tibet-nc 0.1.0

Secure remote shell via Matrix E2EE — no ports, no TCP surface, TIBET L4 Airlock verification.

tibet-nc

PRE-ALPHA (v0.1.0a1) — NOT PRODUCTION READY

API, protocol, and security model are subject to change. Do not deploy in production environments.

Secure remote shell via Matrix E2EE — SSH without the attack surface.

What is tibet-nc?

tibet-nc replaces SSH/telnet with a remote shell that has no open ports, no TCP listener, and no discoverable attack surface. Commands are sent via Matrix (end-to-end encrypted) and every execution is a verified TIBET token.

Think of it as a speakeasy: there's no visible door. You need to know the Matrix room and have a verified TIBET identity to get in.

How it works

[Matrix Client] → E2EE message → [Matrix Server] → [tibet-nc daemon]
                                                        ↓
                                                   L4 Airlock
                                                   ├── Identity check
                                                   ├── Timebox check
                                                   ├── Command safety
                                                   └── Hash chain
                                                        ↓
                                                   Restricted PTY
                                                        ↓
                                                   Output + TIBET token
                                                        ↓
                                              [Matrix Client] ← E2EE

L4 Airlock Verification

Every command passes 4 layers before execution:

1. Identity — Matrix user must be in the allowed list
2. Timebox — Command must arrive within latency window for its DID type
3. Command safety — Blocked patterns (rm -rf /, dd if=, etc.) are rejected
4. Hash chain — SHA256 chain links every command to the previous one

What makes it different from SSH?

	SSH	tibet-nc
Open port	22 (scannable)	None
Protocol	TCP	Matrix E2EE
Auth	Keys/password	TIBET identity
Audit trail	auth.log	Full TIBET provenance per command
Command safety	None	L4 Airlock (blocked patterns)
Hash chain	None	SHA256 per session

Current status

• Matrix E2EE transport
• L4 Airlock verification
• Restricted PTY execution
• TIBET token per command
• Hash chain integrity
• Blocked dangerous commands
• Systemd service (DL360)
• Multi-device session management
• File transfer via Matrix
• Interactive mode (vim, top)
• PyPI release

Running (development)

The daemon currently runs from /srv/jtel-stack/tibet-nc/ as a systemd service. See the deployed instance for reference — package structure is being formalized.

License

MIT — Humotica AI Lab

Credits

Designed by Jasper van de Meent. Built by Jasper and Root AI as part of HumoticaOS.

---

Stack-positie: Groep experimental · Bootstrap = OSAPI-handshake naar tibet + jis (fail → snaft-rule + tibet-pol-rapport) · ← tibet-airlock · See STACK.md · See demo/golden-path/ for the spine end-to-end.

Enterprise

For private hub hosting, SLA support, custom integrations, or compliance guidance:

Enterprise	[e-mail]
Support	[e-mail]
Security	[e-mail]

See ENTERPRISE.md for details.