Core Concepts

Tubo is a secure peer-to-peer connectivity and collaboration platform built from a small set of composable primitives.

The canonical model

Primitive	What it is
Service	A local application endpoint: HTTP, TCP, or Unix socket. Local, never automatically public or discoverable.
Pipe	A stable directed connectivity resource: `Ingress → Pipe → Target`. A Pipe target is exactly one Service or one other Pipe — Pipe-to-Pipe composition is fundamental.
Session	A concrete active traversal. Owns byte flow and continuity for one connection.
Identity	A stable cryptographic participant / resource-owner identity (Ed25519).
Scope	An optional collaboration/security domain. Never a prerequisite for connectivity.
Invite	The exact bootstrap/redemption credential. One-time, short-lived, owner-signed, bound to one Pipe.
Access Lease	Short-lived authorization to open one exact remote Pipe. Every remote open requires one.
Descriptor	Higher-level discoverable metadata referencing Pipes (e.g. agent cards) — future work.

The authorization rule

Every remote Pipe open requires a short-lived, cryptographically verifiable Access Lease. No Access Lease means no remote Pipe open. Pipe ID, endpoint, relay route, invite, or membership alone are insufficient — the receiving boundary fails closed on invalid signature, wrong subject, wrong Pipe audience, expiry, revocation, stale authorization epoch, or unavailable revocation state.

Exact Pipe Authority

Each Pipe has a dedicated authority key, bound to the Pipe owner by a signed owner binding. The authority is the only issuer of Access Leases for that Pipe: it validates invite redemption and possession proofs, records the accepted relationship, checks revocation and the current authorization epoch, and mints short-lived leases — at redemption, and per-open afterwards through renewal.

Durable accepted binding

Redeeming an invite establishes a durable accepted relationship between one Pipe and one recipient identity. It survives invite expiry, lease expiry, and restarts on both sides: reconnects and renewals derive fresh short-lived Access Leases from the binding without a new invite. A fresh invite for the same Pipe+recipient replaces the relationship (explicit re-authorization); revocation fences it until re-acceptance.

Separation of concerns

Discovery finds a resource. Connectivity reaches it. Authorization decides you may open it. They are always separate.
An exact invite bypasses discovery entirely — nothing about a shared Pipe is listed anywhere.
Relays, bootstrap providers, and caches provide reachability only — never ambient authorization.
Optional Scopes add coordination domains; connectivity never depends on Scope topology.

Growth path

The same primitives grow into scoped collaboration, signed Pipe discovery, private infrastructure, persistent connectivity, gateways, catalogs, MCP, A2A, and agent discovery. Tubo is not primarily a VPN, reverse proxy, service mesh, or centralized tunnel broker — those are compositions over Pipes.