NET: Network Event Transport

Website · Docs · Quickstart · Browser SDK · NET for games · Release notes

Net is what the internet would look like if it were built today — the Net inspired by the Cyberpunk
universe, built for real machines. A flat, latency-first, end-to-end encrypted mesh where every
computer, device, app, and agent is an equal node: no clients, no servers, no coordinators. The mesh
propagates state, not connections.

You find what another machine can do, call it through typed RPC, and move artifacts between
participants — while whoever owns a resource keeps control of access. Identity, discovery,
channels, typed RPC, durable logs, folded state, and artifacts are one substrate, so the same
mesh runs vehicular, industrial, robotics, and edge workloads.

How the mesh works

• Capability announcements. A node says what it can do, so you find peers by capability, not address.
• Pingwaves. Small heartbeat frames carry who a node is, what it offers, and how far away it is.
• Proximity graphs. Each peer keeps a latency-weighted map of the mesh and can route to the nearest capable node.
• Drop instead of queue. Buffers are fixed-size, so load is dropped rather than queued or blocked; a node that can't keep up goes quiet and the mesh routes around it.
• End-to-end encrypted forwarding. Relays forward ciphertext they cannot read — there is no trusted middle.
• Reachable through NATs. Nodes try a direct path first and fall back to a relay; a browser tab joins as a full node over WebRTC.
• Latency-first. Transport, routing, and placement all prefer the fastest path available.
• Zero-copy ring buffers. Each shard drains a lock-free, pre-allocated ring buffer — no allocation on push or pop — and event payloads are refcounted Bytes, so moving them through the bus is a pointer bump, not a copy.
• Sharded ingestion. Events stripe across per-shard buffers, merged for cross-shard consumption; the shard count defaults to CPU count and can scale at runtime.
• Optionally-reliable, optionally-ordered. Delivery guarantees and ordering are chosen per channel — the mesh defaults to the fastest path and lets a caller pay only for the guarantees it needs.

What that gives you

• No broker, no registry, no coordinator. Peers find each other by what they can do.
• Identity outlives a path. A node is its keypair; addresses and routes change underneath it.
• Work runs where the resource lives. A credential never leaves the machine that holds it; the caller invokes a capability, not a host.
• One identity, several authority planes. Permission tokens and organization grants decide who may reach a capability; subnet membership comes from a node's published tags.

Status: pre-1.0. Major releases may break APIs — pin and read the
release notes. The wire format is versioned separately, and
subprotocol IDs are permanent.

Install

One engine, several bindings — start with the package for your language:

cargo add net-mesh-sdk                        # Rust
npm install @net-mesh/sdk @net-mesh/core      # TypeScript / Node
pip install net-mesh-sdk                      # Python
go get github.com/ai-2070/net/go              # Go

Published names and source imports differ on purpose: the crates/registries use
net-mesh* / @net-mesh/*, while source imports are net_sdk, @net-mesh/sdk, and
from net_sdk import .... Lower-level bindings that skip the SDK ergonomics are in
SDKs. Full per-language setup:
Install, Quickstart.

Benchmarks

• Header serialize — 2.19 ns, 456 M ops/sec
• Routing lookup (hit) — 37.7 ns, 26.5 M ops/sec
• 1-hop forward — 61.7 ns, 16.2 M ops/sec
• Heartbeat from a known peer — 39.8 ns, 25.2 M ops/sec
• Full fail + recover cycle — 291 ns, 3.44 M ops/sec
• Capability filter match (single tag) — 57.1 ns, 17.5 M ops/sec

These measure local operations on an M1 Max — not NIC transfer, wire latency, or propagation. More under Performance.

Claude Code Skill

An agent working from surface familiarity will write integration code that runs and is quietly
wrong. Install the skills first:

npx skills add ai-2070/net-claude-skill -g     # drop -g for the current project only

Pair them with opensrc so the agent can read Net's
real source instead of guessing a signature — one fetch covers all five bindings:

npx -y opensrc@latest path ai-2070/net

Full install options: Claude Skills.

Chippin' In

Start a mesh node and put one event on it.

use net_sdk::Net;

let node = Net::builder().shards(4).memory().build().await?;
node.emit(&Hello { msg: "hello, mesh".into() })?;   // a receipt, or an error

import { NetNode } from '@net-mesh/sdk';

const node = await NetNode.create({ shards: 4 });
node.emit({ msg: 'hello, mesh' });
await node.shutdown();   // explicit — Node finalizers are not deterministic

The memory adapter accepts and counts events; it does not retain them, so a subscriber would never
yield. For a round trip, run two nodes over the mesh transport — see
Event bus.

Setting up your own mesh

A few commands, two machines. One machine runs a node and hands out a join link. The other
uses the link and runs its own node. up makes the mesh key for you, so nothing secret is copied
by hand.

npm install -g @net-mesh/cli                   # installs the `net-mesh` binary

net-mesh up --enroll                           # operator: runs the node, stays in the foreground
net-mesh invite create                         # prints a `netmesh-join_` token — keep it secret
net-mesh join <TOKEN> --yes && net-mesh up     # device: use the link, then run its own node

What it enables

Capabilities, authority, and state on one substrate change what you can build. Each point leads
with the knobs you'd set; the links go deeper.

Distance becomes a parameter, not a rewrite. Call a capability by name; the mesh decides where
it runs. deadline=500ms, routing=lowest-latency.
Discover and invoke,
Architecture.

Sensing and computation stop sharing a body. A device produces data without hosting the code
that acts on it. channel=sensors/lidar/front, reliability=reliable.
Capabilities,
Dataforts.

Coordination that never funnels through a coordinator. No registry, broker, or leader to cap
it. shards=16, backpressure=drop-oldest.
Event bus,
Capabilities.

Software that outlives its host. A daemon is an identity, not a process pinned to a box.
placement=nearest, replicas=3.
Daemons and placement,
Continuity and migration,
Task lifecycle.

These show up in agent runtimes, robotics and fleet operations, industrial control, edge and IoT,
and local-first collaboration. Built end to end:
Distributed daemon,
Event-sourced service,
Fleet telemetry.

One system, end to end

An intersection has no line of sight: a building hides the cross traffic from the vehicle
approaching it. A second vehicle, coming the other way, can see. Neither can hand over its
sensors — the raw frames belong to the machine that produced them — but the observation can
travel.

The vehicle that can see serves the view under its own authority:

use net_sdk::mesh::MeshBuilder;
use net_sdk::org::{OrgAccess, OrgCaller};
use serde::{Deserialize, Serialize};
use schemars::JsonSchema;

const PSK: [u8; 32] = [0x42; 32];

#[derive(JsonSchema, Deserialize, Serialize)]
struct ObserveReq { intersection: String }
#[derive(JsonSchema, Deserialize, Serialize)]
struct Observation { class: String, distance_m: f32 }
#[derive(JsonSchema, Deserialize, Serialize)]
struct CornerView { objects: Vec<Observation>, confidence: f32 }

// The node authority and the fleet credentials are provisioned out of band (see
// "Private capabilities"); `onboard_sensors` / `perceive_corner` are application code.
let seeing = MeshBuilder::new("0.0.0.0:7700", &PSK)?.build().await?;

// Serve to this fleet only. `OrgAccess::Granted` admits another operator's vehicle
// holding a capability grant. Hold the handle for the provider's lifetime — dropping
// it unregisters the service.
let _serve = seeing.serve_org("intersection.observe", OrgAccess::SameOrg, |caller: OrgCaller, req: ObserveReq| async move {
    // The raw frames and the perception model never leave this vehicle.
    Ok(perceive_corner(&onboard_sensors(), &req.intersection).await?)
})?;

The vehicle in the blind spot asks by capability — no peer was configured in advance:

// The blind-spot vehicle: same mesh and PSK; its fleet credentials are provisioned
// out of band. Handshake with the seeing vehicle (accept on one side, connect on the
// other, both start) before the call.
let blind_spot = MeshBuilder::new("0.0.0.0:7700", &PSK)?.build().await?;

let org = blind_spot.org(credentials)?;                    // sees only what this fleet may see
let view: CornerView = org
    .call("intersection.observe", &ObserveReq { intersection: "5th & Main".into() })
    .await?;
// The blind spot closes on a derived observation, not on a camera feed.

Two sensors addressed each other; neither owned the other's hardware, and neither handed over its
data. The seeing vehicle keeps its frames and its model, and the caller receives exactly what it
asked for and nothing more. A vehicle whose operator holds no grant is not shown the capability at
all — the private announcement is opaque without the audience, so discovery finds nothing and the
call refuses locally, before anything is sent.
Private capabilities,
Security model. When the caller needs more than
the typed view — a clip, an occupancy grid — it travels as a content-addressed artifact:
Dataforts.

Why the architecture works

A provider has an identity; its capabilities are discovered under that identity and its owner's
authority; a caller invokes one; and the results, streams, state, and artifacts stay attached to
the work. These are not separate products joined by glue — identity, discovery, channels, typed
RPC, durable logs, folded state, and artifacts are one substrate, so authority and observation
travel with the call instead of being re-established at every boundary.
Architecture,
Identity,
Capabilities,
nRPC,
Durable logs,
Folds,
Dataforts,
Daemons.

Underneath sits a flat, encrypted mesh. Three properties do most of the work.

Identity outlives a path. A node is its keypair, and its address is incidental. If a route
breaks, traffic is rerouted and the participants keep the same identity — there is no session to
resume, because nothing was bound to the socket in the first place. Read:
Architecture,
Events and causality.

Bounded buffers, explicit overload behaviour. Every node has a fixed-capacity ring buffer.
When it fills, the node drops — oldest or newest, per configuration — instead of growing an
unbounded queue or blocking its producer, and stats().events_dropped surfaces it. A node that
cannot keep up goes quiet, and its neighbours route around it. Net's hot path needs those
drop-not-queue semantics, which is why it carries its own transport over UDP rather than layering
on TCP. Read: Event bus.

No trusted middle. Relay nodes forward encrypted bytes they cannot read, and there is no
special node whose absence stops the mesh. Read:
Security model.

The performance story — what is fast, and what the numbers do and do not include — is scoped in
Performance.

Worldview

Net's unit is a capability offered by a provider, together with the authority and live state
needed to use it. Other systems organize distributed work around different objects — HTTP
around an endpoint, MCP around a tool a configured host may call, NATS around a subject, Zenoh
around a key expression. Net addresses capabilities under identity and authority — so it looks
like a message broker from the outside and is not one underneath, and code written from API
familiarity runs and is quietly wrong.

That makes it a substrate beneath applications, not a replacement for their workflows or business
model: a workspace, fleet console, agent runtime, or industrial application can use Net and keep
its own interface, approvals, and user experience.

• The Agentic Mesh — the problem from an application's point of view.
• When to use Net — the fit boundary, including when HTTP, MCP, NATS, or an ordinary database is the simpler choice.
• How Net relates to other systems — a compact comparison by abstraction, topology, and trust boundary.
• Net and MCP · Connecting HTTP systems · Net and NATS · Net and Zenoh.

Discovery, invocation, and outcome are separate: finding a provider does not authorize a call, and
a successful invocation is not proof that the real-world outcome holds. See Submitted is not
completed.

What's in the box

The rest of the surface, one line each; every entry links to the page that goes deep.

Performance

Full set and methodology in
net/crates/net/BENCHMARKS.md. Each measures one operation in isolation, not the cost
of a packet path. None includes NIC transfer, wire latency, or propagation.

SDKs

All SDKs wrap the same Rust core. The SDK is the developer experience; the engine is Rust.

Lower-level bindings (skip the SDK ergonomics, talk directly to the engine):

The bindings are not at parity. This is the short version; the full matrix — with the reason
behind every gap — is binding coverage.

✓ supported · core-only reachable only through the low-level binding (@net-mesh/core,
net) · partial · – not exposed.

WebRTC

Net natively supports WebRTC: a browser tab becomes a real mesh node — same
identity, channels, and RPC as anything else — by connecting to a native anchor, a node built
with the webrtc feature. Against the binding coverage surface, a browser leaf gets:

• Event bus — ingest + poll
• Mesh channels — subscribe / publish
• Capability announce + discovery
• nRPC — typed request / response + streaming, including org-scoped calls and serving
• Organization capability auth
• Plus the browser-only additions: a replicated store, lossy netcode, world handoff, Three.js binding

Not exposed to a browser leaf:

• Subnet exports · Dataforts · RedEX / CortEX / MeshDB · compute / groups / daemons
• Gang-claim scheduler · Deck · MCP bridge · A2A · consumer-side filter DSL

Games. The browser leaf's netcode gives a web game multiplayer with no game server to run:
players connect directly, and one player hosts or several share a match. Play
Rose & Blade, a 16-player sword fight, or take apart
Net Shooter, an open-source three.js FPS
(play it). More in NET for games.

Read: WebRTC transport,
Browser SDK,
NAT and traversal.

Origin

Net (Network Event Transport) is loosely inspired by the Net from the Cyberpunk universe — a
flat, encrypted mesh where every device is a first-class node. Not affiliated with CD Projekt Red
or R. Talsorian Games; this is an engineering take on the concept, not a licensed adaptation.
Implementation details, the module map, and code examples live in the
crate README.

License

Licensed under either of

• Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
• MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in
this project shall be licensed as MIT OR Apache-2.0, at the recipient's option. Contributions are
subject to the Contributor License Agreement,
which must be signed before a first contribution is merged.