A sovereign line to a machine you own, without an operator-run control plane.
Direct paths are preferred and measured. The current browser path never silently inserts a data relay, and it reports when network physics prevents a direct connection. Rendezvous uses public Nostr and STUN infrastructure: signaling content is sealed, while those services can still observe network and timing metadata.
Why it exists
Every remote-access tool I had used put a company in the path. Tailscale needs a control plane and falls back to relays that carry your packets. TeamViewer and ngrok are third parties that see the session. Raw WireGuard is honest and fast, and then it dies the moment you are behind CGNAT, or on a carrier that hands you no IPv4 and no port to forward.
ByteTraverse is the line I wanted: one whose identity and authority I own, that exhausts sovereign direct paths before considering anything in the middle, and that opens from a browser with nothing installed.
What it is
No operator-run control plane or hidden data relay. Public Nostr relays and STUN observers are still third-party infrastructure; they carry sealed rendezvous material and network observations, not the console session.
The current browser carriage is direct and the application session is end-to-end encrypted between your devices. Public rendezvous services, NATs and carriers can observe network metadata; they cannot decrypt the sealed signaling or DTLS session.
It has demonstrated direct traversal across ordinary NAT and specific CGNAT/NAT64 topologies with no port-forwarding, including from an unmodified browser. Hard endpoint-dependent NAT can still make a direct path physically unavailable, and ByteTraverse reports that instead of hiding it.
How it works
Discover
Both ends learn their own public address from public STUN servers, and read the shape of the NAT in front of them.
Rendezvous
They exchange sealed connection offers over public Nostr relays. The relays carry only AES-GCM ciphertext; the box's answer is BIP340-signed by an identity you pinned at enrollment, so a relay can neither read it nor forge it.
Traverse
Both ends send at once to open their NATs, the WireGuard hole-punch. On a carrier that gives the phone no IPv4, the box's address is embedded in the carrier's own NAT64 prefix, so the carrier's translator delivers the packets. No port-forward, no UPnP, no relay.
Transport
The tunnel is clean-room WireGuard, Noise IKpsk2, end to end. The browser console rides a WebRTC DataChannel, DTLS-encrypted to the box.
Identity
Device keys are generated non-extractably in the browser and never leave it. The box is pinned on first use, the way SSH records a host key. Every enrollment link is single-use.
Proof
One retained live proof: a stock Safari iPhone on an IPv6-only carrier reached a v4-only home box with no public IPv6, app, data relay or port-forward by using the carrier's NAT64 path. That is evidence for this topology, not a claim that every carrier/NAT pair can form a direct path. A representative trace:
addresses are documentation ranges (RFC 5737). the NAT64 prefix is the well-known 64:ff9b::/96.
Status
What is proven, what is not. Own-infrastructure real-device testing is authorized; independent professional cryptographic assurance is not complete.
Composition
The WireGuard core is clean-room Rust. Its primitive crate is zero-dependency with unsafe forbidden and RFC/vector coverage; kernel wg interoperability is tested separately. The handshake is WireGuard's Noise IKpsk2, rebuilt from the whitepaper. Browser signaling uses separately vendored third-party cryptography, pinned by exact hash, rather than pretending the whole product has one implementation.
Roadmap
ByteTraverse is early, and honest about where it is. The browser console works today and is the artifact you can use now. The native WireGuard data plane is built and waits on an independent professional crypto audit and closure of the remaining constant-time assurance residuals before it carries real traffic.
Next: dial a machine by a stable name instead of a key, and a native client for the networks a browser cannot reach.