Why this is a protocol

Here are four properties of the network. Each can be checked against the contracts and the API rather than taken on trust.

The client chooses the route

The protocol has no notion of a hop count. A SessionRequest has a single flag, chained, and it means one thing: “I will reach this node through something else, so issue credentials without XTLS Vision”. Vision only works over a direct TCP connection and does not survive a proxy in between.

What that something else is, the network never learns. A client takes a session from one Control Plane, a session from another, and joins them on its own machine. Between them it can put anything: delay, reordering, more hops.

This follows from where a Control Plane’s job ends. It grants access to one node, and that is all.

The chain holds no traffic

This is everything that reaches the chain about time served:

struct PushItem {
    uint64  node;       // whose node
    uint64  cp;         // the Control Plane it worked for
    uint64  fromTs;     // from when
    uint64  delta;      // how many seconds
    bytes32 session;    // which session, hashed
    bytes32 permission; // which permission paid for it
    bytes   sig;        // the node's signature
}

No bytes, no destinations, no volumes. The network pays for the time a node spent working, and for nothing else. Byte counts stay at the Control Plane, which needs them for one thing: telling a working tunnel from an idle one.

The two hashes mean nothing outside the network. A session id is a random UUID. A permission digest is one-way, and the permission itself was made up by the client and signed blind, so the issuer never saw it.

Since what the traffic contains does not affect the payout, the network has no reason to look inside it, and nothing in it does. Volume is not priced either, so nobody gains by measuring it more closely than the idle check needs.

Control Planes are interchangeable

The list of Control Planes lives in CPEndpointRegistry, and anyone can read it. A client polls them itself, picks a fast one, and moves to another when it stops answering. There is no main entrance to the network.

Control Planes work as a federation. A session opened through one can run on another’s node, reports travel between them, and if a Control Plane goes down, a neighbour pushes the time its nodes served to the chain.

One part is not open yet: during the test stage the founder grants the CP role by hand. Later a Star will get it by putting up a stake, under rules the DAO sets; see becoming a Control Plane.

There is no account

The account is not hidden. There is simply nowhere to keep one.

What a Control Plane records about a session lasts as long as the session does: which node serves it, when it expires, the latest byte totals from its checkpoints, and who opened it — the wallet in the wallet tier, a random label in the anonymous one. Beside that it keeps the key that may report on the session and the permission the session runs on:

type SessionBinding struct {
    CheckpointPublicKey []byte // ed25519, 32 bytes
    PermissionDigest    []byte // one-way, or nil
    PermissionWindow    uint64 // the window that permission belongs to
}

No login, no profile, no history. Both records go with the session: the binding is deleted when the session ends and otherwise expires 48 hours after it was last written. The checkpoints themselves, each with its byte totals, are kept for four hours so that a client’s report can be checked against the node’s, and then expire. None of it reaches the chain.

There are no API keys. A key would have to be issued, stored, revoked and sometimes refused, and every one of those steps builds a list of users. Entitlement is shown with a signature or a proof, and neither leaves a trace.

The same entitlement can be shown two different ways — a wallet signature, or a proof of membership with no wallet in it at all. That works precisely because the entitlement is not tied to an account.

An Orbit is a bearer token. Before activation it transfers freely, up to ten unactivated per address. After activation it binds to its holder and starts its thirty days. Buying an Orbit and giving it away is an ordinary thing to do.

What openness costs

An open API cannot be protected by nobody knowing about it: anything not checked explicitly is not checked at all. So before writing code, read what needs a signature and what does not.

And since the client chooses the route, the quality of the route is the client’s job too. The network answers for a node being available, not for the chain you built from nodes being a sensible one.