Public HTML edition · 20 August 2026
Executive overview
M2 is an Android-first communication system for private, compartmented coordination when ordinary organizational or personal channels are inappropriate, unavailable, or too identifying. It is designed for high-exposure and national-security-adjacent operating conditions without presenting that design intent as an awarded certification.
The architecture coordinates four controls: participation without a global real-name account, endpoint encryption for communication content, Tor-routed access to a v3 Onion Service, and a temporary encrypted relay with delivery-triggered deletion and a 48-hour maximum for undelivered payloads.
Accountless operation and Channel identity
M2 does not require ordinary Channel participants to register a phone number, email address, or real-name identity. Instead, a Channel establishes an independent membership context. A participant can keep one operational compartment separate from another without creating a global public M2 profile that joins them together.
This is sometimes described as “zero knowledge” in identity-minimizing product language. In precise terms, it means the service minimizes centralized user identity data. It does not claim to implement a cryptographic zero-knowledge proof system.
Capability material
Signed invitation material and M2 Codes convey operational authority. They should be distributed deliberately, protected separately, and retired with the Channel’s purpose. The Channel model works best when groups are short-lived, well-defined, and not reused across unrelated activity.
Device-level confidentiality
M2 encrypts messages and supported files on the endpoint for intended recipients. The relay handles ciphertext rather than readable communication content, while local conversation context follows the client’s encrypted storage design.
Protected-file controls can reduce accidental export and keep supported material inside the intended experience. As with every endpoint system, information already visible to an authorized recipient can be recorded or copied outside the cryptographic boundary.
Tor and v3 Onion routing
Embedded Tor carries messaging traffic to an M2 v3 Onion Service. The messaging Gateway therefore does not receive a direct originating clearnet connection from the device. This separates the messaging application service from the device’s ordinary network origin and avoids exposing an Onion hostname in public website content.
The public Mirage Project website is different: it is served over ordinary HTTPS through Cloudflare. A website request reaches Cloudflare, and the first-party network-identity endpoint processes bounded IP-derived status fields with no-store behavior. These website functions are not described as Tor-routed messaging.
Authenticated receipt and temporary encrypted relay
The M2 Gateway temporarily relays encrypted payloads. Once a client produces authenticated durable receipt, the service initiates server-side ciphertext deletion. Payloads that remain undelivered expire after a hard maximum of 48 hours. Deleted communication content is excluded from the recovery-backup classification recorded for the current deployment.
This model is intentionally temporary: M2 is a coordination path, not a permanent archive. It limits server-side ciphertext lifetime while still allowing an intended recipient a bounded delivery window.
Signed software supply chain
The Android application uses a dedicated release authority separate from the marketing site. It verifies a trusted manifest, compatible package identity, increasing version, immutable APK SHA-256, and the established production signing certificate before Android asks the user to approve installation. The current signed predecessor-to-current update path has been exercised on a clean API 36 virtual device.
Operational use
M2 is strongest when the surrounding practice matches its compartmented design: protect endpoints, separate personal and operational identities where practical, keep invitation material controlled, and close Channels when their purpose ends. Use a separate system when regulations, evidence handling, or organizational policy require retained records.
Tor, endpoint encryption, and temporary relay handling materially reduce exposure, but no communication product can make an infected endpoint, an untrusted recipient, or every network observer disappear. M2 states those boundaries so teams can use its strengths in the right setting.
Current assurance scope
The current release publishes hashes, signer evidence, SBOM, provenance, source archive, third-party notices, and update-compatibility evidence. Automated and emulator verification is recorded. An independent third-party security audit and current-operation physical-device execution are not recorded as complete.