Security Model

Authorization is cryptographic, short-lived, revocable, and fails closed. Transport is end-to-end encrypted; infrastructure provides reachability, never trust.

Non-negotiable rules

• Every remote Pipe open requires a short-lived, verifiable Access Lease. No lease, no open.
• An invite is never an Access Lease. Invites bootstrap a relationship exactly once; leases authorize every open.
• Connectivity depends on authorization, not topology. Scope membership or relay reachability alone grants nothing.
• Receiving boundary fails closed on invalid signature, wrong subject, wrong Pipe audience, expiry, revocation, stale authorization epoch, or unavailable revocation state.

Exact Pipe Authority

Each Pipe's dedicated authority key is bound to the owner by an Ed25519 owner binding embedded in every invite. The owner key and the authority key are distinct and neither can substitute for the other. Remote redemption sees only a read-only key loader — a remote peer can never provision authority material, switch subject or Pipe, or renew a relationship that never existed.

One-time redemption

An invite is single-use: the first successful redemption atomically records the accepted relationship and the anti-replay history; every later attempt with the same invite fails. Redemption requires a fresh challenge-response possession proof from the recipient's identity key. Invites can also be revoked before redemption (tubo revoke invite <token>) — the redemption boundary checks exactly that revocation row.

Short-lived leases and epochs

Access Leases live for minutes. The authority mints the first lease at redemption and fresh ones per open through the durable binding. Each lease carries the authorization epoch at which it was issued: a pipe-access revocation advances the epoch, making every earlier lease and accepted relationship stale immediately. A fresh share+accept at the new epoch re-authorizes — revocation is never a permanent kill switch for the owner.

Fail-closed dependencies

Revocation state, accepted-relationship state, and redemption persistence are mandatory: the open authorizer cannot even be constructed without revocation state, and redemption/renewal reject missing dependencies before any verification work. Unavailable state denies; it never allows.

Transport

• libp2p Noise-encrypted streams end to end; relays and caches never see plaintext and never authorize.
• After an authorized handshake, raw duplex bytes flow — no per-frame decode on the data plane, bound decoders on the control plane.
• Fresh challenge nonces on every open prevent replay; leases and sessions are bound to subject, Pipe audience, and epoch.

Host and identity hygiene

• Host identity files are created atomically under exclusive locks — concurrent processes converge on one identity; a corrupt identity key fails closed instead of silently rotating.
• Zero-config sharing trusts only an embedded, signed public bootstrap bundle with a pinned root and expiry — never a hardcoded provider path.
• Local services are never automatically public or discoverable.

Non-goals

• Tubo is not an anonymous network: relays see participant network identities.
• Session resume/migration is deferred (tracked, not shipped).
• Runtime trust-root rotation for the public bootstrap is future work; the current signed bundle is single-use by design.