https://pastebin.com/if5Rq1rH

# RFC 0001  Universal Autonomous Mesh (UAM)

```
Network Working Group                                     UAM Architecture WG
Request for Comments: 0001                                       Draft v0.2.0
Category: Informational / Experimental                          September 2026
Status: FROZEN FOR TEST-SUITE DEVELOPMENT
Supersedes: v0.1.x and all errata v0.1.1v0.1.4
```

---

## Abstract

This document specifies the architecture, trust model, wire formats, and
component interfaces for the **Universal Autonomous Mesh (UAM)**: a
hardware-agnostic, zero-trust, delay-tolerant distributed operating system and
routing mesh. UAM routes *intent* and *data* across real-time LANs, airgapped
manual transfers, and high-latency space links. It uses a Just-In-Time (JIT)
capability engine to synthesize missing functionality on demand.

This revision consolidates all decisions from WG discussion. It is the frozen
basis for the negative test suite and the reference implementation.

---

## 1. Introduction

Existing distributed systems assume one or more of:

1. Continuous connectivity.
2. A trusted central authority.
3. Homogeneous hardware and runtimes.
4. Capability parity between nodes.

UAM rejects all four. The network is a **discontinuous, adversarial,
heterogeneous graph** of sovereign nodes. Capability is compiled on demand,
not pre-installed.

### 1.1 Design Principles

| # | Principle | Consequence |
|---|-----------|-------------|
| P1 | Identity is not authority | A signature proves *who*; a capability
token proves *what*. |
| P2 | Visibility is a capability | Topology is payload, not public fact. |
| P3 | Store-and-forward is the default | Real-time delivery is an
optimization. |
| P4 | Code is untrusted until proven scoped | JIT code runs only inside a
capability-scoped sandbox. |
| P5 | Sovereignty is local | No remote node forces a local action without
Guardian command and local policy evaluation. |
| P6 | Convergence over consensus | CRDTs where possible; quorum only for root
truth. |
| P7 | Signatures cover bytes, not structures | Every signed structure has a
canonical byte encoding and a defined domain separator. |

### 1.2 Scope

This RFC covers architecture, trust model, wire formats, and mandatory runtime
policies. It does not define: reference implementation, economic model,
jurisdiction-specific telecom compliance, or PQC migration (deferred to RFC
0002).

### 1.3 Conventions

**MUST**, **MUST NOT**, **SHOULD**, **SHOULD NOT**, **MAY**, **OPTIONAL** are
as in RFC 2119.

- **Node**  any participant holding an identity and running at least
`UNIVERSAL_ROUTER`.
- **Envelope**  atomic routed data unit.
- **Intent**  a request that may lack a target capability.
- **Capability**  scoped, verifiable grant of authority.
- **Dark Mesh**  topology records visible only to holders of a `discover`
scope.
- **Guardian**  root-authority signer, typically airgapped.
- **Courier**  any physical or scheduled transfer medium.
- **SSOT**  single source of truth; in UAM, convergent, not central.
- **HLC**  Hybrid Logical Clock.

---

## 2. System Model and Assumptions

- Nodes MAY be intermittently connected, partitioned indefinitely, or one-way
reachable.
- Clocks are **not** synchronized. HLC is used for ordering; wall-clock never
for security decisions.
- Storage MUST be assumed crash-unsafe unless the node declares a durable
queue.
- The adversary MAY control an arbitrary number of nodes, including relays.
- The adversary MUST be assumed able to observe traffic timing and volume.
- Physical couriers MAY be inspected, tampered with, or replayed.
- Nodes MAY be running different implementations. **Cross-implementation
byte-identical signature verification is a hard requirement.**

---

## 3. Component Architecture

```
```
    (root trust, quorum, airgapped)GUARDIAN_AUTHORITY                      
                    ,
 signs root capabilities                               
 signs root capabilities                               
 RY$  STATE_REGISTRY $ TOPOLOGY_GOSSIPER  TOGRAPHIC_   
     (convergent)      (Merkle delta sync)IDENTITY         
,  ,  ,
                                                    
         <                     <                      <
         <                     <                      <
                      UNIVERSAL_ROUTER                        
              (store-and-forward DTN micro-kernel)            
,,,
                                                 
        <                      <                   <
        <                      <                   <
       SECURE_SANDBOX       AI_ARCHITECT    GATEWAY_      
       (WASM isolation)     (JIT codegen)   REGISTRY      
       
```

Dependency order (bottom-up): `CRYPTOGRAPHIC_IDENTITY`  `STATE_REGISTRY` 
`UNIVERSAL_ROUTER`  {`TOPOLOGY_GOSSIPER`, `GATEWAY_REGISTRY`,
`SECURE_SANDBOX`, `AI_ARCHITECT`}  `GUARDIAN_AUTHORITY`.

---

## 4. Identity, Authority, and Visibility

This is the load-bearing separation of the entire system.

| Layer | Question | Mechanism |
|-------|----------|-----------|
| **Identity** | Who signed this? | Ed25519 keypair; `node:` +
base58btc(multicodec 0xed01  pubkey) |
| **Authority** | What are they allowed to do? | Attenuating capability tokens
(B'7) |
| **Visibility** | What may they know exists? | Capability-gated topology
disclosure (B'10) |

A node with a valid key and no capability MUST be treated as an
**authenticated stranger**: rate-limited, ignored, or answered with a null
topology  never granted state.

More: https://pastebin.com/if5Rq1rH