type":1}]

TestResult.xcresult/Data/data.0~2owYXqPLavzm7RLYG6qmmrxKR5IlZTI3rQrcYZHCV4r_CnxaOJt8jVAYw6bCvDqKIwfTOLMLgaQOYzfHOe-rZg==

@@ -1 +0,0 @@
-[{"name":"02A2B24D353061AA8ED3B5CAE135FA","type":1}]

TestResult.xcresult/Data/data.0~3FZIBUmR9Jugwg5zV4dqBEHFUpztw_sAxpLJK0W8nubuSLorPW5UMY2X5tMXngzg1qVIxINr4fbex8EwyOxmeA==

@@ -1 +0,0 @@
-[{"name":"1846F3D1223CD89DB37574063303CC","type":1}]

TestResult.xcresult/Data/data.0~3Tzkb-MsY88-XkSPqt-U--iCrdHj0eevlNixse5tUz_jC7ksUkYTPzgAa0bN-qo3N63FG6-b8x3obBeNlirpRQ==

@@ -1 +0,0 @@
-[{"name":"298FB4DD003C4885F92C170D32954D","type":1}]

TestResult.xcresult/Data/data.0~3nOUZeIKWBVAiUd_Mz6imt2O5J2nEH__Crma0W6G39hKQwgdZwRJrXca1L_X4jcKLzzTBR3eoa6TTK4Vm1hduQ==

@@ -1 +0,0 @@
-[{"name":"6250CA76F834A1AB8ADA7C2BF60804","type":1}]

TestResult.xcresult/Data/data.0~4VqMqsI5lOfxRppnud6-VDWcNsU8J7VgFCJfW2dXPwOcAkvU-I8Um5yp9n0Zv6nr3VmcxYggaVMDFfR0U_vjKw==

@@ -1 +0,0 @@
-[]

TestResult.xcresult/Data/data.0~5-RBrzKX-WnfFZxVBQ30JfLx9YiSqcV06ZK_zCL-_TkkrlPGC53Tnk-PDRsDHcJCPrrZblAiPDN6bfdfcIihyg==

@@ -1 +0,0 @@
-[{"name":"16EB30938731948B7DE73214F4EF62","type":1}]

TestResult.xcresult/Data/data.0~6onpxd1jqudmB_v9Q7HLRsoaf_eiF0MHOe57HYntk9t-Tki94tZy5NaHHaOqqkJONO7Ss0EdXLsP4NkNUeldtQ==

@@ -1 +0,0 @@
-[{"type":1,"name":"18D4B812B33D1DAC12B7B9582F980A"}]

TestResult.xcresult/Data/data.0~7GwHIpoCCDqJ85jFHtn5Ky7nxbR32QT81gfd0HklgijpF9EMADyE2h7TyS4P0GPIl3dzU8moE578Eb9j49aGFg==

@@ -1 +0,0 @@
-[{"name":"8F8E36790E3B91AC0D6C1DE4AA4B84","type":1}]

TestResult.xcresult/Data/data.0~7KKHaCa0rHE817uJkKmBQuyDBDfim8CtqjHjpLK-0v_HnueqoVpoByp4cYv5KFeI9e3svhwF8n9WxeCrZMJAMQ==

@@ -1 +0,0 @@
-[{"type":1,"name":"7241625CC9378F9B48DF34B4275067"}]

TestResult.xcresult/Data/data.0~7N-Yqs0OkYfx4Z1fJ6CJSiO8fz6BrBC5OJ392iemK4BmhLKODyu1OcZeYQZsMMU5e5cMyql1twu0Diae8kFfSA==

@@ -1 +0,0 @@
-[{"name":"F70FD7F495326FAAF8F5F6678ECDB7","type":1}]

TestResult.xcresult/Data/data.0~7fCH17RaGH34dNhiHCST5cD9qRGeRAvEQXU6-DzldbQQS0loRSGW96dUD65C-gtHIQhp6OMaru0VCOEaHWNKNg==

@@ -1 +0,0 @@
-[{"name":"187DDE074D38699793B709B475FEA4","type":1}]