Komms

Sovereign messaging: end-to-end encrypted, server-independent at its core, and functional on & off the grid.

Messages no carrier or optional convenience service can read or scan. The core needs no provider and works over the internet, commodity LoRa radios, or a USB stick in a pocket.

New here? Read Start Here: the whole idea in plain words, with no cryptography knowledge required.

Install 0.1 Alpha for testing

Open the public Komms 0.1 Alpha release and download one package:

System	Choose
Windows 10/11 x64	.msi or -setup.exe
macOS Intel or Apple silicon	universal .dmg
Linux x86-64	.AppImage, .deb, or .rpm
Android 8.0+	-android-debug.apk

Download SHA256SUMS too. These are unsigned/debug-signed Alpha packages, so verify the download before accepting an operating-system warning. The Alpha testing guide has exact verification, installation, first-test, and issue-reporting steps. No source build is required. iOS currently remains source/Simulator-only.

Current implementation status

Komms 0.1 Alpha is a packaged public prerelease for testing, not an audited stable release. The current repository contains the complete server-independent messaging core and all three application shells:

Area	Current state
Core and internet/LAN delivery	M0–M3 are complete: hybrid PQXDH, Double Ratchet, sealed envelopes, encrypted storage, sneakernet, libp2p QUIC/TCP, Kademlia discovery, volunteer mailboxes, NAT traversal, mDNS, kult-node, kultd, local RPC, CLI, and UniFFI.
Off-grid delivery	The M4 Meshtastic carrier, duty-cycle enforcement, selective retransmission, and token-blind internet↔mesh bridge are implemented and tested. The physical two-radio nightly bench still needs to be stood up.
Applications	Tauri desktop packages are published for Windows x64, universal macOS, and Linux x86-64; a debug-signed Android APK supports Android 8+ on arm64 devices and x86-64 emulators. The SwiftUI iOS shell remains source/Simulator-only. Per-push CI exercises the core, desktop, generated bindings, Android APK, and iOS Simulator build. Production signing, store distribution, and hands-on device qualification remain.
Messaging features	Pairwise and sender-key group text, authenticated immutable message edits with inspectable version history, disappearing text, view-once attachments, fixed-electorate group polls, signed owner/admin/member authority, note-to-self, scheduled text, attachments, recorded audio, still-image editing, group mentions, and B9 safe text formatting are shipped through the shared APIs and all three shells. Poll votes and voter identities are visible to members—not anonymous—and converge under offline reorder; creators close ordinarily while the current owner can commit a separately signed moderation snapshot. C6 role changes, ownership transfer, and admin requests are owner-serialized, generation-bound, and re-key the group. C4 uses exact local deadlines, coarse authenticated relay deletion hints, terminal tombstones, and KKR6 backup exclusion without promising remote erasure or screenshot prevention. Edits converge without rewriting originals; formatting remains inert. Delivery state remains the honest queued → sent → delivered ladder.
Linked devices	C2 is shipped through the shared core, strict RPC/CLI, UniFFI, and all three shells: one stable account can authorize up to eight independently keyed devices through a mutually confirmed QR/paste ceremony. Pairwise sessions, group sender chains, capability state, and delivery rows remain per physical device; encrypted explicit sync converges contacts, private organization, ordinary history, edits, polls, authority, and terminal tombstones without a cloud account. Permanent exact-device revocation and KKR7 recovery never resurrect old credentials. The published Android APK and automated iOS Simulator build provide release evidence; hands-on device qualification remains.
Live audio calls	C7 audio is shipped through direct libp2p QUIC, transient ratcheted signaling, authenticated per-call media, RPC/CLI, UniFFI, desktop, Android, and iOS. Calls never use TCP, relay-only, mailbox, sneakernet, or LoRa paths; they create no chat history or backup state and use no coordinator, SFU, STUN/TURN, or project service. Real-NAT, handoff, battery, audio-route, and device qualification remain alpha release gates; video remains later work.
Attachment safety	C1 safe file presentation is shipped over the unchanged sealed F3/F4 pipeline. Sender filenames/types remain untrusted hints; mismatched, active, unknown, or nameless files are export-only, recognized external opening is explicit and warns that no malware scan is promised, and no file auto-opens or creates mesh airtime.
Private contact names	B5 contact rename is shipped across node, RPC/CLI, UniFFI, desktop, Android, and iOS. Petnames are NFC-normalized, duplicate-capable private local labels; spoofing-risk warnings require explicit review, exact peer keys remain authoritative, and rename creates no protocol or transport work. Optional signed self-display suggestions remain deferred.
Private local organization	B10 folders, B11 conversation pins, and B18 contact/conversation labels are shipped across storage, node, RPC/CLI, UniFFI, desktop, Android, and iOS. They remain sealed endpoint-private metadata, compose as folder → labels → pins/activity, create zero peer or transport work, are preserved by KKR7, and may converge only through explicit authenticated own-device C2 sync. Message pins and message labels remain separate work.
Appearance and accessibility	B12 system/light/dark appearance is shipped across the sealed F5 preference, node, RPC/CLI, UniFFI, desktop, Android, and iOS. Native system changes apply live, semantic palettes meet the shared WCAG targets, high-contrast/reduced-motion preferences remain native, and security/delivery meaning always retains text or icon cues.
Private custom icons	B13 contact, group, folder, and note-to-self icons are shipped across the sealed F5 record, node, RPC/CLI, UniFFI, desktop, Android, and iOS. Generated initials are the safe fallback; eight bundled glyphs or selected local JPEG/PNG inputs become strict metadata-free 256×256 PNGs under per-icon/count/aggregate quotas. Icons create zero remote lookup, peer sync, notification, or transport work; portability is limited to KKR7 and explicit authenticated own-device C2 sync.
Screen security	B14 is shipped as an always-on pre-unlock policy across the shared capability contract, RPC/CLI, UniFFI, and every shell. Android applies FLAG_SECURE to every activity; iOS obscures inactive/app-switcher and live-captured scenes without claiming universal screenshot blocking; desktop requests best-effort native content protection, shields on focus loss, and locks immediately with Ctrl/Cmd+Shift+L. OS, compositor, privileged-software, and external-camera limits remain explicit.
Input privacy	B15 is shipped as an always-on pre-unlock policy across the shared capability contract, RPC/CLI, UniFFI, and every textual field. Android requests IME_FLAG_NO_PERSONALIZED_LEARNING and no suggestions; iOS disables correction and uses secure passphrase/mnemonic fields; desktop disables webview autocomplete, correction, capitalization, and spellcheck. Keyboard, OS, webview, and writing-tool limits remain explicit.
Runtime and release assurance	The headless runtime recovers poisoned synchronization locks instead of cascading a panic, emits policy-bounded structured diagnostics through tracing, and accepts passphrases/restore mnemonics from owner-only secret files. Rust 1.88 is the declared and tested MSRV. Version 0.1.0 is published as a GitHub prerelease with native Windows/macOS/Linux packages, an installable Android test APK, checksums, and a public Linux amd64/arm64 kultd image. These are Alpha artifacts: Windows signing, store distribution, an updater, and stable support promises are not configured. Per-push CI, the complete local matrix, and a weekly advisory/macOS/coverage workflow provide complementary evidence.
Optional mobile convenience	ADR-0017 through ADR-0019 propose reversible post-pairing rendezvous and content-free native wake. The layer is design-only: no optional service is implemented or required by the sovereign core.

Older KKR1 through KKR6 backups remain restorable; current backups are KKR7. KKR6 added signed group authority state and consumed admin-request ids. KKR7 adds linked-device authority, convergence state, and recovery semantics; all current backups exclude live ephemeral plaintext/media and carry terminal tombstones so restore cannot resurrect removed content. The principal release gaps are the physical radio bench, hands-on mobile qualification, reproducible signed/store distribution work, remaining M6 hardening, and an external security audit. See the roadmap for engineering milestones, the feature delivery plan for the product backlog, and the local release gate for the no-hosted-compiler workflow.

Komms is a decentralized messenger built on four principles:

1. No mandatory middle. No account or project-operated service is required to communicate. Peers talk directly, via volunteer relays holding only sealed ciphertext, or over radio. Optional rendezvous and native-wake services may improve convenience, but they receive no message plaintext or identity keys and their loss never disables the core.
2. Cryptography at the state of the art. Hybrid post-quantum key agreement (X25519 + ML-KEM-768), Double Ratchet sessions with encrypted headers, and XChaCha20-Poly1305 everywhere, assembled strictly from published, audited designs.
3. Off-grid is a first-class citizen. When networks are down or shut off, the same sealed messages travel over commodity Meshtastic LoRa radios (kilometers of range, multi-hop, ~€30 hardware), local links, or .kkb file sneakernet.
4. Your keys, your data, your hardware. Identity is a keypair you mint yourself: no phone number, no email. History is stored locally, encrypted, exportable, and deletable for real.

Why this project exists, including its answer to the EU's ChatControl regime, is set out plainly in Why Komms.

Design documents

Doc	Contents
00: Start Here	The whole project in plain words, for any knowledge level
01: Why	Motivation, position, commitments
02: Threat Model	Adversaries, security goals, honest limits
03: Architecture	Layers, crates, message lifecycle, store-and-forward
04: Cryptography	Normative crypto spec: PQXDH, Double Ratchet, envelopes
05: Transports	Internet (libp2p), proximity, Meshtastic/LoRa, sneakernet
06: Identity & Trust	Keypair identity, verification, petnames
07: Storage	Local-first encrypted storage, backup, portability
08: Roadmap	Milestones M0–M6 with acceptance criteria
09: Implementation Guide	Build order, API sketches, standards, review gates
10: HIL Bench	Hardware-in-loop nightly: two-radio bench runbook
11: Feature Scope	Which product features fit the model, and under what constraints
12: Feature Delivery Plan	Sequenced implementation plan for every approved product feature
13: Screen Security	B14 platform guarantees, limitations, behavior, and qualification matrix
14: Incognito Keyboard	B15 input-field guarantees, native controls, honest limits, and qualification matrix
15: Private Contact Names	B5 local petname rename contract, warnings, privacy boundary, and qualification matrix
16: Safe Text Formatting	B9 source subset, active-content boundary, limits, compatibility, and qualification matrix
17: Safe File Presentation	C1 filename/type policy, open/export boundary, lifecycle, and qualification matrix
18: Authenticated Message Editing	C3 immutable edit events, authorship, convergence, retained versions, compatibility, and qualification
19: Disappearing Messages and View-Once Attachments	C4 exact local expiry, coarse relay retention, tombstones, KKR6 exclusion, honest limits, and qualification
20: Group Polls	C5 visible authenticated votes, fixed electorate, deterministic convergence, creator closure, and qualification
21: Group Roles, Ownership, and Moderation	C6 signed owner/admin/member authority, transfer, rotation, moderation, backup, and qualification
22: Linked Devices	C2 device certificates, confirmed linking, per-device delivery, deterministic sync, revocation, recovery, and qualification
23: Live Audio Calls	C7 direct-QUIC gating, transient signaling, authenticated Opus media, platform behavior, privacy limits, and qualification
24: Local Release Gate	Toolchains, complete local validation, CI/audit evidence, SDK deferrals, signing boundary, and publication discipline
25: Release Runbook	Versioning, native desktop/APK artifact builds, signing inputs, qualification, and explicit publication
26: Self-hosting	Hardened Docker Compose deployment, ports, secret initialization, node modes, and Alpha limits
27: Alpha Testing	Download verification, installation, smoke testing, issue reporting, and self-hosted image quick start
ADRs	Decision index, status, and the alternatives each decision beat

Stack

Rust workspace (kult-crypto / kult-protocol / kult-transport / kult-store / kult-node / kultd / kult-ffi), UniFFI bindings, Tauri desktop app, native mobile shells. Layout in Architecture §7. Implemented so far: kult-crypto (hybrid PQXDH, Double Ratchet with encrypted headers, anonymous sealed boxes, sealed state, sender-key group chains), kult-protocol (envelopes, padding buckets, fragmentation + NACKs, delivery tokens, sealed group headers, .kkb bundles), and kult-store (encrypted SQLite, key hierarchy, persistent queue), kult-transport (the Transport contract, the sneakernet spool-directory carrier, and the libp2p internet carrier: QUIC primary, TCP+Noise+Yamux fallback, envelope request-response protocol with honest next-hop acks, a Kademlia discovery plane serving signed prekey-bundle records, volunteer mailbox relays storing only sealed envelopes, and NAT traversal via AutoNAT + Circuit Relay v2 + DCUtR), and kult-node (session lifecycle, delivery engine with per-message state machine and retry/backoff, transport scheduler with mesh priority classes and the 4 KiB airtime ceiling, end-to-end encrypted delivery receipts, fragmentation over small-MTU links with selective-retransmission NACKs, contact-by-address via DHT lookup, command/event API), and kultd (headless daemon: tick loop, DHT bootstrap + bundle publication, automatic NAT/relay lifecycle, mailbox check-ins, local JSON RPC over a Unix socket, kult CLI), and kult-ffi (UniFFI bindings: the node's command/event API as typed records/enums with an embedded in-process runtime, for the application shells), plus apps/desktop (Tauri shell), apps/android (Kotlin alpha shell over the generated bindings), and apps/ios (SwiftUI alpha shell over the same bindings). The daemon writes structured, content-free diagnostics to stderr (RUST_LOG, default info) and supports owner-only passphrase/mnemonic files for service deployment; run kultd --help for the complete operator surface.

Build and validation

Rust 1.88 or newer is required by the locked dependency graph and verified as the minimum supported Rust version in CI. A current stable toolchain is the normal developer choice; the complete fuzz gate additionally needs nightly Rust and cargo-fuzz. Platform SDK requirements live in the desktop, Android, and iOS guides.

cargo test --workspace --all-features          # KATs, properties, e2e, soak
cargo build -p kult-crypto --no-default-features   # no_std build
cd crates/kult-crypto && cargo +nightly fuzz run envelope_decode -- -max_total_time=60

Before a publication candidate, run scripts/local-release-matrix.sh from the repository root and record every explicit DEFERRED platform gate. The exact division between local checks, per-push CI, weekly audit evidence, physical qualification, and signing is documented in the local release gate.

The Komms 0.1 Alpha prerelease was built from tag v0.1.0 on native Windows, macOS, Linux, and Android runners. Install it using the Alpha testing guide. Its public Linux amd64/arm64 self-hosting image is available as the immutable ghcr.io/andrigitdev/komms-kultd:0.1.0 tag and the 0.1-alpha/alpha aliases. See the release runbook for the version bump, APK/installer/container, signing, checksum, smoke-test, and publication process, or the self-hosting guide to run kultd.

Contributing

Security review, hands-on platform testing, and focused implementation of the remaining roadmap are especially valuable; see CONTRIBUTING.md. Security issues: SECURITY.md.

License

AGPLv3. Anyone may run, study, modify, and share every component, and modified network services must publish their source. Rationale: ADR-0006.