Open source · message broker · research prototype

Every message runs under a contract.

Pigeon is a contract-native message broker. A service authenticates, negotiates what it may communicate, and every message is checked against that runtime contract before routing or delivery.

$npm install pigeonmq
Send your first message View source

How it works

Messaging begins with negotiated authority.

Pigeon keeps the normal broker lifecycle, but inserts a runtime communication contract before the message path.

01

Authenticate

The broker resolves the principal. Identity is not accepted from the message body.

02

Negotiate

Requested subjects are intersected with policy and compiled into a session contract.

03

Communicate

Publish, receive and replay execute under the resulting contract ID.

04

Decide

Admission gates allow, deny or quarantine before the message reaches a receiver.

Quickstart

Reach the first governed decision, not just a running server.

The adoption target is simple: start the broker, negotiate one contract, send one valid message, then trigger one violation.

npm · available now

$npm install pigeonmq
  1. 01npx pigeon broker start
  2. 02import { PigeonClient } from "pigeonmq"
  3. 03await pigeon.connect(["payments.authorize"])
  4. 04await pigeon.request(…)

Python and Rust are already first-party repository clients and CI targets. PyPI/crates.io publication is intentionally not shown as live until release automation and registry ownership are complete.

Why Pigeon

Topic permission is necessary. It is not the whole communication decision.

Pigeon explores what happens when the broker understands the negotiated context of a message, not only the address it is sent to.

Intent

A producer may publish to a subject but still use an intent outside its negotiated communication scope.

Data boundary

Schema-valid data can still violate classification or forbidden-field constraints.

Residency

A permitted subject can still be invalid for the region in which this message is being processed.

Evidence

A rejected communication becomes a typed decision, quarantine record and audit event instead of an opaque application failure.

Current status

Working broker. Explicit boundaries.

Pigeon is deliberately transparent about the line between the current experiment and production distributed messaging.

Shipped

  • policy-compiled session contracts
  • publish / receive / replay / ack
  • identity, intent, schema, region and data gates
  • idempotency and rate limiting
  • quarantine + hash-chained audit
  • Node, Python and Rust clients
  • cross-language integration CI
  • enforcement benchmark

Not claimed yet

  • multi-node replicated broker
  • production mTLS/SPIFFE/JWT edge identity
  • durable distributed session contracts
  • streaming consumer leases
  • Kafka / NATS / RabbitMQ compatibility bridges
  • production-grade availability guarantees
Run live demo →