sturdyref = (node public key, service name). The service address IS the Ed25519 key
(iroh EndpointId); the service name travels in ALPN keywire/0/<name>. Payload bytes are
opaque — nash.actor 4-byte-BE JSON-RPC, syrup CapTP frames, MCP stdio all pass unmodified.
This is Bridge 2 of the OCapN buildout, replatformed: no tailnet, no DNS, no shared secret;
NAT traversal + relay fallback from iroh (QUIC, TLS 1.3).
peer A (bb/TS/Guile service on localhost TCP)
↑ tcp heterogeneous peers keep their wires
keywire serve <keyfile> nash=127.0.0.1:9999 ← owns key; prints keywire-node-id
↑ iroh QUIC (ALPN keywire/0/nash)
keywire connect 127.0.0.1:19999 <node-id> nash ← local TCP listener, key-addressed dial
↑ tcp
peer B (any client)
Toolchain: pixi global install rust (nix daemon was down; flox blocked). Build:
bb build.bb (uses ~/.pixi/bin/cargo, CARGO_HOME=~/.cargo-keywire). iroh 1.0.3
(0.35 FAILS: netwatch-0.5/socket2 drift). 1.0 API deltas: Endpoint::builder(presets::N0),
NodeId→EndpointId, SecretKey::generate() (no rng arg), ep.id(), conn.remote_id(),
conn.alpn() -> &[u8] on accepted conn.
bb frame-server :29999 ← serve ← iroh ← connect :29998 ← bb client, 4-byte-BE frames:
- +1 Play: response frame observed end-to-end
- 0 Witness: JSON-RPC id 42 round-trip closed
- −1 Coplay: byte-transparency refutation attempt — 128 KiB random blob,
server-side sha256 == client-side sha256 (
11aa9cff…) → refutation failed, transparency holds - Σ ≡ 0. Peer key visible server-side (
conn from 3d825e…= connect side's ephemeral key — authenticated peer identity for free; allowlist hook goes here).
Re-verified 2026-08-10: clean release build (iroh 1.0.3, 38s), E2E exit 0, sha
8b341046… equal both sides, GF3 {:play 1 :witness 0 :coplay -1 :sum 0}.
- cross-host: haiku.gay / dgx / second mac (this run was loopback; direct-vs-relay path unmeasured)
- keywire connect uses one QUIC conn; exits on conn loss (supervisor restarts)
- allowlist by remote_id (capability discipline: key = capability to dial, not yet to filter)