00 Orientation

Private Messaging Over Solana

Direct when possible, relayed when necessary, sharded when offline.

Covenant is a covert peer-to-peer messaging system that uses Solana for rendezvous, QUIC for live transport, and threshold-sharded storage for delayed delivery. The repo includes protocol crates, operator tooling, and a desktop shell over the real Rust app core.

Try in your browser Download desktop

QUIC live transport

Relay fallback

Threshold offline storage

Scroll to follow the protocol

Chain

P2P

Storage

Covenant

Delivery Path Current shape

step 01 rendezvous over Solana

step 02 direct QUIC hole punch

step 03 relay only if the path fails

step 04 shard ciphertext when the peer is offline

Live delivery Hole-punch first

Sessions stay off chain and off storage whenever the network cooperates.

Offline delivery k-of-n shards

Storage nodes see fragments, not whole ciphertext payloads.

Runtime model One app core

Desktop UI, archive worker, and protocol crates share the same state model.

01 Reader Paths

Choose A Path

Different readers need different answers first.

I want the protocol shape Read the planes, fallback logic, offline path, and threat-facing design choices. I want the product surface See what the desktop shell already exposes and how the runtime flows are framed. I want direct answers Open the FAQ for the short version of the obvious questions people ask first. I want the whole paper mapped Walk every major section and appendix from the whitepaper before opening the full markdown.

02 Validation

What Exists Today

The repo is already wired around real protocol edges.

hole punch 9/9

Default `covenant-p2p` hole-punch coverage is green.

nat traversal 3/3

Full-cone and symmetric-NAT behaviors are modeled explicitly.

soak 1000 iters

Remote storage sessions now hold steady after connection reuse.

03 Delivery Story

Delivery Flow

What actually happens when Alice sends a message.

Find the peer

Rendezvous hints and timing come from the Solana-backed control plane.

Try the direct path

Peers hole-punch and establish a QUIC session for live delivery.

Fallback cleanly

Symmetric NATs and bad paths can route through relayers without changing the message model.

Persist only when needed

If the recipient is offline, ciphertext is sealed, split, and distributed across storage nodes.

04 Questions

Core Questions

The three questions people ask first.

Scroll this chapter

Read the core answers in order: control plane, delivery fallback, then offline privacy.

01 Why Solana?

02 Why not just direct?

03 What does storage see?

Why Solana?

Covenant uses Solana as the rendezvous and timing substrate. It is where peers discover each other, publish control information, and coordinate connection attempts. The normal message payload path is still off-chain.

Why not just direct?

Direct QUIC is the first choice, but real networks do not always cooperate. Symmetric NATs and broken path assumptions force a fallback. Covenant keeps the same envelope model and routes through relayers only when the direct path fails.

What does storage see?

Offline storage nodes do not receive a whole message. Ciphertext is sealed, split, and distributed as threshold shards, so a single storage node cannot reconstruct the payload on its own.

Open the full FAQ

05 Read Next

Use the short path first, then go deep.

Quickstart How to orient yourself in the repo, run the desktop shell, and find the operator docs. Whitepaper The full protocol design, coverage appendix, and known open issues. Archive Service Run archive discovery and backfill outside the interactive UI. Devnet Checklist What is already in place for a meaningful devnet and what remains later-phase.