The transport and replication layer of the CIRIS Epistemic Web (CEWP). A single Rust crate that moves the 15 signed envelope kinds of the CEG grammar between federation peers over any medium — Reticulum mesh, HTTPS, packet radio — decides who is allowed to learn a claim exists, and attributes every inbound byte to a cryptographic identity before any handler sees it.
Edge is the operational realization of Constitution Part 5 — Transport & Substrate, built on two disciplines: fail-secure (a missing key or unresolved consent resolves to less access, never a silent downgrade) and integrity through structure (privacy and authenticity are properties the wire format cannot violate, not promises an operator makes). Its design thesis, from contextual integrity: "the strongest flow rule is one the network cannot express breaking."
📖 The protocol spec:
FSD/CIRIS_EDGE_TRANSPORT.md— the 15 EnvelopeKinds, the cohort/namespace projections, the anti-entropy state machine, the transport attribution pipeline, the serve/consent gates, and the CEG-vs-OSI layering, with diagrams and code anchors. Start there.
host application code
│ registers handlers ┌─ Reticulum mesh (TCP / LoRa / serial / I²P)
▼ │
ciris-edge ──── anti-entropy replication ───┼─ HTTPS (bearer / mTLS)
│ attribute at the wire · serve by consent │
▼ └─ packet radio
ciris-persist ──── keys · attestations · trace · admission
One shape, many peers. Library, not sidecar. Verify happens at the wire,
before any handler sees a byte. Key seeds never cross the FFI boundary. Every
transport is a projection of one Transport trait; Reticulum is canonical, HTTPS
is the production fallback so cloud deployments participate today.
MISSION.md— the WHY. Mission-Driven Development alignment to CIRIS Accord Meta-Goal M-1; per-module missions; anti-patterns; failure modes.FSD/CIRIS_EDGE_TRANSPORT.md— the protocol. State machines, the 15 kinds, namespaces, attribution, consent-routing, CEG↔OSI.FSD/CIRIS_EDGE.md— the architecture spec, crate shape, public API surface, verify-via-persist contract, test categories.
Every claim is one of 15 signed EnvelopeKinds,
each its own anti-entropy stream. A claim's cohort_scope (self → family
→ community → affiliations → species → biosphere → federation) resolves
to a projection — SelfOwn (publish-your-own, structurally invisible — no
directory advertisement), Cohort (roster hold-and-forward), or Global
(commons + anti-rollback tombstones). Peers reconcile per (peer, kind) via a
bidirectional Summary → Diff → Deliver round. Every inbound frame is
attributed at ingest to a Rooted ∧ owns_key federation identity (a fresh
peer bootstraps via a narrow, self-authenticating {Key, IdentityOccurrence, TransportDestination} carve-out); an unattributable frame is dropped before any
serve gate is consulted. Only the Attestation plane is consent-gated — a
consentable claim flows to a peer only if the producer's consent grant includes
it, the recipient holds infra:serve, and it satisfies any recipient_capability
restriction. The recipient axis cannot exceed the transmission principle,
by construction.
Edge realizes the lightnet/darknet split of
CC 5.4.6: a
public identity plane (announced, rooted, attributable — no anonymity
claim) and a derived group plane (per-group destinations derived from
directory state members already hold — never announced, so group existence
is structurally invisible to outsiders). Derivation replaces discovery;
determinism replaces coordination. What that buys — private manageable
groups, decentralized video over member-relays, and the posited
occurrence-invisible ballot — and the measurement status of each claim, is in
docs/LIGHTNET_DARKNET.md. The proofs run as
the multi-container acceptance bench (bench-mesh/,
real video + real blobs through real relays, in CI).
v18.2.x — measured, not promised. The acceptance sweep is at 100%:
across every tested group size, real encrypted video and files were
delivered between separate machines through a relay that can neither read
them nor learn the group exists; members joined mid-stream; keys rotated
without a single lost frame; retired addresses verifiably went dark while
their successors kept answering; outsiders were refused. Every one of those
sentences is a test that fails loudly if it stops being true
(bench-mesh/; labels and evidence in
docs/LIGHTNET_DARKNET.md).
Under the hood: production CEG-native transport, scope-native addressing end
to end (#499), the A/V mesh spine, and the delivery-model completion cut
(v18.2.0: every replication plane activatable, every special case a named
tested predicate, spec re-synced to code). Reticulum + HTTPS + packet-radio
transports; the anti-entropy replication engine; the #393 two-item
attribution gate; MLS cohorts (TreeKEM, X-Wing) with scope-derived
addressing and seal/retirement; mandatory hybrid Ed25519 + ML-DSA-65 on
every producer; PyO3 + UniFFI mobile surfaces (Android floor: API 24).
Pinned in lockstep to ciris-persist via drift-witnessed policy hashes.
CIRISConstitution— the canonical CEG spec (Part 5 is edge's transport substrate; Part 2 the grammar; Part 3 the namespace).CIRISPersist— substrate: federation keys, attestations, trace storage, admission (theput_*surface edge replicates onto).CIRISVerify— hybrid crypto primitives (Ed25519 + ML-DSA-65, X-Wing), consumed transitively via persist.CIRISAgent— reasoning loop; emits signed traces edge replicates.CIRISRegistry·CIRISLens— identity/build directory · analytical observatory; federation peers.
AGPL-3.0, matching the CIRIS stack. License-locked mission preservation per
MISSION.md §6.