Keep working offline
A publish succeeds when the item is durably committed on the device—not when a server answers. Applications keep the same data model through short outages and long partitions.
Open source · Offline first · Source-authenticated
Keep data moving when the network disappears.
Aster is an offline-first data mesh for applications that cannot depend on continuous connectivity or trusted infrastructure. Publish to a local node, carry protected data across direct peers or payload-blind relays, and reconcile it according to explicit data-class semantics.
Apache-2.0
Rust reference implementation
Connect · gRPC · gRPC-Web
Evaluation-stage project
mise install mise run tour-relay ASTER · PAYLOAD-BLIND RELAY 00:18 Move protected Events through a relay that cannot read them ● n0 Origin ─── ● n1 Blind relay ─── ○ n2 Responder ━━━━━━──── 2 / 7 verified phases ◒ Relay delivers Ping running: n1, n2 · direct Iroh · hybrid-PQ mission
Built for disconnected systems
The network should accelerate delivery—not decide whether your app works.
Field teams, vehicles, sensors, and edge services move in and out of reach. Aster makes local durability the success condition, then synchronizes when an authenticated contact becomes available.
Trust the data, not the path
Route-only relays can store and forward protected Events without content keys. Authorized recipients verify the source, scope, epoch, and content before accepting an item.
Keep conflicts honest
Aster preserves causality across partitions. State converges deterministically, Records keep concurrent siblings for explicit resolution, and Events expose authenticated sequence gaps.
How Aster works
A durable path from publisher to application
Aster separates application semantics, mission identity, and carrier connectivity. Each layer can evolve without handing correctness to a central service or synchronized wall clock.
1
Publish
Your application publishes a typed item. Aster protects it at the source and commits it locally. That durable commit is what success means.
2
Authenticate
Before inventory is exchanged, peers authenticate both the carrier endpoint and the mission identity. Ordered control and rekey state activates before application data.
3
Reconcile
Nodes compare compact inventories for the network-enabled data classes and scopes the receiver requested, transferring differences instead of full datasets.
4
Relay
Direct peers move data when they meet. Route-only intermediates can store and forward sealed Events without decrypting them or presenting them to an application.
5
Deliver
Recipients verify source, scope, epoch, and content before commit. Applications consume durable Events at least once, receive durable positive-current-version State and whole-key active-head Record projections, and resolve Record conflicts only after a fresh query.
Four data classes
Choose behavior, not a storage primitive
The class is part of the protocol contract. It tells every implementation what may converge automatically, what must stay ordered, and where the application must decide.
Convergent value
State
Position, device health, active settings
One current value per logical key. Causality chooses successors; concurrent updates converge deterministically while retained history remains inspectable.
Ordered fact
Event
Messages, observations, audit entries
Immutable items ordered per publisher. Consumers can detect authenticated sequence gaps and acknowledge durable, at-least-once delivery.
Application-owned conflict
Record
Plans, forms, annotations, workflows
Mutable documents with every concurrent head preserved. The whole active-head set can be delivered as one durable projection, but sibling IDs do not authorize resolution: Aster requires application review and a fresh exact-query guard.
Immutable content
Blob
Imagery, maps, attachments, model files
Immutable chunks are bound to an authenticated manifest and stored through crash-resumable encrypted local staging. The live Rust API supports peerless durable publication, bounded authenticated reads, metadata-only delivery, and direct resumable transfer between content-capable peers. Route-only custody, TTL and garbage collection, representative physical or mixed-implementation acceptance, and release authorization remain open.
Designed for integration
A mesh engine that stays behind your application boundary
Bring Aster into an existing stack without making the application understand peers, carriers, or reconciliation.
Separate carrier from protocol
The IP runtime uses direct Iroh or one exact operator-pinned connectivity relay, while mission identity, source authenticity, and data semantics remain independent. The controlled relay is connectivity infrastructure—not an Aster node, store, route grant, or payload-blind Event relay. Hosted lookup, public/default relay substitution, and port mapping remain disabled; the carrier boundary is designed for additional carriers without changing the application model.
Protect data end to end
Peers authenticate mission membership before inventory. Every accepted item is checked against source, scope, epoch, and content commitments; route-only relays do not receive content keys.
Bound work on constrained nodes
Receiver interests, route authority, capped pages, and class-separated reconciliation limit what a contact can request. Priority, finite-TTL custody, and operator quota enforcement remain tracked roadmap gates.
Share by topic and scope
Topics describe what data means. Scopes bound where it may travel. The opt-in semantic-v6 Event bridge uses signed, static directed edges with topic, priority, and hop-count narrowing. Dynamic administration, cross-class bridges, and production qualification remain open.
Integrate through ConnectRPC
The loopback agent exposes Event and status operations through checked-in Protobuf for Connect, gRPC, and gRPC-Web—no hosted schema registry required. Rust, C, Go, and Python APIs support linked deployments.
Package for Kubernetes, Zarf, and UDS
Run one agent as a same-Pod sidecar, keep RPC on loopback, and give it exclusive ownership of durable state. A Zarf package can carry the images, local schema, policy, and storage, then compose into UDS.
Try the mesh
Watch the mesh work, then take control
The live tour verifies a deterministic offline and relay path as it unfolds. The playground keeps 2 through 32 independent local node processes running so you can choose a publisher, send synthetic messages, and isolate, stop, or rejoin nodes while exact Event observations update. Default-off LAN and hierarchy guides separately exercise mission-authenticated discovery and static, payload-blind Event bridges without turning those procedures into retained physical or production evidence.
1 Clone Aster and install its pinned tools
git clone https://github.com/defenseunicorns/aster cd aster mise install
2 Watch a verified path unfold live
mise run tour-relay
3 Choose 2–32 local demo nodes
mise run playground -- --nodes 5
4 Send messages and change availability
send 0 hello from the left isolate 2 send 1 retained during isolation rejoin 2 status
Built for evaluation. Explicit about what is left.
Aster is an evaluation-stage reference implementation for protocol evaluation, application integration, and controlled capability testing—not production deployment. Event, State, Record, and Blob have live Rust APIs; Event also has a local ConnectRPC API. Default-off mission-authenticated LAN discovery and the static Event hierarchy have bounded procedures and same-host diagnostics, not retained physical, hostile-network, capacity, or production evidence. The live surfaces, demos, and retained receipts each have explicit claim limits. Production authorization still depends on the tracked security, interoperability, platform, operations, and representative acceptance gates. Follow Project status for exact evidence and remaining gaps.