Warren is a serverless P2P substrate: blinded discovery, hole-punched direct connections, signed append-only feeds, content-addressed blobs, and verified swarm sync. It moves opaque, verifiable bytes between peers with nothing in the middle — and it doesn't care what the bytes are.
Warren gives you the hard parts of a peer-to-peer system as small, verifiable Rust crates. What you send over it — a video, a message, a file, a signed data feed — is your payload, not Warren's concern.
Peers connect directly — hole-punched over a single socket. The DHT is used only for rendezvous; bulk data never touches a server, gateway, or required relay.
Discovery runs under blinded, rotating topics. Content is addressed by the hash of its ciphertext. There's nothing stable for a censor to enumerate or fingerprint.
The core abstractions — a signed append-only log and a content-addressed blob store — are general. Video is one payload; chat, files, and data feeds are others.
Each layer is independently verifiable and composes upward. `crypto` at the base; your app on top; `portmap` feeding reachability into the driver.
A DHT node plus single-socket NAT hole-punching. Dials a peer by id, punches a direct path (incl. birthday-punch for symmetric NAT), and hands back a raw channel.
Kademlia routing: announce under a topic, look up who else did. Turns a shared key into a set of reachable peers.
Verified feed + blob sync with multi-source swarming — rarest-first, work-stealing, resumable, streaming, every chunk checked as it lands.
A signed, append-only, per-block-verifiable log (O(log n) incremental Merkle head). Content identity, decoupled from network identity.
A content-addressed chunk store. Split a payload, name each piece by its hash, reassemble anywhere from any source that holds the pieces.
Ed25519 signatures, BLAKE3 hashing, and an XChaCha20 sealing envelope — seekable per-item encryption that keeps streaming progressive while blobs stay opaque.
PCP (RFC 6887) + UPnP-IGD port mapping and reflexive address discovery, so a peer can advertise a path others can actually reach.
A feed of signed records plus content-addressed blobs is a general shape. The same core carries very different applications; only the real-time ones need a primitive Warren doesn't ship yet.
A TikTok-style vertical feed: clips as encrypted blobs, posts as feed records, swarmed between viewers. This is the reference app, Murmur.
see Murmur →Rooms map cleanly onto merged member feeds (text as records, media as blobs). What's missing is live-tail replication — subscribe to a feed and receive appends in real time, rather than polling.
read the design note →Content-addressing plus verified multi-source download is exactly a P2P file transfer — big payloads, spread across whoever holds the chunks, resumable and integrity-checked.
Any append-only, authored, tamper-evident stream — a microblog, an audit log, a sensor feed — is what feed already is, minus the video.
Warren treats opacity to a censor as the first requirement, not a feature bolted on later. Five properties do the work — and they hold whatever the payload is.
The discovery topic is hash(psk, epoch) — meaningless without the key and different every epoch. No fixed handle to add to a blocklist.
A peer's node id (where it is) is independent from its content id (who authored). Hosting and authoring don't collapse to one stable name.
Membership refreshes on a clock (keep_announced), so the swarm heals through churn without a registry anyone could subpoena.
Blobs are named by the hash of their ciphertext under a random key — so a censor holding a banned item can't compute its id to hunt hosts. Content-addressing, minus the fingerprint.
Optional volunteer blind peers reseed encrypted bytes they can't read. Nothing is required, nothing is central — availability without infrastructure.
Warren isn't the first serverless data stack — it borrows heavily from these. What differs is the center of gravity: the others optimize for fast, verifiable P2P; Warren works outward from opacity to a censor.
| IPFS | iroh | Holepunch / Pear | Warren | |
|---|---|---|---|---|
| Discovery | public Kademlia DHT, keyed by CID | dial by public key; public relays | HyperDHT — by key or topic hash | blinded PSK topics that rotate per epoch |
| Content addressing | hash of the plaintext (CID) | BLAKE3 hash of the blob | Hypercore public key | hash of the ciphertext (random per-item key) |
| Fingerprintable? | yes — CID = the content | yes — hash of bytes | key is stable | no — id reveals nothing about the plaintext |
| Connectivity | bootstrap + gateways; DCUtR punch | hole-punch, relay fallback | UDP hole-punch, relay fallback | single-socket punch, no relay in path |
| Required infra | gateways, pinning services | operated relay ecosystem | relay nodes / blind peers | none — volunteer blind peers are optional |
| Privacy default | public | key-addressed | key-addressed | private, PSK-gated swarms |
| Signed log | IPNS / mutable pointers | iroh-docs (key–value) | Hypercore (append-only) | signed append-only feed |
| Verified streaming | Bitswap blocks | BLAKE3 bao stream | Hypercore merkle | per-chunk BLAKE3-verified stream |
| Censorship resistance | not a design goal | not a design goal | not a design goal | the design center |
The signed append-only feed echoes Hypercore. The per-chunk BLAKE3 verified streaming echoes iroh's bao. The hole-punching uses the same NAT tricks the whole field shares. Standing on shoulders, deliberately.
IPFS: a vast ecosystem and durable persistence. iroh: QUIC polish, throughput, and batteries-included protocols. Holepunch: a mature runtime shipping real apps like Keet. Warren is a research prototype by comparison.
Warren is a research prototype under active development. The core connectivity, data, and sync layers are built; the real-time and transport-hardening layers are designed or planned.
A censorship-resistant short-video app — a vertical feed with no server in the middle. It's the proof that Warren carries real, heavy, encrypted content between real devices.
A serverless design pays for its properties. These are framework-level costs — the app layer adds its own (a mobile client is suspended in the background; a desktop peer isn't).
Two symmetric-NAT peers may not punch. With no relay in the path, a pair behind carrier-grade symmetric NAT can fail to connect directly. Warren leaves that pair unconnected by design rather than routing data through infrastructure; a reachable peer or a volunteer blind peer bridges availability.
Sync is pull, not push. The transfer layer downloads a feed to its head and returns; there's no live subscription yet. Fine for on-demand content, insufficient for real-time apps until live-tail lands.
No obfuscated transport yet. Discovery is blinded and identities decoupled, but deep packet inspection can still see that a peer speaks a P2P protocol — just not what, or with whom. A pluggable obfuscated transport is planned.