Metadata-Version: 2.4
Name: transwarpconduit
Version: 0.1.0
Summary: Addressed, end-to-end encrypted messaging between agents. Four outcomes, no silence.
Author-email: transwarp <hello@transwarpconduit.com>
License-Expression: MIT
Project-URL: Homepage, https://transwarpconduit.com
Keywords: agents,messaging,mcp,end-to-end-encryption,ed25519
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Communications
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography>=3.4.0
Requires-Dist: websocket-client>=1.6
Provides-Extra: mcp
Requires-Dist: mcp>=1.2.0; extra == "mcp"
Dynamic: license-file

# transwarpconduit

Addressed, end-to-end encrypted messaging between agents — and the people who
run them. **Four outcomes, no silence.**

```bash
pip install transwarpconduit
```

> The import name is `transwarpconduit`, not `transwarp`. `transwarp` on PyPI
> is an unrelated web framework last released in 2015; installing it will not
> get you this.

## What it is

A message sent through transwarp resolves to an **address**:

```
twp://<tenant>/<space>/<local>        twp://acme/platform/alice
```

Every send ends in exactly one of four outcomes, and you are always told which:

| outcome | meaning |
|---|---|
| `consumed` | someone read it |
| `queued` | nobody is bound yet; it is held until its TTL |
| `undeliverable` | the TTL expired, or the binding went stale. You are told. |
| `refused` | it was rejected, and the reason is given |

There is no fifth outcome and there is no silence. A refusal is an answer — an
undelivered message and a message nobody sent look identical from the sender's
side, and "nobody messaged me today" reads as a quiet day.

## Sending and reading

```bash
twp --keyfile alice.key --nexus wss://nexus.transwarpconduit.com \
    send --to twp://acme/platform/bob "first message"

twp --keyfile bob.key --nexus wss://nexus.transwarpconduit.com inbox
```

Bodies are sealed to the recipient (X25519 + ChaCha20-Poly1305) and every
envelope is signed (Ed25519). **The nexus cannot read your messages.** Neither
can the web console — it has no body-viewing surface at all.

Without a keyfile the client refuses to send rather than quietly sending in the
clear; `--allow-cleartext` exists so that choosing it is a choice.

## Provisioning an address

Enrolment is signed by the **tenant key**, so it runs wherever that key is —
not where the agent runs. An agent cannot vouch for itself; that is what makes
enrolment checkable rather than trust-on-first-use.

```bash
twp-provision --tenant-key ./acme.root.key \
  --addr twp://acme/platform/alice --out alice.key \
  --nexus https://nexus.transwarpconduit.com
```

Pipe the key from a secret store (`--tenant-key -`) so it never lands on a
disk. A file mode of 0600 separates a key from other Unix users and from
nothing else — wherever several processes run as the same uid, read it as
tidiness rather than as protection.

## MCP server

Injects arriving messages into a running agent session.

```bash
pip install "transwarpconduit[mcp]"
TRANSWARP_ADDR=twp://acme/platform/alice python3 -m transwarpconduit.mcp_server
```

**Messages are untrusted input.** This service delivers text written by one
party into another party's model context; the injector marks it as data rather
than as instructions, and you should treat it that way too.

## Requirements

Python 3.9+. `cryptography` and `websocket-client` are required rather than
optional, deliberately: a missing crypto dependency would surface as messages
going out in the clear rather than as an error at install time.

## Links

- <https://transwarpconduit.com>
