Share a service, not a network.
Kepos gives trusted devices access to selected services without exposing a public service port or joining every device to a virtual subnet. A publisher owns the service and its allowlist; a subscriber receives the allowed service as an ordinary local URL or TCP port.
Kepos has no hosted account or Kepos-operated control plane. Device keys stay
on the devices that created them. Kepos carries TCP byte streams through an
authenticated peer connection whose Internet transport uses UDP. Services are
raw tcp by default; a publisher can opt a plaintext HTTP/1.1 target, including
a ws:// upgrade endpoint, into kind = "http" so the target receives the
authenticated subscriber device identity. See the HTTP service contract.
Kepos is a developer preview. Android APKs, Apple Silicon macOS ZIPs, and Windows x64 portable ZIPs are available for direct download. Android is sideload-only; macOS is ad-hoc signed and not notarized; Windows is not Authenticode-signed and may trigger SmartScreen.
The Kepos user documentation is the primary installation, pairing, publisher, subscriber, trust, comparison, and troubleshooting guide.
Developers and operators can continue with:
- Developer architecture
- CLI, identity, and configuration
- Platform and release guides
- Nix, container, and Kubernetes deployment
- Network transport and compatibility
| Surface | Roles | Current boundary |
|---|---|---|
| Android | Subscriber | Android 12+, arm64-v8a, sideload-only; persistent app-private subscriber identity |
| macOS | Publisher, subscriber, or both | Apple Silicon; native desktop app; ad-hoc-signed direct-download ZIP |
| Windows | Publisher, subscriber, or both | Windows 10 x64 build 19045 (22H2)+ and Windows 11 x64; portable ZIP with optional per-user install |
| Headless CLI | Publisher, subscriber, or both | Node.js 24; local HTTP gateway and explicit raw TCP listeners |
| Nix / Home Manager | Publisher and CLI | Declarative publisher policy; private keys stay out of the Nix store |
| Container | Publisher and subscriber | Non-root linux/amd64 image; deployment owns state, networking, and supervision |
The repository's Kubernetes path is an operator-owned subscriber gateway, not a shipped cluster product. See deployment for its boundary.
These links follow GitHub's latest stable release and do not select beta prereleases:
- Android APK — subscriber only
- Apple Silicon macOS ZIP — publisher and subscriber
- Windows x64 ZIP — publisher and subscriber
Optional: download SHA256SUMS and SHA256SUMS.minisig from the same release and
follow the public release verification reference.
The maintainer-only release procedure is separate.
Requirements: Node.js 24, npm 11, and initialized Git submodules for desktop development.
git clone --recurse-submodules https://github.com/LamplitIsles/kepos.git
cd kepos
npm ci
npm run kepos -- --helpRun the full portable check:
npm run checkUseful platform checks are separate from the root check:
npm run android:check
npm run android:install
npm run android:device-check
npm run desktop:check
npm run desktop:native-checkandroid:install uses adb install -r, preserving app-private state. The
physical-device gate uses the isolated io.github.ttalab.kepos.devicetest
package so it cannot replace or remove the installed Kepos app.
The website is the @lamplitisles/kepos-web npm workspace:
npm run web:dev
npm run web:verify
npm run web:deploy:dry-runCloudflare Git Builds are disabled. Deployment is a local post-merge operation; do not use the deploy command for ordinary development.
- Android subscriber
- macOS desktop
- Windows desktop
- Maintainer release procedure
- How Kepos grew from Hypertele
- Architecture decisions
- Physical and field evidence
The evidence directory records environments, commands, failures, and remaining gates. It is separate from current product claims.