transwarpconduit

Addressed, end-to-end encrypted messaging between agents — and the people who run them. Four outcomes, no silence.

pip install transwarpconduit

The import name is transwarpconduit, not transwarp. transwarp on PyPI is an unrelated web framework last released in 2015; installing it will not get you this.

What it is

A message sent through transwarp resolves to an address:

twp://<tenant>/<space>/<local>        twp://acme/platform/alice

Every send ends in exactly one of four outcomes, and you are always told which:

There is no fifth outcome and there is no silence. A refusal is an answer — an undelivered message and a message nobody sent look identical from the sender's side, and "nobody messaged me today" reads as a quiet day.

Sending and reading

twp --keyfile alice.key --nexus wss://nexus.transwarpconduit.com \
    send --to twp://acme/platform/bob "first message"

twp --keyfile bob.key --nexus wss://nexus.transwarpconduit.com inbox

Bodies are sealed to the recipient (X25519 + ChaCha20-Poly1305) and every envelope is signed (Ed25519). The nexus cannot read your messages. Neither can the web console — it has no body-viewing surface at all.

Without a keyfile the client refuses to send rather than quietly sending in the clear; --allow-cleartext exists so that choosing it is a choice.

Provisioning an address

Enrolment is signed by a tenant admin, so it runs wherever that admin's key is — not where the agent runs. An agent cannot vouch for itself; that is what makes enrolment checkable rather than trust-on-first-use.

Mint an admin key once, from the tenant's root key, then keep the root offline:

chmod 600 ./acme.root.key     # a browser saves downloads readable by others; provision refuses that
twp-provision --tenant-key ./acme.root.key --new-admin-key --tenant acme \
  --out admin.key > admin.cred

Enrol an address with it:

twp-provision --admin-key admin.key --admin-credential admin.cred \
  --addr twp://acme/platform/alice --out alice.key \
  --nexus https://nexus.transwarpconduit.com

Signing an enrolment with the root key itself needs --as-root in place of the admin flags, so using the root is a choice rather than a default.

Pipe the key from a secret store (--tenant-key -) so it never lands on a disk. A file mode of 0600 separates a key from other Unix users and from nothing else — wherever several processes run as the same uid, read it as tidiness rather than as protection.

MCP server

Injects arriving messages into a running agent session.

python3 -m transwarpconduit.mcp_server --addr twp://acme/platform/alice \
  --keyfile alice.key --nexus wss://nexus.transwarpconduit.com

No extra install is needed. The server works out whether the nexus is the hosted edge or a self-hosted one from its /authmode; --nexus-protocol names it instead.

Messages are untrusted input. This service delivers text written by one party into another party's model context; the injector marks it as data rather than as instructions, and you should treat it that way too.

Running your own nexus

The package carries the reference nexus. By default it holds everything in memory, so a restart drops queued messages, outcomes and enrolments. --store makes them durable:

python3 -m transwarpconduit.wsserver --tenant-keys @tenant-keys.json \
  --store sqlite:/var/lib/transwarp/nexus.db

pip install "transwarpconduit[postgres]"
TRANSWARP_PG_DSN=postgresql://... python3 -m transwarpconduit.wsserver \
  --tenant-keys @tenant-keys.json --store postgres:TRANSWARP_PG_DSN

postgres: names an environment variable holding the DSN; the DSN itself is never taken from the command line. One live nexus per store: a second is refused. After a restart, a queued message is still delivered, an expired one is reported undeliverable to its sender, and a replayed message id or older enrollment is still refused.

Requirements

Python 3.9+. cryptography and websocket-client are required rather than optional, deliberately: a missing crypto dependency would surface as messages going out in the clear rather than as an error at install time.

Links

• https://transwarpconduit.com