Architecture
Cells & Blast Radius¶
The network is deliberately compartmentalised. If one part is compromised, only a small portion of the group is affected — and even that portion loses only metadata, never content.
Independence is structural, not enforced¶
A client holds N cell secrets, and a cell is a machine — so the N credentials land on N distinct machines by construction. No assignment logic has to be trusted to spread them; the vocabulary guarantees it.
This is why the words matter. Had "cell" meant an address rather than a machine, a client's N credentials could co-locate on one host, a single host compromise would take all N at once, and the redundancy would be decorative.
The redundancy math¶
A client is stranded only if all N of its cells fail inside its response window.
For independent per-cell failure probability p, that is pᴺ:
| N | p = 0.1 | stranded per 10k devices |
|---|---|---|
| 3 | 1e-3 | ~10 |
| 10 | 1e-10 | ~0 |
| 40 | 1e-40 | never |
N = 10 buys roughly eight orders of magnitude over N = 3, at negligible cost.
This is why N is 10 and not 2–3 — and why it is a manifest tunable
we can push to 40 to experiment. The pᴺ argument holds only under
independence, which is exactly what the cell-is-a-machine topology provides.
See depletion for how these N credentials wear down and get refreshed.
Compartmentalisation is a dial¶
A compromised cell yields metadata only — who talked to whom, when, how much, for that cell's devices. Not content (end-to-end encrypted), and no ability to impersonate (identity chains to the root). But metadata still matters, and how much leaks is a design choice:
| Cells per device (N) | Total cells | Exposure per compromised cell |
|---|---|---|
| 10 | 20 | ~50% |
| 10 | 100 | ~10% |
| 10 | 200 | ~5% |
Redundancy and compartmentalisation pull against each other, and the ratio must be set deliberately.
Target ~100 cells at 10k devices
~100 cells → ~1,000 connections each, ~10% metadata exposure per compromised cell. These are small machines, so the cost is mostly operational, not hardware. To be revisited against real operating cost.
Two dials, two layers¶
Do not confuse the resilience dial with the compartmentalisation dial:
| Dial | Layer | Protects against | Set by |
|---|---|---|---|
| Slots per cell | one machine | a single address being blocked/blackholed | per-cell resilience |
| Cells per client (N) | across machines | a whole machine being compromised or failing | client redundancy |
A cell binding 200 addresses serves 200 different clients' single addresses — not one client's 200. See address derivation for the grid.
Cross-cell communication¶
When devices on different cells talk, cells relay to each other over links authenticated by the same root key. The relaying cell sees ciphertext and a routing header — never content. A client connecting to multiple cells then becomes a reachability choice (redundancy if its home cell dies), not a requirement for reaching anyone.
Still open
Whether cross-cell traffic is best served by cell-to-cell relay (preferred) or client multi-homing is not yet settled. See open questions.