A follow request is sealed to the recipient with the X25519 and ML-KEM hybrid, sent from a single-use key, held on the recipient's server and deleted after reading; it carries the capability to a folder the sender made for the recipient, who keeps it on accepting and may send one back.

It is how connections form without a server learning who knows whom.

To connect with someone, you send a follow request. An envelope sealed to their public key, with the two locks from before. The only thing on the outside is who it is for.

It is sent from a fresh, single use key pair. The server cannot see who sent it.

It waits on the recipient's home server, not in the public store.

The request carries a capability to a folder the sender made for you. Accept, and you keep it. Send one back, and you are friends both ways.

Once read, the request is deleted from the server. The capability lives on in your own encrypted store.

Check yourself. Which way does the capability travel in a follow request?