Open source / distributed messaging
Shared infrastructure.
Endpoint encryption.
EpochGrid combines NATS messaging infrastructure with MLS end-to-end group encryption. The fabric routes and stores messages. Devices hold the keys and read the content.
- Transport
- NATS + JetStream
- Encryption
- MLS via OpenMLS
- Implementation
- Rust · CLI + TUI
01 / Purpose
Why EpochGrid?
Separate the messaging fabric from the keys that make a conversation readable.
Infrastructure has a defined role
NATS handles routing, authentication and persistence. The identity service manages public registration metadata, without an application decryption path.
Group state stays at the edge
OpenMLS manages cryptographic membership. Independent device keys and authenticated Welcome messages connect directory identity to the group.
Failure is part of the workflow
Durable inboxes, a ciphertext outbox and local transactions support offline catch-up and tested process restart boundaries.
02 / Implementation
A working, deliberately scoped system
Identity and discovery
Independent NATS and MLS keys; signed registrations and operator-authorized enrollment.
Encrypted group messages
Authenticated Welcome joining and MLS PrivateMessages for the two-device development flow.
Durable delivery and history
JetStream ciphertext, retryable sends, local transcripts and offline catch-up.
A persistent terminal client
Channel navigation, message composition, history, unread counts and automatic reconnect.
Implemented describes repository code, not production readiness. Acceptance evidence (external) · Terminal client (external)
03 / Message path
One fabric. Distinct trust boundaries.
Content encryption, broker permissions and local storage provide different protections.
04 / Foundations
A small set of substantial building blocks
Build with the project
Start with the code. Help refine the boundaries.
Run the development flow, examine the threat model, or discuss a focused change with the maintainers.