8.1 Peer-to-Peer QUIC Mesh & Visual Receipt Cards

chinwag mesh status --iroh-quic

Multi-machine agent coordination should not require every developer and CI container to install a privileged kernel VPN or share a corporate Tailscale tailnet.

chinwag-mesh (Apache-2.0) provides a zero-configuration, closed-room iroh QUIC P2P & 5-Rung Enterprise Proxy-Resilient Transport Mesh paired with Post-Quantum Hybrid E2EE (RFC 9180 HPKE + ML-KEM-1024 + XChaCha20-Poly1305), K1 + K2 Dual-Signature Hardware/Org Attestation (EXIT_K2_REQUIRED = 78), and the 3-Repo Chinwag Cryptographic Time Machine.

1. Closed-Room iroh QUIC P2P & K1 + K2 Dual-Signature Admission

Unlike consumer peer-to-peer overlays that publish node keys to the public BitTorrent Mainline DHT, chinwag-mesh enforces strict enterprise room isolation:

• Zero Public DHT Leak (RoomPeerSetGuard): Disables public pkarr / BitTorrent DHT publishing completely. Peer discovery is restricted strictly to your organization's verified roster epoch (VerifiedRosterEpochV1).
• Mandatory K1 + K2 Dual-Signature Gate (EXIT_K2_REQUIRED = 78): Every peer connection (TransferTicketV1, <= 60s TTL) and every mesh envelope (MeshEnvelopeOuterV1) must carry both:
  1. K1 (Origin Hardware / Seat Key): Signed by the sender's local Ed25519 hardware key or RAM-only CI key.
  2. K2 (Organization Coordinator Countersignature): Countersigned by your organization's edge coordinator after verifying active roster membership and epoch freshness.
  • Any connection or envelope missing a valid, non-expired K2 countersignature fails closed immediately with exit code 78 (EXIT_K2_REQUIRED) before HPKE decapsulation.
• Post-Quantum Hybrid E2EE (RFC 9180 HPKE): Payloads are compressed with zstd (bounded by a 16 MiB decompression cap) and sealed end-to-end using RFC 9180 HPKE (ML-KEM-1024 + X25519 + XChaCha20-Poly1305 / ChaCha20-Poly1305).

2. The 3-Repo Chinwag Cryptographic Time Machine (INV-CF-ARTIFACTS-TIME-MACHINE-01)

Every organization is provisioned three isolated, content-addressed Git repositories in the Chinwag Encrypted Artifact Store that together act as a Cryptographic Time Machine across code, trajectory steps, and security policy:

Five Native Cryptographic Time-Machine Capabilities

1. Zero-Copy Edge Repository Forking (repo.fork(...)): When chinwag fork-run --at-step N or a parallel Triad race (Builder vs. Reflex-1) runs, The Chinwag Encrypted Artifact Store spawns an instant zero-copy repository <org>/<project>--fork-<run_id>--step-<N>.git pinned to steps[N].project_worktree_oid so parallel agents never collide on HEAD (250 Credits per warm fork or teleport; 0 Credits for direct iroh QUIC P2P mesh & local loopback).
2. K1+K2-Gated Ephemeral art_v1_<TOKEN> Broker (repo.createToken('read' | 'write', ttl)): No client or CI runner ever holds a long-lived Git token. Quarantined fork PRs receive only a 5-minute read token (ttl = 300s); coding agents receive a 10-minute write token (ttl = 600s) scoped strictly to their own repo.fork() sandbox; chinwag-config.git write tokens (ttl = 120s) require a human K1 hardware passkey signature (with tiered 2-of-3 Senior quorum or 1 Head override + Head-Only Rollback for high-risk policy changes).
3. Zero-Egress Edge Bootstrap (chinwag tasks import --source <url>): Hydrates <org>/<project>.git directly at the Cloudflare edge from GitHub or GitLab with zero developer upload bandwidth.
4. Zero-Clone Edge File & Commit Inspection (repo.commits / repo.files): Inspects .chinwag/allowed_signers, chinwag.workflow.yaml, and .chinwag/regressions/*.json cassettes directly at the edge in <1 ms without git clone.
5. Instant readOnly: true Shroud Freeze (chinwag shroud): Immediately locks all organization repositories in the Chinwag Encrypted Artifact Store to readOnly: true and blocks all createToken minting during incident response or key rotation.

3. Enterprise Proxy-Resilient 5-Rung Transport & .cwcard.png Visual Receipt Cards

Corporate TLS inspection appliances and strict outbound firewalls often throttle raw UDP or long-lived WebSockets. chinwag-mesh (chinwag bridge) automatically selects the optimal enterprise-compliant transport path while preserving the exact same K1+K2 HPKE envelope:

+-----------------------------------------------------------------------------------+
| RUNG 1: Local Unix Domain Socket / Shared CRDB (.chinwag/bus.sock · <0.15ms)      |
+-----------------------------------------+-----------------------------------------+
                                          | (Cross-host peer detected)
                                          v
+-----------------------------------------------------------------------------------+
| RUNG 2: Direct Closed-Room iroh QUIC P2P (RoomPeerSetGuard · <8ms)                |
+-----------------------------------------+-----------------------------------------+
                                          | (UDP restricted by corporate firewall)
                                          v
+-----------------------------------------------------------------------------------+
| RUNG 3: Outbound WSS :443 Edge Relay (<18ms · K1+K2 Verify-Before-Decrypt)        |
+-----------------------------------------+-----------------------------------------+
                                          | (WebSocket upgrade filtered by proxy)
                                          v
+-----------------------------------------------------------------------------------+
| RUNG 4: HTTPS/2 & Chinwag 3-Repo Git Sync over Port 443 (<35ms)      |
+-----------------------------------------+-----------------------------------------+
                                          | (Asynchronous PR / Slack / Linear card)
                                          v
+-----------------------------------------------------------------------------------+
| RUNG 5: .cwcard.png Enterprise Proxy-Resilient Visual Receipt Card (<20ms unseal) |
+-----------------------------------------------------------------------------------+

.cwcard.png Visual Receipt Cards (chinwag-mesh stego-encode / stego-decode)

A .cwcard.png file is a standard, human-readable ISO/IEC 15948 PNG status scorecard (rendering build status, commit SHA, and ✓ed25519 badge) that simultaneously carries the signed, HPKE-encrypted diagnostic envelope via either:

• Mode A (StegoPngMode::AncillaryCwcd): Fast ancillary cWcd chunk carrier when proxies preserve custom PNG chunks.
• Mode B (StegoPngMode::IdatPixelPlane): Lossless RGBA scanline pixel-plane carrier that survives corporate MITM proxies, Slack, GitHub PR, and Linear image re-encoding when ancillary chunks are stripped.

Adaptive <= 310ms 5-Rung Transport Ladder & Profile Persistence in the Chinwag Encrypted Artifact Store (refs/chinwag/ladder-profiles/<net_hash> & refs/chinwag/stego-cards/<msg_id>)

• Cold Escalation (<= 310ms Total Budget): On a new network fingerprint (net_hash), chinwag-mesh probes Rung 1 → Rung 5 (60ms per blocked rung probe) and automatically detects whether an enterprise proxy strips PNG ancillary chunks (Mode A AncillaryCwcd vs. Mode B IdatPixelPlane RGBA scanlines), completing end-to-end delivery in <= 310ms.
• Warm Profile Jump (0ms Probe Overhead on Attempt #1): The Chinwag Encrypted Artifact Store caches the winning Rung + Stego-.png Mode (ArtifactsLadderProfileV1) at refs/chinwag/ladder-profiles/<net_hash> (and anchors visual receipt cards at refs/chinwag/stego-cards/<msg_id>) in <org>/chinwag-bus.git. Subsequent calls from any developer machine or CI runner on that network jump straight to the winning transport and Stego mode on Attempt #1 (0ms probe overhead).

# Probe enterprise proxy environment and cache the winning <= 310ms ladder profile:
chinwag-mesh bridge --env zscaler

# Encode or verify a signed .cwcard.png visual receipt card (Mode A cwcd or Mode B idat):
chinwag-mesh stego-encode --out run-1842.cwcard.png --mode idat --message "Run #1842 Verified"
chinwag-mesh stego-decode --in run-1842.cwcard.png

4. The Open chinwag ext Extension SDK (ExtEnvelopeV1)

Specialized team workflows, live voice rooms (warroom), encrypted workspace teleports (chinwag teleport), and tournament bridges (vault), run as OS-sandboxed out-of-process extensions (macOS Seatbelt / Linux Landlock ABI v4) over a signed ExtEnvelopeV1 boundary.

• Next: Reference Extensions: warroom & whisper
• Ready to connect agents securely across every machine? Reserve Your Organization Credit Pack →