Every QAL service on one grid: data/value/trust badges, the four tunnels, and what 'trusted' means · content/app_hub_services.md
App Hub — Services & Tunnels
Every app built for the QAL network, on one grid: what it is, what port it
answers on, and — the honest part — what it carries (data? money?) and
whether the pipe itself is trusted (encrypted or signature-verified
end-to-end). The desktop wallet's Network tab renders this grid with live
/health probes; the public App Hub page
(ui-codex/apphub.html) renders the same
grid with demo + docs links instead of live probes.
The display list mirrors scripts/manifest.json (generated — regenerate
there first, then mirror into the two UIs).
The badge matrix
- DATA — carries user content: messages, files, payloads, anchors.
- VALUE — moves, holds or issues money.
- TRUST — the transport is encrypted or authenticated/verified. A lit badge is a claim the stack can back up; an unlit badge is a honest "no" (e.g. the devnet faucet is unauthenticated; the provider adapter is plain HTTP bounded by the tailnet; qalpub is public by design).
The four tunnels (pipeline transparency)
The wallet Network tab shows "your current tunnels" — the active legs your traffic rides, each with an honesty line about what the far end can see:
| Tunnel | Target | Trust | What it can see |
|---|---|---|---|
| 💬 Chat | relay :8830 (+ fleet :8840) |
encrypted, verified, contact-pinned | ciphertext only |
| ◆ Money | loopd :8823 |
HMAC-signed, escrowed | balances, memos, receipts |
| ⛓ Chain | :9000 |
Starfish consensus, anchored | public anchors + receipts |
| 🌉 Bridge | :8837 |
token-authed, tailnet-only | transcripts & whitelisted files you expose |
What "trusted tunnel" means
A tunnel is called trusted in the UI when every layer it relies on is intact:
- Your keys — seed-derived, vault-encrypted at rest. Prevents anyone spending or signing as you.
- Pinned contacts — peers verified by qoll-code fingerprint once. Prevents relay key-substitution / man-in-the-middle.
- Relay proof-of-possession — relays hold sealed envelopes and release them only to the key that can open them; they are ciphertext-blind. Prevents server snooping, replay and rerouting.
- Chain anchoring — receipts and data anchors land on the Starfish-consensus chain. Prevents silent tampering; history becomes tamper-evident.
Untrusted by design is stated, never hidden: relays never see plaintext, qalpub is public on purpose, and dev-only pieces (faucet) carry no auth.
The services
| Service | Port | DATA | VALUE | TRUST | One line |
|---|---|---|---|---|---|
| chain | 9000 | ✓ | ✓ | ✓ | private IOTA-fork chain · Starfish consensus |
| faucet | 9123 | — | ✓ | — | devnet gas, rides the chain |
| loopd | 8823 | — | ✓ | ✓ | money rails — agents/caps/holds/settle (HMAC) |
| qmarket | 8824 | ✓ | ✓ | ✓ | P2P compute marketplace, escrow holds |
| provider | 8850 | ✓ | — | — | compute provider adapter (tailnet-bound) |
| relay1 | 8830 | ✓ | — | ✓ | encrypted store-and-forward, ciphertext-blind |
| qalpub | 8832 | ✓ | ✓ | — | public content — paid unlocks, channels |
| qalbazaar | 8834 | ✓ | ✓ | ✓ | agent marketplace, escrowed delivery |
| qalredeem | 8835 | ✓ | ✓ | ✓ | voucher codes → credit |
| qalclaim | 8836 | ✓ | — | — | points & claims ledger |
| qalbridge | 8837 | ✓ | — | ✓ | phone bridge — Bearer token, tailnet-only |
| qalid | 8838 | ✓ | — | ✓ | DID docs + challenge proofs |
| qalpay | 8839 | — | ✓ | ✓ | PSP webhooks → credit (HMAC, idempotent) |
| qalsh | — | — | ✓ | ✓ | guarded exec, rides qalchat |
| qalmcp | — | ✓ | — | ✓ | MCP over stdio — the stack as tools |
| qalpipe | — | ✓ | — | ✓ | on-chain DataAnchor CLI |
| seedkit | — | — | — | ✓ | BIP39 derive, offline by doctrine |
| wallet-app | — | ✓ | ✓ | ✓ | the Tauri wallet itself |
| relay2 (fleet) | 8840 | ✓ | — | ✓ | fleet relay #2 (often offline) |
| minirig-provider (fleet) | 8851 | ✓ | — | — | remote compute provider |
Fleet rows show "unreachable from this device" honestly when the tailnet host does not answer — the wallet never pretends a dead service is alive.