@sym-bot/mesh-channel 0.1.19 → 0.1.20
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/plugin.json +33 -33
- package/.mcp.json +14 -14
- package/CHANGELOG.md +207 -170
- package/README.md +183 -137
- package/SECURITY.md +89 -89
- package/bin/install.js +350 -199
- package/package.json +32 -32
- package/server.js +325 -325
package/README.md
CHANGED
|
@@ -1,137 +1,183 @@
|
|
|
1
|
-
# sym-mesh-channel
|
|
2
|
-
|
|
3
|
-
[](https://www.npmjs.com/package/@sym-bot/mesh-channel)
|
|
4
|
-
[](https://sym.bot/spec/mmp)
|
|
5
|
-
[](https://arxiv.org/abs/2604.03955)
|
|
6
|
-
[](LICENSE)
|
|
7
|
-
[](https://nodejs.org)
|
|
8
|
-
|
|
9
|
-
> MCP server that turns Claude Code into a peer node on the [SYM mesh](https://sym.bot) — the first non-Anthropic implementation of Claude Code Channels for real-time agent-to-agent cognition.
|
|
10
|
-
|
|
11
|
-
Two Claude Code sessions on different machines discover each other via Bonjour mDNS, form a peer-to-peer mesh, and exchange structured cognitive signals in real-time. Each side is a full peer with its own cryptographic identity, its own [SVAF](https://arxiv.org/abs/2604.03955) receiver-side gating, and its own memory — not a thin client. Signals arrive mid-conversation as `<channel>` notifications. No polling, no shared server, no orchestrator.
|
|
12
|
-
|
|
13
|
-
**Verified cross-platform:** Mac ↔ Windows on the same wifi, pure Bonjour, no relay, no token. Cross-network via optional WebSocket relay.
|
|
14
|
-
|
|
15
|
-
- **SVAF paper**: [arxiv.org/abs/2604.03955](https://arxiv.org/abs/2604.03955)
|
|
16
|
-
- **MMP spec**: [sym.bot/spec/mmp](https://sym.bot/spec/mmp)
|
|
17
|
-
|
|
18
|
-
## What this looks like
|
|
19
|
-
|
|
20
|
-
A Claude Code session on Mac broadcasts a structured signal: `focus: "echo loop between same-domain agents"`, `intent: "need architecture review before implementation"`. A session on Windows receives it in real-time as a `<channel>` notification — no tool call, it just appears mid-conversation. The Windows Claude reviews, responds with a detailed architecture analysis, and the Mac session sees the response land mid-turn. Two agents coordinated through typed cognitive signals on an open protocol, across machines, with zero human copy-paste.
|
|
21
|
-
|
|
22
|
-
This isn't hypothetical. This README was coordinated by two Claude Code sessions working through the mesh it describes.
|
|
23
|
-
|
|
24
|
-
## How real-time push works (Claude Code Channels + MMP)
|
|
25
|
-
|
|
26
|
-
This MCP server composes two things:
|
|
27
|
-
|
|
28
|
-
**[Claude Code Channels](https://code.claude.com/docs/en/mcp)** (Anthropic, shipped 2026-03-20) — an MCP capability that lets servers push events directly into Claude's conversation context mid-turn via `notifications/claude/channel`. Anthropic built it for the Telegram/Discord/iMessage integrations. We use it for agent-to-agent cognitive coupling.
|
|
29
|
-
|
|
30
|
-
**[MMP — the Mesh Memory Protocol](https://sym.bot/spec/mmp)** — defines what gets pushed: typed seven-field cognitive bundles (CAT7: focus, issue, intent, motivation, commitment, perspective, mood), how receivers gate incoming signals ([SVAF](https://arxiv.org/abs/2604.03955)), and how peers maintain identity without a central orchestrator. MMP is the protocol; this MCP server is the reference implementation for Claude Code hosts.
|
|
31
|
-
|
|
32
|
-
**The composition:** when a peer on the mesh broadcasts a CMB (Cognitive Memory Block), the SymNode inside this MCP evaluates it via SVAF. If accepted, the MCP fires a `notifications/claude/channel` notification to Claude Code, which surfaces it as a `<channel>` block in the conversation. Claude sees it, can react, and can broadcast back via `sym_send` or `sym_observe`. No polling. No tool calls. The mesh thinks together.
|
|
33
|
-
|
|
34
|
-
## Quick start
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
```
|
|
48
|
-
|
|
49
|
-
The
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
The
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
```
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
1
|
+
# sym-mesh-channel
|
|
2
|
+
|
|
3
|
+
[](https://www.npmjs.com/package/@sym-bot/mesh-channel)
|
|
4
|
+
[](https://sym.bot/spec/mmp)
|
|
5
|
+
[](https://arxiv.org/abs/2604.03955)
|
|
6
|
+
[](LICENSE)
|
|
7
|
+
[](https://nodejs.org)
|
|
8
|
+
|
|
9
|
+
> MCP server that turns Claude Code into a peer node on the [SYM mesh](https://sym.bot) — the first non-Anthropic implementation of Claude Code Channels for real-time agent-to-agent cognition.
|
|
10
|
+
|
|
11
|
+
Two Claude Code sessions on different machines discover each other via Bonjour mDNS, form a peer-to-peer mesh, and exchange structured cognitive signals in real-time. Each side is a full peer with its own cryptographic identity, its own [SVAF](https://arxiv.org/abs/2604.03955) receiver-side gating, and its own memory — not a thin client. Signals arrive mid-conversation as `<channel>` notifications. No polling, no shared server, no orchestrator.
|
|
12
|
+
|
|
13
|
+
**Verified cross-platform:** Mac ↔ Windows on the same wifi, pure Bonjour, no relay, no token. Cross-network via optional WebSocket relay.
|
|
14
|
+
|
|
15
|
+
- **SVAF paper**: [arxiv.org/abs/2604.03955](https://arxiv.org/abs/2604.03955)
|
|
16
|
+
- **MMP spec**: [sym.bot/spec/mmp](https://sym.bot/spec/mmp)
|
|
17
|
+
|
|
18
|
+
## What this looks like
|
|
19
|
+
|
|
20
|
+
A Claude Code session on Mac broadcasts a structured signal: `focus: "echo loop between same-domain agents"`, `intent: "need architecture review before implementation"`. A session on Windows receives it in real-time as a `<channel>` notification — no tool call, it just appears mid-conversation. The Windows Claude reviews, responds with a detailed architecture analysis, and the Mac session sees the response land mid-turn. Two agents coordinated through typed cognitive signals on an open protocol, across machines, with zero human copy-paste.
|
|
21
|
+
|
|
22
|
+
This isn't hypothetical. This README was coordinated by two Claude Code sessions working through the mesh it describes.
|
|
23
|
+
|
|
24
|
+
## How real-time push works (Claude Code Channels + MMP)
|
|
25
|
+
|
|
26
|
+
This MCP server composes two things:
|
|
27
|
+
|
|
28
|
+
**[Claude Code Channels](https://code.claude.com/docs/en/mcp)** (Anthropic, shipped 2026-03-20) — an MCP capability that lets servers push events directly into Claude's conversation context mid-turn via `notifications/claude/channel`. Anthropic built it for the Telegram/Discord/iMessage integrations. We use it for agent-to-agent cognitive coupling.
|
|
29
|
+
|
|
30
|
+
**[MMP — the Mesh Memory Protocol](https://sym.bot/spec/mmp)** — defines what gets pushed: typed seven-field cognitive bundles (CAT7: focus, issue, intent, motivation, commitment, perspective, mood), how receivers gate incoming signals ([SVAF](https://arxiv.org/abs/2604.03955)), and how peers maintain identity without a central orchestrator. MMP is the protocol; this MCP server is the reference implementation for Claude Code hosts.
|
|
31
|
+
|
|
32
|
+
**The composition:** when a peer on the mesh broadcasts a CMB (Cognitive Memory Block), the SymNode inside this MCP evaluates it via SVAF. If accepted, the MCP fires a `notifications/claude/channel` notification to Claude Code, which surfaces it as a `<channel>` block in the conversation. Claude sees it, can react, and can broadcast back via `sym_send` or `sym_observe`. No polling. No tool calls. The mesh thinks together.
|
|
33
|
+
|
|
34
|
+
## Quick start
|
|
35
|
+
|
|
36
|
+
### Via npm (available now)
|
|
37
|
+
|
|
38
|
+
```bash
|
|
39
|
+
npm install -g @sym-bot/mesh-channel # install + auto-configure ~/.claude.json
|
|
40
|
+
claude --dangerously-load-development-channels server:claude-sym-mesh # launch
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
### Via Claude Code plugin (pending Anthropic approval)
|
|
44
|
+
|
|
45
|
+
```
|
|
46
|
+
/plugin install sym-mesh-channel
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
The plugin has been [submitted to the Anthropic Plugin Directory](https://claude.ai/settings/plugins/submit) and is pending review. Once approved, the `--dangerously-load-development-channels` flag is no longer needed.
|
|
50
|
+
|
|
51
|
+
---
|
|
52
|
+
|
|
53
|
+
Install auto-detects your hostname, creates a unique node identity (`claude-<hostname>`), and configures the MCP server globally in `~/.claude.json`. To customize your node name, set `SYM_NODE_NAME` before installing. If two people are on the same wifi, their sessions discover each other automatically. Verify inside Claude Code:
|
|
54
|
+
|
|
55
|
+
```
|
|
56
|
+
sym_status → Node: claude-yourhostname, Peers: 1
|
|
57
|
+
sym_peers → 1 peer(s): claude-theirhostname via bonjour
|
|
58
|
+
sym_send "reviewing the auth module — found a race condition"
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
The other peer sees it arrive **in their Claude Code context as a real-time `<channel>` notification** — no polling, no tool call. It just appears mid-conversation. Their Claude can reason about it, respond, or act on it autonomously.
|
|
62
|
+
|
|
63
|
+
For cross-network setup (different offices, remote team), see [Cross-network setup](#cross-network-setup-optional) below.
|
|
64
|
+
|
|
65
|
+
### Advanced: per-project node identity
|
|
66
|
+
|
|
67
|
+
By default every Claude Code session on a machine shares one mesh identity (set globally in `~/.claude.json`). If you run several Claude Code sessions in parallel from distinct project directories and want each to appear as its own peer on the mesh — e.g. a "research" session and a "strategy" session on the same laptop — install per-project instead:
|
|
68
|
+
|
|
69
|
+
```bash
|
|
70
|
+
cd path/to/your/project
|
|
71
|
+
SYM_NODE_NAME=claude-myproject-win sym-mesh-channel init --project
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
This writes `<project>/.mcp.json` and merges `<project>/.claude/settings.local.json` instead of touching `~/.claude.json`. Claude Code loads project-scoped `.mcp.json` on launch and its entries override the global one when you're running from that directory, so each project gets its own `SYM_NODE_NAME` without stepping on siblings. Rerun from each project root with a distinct `SYM_NODE_NAME` to register each one as a separate peer.
|
|
75
|
+
|
|
76
|
+
Normal one-machine-one-peer usage does **not** need `--project` — the default global install is correct for most users.
|
|
77
|
+
|
|
78
|
+
## Requirements
|
|
79
|
+
|
|
80
|
+
| | macOS | Linux | Windows |
|
|
81
|
+
|---|---|---|---|
|
|
82
|
+
| Node.js ≥ 18 | ✓ | ✓ | ✓ |
|
|
83
|
+
| Claude Code ≥ 2.1.97 (Channels feature) | ✓ | ✓ | ✓ |
|
|
84
|
+
| Bonjour / mDNS for LAN discovery | built-in | install `avahi-daemon` | built-in (Windows 10+) |
|
|
85
|
+
|
|
86
|
+
The `--dangerously-load-development-channels` flag is required during the review period. Once the plugin is approved on the Anthropic Plugin Directory, this flag is no longer needed — install via `/plugin install` and launch normally.
|
|
87
|
+
|
|
88
|
+
## What you get
|
|
89
|
+
|
|
90
|
+
Five MCP tools exposed to Claude Code, namespaced under `mcp__claude-sym-mesh__`:
|
|
91
|
+
|
|
92
|
+
| Tool | What it does |
|
|
93
|
+
|---|---|
|
|
94
|
+
| `sym_send` | Broadcast a free-text message to all mesh peers. Arrives in receivers' contexts as a `<channel>` notification. |
|
|
95
|
+
| `sym_observe` | Share a structured CAT7 observation: focus, issue, intent, motivation, commitment, perspective, mood. SVAF-gated on the receiving side. |
|
|
96
|
+
| `sym_recall` | Search mesh memory for past CMBs. |
|
|
97
|
+
| `sym_peers` | List discovered peers (via bonjour or relay). |
|
|
98
|
+
| `sym_status` | Node identity, relay state, peer count, memory count. |
|
|
99
|
+
|
|
100
|
+
Real-time push is bidirectional: peer events arrive in Claude's context without any tool call, while the session is mid-turn. This is the "Claude thinks with the mesh" property — not "Claude pokes the mesh occasionally."
|
|
101
|
+
|
|
102
|
+
## How it works
|
|
103
|
+
|
|
104
|
+
```
|
|
105
|
+
Claude Code A Claude Code B
|
|
106
|
+
↕ (stdio + MCP) ↕
|
|
107
|
+
sym-mesh-channel (SymNode) ←— Bonjour mDNS —→ sym-mesh-channel (SymNode)
|
|
108
|
+
↕ (LAN discovery) ↕
|
|
109
|
+
└──────────── optional WebSocket relay ────────────────┘
|
|
110
|
+
(cross-network, see below)
|
|
111
|
+
```
|
|
112
|
+
|
|
113
|
+
- **Stdio half**: Claude Code spawns the MCP server as a child process. MCP tool calls flow over stdio.
|
|
114
|
+
- **Push half**: when a CMB arrives at the SymNode (via Bonjour or relay), the MCP server fires a `notifications/claude/channel` notification back over stdio. Claude Code surfaces it as a `<channel>` block in the conversation context.
|
|
115
|
+
- **Identity**: each peer has its own Ed25519 keypair stored at `~/.sym/nodes/<name>/identity.json`. NodeIDs are UUID v7 + Ed25519 signatures, gossiped through the relay's directory and/or via Bonjour TXT records.
|
|
116
|
+
- **SVAF**: incoming CMBs are evaluated by Symbolic-Vector Attention Fusion before they enter cognitive state. Low-relevance CMBs are gated out so the receiver's context doesn't drown.
|
|
117
|
+
|
|
118
|
+
For the full architecture, see MMP spec sections 4-6.
|
|
119
|
+
|
|
120
|
+
## Cross-network setup (optional)
|
|
121
|
+
|
|
122
|
+
LAN-only is enough for two people sitting next to each other. To connect across networks (different offices, coffee shop ↔ home, etc.) you need a relay:
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
# Run your own relay (Render-friendly Dockerfile included)
|
|
126
|
+
git clone https://github.com/sym-bot/sym-relay
|
|
127
|
+
cd sym-relay && npm install && npm start
|
|
128
|
+
# or deploy the Dockerfile to Render / Fly / Railway / etc
|
|
129
|
+
```
|
|
130
|
+
|
|
131
|
+
Then add the relay env vars to your `claude-sym-mesh` entry in `~/.claude.json`:
|
|
132
|
+
|
|
133
|
+
```json
|
|
134
|
+
"env": {
|
|
135
|
+
"SYM_NODE_NAME": "claude-mac",
|
|
136
|
+
"SYM_RELAY_URL": "wss://your-relay.example.com",
|
|
137
|
+
"SYM_RELAY_TOKEN": "your-shared-token"
|
|
138
|
+
}
|
|
139
|
+
```
|
|
140
|
+
|
|
141
|
+
Both peers must use the same relay URL and token to be on the same channel. The relay supports per-token channel isolation so you can run a single relay for multiple groups.
|
|
142
|
+
|
|
143
|
+
## Troubleshooting
|
|
144
|
+
|
|
145
|
+
**Peers don't see each other on the same wifi.** Check Bonjour is running:
|
|
146
|
+
- macOS: `dns-sd -B _sym._tcp` (built-in)
|
|
147
|
+
- Linux: `avahi-browse -r _sym._tcp` (needs `avahi-daemon` running)
|
|
148
|
+
- Windows 10+: mDNS is built-in. If discovery fails, check Windows Firewall allows mDNS (port 5353 UDP).
|
|
149
|
+
|
|
150
|
+
Some corporate networks block mDNS multicast — try a hotspot or home wifi to verify. If LAN is blocked, fall back to a relay.
|
|
151
|
+
|
|
152
|
+
**`<channel>` notifications never arrive even though peers are connected.** Verify Claude Code was launched with `--dangerously-load-development-channels server:claude-sym-mesh`. Without that exact flag, MCP push notifications are silently dropped.
|
|
153
|
+
|
|
154
|
+
**`sym_status` says "Peers: 0" but `sym_peers` lists peers.** Snapshot timing — both views read the same `_peers` map at slightly different moments. The peer set is dynamic. If counts disagree consistently, file an issue.
|
|
155
|
+
|
|
156
|
+
**`sym_status` says "Relay: connected" even though you didn't configure a relay.** Your shell profile (`~/.zshrc`, `~/.bashrc`, etc.) exports `SYM_RELAY_URL`. Claude Code's MCP env block is **additive** — omitting a key doesn't remove it from the child process. Fix: set `SYM_RELAY_URL` and `SYM_RELAY_TOKEN` to `""` (empty string) in the MCP env block to override the shell. The installer (`npx @sym-bot/mesh-channel init`) does this automatically as of v0.1.8.
|
|
157
|
+
|
|
158
|
+
**Multiple Claude Code sessions on the same machine want to share an identity.** Don't. Each session should have a distinct `SYM_NODE_NAME`. As of `@sym-bot/sym 0.3.70`, the SymNode acquires an exclusive lockfile on its identity (`~/.sym/nodes/<name>/lock.pid`) and refuses to start a second process with the same name. If you see `EIDENTITYLOCK`, find and kill the other process or pick a different name.
|
|
159
|
+
|
|
160
|
+
## Security
|
|
161
|
+
|
|
162
|
+
Defense in depth — three layers, all must pass before a mesh signal reaches Claude's context:
|
|
163
|
+
|
|
164
|
+
1. **Transport**: Ed25519 peer identity (LAN) + relay token auth (cross-network). Unauthenticated sources cannot reach `pushChannel()`.
|
|
165
|
+
2. **Protocol**: [SVAF](https://arxiv.org/abs/2604.03955) per-field content gating — evaluates each incoming CMB across 7 semantic dimensions and rejects irrelevant signals.
|
|
166
|
+
3. **Application**: text-only context injection, no code execution, no permission relay (`claude/channel/permission` is explicitly not declared).
|
|
167
|
+
|
|
168
|
+
**Optional peer allowlist**: set `SYM_ALLOWED_PEERS=claude-mac,claude-win` to restrict which authenticated peers can push to Claude's context. When empty (default), all authenticated peers are accepted.
|
|
169
|
+
|
|
170
|
+
See [SECURITY.md](SECURITY.md) for the full security model.
|
|
171
|
+
|
|
172
|
+
## References
|
|
173
|
+
|
|
174
|
+
- [SVAF paper (arXiv:2604.03955)](https://arxiv.org/abs/2604.03955) — Xu, 2026. Symbolic-Vector Attention Fusion for Collective Intelligence.
|
|
175
|
+
- [MMP spec v0.2.2](https://sym.bot/spec/mmp) — Mesh Memory Protocol specification.
|
|
176
|
+
- [sym-swift](https://github.com/sym-bot/sym-swift) — iOS/macOS SDK implementing the same protocol.
|
|
177
|
+
- [sym-relay](https://github.com/sym-bot/sym-relay) — WebSocket relay for cross-network mesh.
|
|
178
|
+
|
|
179
|
+
**Verified cross-platform:** Mac ↔ Windows on the same wifi (April 2026).
|
|
180
|
+
|
|
181
|
+
## License
|
|
182
|
+
|
|
183
|
+
Apache 2.0 — SYM.BOT Ltd
|
package/SECURITY.md
CHANGED
|
@@ -1,89 +1,89 @@
|
|
|
1
|
-
# Security Model
|
|
2
|
-
|
|
3
|
-
sym-mesh-channel implements defense in depth with three layers. No
|
|
4
|
-
single layer is the sole gate — all three must pass before a mesh
|
|
5
|
-
signal reaches Claude's conversation context.
|
|
6
|
-
|
|
7
|
-
## Layer 1: Transport Authentication
|
|
8
|
-
|
|
9
|
-
Only authenticated peers can send signals to this node.
|
|
10
|
-
|
|
11
|
-
- **LAN (Bonjour)**: peers discover each other via mDNS on the local
|
|
12
|
-
network. Each peer has an Ed25519 keypair generated at first run
|
|
13
|
-
and stored at `~/.sym/nodes/<name>/identity.json`. Peer identity is
|
|
14
|
-
verified via cryptographic handshake (MMP Section 5).
|
|
15
|
-
- **Relay (WebSocket)**: peers authenticate with a shared relay token
|
|
16
|
-
(`SYM_RELAY_TOKEN`). The relay enforces per-token channel isolation —
|
|
17
|
-
peers on different tokens cannot see each other. Unauthenticated
|
|
18
|
-
connections are rejected at the transport level.
|
|
19
|
-
|
|
20
|
-
No unauthenticated source can reach `pushChannel()`.
|
|
21
|
-
|
|
22
|
-
## Layer 2: Protocol-Level Content Gating (SVAF)
|
|
23
|
-
|
|
24
|
-
Every incoming CMB is evaluated by Symbolic-Vector Attention Fusion
|
|
25
|
-
before it enters cognitive state. SVAF computes per-field drift across
|
|
26
|
-
7 semantic dimensions (CAT7: focus, issue, intent, motivation,
|
|
27
|
-
commitment, perspective, mood) and operates in three regimes:
|
|
28
|
-
|
|
29
|
-
- **Aligned** (drift < threshold): CMB is accepted and stored
|
|
30
|
-
- **Guarded** (drift moderate): only the mood field is delivered (protocol guarantee R5)
|
|
31
|
-
- **Rejected** (drift high): CMB is silently dropped
|
|
32
|
-
|
|
33
|
-
This is analogous to a content-aware firewall: it doesn't just check
|
|
34
|
-
who sent the signal — it evaluates whether the signal is semantically
|
|
35
|
-
relevant to the receiver's current context. Low-relevance CMBs are
|
|
36
|
-
gated out so Claude's context window doesn't drown.
|
|
37
|
-
|
|
38
|
-
SVAF field weights are configurable per node (`svafFieldWeights` in
|
|
39
|
-
server.js). The default weights are tuned for engineering-domain
|
|
40
|
-
Claude Code sessions.
|
|
41
|
-
|
|
42
|
-
## Layer 3: Application-Level Restrictions
|
|
43
|
-
|
|
44
|
-
- **No code execution**: incoming mesh signals are text-only CMB fields.
|
|
45
|
-
No mesh peer can trigger Bash commands, file writes, or tool calls
|
|
46
|
-
on this node.
|
|
47
|
-
- **No permission relay**: the `claude/channel/permission` capability is
|
|
48
|
-
explicitly NOT declared. Mesh peers cannot approve or deny tool
|
|
49
|
-
executions on this node.
|
|
50
|
-
- **No arbitrary content injection**: incoming CMBs are formatted as
|
|
51
|
-
structured `[source] focus (mood)` text before being pushed to
|
|
52
|
-
Claude's context. Raw JSON is never injected.
|
|
53
|
-
- **Self-echo filtering**: CMBs from this node's own identity are
|
|
54
|
-
dropped before `pushChannel()` (prevents feedback loops).
|
|
55
|
-
|
|
56
|
-
## Optional: Peer Allowlist
|
|
57
|
-
|
|
58
|
-
Set `SYM_ALLOWED_PEERS` (comma-separated node names) to restrict which
|
|
59
|
-
authenticated peers can push to Claude's context. When set, only CMBs
|
|
60
|
-
and messages from listed peers pass the gate. When empty (default), all
|
|
61
|
-
authenticated peers are accepted — SVAF still gates on content relevance.
|
|
62
|
-
|
|
63
|
-
Example:
|
|
64
|
-
```
|
|
65
|
-
SYM_ALLOWED_PEERS=claude-code-mac,claude-code-win
|
|
66
|
-
```
|
|
67
|
-
|
|
68
|
-
This is an additional layer, not a replacement for transport auth or
|
|
69
|
-
SVAF. It provides explicit identity-level control for environments
|
|
70
|
-
that require it.
|
|
71
|
-
|
|
72
|
-
## Token Handling
|
|
73
|
-
|
|
74
|
-
- `SYM_RELAY_TOKEN`: passed via environment variable, never logged,
|
|
75
|
-
never included in CMBs or channel notifications. In the plugin
|
|
76
|
-
manifest, marked `sensitive: true` (stored in system keychain).
|
|
77
|
-
- Ed25519 private key: stored at `~/.sym/nodes/<name>/identity.json`,
|
|
78
|
-
never transmitted. Only the public key is shared during handshake.
|
|
79
|
-
|
|
80
|
-
## Identity Collision
|
|
81
|
-
|
|
82
|
-
If another process is already running with the same node identity,
|
|
83
|
-
the relay returns close code 4004. The server exits cleanly with
|
|
84
|
-
exit code 2 rather than competing for the identity.
|
|
85
|
-
|
|
86
|
-
## References
|
|
87
|
-
|
|
88
|
-
- [MMP v0.2.2 Specification](https://sym.bot/spec/mmp) — Sections 5 (Connection), 8 (CAT7), 9 (SVAF)
|
|
89
|
-
- [SVAF Paper](https://arxiv.org/abs/2604.03955) — Xu, 2026
|
|
1
|
+
# Security Model
|
|
2
|
+
|
|
3
|
+
sym-mesh-channel implements defense in depth with three layers. No
|
|
4
|
+
single layer is the sole gate — all three must pass before a mesh
|
|
5
|
+
signal reaches Claude's conversation context.
|
|
6
|
+
|
|
7
|
+
## Layer 1: Transport Authentication
|
|
8
|
+
|
|
9
|
+
Only authenticated peers can send signals to this node.
|
|
10
|
+
|
|
11
|
+
- **LAN (Bonjour)**: peers discover each other via mDNS on the local
|
|
12
|
+
network. Each peer has an Ed25519 keypair generated at first run
|
|
13
|
+
and stored at `~/.sym/nodes/<name>/identity.json`. Peer identity is
|
|
14
|
+
verified via cryptographic handshake (MMP Section 5).
|
|
15
|
+
- **Relay (WebSocket)**: peers authenticate with a shared relay token
|
|
16
|
+
(`SYM_RELAY_TOKEN`). The relay enforces per-token channel isolation —
|
|
17
|
+
peers on different tokens cannot see each other. Unauthenticated
|
|
18
|
+
connections are rejected at the transport level.
|
|
19
|
+
|
|
20
|
+
No unauthenticated source can reach `pushChannel()`.
|
|
21
|
+
|
|
22
|
+
## Layer 2: Protocol-Level Content Gating (SVAF)
|
|
23
|
+
|
|
24
|
+
Every incoming CMB is evaluated by Symbolic-Vector Attention Fusion
|
|
25
|
+
before it enters cognitive state. SVAF computes per-field drift across
|
|
26
|
+
7 semantic dimensions (CAT7: focus, issue, intent, motivation,
|
|
27
|
+
commitment, perspective, mood) and operates in three regimes:
|
|
28
|
+
|
|
29
|
+
- **Aligned** (drift < threshold): CMB is accepted and stored
|
|
30
|
+
- **Guarded** (drift moderate): only the mood field is delivered (protocol guarantee R5)
|
|
31
|
+
- **Rejected** (drift high): CMB is silently dropped
|
|
32
|
+
|
|
33
|
+
This is analogous to a content-aware firewall: it doesn't just check
|
|
34
|
+
who sent the signal — it evaluates whether the signal is semantically
|
|
35
|
+
relevant to the receiver's current context. Low-relevance CMBs are
|
|
36
|
+
gated out so Claude's context window doesn't drown.
|
|
37
|
+
|
|
38
|
+
SVAF field weights are configurable per node (`svafFieldWeights` in
|
|
39
|
+
server.js). The default weights are tuned for engineering-domain
|
|
40
|
+
Claude Code sessions.
|
|
41
|
+
|
|
42
|
+
## Layer 3: Application-Level Restrictions
|
|
43
|
+
|
|
44
|
+
- **No code execution**: incoming mesh signals are text-only CMB fields.
|
|
45
|
+
No mesh peer can trigger Bash commands, file writes, or tool calls
|
|
46
|
+
on this node.
|
|
47
|
+
- **No permission relay**: the `claude/channel/permission` capability is
|
|
48
|
+
explicitly NOT declared. Mesh peers cannot approve or deny tool
|
|
49
|
+
executions on this node.
|
|
50
|
+
- **No arbitrary content injection**: incoming CMBs are formatted as
|
|
51
|
+
structured `[source] focus (mood)` text before being pushed to
|
|
52
|
+
Claude's context. Raw JSON is never injected.
|
|
53
|
+
- **Self-echo filtering**: CMBs from this node's own identity are
|
|
54
|
+
dropped before `pushChannel()` (prevents feedback loops).
|
|
55
|
+
|
|
56
|
+
## Optional: Peer Allowlist
|
|
57
|
+
|
|
58
|
+
Set `SYM_ALLOWED_PEERS` (comma-separated node names) to restrict which
|
|
59
|
+
authenticated peers can push to Claude's context. When set, only CMBs
|
|
60
|
+
and messages from listed peers pass the gate. When empty (default), all
|
|
61
|
+
authenticated peers are accepted — SVAF still gates on content relevance.
|
|
62
|
+
|
|
63
|
+
Example:
|
|
64
|
+
```
|
|
65
|
+
SYM_ALLOWED_PEERS=claude-code-mac,claude-code-win
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
This is an additional layer, not a replacement for transport auth or
|
|
69
|
+
SVAF. It provides explicit identity-level control for environments
|
|
70
|
+
that require it.
|
|
71
|
+
|
|
72
|
+
## Token Handling
|
|
73
|
+
|
|
74
|
+
- `SYM_RELAY_TOKEN`: passed via environment variable, never logged,
|
|
75
|
+
never included in CMBs or channel notifications. In the plugin
|
|
76
|
+
manifest, marked `sensitive: true` (stored in system keychain).
|
|
77
|
+
- Ed25519 private key: stored at `~/.sym/nodes/<name>/identity.json`,
|
|
78
|
+
never transmitted. Only the public key is shared during handshake.
|
|
79
|
+
|
|
80
|
+
## Identity Collision
|
|
81
|
+
|
|
82
|
+
If another process is already running with the same node identity,
|
|
83
|
+
the relay returns close code 4004. The server exits cleanly with
|
|
84
|
+
exit code 2 rather than competing for the identity.
|
|
85
|
+
|
|
86
|
+
## References
|
|
87
|
+
|
|
88
|
+
- [MMP v0.2.2 Specification](https://sym.bot/spec/mmp) — Sections 5 (Connection), 8 (CAT7), 9 (SVAF)
|
|
89
|
+
- [SVAF Paper](https://arxiv.org/abs/2604.03955) — Xu, 2026
|