01
Communication contracts
Bind an authenticated principal to explicit subjects and operations for a bounded session instead of relying on indefinite publish authority.
Open-source message broker
Pigeon Protocol v1 · Apache-2.0
Contract-native messaging.
PigeonMQ is an open-source message broker where authenticated services negotiate short-lived communication contracts and every governed message is evaluated against broker policy before delivery.
$
npm install pigeonmqmessage admission · notifications.send
principal orders-service
contract CTR_0182 · publish
message MSG_1049
identity ✓
intent ✓
schema ✓
region ✓
data ✓
idempotency ✓
broker decision → ALLOW
receiver → delivered · acknowledgement recorded
What is PigeonMQ?
A message broker where communication authority is explicit.
PigeonMQ keeps the familiar producer, broker, subject and consumer model. It adds a broker-issued communication contract that answers four questions before governed communication proceeds: who is calling, what they may do, under which constraints, and what happened when the broker decided.
02
Per-message admission
Evaluate identity, intent, schema, region, classification, sensitive data and idempotency before a governed message proceeds.
03
Consistent operations
Apply the same contract semantics to publish, receive, replay and acknowledgement rather than enforcing only at connection time.
04
Decision evidence
Return allow, deny or quarantine as typed broker outcomes and retain the evidence needed to explain the decision.
How it works
Authority is negotiated once; message admission still runs every time.
A communication contract establishes the session boundary. It does not bypass runtime enforcement. Every governed publish, receive, replay or acknowledgement is evaluated by the broker under that contract.
01
Authenticate
Resolve the calling principal from credentials at the broker boundary.
02
Negotiate
Request subjects and operations. The broker issues only the permitted communication scope.
03
Admit
Evaluate each governed message against the contract and subject policy.
04
Deliver or contain
Allow delivery, deny the operation, or quarantine the message with evidence.
Core concepts
A small set of primitives, used consistently.
Principal
Authenticated caller identity resolved by the broker.
Subject
Named communication channel with broker policy.
Contract
Short-lived authority binding principal, subjects and operations.
Envelope
Governed message plus intent, region, classification and idempotency context.
Admission
Ordered checks performed before a message proceeds.
Decision
Allow, deny or quarantine with evidence.
Pigeon Protocol v1
HTTP + JSON, with typed broker semantics.
The Node.js implementation is the canonical broker today. JavaScript, Python and Rust clients preserve the same contract negotiation and error semantics.
Protocol reference →protocol surface
POST/v1/contractsnegotiate authority
POST/v1/messagespublish
POST/v1/subjects/{subject}/receivereceive
GET/v1/auditdecision evidence
GET/v1/quarantineblocked communication
Messaging patterns
The same enforcement model across application domains.
orders.created
Service messaging
jobs.process
Async workers
agents.tool.invoke
Agent → tool
customer.profile.export
Regional flows
deploy.release.request
Operational events
notifications.send
Domain messaging
History
From autonomous vehicles to a message broker.
2024
Origins
Pigeon traces back to a dissertation on blockchain IoC for autonomous vehicles: when machines exchange messages, who may say what, to whom, and how is that proven afterwards?
Jul 2026
v0.1 · Open source
The first policy-native messaging broker is published under Apache-2.0, carrying that question from vehicles to services.
Sep 2026
v1.0 · Session contracts
Broker-issued communication contracts, per-message admission, audit evidence and quarantine become the core model.
Sep 2026
v1.1 · Multi-language
Python and Rust clients join the JavaScript client, with OpenTelemetry decision traces and federation authority primitives.
Start building
Start a broker. Negotiate a contract. Send a message.
The quickstart takes you from installation to broker health, contract negotiation, an accepted message, receiver delivery, and a deliberate policy violation with quarantine evidence.