P2pKit is a Kotlin Multiplatform library for authenticated peer discovery, messaging, and durable file transfer over a reachable local network. It supports Android, JVM/Desktop, and iOS through one transport-independent API.

Current source version: 0.8.0-rc12 (development release candidate). Latest published version: 0.8.0-rc12.

0.8.0-rc12 is available from Maven Central under io.github.apdelrahman1911. It adds opt-in durable RPC result acceptance before Receipt (#543), preserving existing automatic-Receipt APIs. The release record binds the reviewed source, four review passes, regression tests, signed Maven files and verified public consumers. RPC local public identity and device-name preservation from rc11 remain available.

Frozen sample delivery awaits separate owner evidence review. Earlier rc10 samples keep their original source and bytes. Ongoing phone tests retain their own lab builds, profiles and saved results; this release does not replace them.

This is a release candidate, not a production-audit or physical-device pass. Campaign status remains governed by the validation authority. Published tags and artifacts are immutable; later snapshot changes and tests must not be described as evidence for the released binaries.

• Android API 24+, JVM 17, and iOS/iPadOS 14+ through iosArm64, iosSimulatorArm64, and iosX64.
• Android/JVM JmDNS and Apple Bonjour discovery with TCP transport.
• Authenticated protocol v2 by default using Noise_XX_25519_ChaChaPoly_SHA256 and persistent X25519 identities.
• Independent advertising/discovery states, typed failures, bounded framing, keepalive, and outgoing-session reconnect.
• Authenticated metadata envelopes and streaming file transfer with negotiated SHA-256 verification and receiver durable-commit acknowledgement.
• Coroutine/Flow APIs and explicit host ownership of lifecycle and permission presentation.

P2pKit does not provide internet signaling, NAT traversal, relays, accounts, rooms, or built-in application authorization policies. Both peers must already be mutually reachable on the LAN. Guest/enterprise Wi-Fi may block multicast or peer TCP.

0.8.0-rc8 includes immutable application-session authorization for employee-private RPC on shared trusted devices. These APIs are opt-in; existing peer-only routes remain device-level. Applications validate employee credentials, own policy transitions and clear private presentation after an employee change.

The new optional p2p-rpc module adds one explicitly selected authenticated host, dial-only clients, registered typed procedures, bounded recovery, administrator pairing and best-effort notifications. It reuses core/LAN rather than changing ordinary P2P defaults.

RPC is included in the 0.8.0-rc12 Maven publication and integrated as a section in the existing samples. Published rc3 Windows RPC Host/Client remains unavailable; its public-provider and start-gate refusals are part of those immutable binaries.

The rc4 release integrates the productive Windows installed provider and LAN fixes plus the Android accepted-socket repair. On 2026-10-19, the owner reported that the Windows/Android functionality they tested works, using the separately identified incoming artifacts—not the published rc3 samples or a new manual run of the final rc4 packages. This is successful manual testing, not complete installed qualification: the recorded Back deadline failure remains, with zero fully accepted automated UI cycles and partial W01–W11 coverage. See the source/artifact-bound handoff, Windows prerelease limitations, and RPC qualification requirements.

The library's JVM 17 bytecode contract is unchanged. The canonical Windows native sample path uses its pinned JDK 21 runtime and original admission checks; there is no JDK 17 fallback for that native provider. Publication and hosted checks do not imply completed physical-network or installed-app testing.

Use mavenCentral() and keep all P2pKit modules on the same version. Supported consumer languages are Kotlin (Android, JVM/Desktop, and KMP) and Swift through the source-built XCFramework. Java is not supported as an end-to-end SDK integration; see the Java interop limitations.

kotlin {
    sourceSets {
        commonMain.dependencies {
            implementation("io.github.apdelrahman1911:p2p-core:0.8.0-rc12")
            implementation("io.github.apdelrahman1911:p2p-transport-lan:0.8.0-rc12")
        }
    }
}

dependencies {
    implementation("io.github.apdelrahman1911:p2p-transport-lan-android:0.8.0-rc12")
    // Optional hotspot/Wi-Fi provisioning:
    implementation("io.github.apdelrahman1911:p2p-network-provisioning-android-android:0.8.0-rc12")
}

dependencies {
    implementation("io.github.apdelrahman1911:p2p-transport-lan-jvm:0.8.0-rc12")
    // Optional manual-endpoint provisioning:
    implementation("io.github.apdelrahman1911:p2p-network-provisioning-desktop:0.8.0-rc12")
}

Kotlin Multiplatform root coordinates select their platform variants. The complete 21-coordinate publication set is recorded in the 0.8.0-rc12 release record.

The Maven publications serve Kotlin Multiplatform consumers. A direct Swift application builds P2pKitShared.xcframework from this repository:

./gradlew :p2p-transport-lan:assembleP2pKitSharedReleaseXCFramework

The maintained Swift sample and provenance-checked integration live under samples/iosApp.

The 0.8.0-rc12 release uses Kotlin 2.4.20, with the iOS 14 library floor retained explicitly. Kotlin Multiplatform applications that link their own Apple binary must apply the iOS 14 Kotlin/Native override documented in the compatibility policy; repository-built XCFrameworks apply it and verify every Mach-O slice automatically.

Authenticated v2 is the default and fails closed. Exchange the full pairing QR or fingerprint through a trusted channel, then pin the expected identity:

import dev.p2pkit.core.AppId
import dev.p2pkit.core.P2pKit
import dev.p2pkit.core.P2pMessage
import dev.p2pkit.transport.lan.lan
import kotlinx.coroutines.flow.first

val kit = P2pKit.create {
    appId = AppId("com.example.transfer")
    deviceName = "My device"
    transports { lan() } // Android: lan(applicationContext)
}

kit.start()
kit.startAdvertising()
kit.startDiscovery()

val expectedFingerprint =
    requireNotNull(kit.parsePeerPairingQr(qrFromTrustedChannel))
val peer = kit.peers.first { it.isNotEmpty() }.first()
val session = kit.connect(peer, expectedFingerprint)
session.send(P2pMessage.Text("hello"))

For an executable discovered-peer example, the CLI's pairing and connect-pinned <peer-alias> <full-pairing-QR> commands implement this exchange; see the sample pairing walkthrough. The interactive samples' incoming admission remains development-only, not an allowlist. The KMP sample separately demonstrates PinnedOnly admission.

Subscribe to incomingSessions before advertising and attach each session.incoming collector promptly; these are hot event streams. send() confirms a local transport write, not remote application processing. Add domain-level IDs, ordering, deduplication, acknowledgements, and repair where your application requires them.

Building Android AARs or APKs from the released rc8 source requires NDK 29.0.14206865 alongside the Android SDK; see the canonical SDK setup. Its JNI socket helper atomically establishes nonblocking/close-on-exec flags at the existing API 24 minimum and builds all four Android ABIs. The recorded kernel/JNI runtime controls passed on Android 10/API29 arm64; this is not coverage of every Android version or ABI. Historical published rc3 artifacts retain their original bytes.

Initialize secure identity storage once from Application.onCreate() before constructing a kit:

class MyApplication : Application() {
    override fun onCreate() {
        super.onCreate()
        P2pKitAndroid.initialize(this)
    }
}

Declare the base LAN permissions:

<uses-permission android:name="android.permission.INTERNET" />
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
<uses-permission android:name="android.permission.CHANGE_WIFI_MULTICAST_STATE" />

For an app targeting SDK 37+, raw LAN additionally needs the dangerous android.permission.ACCESS_LOCAL_NETWORK grant on Android 17/API 37+. Declare it in that final app (not in apps targeting SDK 36 or lower):

<uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK" />

The current development source reports this live grant as P2pPermission.LocalNetwork through kit.permissions; this is not a claim about older published binaries. The app requests access using Android's permission APIs and rechecks the live result before retrying its intended operation. Denial/revocation must not trigger automatic start or prompt loops. Preflight direct start()/connect() calls too; only the advertising/discovery feature entry points perform the SDK permission gate. A preflight cannot prevent a later OS revocation, so handle operation failures and keep cleanup available. Android 16's explicit local-network compatibility opt-in is a separate test mode, not ordinary API 36 behavior. See the Android policy.

The optional network-provisioning sidecar has separate runtime permission and system-state requirements. Query its permission manager immediately before a provisioning operation; do not gate the base LAN transport on those permissions.

The final application Info.plist must contain a nonblank local-network reason and the secure-v2 Bonjour service:

<key>NSLocalNetworkUsageDescription</key>
<string>Find and connect to nearby devices on your local network.</string>
<key>NSBonjourServices</key>
<array>
    <string>_p2pkit2._tcp</string>
</array>

Keep these values in the source that generates the final plist. The sample uses samples/iosApp/project.yml. Add the legacy _p2pkit._tcp service only for an explicitly configured deprecated plaintext-v1 build; v1 and v2 do not interoperate or downgrade.

Core intentionally has no plaintext secure-identity default. Install a durable, confidential, integrity-protected operating-system-backed store:

val kit = P2pKit.create {
    appId = AppId("com.example.transfer")
    deviceName = "Desktop"
    jvmSecureIdentityStore(protectedIdentityStore)
    transports { lan() }
}

putIfAbsent must be atomic across processes and durable before returning. The samples' in-memory stores are development-only.

See the architecture overview and current specification.

Discovery TXT records, names, peer IDs, and AppId are untrusted. The default RejectUnknown policy requires an exact trusted identity. The explicit-risk AcceptAnyAuthenticatedSameApp policy encrypts and authenticates key possession but does not identify a person/device; it requires application-level admission. There is no automatic fallback to plaintext.

Public collection models are snapshot values. Text/binary messages are capped at 4 MiB. File transfer is streaming and completes only after the authenticated receiver verifies the sender's prepared SHA-256 snapshot and completes the destination's platform durability contract. The JVM destination fsyncs file content and atomically publishes it; POSIX hosts also fsync the parent directory. The public JDK exposes no equivalent parent-directory barrier on Windows, so sudden power loss may lose the renamed directory entry there.

Use the operational limits reference for current admission, receive-backlog, framing, discovery and timeout policies, their observable failures, and the settings applications can configure.

Read the security model, compatibility policy, and 0.6-to-0.7 migration guide. That guide retains its historical security-transition scope. Upgrading from 0.7 to 0.8 also requires reviewing the 0.8 behavior changes and RPC/Windows limitations.

The 0.8.0-rc12 release record binds immutable source 4c25bf28a9c1561c129387b7c6786425b18e0f98 to all fourteen mandatory components in original main run 42360977579/1. All 125 declared command outcomes passed with closed captures and known cleanup. Hash-bound report entries are metadata, not unique or decrypted test counts. Coverage includes API/ABI, strict Dokka, dependencies/SBOM, publication shape, isolated consumers, Swift/XCFramework and native ARM64/Intel execution.

Protected publisher 42364155910/1 passed. Its original validator checked 121 signed originals across 21 coordinates; independent archive inspection verified all 726 file hashes. Remote comparison matched 242 files against the signed bundle and completed isolated consumer builds. The publication-build SBOM contains 88 components. Frozen application delivery awaits separate owner evidence review. The installed phone-test apps and results remain bound to their own lab source.

The unpublished rc9 attempt retains its original ARM64 runner/evidence-upload failure and publisher refusal before signing/upload. The rc8 record retains its historical source cleanup failure and unchanged-source replacement; neither is relabeled by rc10's success. Known-route protection remains distinct from fair unknown-peer discovery and guaranteed connectivity; review its authorization, expiry and capacity contract. The opt-in 256-client policy is not a physical mobile-capacity pass. Stable/production remains NOT_READY while independent, physical-device and formal installed-Windows qualification is incomplete. Issue #520 remains an unresolved, owner-deferred intermittent iOS observation.

The 0.8.0-rc7 record retains its exact source bc3a28e8e381b49585fb697160cb954bc642ea29, original Intel runtime-enumeration timeout and unchanged-source replacement. Its protected publication and seven verified public downloads remain historical rc7 facts. Those immutable binaries do not include rc8's known-route protection, application-session authorization or host256().

The 0.8.0-rc6 release record records the exact main-source modular qualification, API/ABI, strict Dokka, dependency/SBOM, publication shape and consumers, Swift/XCFramework checks, and native ARM64 and Intel simulator execution. Maven publication separately verified signed remote bytes and consumers; the sample publisher verified complete anonymous download hashes for all four applications and their public metadata.

These results belong to release source 3ef2c6155abd66292011c3775b30fb71d280e9c7, not to later documentation or feature commits. Post-release iOS test-harness maintenance distinguishes invalid keyboard-key geometry from actual hittability: an indeterminate key proves neither input readiness nor keyboard dismissal. The real English/German input and consent tests retain their assertions and deadlines; this test-only change does not modify the published 0.8.0-rc6 binaries. A resolved-graph SBOM is not a scan of every distributed binary; a successful build or simulator test is not a real-device or installed-application result. The iosArm64 device target still needs external hardware for runtime testing. Focused API35 credential-lifecycle and API37 permission/recreation/TCP cases have separately recorded hosted acceptance; they are not a general device suite or installed tests of the published packages. The published 0.8.0-rc6 retains its API24–32 preview limitation. The rc7 Android sample adds lifetime FLAG_SECURE on those APIs, including its foreground-capture tradeoff. The earlier-source synthetic API24 and API32 witnesses retain their accepted original task-preview/lifecycle evidence; they are not re-execution at the rc7 release source and do not establish natural-credential, physical-device or all-OEM coverage. See the current policy and evidence limits. Android host JVM tests (including Robolectric shadows) are not ART or physical-device evidence.

The canonical six-area status table records external campaign progress and links each execution handbook. In particular, the CLI/Desktop row's partial automated coverage is not a completed fault-injection or real-display campaign. See automated scope and history for the distinct host/target evidence. Do not treat this release candidate as fully production validated or independently audited.

• Mac continuation handoff (start from main)
• In-progress audit checkpoint (not a release approval)
• Documentation index
• Contributing
• Security reporting
• Support policy
• Changelog

P2pKit is licensed under the Apache License 2.0.