The trusted circle and group transparency

Two rules run through this part of Pigeon: nobody is told anything about your account unless you choose them, and nobody in a group has powers or knowledge the others don't.

The trusted circle Built

Your trusted circle is a short list of people who are warned if your account is recovered or taken over, so someone notices if it wasn't you. They don't approve or vote on anything; they are only told.

Nobody is warned by default. The circle starts empty, and sign-up says so.
You pick specific people, the way you'd pick who sees your location.
No secret lists. A person is told when you add them (<name> added you to their trusted circle) and when you remove them, and can leave.
Everyone else who already shares a conversation with you sees at most Security keys changed on <date>. It's never public.

The list is stored in your own key history as keyed, salted tags, padded to a multiple of eight. Anyone reading that history learns that you have a circle, its size to the nearest eight, and when it changed: not who is in it.

Groups have no admins Built

A Pigeon group has no admin, owner or creator role. Every member can add or remove members, and every change is an MLS commit that every member sees. The desktop app's group screen is tested to have no role controls at all.

The trade-off is stated in the design: any member of a group can remove any other, visibly. A limit on how fast one member can remove others is under consideration Planned.

Security alerts in a group: opt-in and the same for everyone Built

Each group has a switch, “Show security alerts in this group”. It's off by default and its state is visible to all members.
Each member's yes or no is signed by that member's own app, so the server can't fake it.
Every member sees the same overview of who has opted in: one answer per member, the same for everyone.
Whatever the switch says, members always see when a device leaves the group.

If a member's app is older than the switch, the switch can't be turned on until they update.

What's built

The circle, the group switch and the overview are in the core and the command-line tool, and on the desktop: groups (create, remove a member, leave, the switch and the overview), and the circle screen. Adding a person to a group from the desktop waits for contact codes Planned.

Sources: ADR-0010 amendment 3 (rulings T1 to T7) and section (s) on the circle's storage, ADR-0006 amendment 5 (no group admin role), crates/pigeon-core/src/identity/circle.rs.