soft3 radio — the transport the stack actually needs

radio is the largest module in the stack by a wide margin: 194,163 lines of Rust in 497 files, 334 dependency crates for cyber-radio alone, 646 for the workspace. it was forked from iroh 0.96 wholesale to change one hash. the fork delta in the core transport is +72/−71 lines; the stack's consumers use an endpoint, connect, accept and two streams. this page measures what is there against what the specs require, names the optimization vectors, and projects the module the way soft3 would build it — transmit only, addresses from the graph, identity from the neuron, format from hemera, frame from tade, store in bbg — with a line budget.

1. what is there

our own code in the tree: cyber-bao + particle + radio-cli + tests ≈ 5,300 lines — 2.7%. everything else is upstream iroh with the hash swapped in blobs (766 diff lines) and gossip (98).

the dependency graph carries the IPFS era twice: upstream iroh 0.96 + registry iroh-quinn next to the vendored fork; blake3 1.8.3 + bao-tree 0.16 through registry iroh-blobs under docs and willow (the README's "zero BLAKE3" is false); ed25519-dalek 2 and 3; redb 2 and 3; cyber-hemera 0.1.2 and 0.3.1. iroh-docs does not compile; iroh-ffi depends on a feature that does not exist; launch row 39 records that radio fails from a clean checkout.

2. what the stack requires of it

from soft3/specs/routing.md, foculus/specs/gossip.md, cyb/decide/wire.md, cybergraph/specs/address.md (branch docs/locus-0927), radio/specs/neuron-context.md, tade/spec, cyber/network.md, cyber/launch.md:

the gap is not a missing feature. it is that iroh is a network product and the stack wants a wire.

3. optimization vectors

3.1 cut: zero consumers, zero spec (−~78K lines, −~250 crates)

3.2 replace with our components (−~12K, and the module becomes soft3's)

3.3 keep, and keep upstream

QUIC (quinn with multipath, QNT hole-punching, QAD), TLS (rustls, raw public keys), HyParView + Plumtree, netwatch, portmapper for home NATs. these are the parts where a rewrite is the trap: a QUIC implementation is 40K lines of state machine and a decade of interop; the n0 fork's hole-punching inside QUIC is the best available and is being upstreamed. vendoring them under cyberia-to names for publication is right; editing them is not.

4. the projection — radio in the soft3 taste

one verb: transmit. radio dials, punches, relays through a peer, gossips, and pipes verified streams. it holds no address, no identity, no store, no reconciliation, no format, no frame of its own.

radio
├── endpoint   bind · dial(EndpointAddr) · accept · ALPN registry · raw-pk TLS, hybrid PQ KEX    ~1,500
├── paths      ip paths · QNT punch events · peer-relay path · path selection (from socket/)     ~2,000
├── relay      forward datagrams for two of my peers over radio/relay/1 · delivery receipt       ~600
├── observe    observed address by QAD from peers · interface changes (netwatch)                  ~300
├── gossip     HyParView membership · Plumtree broadcast · topic = hemera id · message = signal   ~2,000
├── stream     the tade binding: a QUIC stream is a sequence of tade frames                      ~300
├── fetch      get/provide by particle · ranged verified streaming · resume at last good chunk   ~2,500
└── custody    store-and-forward queue for signals when a path is dark (the interplanetary case) ~800
cyber-bao      the ranged adapter over hemera::stream (ours today)                               ~3,800
                                                                                        own code ~13,800
deps: quinn fork (~50K, vendored for publication) · netwatch/portmapper (~7K) · rustls · tokio

the IPFS era, named so it stays gone: CID and multiformats → particle; DHT, DNS seeds, pkarr → cyberlinks on the book; bitswap-shaped blob store → bbg; DERP relay fleet → the peer that follows you, paid in focus; docs/willow → foculus; postcard → tade; ed25519-as-identity → neuron bound by signature; a measurement pipeline → lytics.

what the interplanetary row adds that iroh has nowhere: custody — a signal accepted for forwarding is kept until a path confirms delivery; idle paths are dark, not dead; streams resume by particle range. gossip's "eventually connected ⇒ every correct node receives it" (VEC P4) is a transport property only if the transport holds the bundle across the dark.

budget: ~14K lines of own code against 194K in the tree today — fourteen times smaller — with ~80 crates instead of 334, one quinn, one ed25519, one hemera, zero blake3. counted with the vendored quinn and nettools the tree is ~70K, of which 80% is a QUIC stack we do not edit.

5. order of work

1. trim (a week, no design): delete docs, willow, ffi, dns-server, car, relay server, gossip sim/rpc, blobs rpc/store/tickets/examples; dedupe the lock (one quinn, one ed25519, one redb → none, one hemera); the tree builds from a clean checkout (launch row 39). −~78K.
2. the tade binding and the signal-as-message: one framing for settle gossip, signal gossip and fetch; u32 LE and postcard envelopes retired. closes the three-framings conflict.
3. graph addressing: dial(EndpointAddr) only; the node parses ANTENNA/SOCKET; ANTENNA carries the NSIG1 binding; cy wire stops deriving neurons from endpoint keys (cyb/decide/wire.md:60).
4. relay-through-peer over radio/relay/1; delete the WebSocket relay actor and mapped-addr machinery once the peer path works across two machines (the soft3/status.md:80 milestone).
5. hybrid PQ KEX by provider swap; the ed25519 transport key becomes explicitly ephemeral and bound.
6. custody for the dark-path case, behind the foculus delay-tolerant regime.

what this page does not decide: whether mdns stays as an optional LAN bootstrap; whether ranger.rs moves to foculus before or after launch; the relay receipt format (a cyberlink, presumably). launch rows touched: 21, 22, 34, 39, 42.

6. QUIC — the boundary, and where the stack enters it

what QUIC is, and why its core is not ours to rewrite

QUIC (RFC 9000/9001/9002) is a transport over UDP that folds four things that TCP+TLS keep apart into one state machine: connection establishment with TLS 1.3 inside the handshake (1-RTT, 0-RTT resumption); per-packet AEAD protection with separate key levels (initial, handshake, 1-RTT) and key update; loss detection and congestion control driven by ACK ranges, probe timeouts and pacing (RFC 9002); and many independent streams per connection with per-stream flow control, so one lost packet stalls one stream, never the connection. on top: connection ids that let a connection survive an address change, path validation (PATH_CHALLENGE/RESPONSE), anti-amplification before validation, PMTU discovery, version negotiation. the n0 fork adds three extensions: multipath (several validated paths under one connection, each with its own congestion state), QAD (a frame that tells a peer which address it is seen at), and QNT (ICE-style candidate exchange and simultaneous open inside the connection — hole-punching with no external signalling).

quinn-proto is 38,665 lines because every one of those is a state machine with a corner-case budget written in RFC prose and paid for in interop events since 2017: ACK-of-ACK rules, PTO backoff, stream state transitions, retry and stateless reset, key phase bits, amplification limits, migration under NAT rebinding. none of it carries any assumption about who the peers are, what the bytes mean, or how a path was chosen. that is exactly why it is reusable and exactly why rewriting it buys nothing: there is no cyber-specific invariant inside it to express. the trap is that a transport that is 95% right looks finished and is not; the last 5% are the attacks (amplification, reset injection, congestion collapse) and the interop with every other implementation on the planet.

where the stack enters — the extension points QUIC already exposes

the n0 fork proved the pattern: QAD and QNT are extension frames and transport parameters, added without touching the core. cyber enters the same way, at five points, with two things the stack has that no other transport has: location proofs and a graph that is also the routing table.

and two places where cyber's routing lives above QUIC, because QUIC is point-to-point and the graph is not:

• forwarding: greedy by locus over FOLLOW with gravity-pressure fallback (soft3/specs/routing.md) is an overlay that chooses the next QUIC peer; the hop carries a tade frame on a stream or a QUIC datagram (RFC 9221, in the fork) when the payload is itself a QUIC packet being relayed — datagrams avoid reliability-on-reliability.
• custody: delay-tolerant delivery is a bundle layer, not a transport feature; QUIC stays the protocol of one pond, custody bridges ponds. this is the CCSDS lesson (bundles over a convergence layer) applied with our own convergence layer.

what this buys that nobody else has

every QUIC stack measures RTT; none can say whether the RTT is honest. with PLACE frames a path's RTT is evidence with a signature on both ends, so congestion control can trust its floor, relays can be paid by proven latency, a sybil at the rim cannot fake proximity, and a Mars node's minutes are a known constant rather than a timeout. that is the stack reaching into the transport at the one point where it has something to add — the physics — and leaving the state machine alone.

7. the task, as work

each step is a PR against main; each has a gate that is a test or a measurement, not a review opinion. estimates are lines removed/added and calendar for one agent; launch rows from cyber/launch.md.

order: 1 → 2 → 3 → 5 → 4 → 6 → 7 → 8 → 9. steps 1–3 and 5–6 are phase-1 material (rows 21, 22, 34, 39, 42); 4 is the two-machine milestone; 7–9 are the design target and can land in the canary.

exit state: radio = endpoint · paths · relay · observe · gossip · stream · fetch · custody, ~14K own lines, cyber-bao beside it, quinn and nettools as vendored dependencies, ~80 crates, one of everything.

8. after QUIC — cybernet, the wire the stack would build if the internet were not in the way

QUIC is the best transport the IP internet has, and it is a legacy transport: it carries TCP's abstractions — a connection between two addresses, ordered reliable byte streams, ACKs of byte offsets, a handshake per peer — into UDP, because the applications it was built for (HTTP) think in connections and streams. cyber does not. its unit is not a connection; it is a signal or a particle, self-certifying, addressed by name, forwarded by whoever holds it, verified by whoever receives it. strip QUIC to what the stack would keep and three of its four pillars fall away.

what remains is a different animal, and it has a name in the literature: named-data networking — interests and data, no connections, data cached by forwarders, routed by name. NDN never deployed for three reasons, and cyber has all three: name-based routing tables that explode at scale (cyber routes greedily by locus, O(degree) state, no table — soft3/specs/routing.md); no incentive to forward or cache (relay receipts paid in focus); no global naming authority (the cybergraph is the name graph, and a particle is its own authority).

the native wire — cybernet

L1  wire     a pairwise channel: PQ KEM (mudra seal, hybrid) → AEAD per packet, rekey by counter.
             no handshake state beyond one round; no streams; no ACKs.                       ~1,500
L2  packet   tade frames, datagram-sized:
             INTEREST(particle, range, hops, min_dist, visited)
             DATA(chunk, proof path)        SIGNAL(frame)
             PLACE(challenge | response)    RECEIPT(forwarded, signed)                        ~500
L3  forward  greedy by locus over FOLLOW, gravity-pressure at minima, cache at forwarders,
             interest aggregation (one upstream ask for many downstream asks), receipts;
             rate control = pressure: a forwarder sheds interests it cannot pay for          ~2,000
L4  custody  interests persist across dark paths; data waits for the path; DTN-native        ~1,000
L5  observe  addresses, loci, RTT evidence from PLACE                                          ~500
                                                                               own code ≈ 5,500
legacy era   quinn as the convergence layer over IP (QNT for NATs), until the links are ours  (dep)

no connection, no stream, no ACK: only interests and data, the receiver drives reliability by re-expressing what it lacks (the BitTorrent and NDN model), and a forwarder is a cache with a locus. the hemera chunk (4 KiB) spans three or four datagrams and is verified at the chunk, like a QUIC packet is verified at the packet — one level up.

why it is faster, concretely

• first packet is the request: a public particle is fetched with no handshake, and the nearest holder answers — latency is distance to the closest copy, not RTT to the origin plus a TLS round trip;
• every fetch is multi-source by construction, since any holder of the range may answer the interest;
• no head-of-line blocking because there is no line: chunks are independent;
• forwarding decision is a fixed-point comparison of loci — no table lookup, no routing protocol, no convergence time;
• verification at line rate on the accelerator: a DATA packet lands in unified memory and its proof path is checked where it lies (the honeycrisp mandate), the same buffer the application reads;
• across light-minutes it is the only design that works at all: an interest that waits is normal, a cache en route is the point, and nothing times out because nothing was promised.

what the stack is missing to build it

in order of how hard the absence bites:

1. locus with proof — tru/specs/locus.md and mudra/specs/place.md are specs on a branch with no code. without a proven coordinate per neuron there is no metric, and greedy forwarding degenerates to flooding. this is the keystone; PLACE frames (§7 step 8) are the measurement, locus is the number.
2. seal — the PQ KEM is specified (ML-KEM-768) and not implemented; the native wire's channel is one KEM exchange and an AEAD, and it cannot be built on TLS.
3. forwarding economics — receipts → focus in tok. without payment, caching and forwarding are charity, which is why NDN stayed in the lab.
4. pressure as rate control — routing.md has gravity-pressure as a routing fallback; the same quantity must become the flow-control law: a spec of how a forwarder prices and sheds interests, and how that stays TCP-tolerable on shared internet paths during the legacy era.
5. reconciliation as reliability — foculus's ranger/CRDT engines are the retransmission layer; they must take the interest/data shape, not the stream shape.
6. the chunk/MTU decision — 4 KiB hemera chunks over 1,200-byte datagrams: fragment at the wire, or make the hemera leaf 1 KiB. a hemera decision, before genesis if the leaf changes.
7. a physical radio — "sovereign transport" is still the IP internet. the native wire is designed for links we own (mesh, satellite, interplanetary); nothing in the stack touches RF yet, and that is the one place where "radio" could become literal.

the IP era, precisely — what quinn is for and for how long

the native wire bypasses IP's routing model (connections, address-based forwarding), not IP's packets: over the internet it runs in UDP datagrams, IP as a dumb link layer, and it earns most of its speed right there — first-packet requests, nearest copy, multi-source, no head-of-line. physically leaving IP needs links we own, and the stack has none yet.

what the IP era actually needs from the wire, and who provides it:

so quinn covers three of four real needs for free and supplies the one thing the native wire still lacks a proof for — a congestion controller that behaves on shared links. the fourth need belongs to neither and must be remembered when the WebSocket relay goes: hostile networks will want ~300 lines of "DATA inside an HTTPS stream", not a relay fleet.

there is no long-term dual stack. the native wire over UDP makes quinn unnecessary entirely (traversal ~500, congestion control ~1,000 once proven, relay already there). the trajectory: phase 1 — QUIC is the wire, transmit only so it can be pulled; then the native wire over UDP and quinn leaves; then the same wire over links we own. during the transition quinn is a bridge to older nodes — version coexistence, not a fallback.

three measurements decide whether "radically better" is a number, and all three can start before quinn is touched: greedy locus routing on the burial graph against the row-42 gate (≥ 97% of targets within 2·log₂N hops, stretch ≤ 1.1); receiver-driven rate control against TCP flows on a shared emulated link; location proofs against a fast man-in-the-middle on the open internet (the lower RTT bound is physics, the upper is attackable).

none of this is on the phase-1 path. all of it is why the phase-1 radio must be transmit only: a QUIC-era module that holds no address, no identity, no store and no reliability of its own is the one that can be swapped for the native wire without touching anything above it.

see soft3/roadmap/component-boundaries.md · soft3/specs/routing.md · foculus/specs/gossip.md · cyb/decide/wire.md · radio/specs/neuron-context.md · cyber/launch.md §critical dependencies 3