yakmesh 2.8.2 → 3.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (232) hide show
  1. package/CHANGELOG.md +637 -0
  2. package/CONTRIBUTING.md +42 -0
  3. package/Caddyfile +77 -0
  4. package/README.md +119 -29
  5. package/adapters/adapter-mlv-bible/README.md +124 -0
  6. package/adapters/adapter-mlv-bible/index.js +400 -0
  7. package/adapters/chat-mod-adapter.js +532 -0
  8. package/adapters/content-adapter.js +273 -0
  9. package/content/api.js +50 -41
  10. package/content/index.js +2 -2
  11. package/content/store.js +355 -173
  12. package/dashboard/index.html +19 -3
  13. package/database/replication.js +117 -37
  14. package/docs/CRYPTO-AGILITY.md +204 -0
  15. package/docs/MTLS-RESEARCH.md +367 -0
  16. package/docs/NAMCHE-SPEC.md +681 -0
  17. package/docs/PEERQUANTA-YAKMESH-INTEGRATION.md +407 -0
  18. package/docs/PRECISION-DISCLOSURE.md +96 -0
  19. package/docs/README.md +76 -0
  20. package/docs/ROADMAP-2.4.0.md +447 -0
  21. package/docs/ROADMAP-2.5.0.md +244 -0
  22. package/docs/SECURITY-AUDIT-REPORT.md +306 -0
  23. package/docs/SST-INTEGRATION.md +712 -0
  24. package/docs/STEADYWATCH-IMPLEMENTATION.md +303 -0
  25. package/docs/TERNARY-AUDIT-REPORT.md +247 -0
  26. package/docs/TME-FAQ.md +221 -0
  27. package/docs/WHITEPAPER.md +623 -0
  28. package/docs/adapters.html +1001 -0
  29. package/docs/advanced-systems.html +1045 -0
  30. package/docs/annex.html +1046 -0
  31. package/docs/api.html +970 -0
  32. package/docs/business/response-templates.md +160 -0
  33. package/docs/c2c.html +1225 -0
  34. package/docs/cli.html +1332 -0
  35. package/docs/configuration.html +1248 -0
  36. package/docs/darshan.html +1085 -0
  37. package/docs/dharma.html +966 -0
  38. package/docs/docs-bundle.html +1075 -0
  39. package/docs/docs.css +3120 -0
  40. package/docs/docs.js +556 -0
  41. package/docs/doko.html +969 -0
  42. package/docs/geo-proof.html +858 -0
  43. package/docs/getting-started.html +840 -0
  44. package/docs/gumba-tutorial.html +1144 -0
  45. package/docs/gumba.html +1098 -0
  46. package/docs/index.html +914 -0
  47. package/docs/jhilke.html +1312 -0
  48. package/docs/karma.html +1100 -0
  49. package/docs/katha.html +1037 -0
  50. package/docs/lama.html +978 -0
  51. package/docs/mandala.html +1067 -0
  52. package/docs/mani.html +964 -0
  53. package/docs/mantra.html +967 -0
  54. package/docs/mesh.html +1409 -0
  55. package/docs/nakpak.html +869 -0
  56. package/docs/namche.html +928 -0
  57. package/docs/nav-order.json +53 -0
  58. package/docs/prahari.html +1043 -0
  59. package/docs/prism-bash.min.js +1 -0
  60. package/docs/prism-javascript.min.js +1 -0
  61. package/docs/prism-json.min.js +1 -0
  62. package/docs/prism-tomorrow.min.css +1 -0
  63. package/docs/prism.min.js +1 -0
  64. package/docs/privacy.html +699 -0
  65. package/docs/quick-reference.html +1181 -0
  66. package/docs/sakshi.html +1402 -0
  67. package/docs/sandboxing.md +386 -0
  68. package/docs/seva.html +911 -0
  69. package/docs/sherpa.html +871 -0
  70. package/docs/studio.html +860 -0
  71. package/docs/stupa.html +995 -0
  72. package/docs/tailwind.min.css +2 -0
  73. package/docs/tattva.html +1332 -0
  74. package/docs/terms.html +686 -0
  75. package/docs/time-server-deployment.md +166 -0
  76. package/docs/time-sources.html +1392 -0
  77. package/docs/tivra.html +1127 -0
  78. package/docs/trademark-policy.html +686 -0
  79. package/docs/tribhuj.html +1183 -0
  80. package/docs/trust-security.html +1029 -0
  81. package/docs/tutorials/backup-recovery.html +654 -0
  82. package/docs/tutorials/dashboard.html +604 -0
  83. package/docs/tutorials/domain-setup.html +605 -0
  84. package/docs/tutorials/host-website.html +456 -0
  85. package/docs/tutorials/mesh-network.html +505 -0
  86. package/docs/tutorials/mobile-access.html +445 -0
  87. package/docs/tutorials/privacy.html +467 -0
  88. package/docs/tutorials/raspberry-pi.html +600 -0
  89. package/docs/tutorials/security-basics.html +539 -0
  90. package/docs/tutorials/share-files.html +431 -0
  91. package/docs/tutorials/troubleshooting.html +637 -0
  92. package/docs/tutorials/trust-karma.html +419 -0
  93. package/docs/tutorials/yak-protocol.html +456 -0
  94. package/docs/tutorials.html +1034 -0
  95. package/docs/vani.html +1270 -0
  96. package/docs/webserver.html +809 -0
  97. package/docs/yak-protocol.html +940 -0
  98. package/docs/yak-timeserver-design.md +475 -0
  99. package/docs/yakapp.html +1015 -0
  100. package/docs/ypc27.html +1069 -0
  101. package/docs/yurt.html +1344 -0
  102. package/embedded-docs/bundle.js +334 -74
  103. package/gossip/protocol.js +247 -27
  104. package/identity/key-resolver.js +262 -0
  105. package/identity/machine-seed.js +632 -0
  106. package/identity/node-key.js +669 -368
  107. package/identity/tribhuj-ratchet.js +506 -0
  108. package/knowledge-base.js +37 -8
  109. package/launcher/yakmesh.bat +62 -0
  110. package/launcher/yakmesh.sh +70 -0
  111. package/mesh/annex.js +462 -108
  112. package/mesh/beacon-broadcast.js +113 -1
  113. package/mesh/darshan.js +1718 -0
  114. package/mesh/gumba.js +1567 -0
  115. package/mesh/jhilke.js +651 -0
  116. package/mesh/katha.js +1012 -0
  117. package/mesh/nakpak-routing.js +8 -5
  118. package/mesh/network.js +724 -34
  119. package/mesh/pulse-sync.js +4 -1
  120. package/mesh/rate-limiter.js +127 -15
  121. package/mesh/seva.js +526 -0
  122. package/mesh/sherpa-discovery.js +89 -8
  123. package/mesh/sybil-defense.js +19 -5
  124. package/mesh/temporal-encoder.js +4 -3
  125. package/mesh/vani.js +1364 -0
  126. package/mesh/yurt.js +1340 -0
  127. package/models/entropy-sentinel.onnx +0 -0
  128. package/models/karma-trust.onnx +0 -0
  129. package/models/manifest.json +43 -0
  130. package/models/sakshi-anomaly.onnx +0 -0
  131. package/oracle/code-proof-protocol.js +7 -6
  132. package/oracle/codebase-lock.js +257 -28
  133. package/oracle/index.js +74 -15
  134. package/oracle/ma902-snmp.js +678 -0
  135. package/oracle/module-sealer.js +5 -3
  136. package/oracle/network-identity.js +16 -0
  137. package/oracle/packet-checksum.js +201 -0
  138. package/oracle/sst.js +579 -0
  139. package/oracle/ternary-144t.js +714 -0
  140. package/oracle/ternary-ml.js +481 -0
  141. package/oracle/time-api.js +239 -0
  142. package/oracle/time-source.js +137 -47
  143. package/oracle/validation-oracle-hardened.js +1111 -1071
  144. package/oracle/validation-oracle.js +4 -2
  145. package/oracle/ypc27.js +211 -0
  146. package/package.json +20 -3
  147. package/protocol/yak-handler.js +35 -9
  148. package/protocol/yak-protocol.js +28 -13
  149. package/reference/cpp/yakmesh_mceliece_shard.cpp +168 -0
  150. package/reference/cpp/yakmesh_ypc27.cpp +179 -0
  151. package/sbom.json +87 -0
  152. package/scripts/security-audit.mjs +264 -0
  153. package/scripts/update-docs-nav.js +194 -0
  154. package/scripts/update-docs-sidebar.cjs +164 -0
  155. package/security/crypto-config.js +4 -3
  156. package/security/dharma-moderation.js +517 -0
  157. package/security/doko-identity.js +193 -143
  158. package/security/domain-consensus.js +86 -85
  159. package/security/fs-hardening.js +620 -0
  160. package/security/hardware-attestation.js +5 -3
  161. package/security/hybrid-trust.js +227 -87
  162. package/security/karma-rate-limiter.js +692 -0
  163. package/security/khata-protocol.js +22 -21
  164. package/security/khata-trust-integration.js +277 -150
  165. package/security/memory-safety.js +635 -0
  166. package/security/mesh-auth.js +11 -10
  167. package/security/mesh-revocation.js +373 -5
  168. package/security/namche-gateway.js +298 -69
  169. package/security/sakshi.js +460 -3
  170. package/security/sangha.js +770 -0
  171. package/security/secure-config.js +473 -0
  172. package/security/silicon-parity.js +13 -10
  173. package/security/steadywatch.js +1142 -0
  174. package/security/strike-system.js +32 -3
  175. package/security/temporal-signing.js +488 -0
  176. package/security/trit-commitment.js +464 -0
  177. package/server/crypto/annex.js +247 -0
  178. package/server/darshan-api.js +343 -0
  179. package/server/index.js +3259 -362
  180. package/server/komm-api.js +668 -0
  181. package/utils/accel.js +2273 -0
  182. package/utils/ternary-id.js +79 -0
  183. package/utils/verify-worker.js +57 -0
  184. package/webserver/index.js +95 -5
  185. package/assets/yakmesh-logo.png +0 -0
  186. package/assets/yakmesh-logo.svg +0 -80
  187. package/assets/yakmesh-logo2.png +0 -0
  188. package/assets/yakmesh-logo2sm.png +0 -0
  189. package/assets/ymsm.png +0 -0
  190. package/website/assets/silhouettes/adapters.svg +0 -107
  191. package/website/assets/silhouettes/api-endpoints.svg +0 -115
  192. package/website/assets/silhouettes/atomic-clock.svg +0 -83
  193. package/website/assets/silhouettes/base-camp.svg +0 -81
  194. package/website/assets/silhouettes/bridge.svg +0 -69
  195. package/website/assets/silhouettes/docs-bundle.svg +0 -113
  196. package/website/assets/silhouettes/doko-basket.svg +0 -70
  197. package/website/assets/silhouettes/fortress.svg +0 -93
  198. package/website/assets/silhouettes/gateway.svg +0 -54
  199. package/website/assets/silhouettes/gears.svg +0 -93
  200. package/website/assets/silhouettes/globe-satellite.svg +0 -67
  201. package/website/assets/silhouettes/karma-wheel.svg +0 -137
  202. package/website/assets/silhouettes/lama-council.svg +0 -141
  203. package/website/assets/silhouettes/mandala-network.svg +0 -169
  204. package/website/assets/silhouettes/mani-stones.svg +0 -149
  205. package/website/assets/silhouettes/mantra-wheel.svg +0 -116
  206. package/website/assets/silhouettes/mesh-nodes.svg +0 -113
  207. package/website/assets/silhouettes/nakpak.svg +0 -56
  208. package/website/assets/silhouettes/peak-lightning.svg +0 -73
  209. package/website/assets/silhouettes/sherpa.svg +0 -69
  210. package/website/assets/silhouettes/stupa-tower.svg +0 -119
  211. package/website/assets/silhouettes/tattva-eye.svg +0 -78
  212. package/website/assets/silhouettes/terminal.svg +0 -74
  213. package/website/assets/silhouettes/webserver.svg +0 -145
  214. package/website/assets/silhouettes/yak.svg +0 -78
  215. package/website/assets/yakmesh-logo.png +0 -0
  216. package/website/assets/yakmesh-logo.webp +0 -0
  217. package/website/assets/yakmesh-logo128x140.webp +0 -0
  218. package/website/assets/yakmesh-logo2.png +0 -0
  219. package/website/assets/yakmesh-logo2.svg +0 -51
  220. package/website/assets/yakmesh-logo40x44.webp +0 -0
  221. package/website/assets/yakmesh.gif +0 -0
  222. package/website/assets/yakmesh.ico +0 -0
  223. package/website/assets/yakmesh.jpg +0 -0
  224. package/website/assets/yakmesh.pdf +0 -0
  225. package/website/assets/yakmesh.png +0 -0
  226. package/website/assets/yakmesh.svg +0 -70
  227. package/website/assets/yakmesh128.webp +0 -0
  228. package/website/assets/yakmesh32.png +0 -0
  229. package/website/assets/yakmesh32.svg +0 -65
  230. package/website/assets/yakmesh32o.ico +0 -2
  231. package/website/assets/yakmesh32o.svg +0 -65
  232. package/website/assets/yakmesh32o.svgz +0 -0
@@ -0,0 +1,447 @@
1
+ # YAKMESH v2.4.0 Roadmap
2
+
3
+ ## Theme: "Mathematical Trust — No Simulation"
4
+
5
+ **Target Release**: February 2026
6
+
7
+ This release unifies YAKMESH's core principles into an unbreakable trust system:
8
+ - **Real hardware** (AES-NI verified)
9
+ - **Precision time** (Atomic/GPS/PTP)
10
+ - **Mathematical consensus** (2/3 threshold)
11
+
12
+ **"You can't fake physics. Atomic time and real silicon are your credentials."**
13
+
14
+ ---
15
+
16
+ ## 🎯 Core Principles
17
+
18
+ ### No Simulation
19
+ - Must prove **real AES-NI hardware** through timing analysis
20
+ - VMs, emulators, and bot farms fail timing verification
21
+ - **Economic barrier**: Real servers cost real money
22
+
23
+ ### Atomic Precision
24
+ - Highest trust requires **physical time sources**
25
+ - Atomic clocks, GPS+PPS, or PTP (IEEE 1588)
26
+ - **Can't fake physics**: Time sources are verifiable
27
+
28
+ ### Mathematical Consensus
29
+ - Revocation through **signature counting**, not voting
30
+ - 2/3 threshold = Byzantine fault tolerance
31
+ - **No human decisions**: Math is final
32
+
33
+ ---
34
+
35
+ ## 🏔️ Trust Tiers
36
+
37
+ | Tier | Hardware | Time Source | Weight | Description |
38
+ |------|----------|-------------|--------|-------------|
39
+ | **ORACLE** | AES-NI ✅ | Atomic Clock | 2.0x | Network truth anchors |
40
+ | **ANCHOR** | AES-NI ✅ | GPS + PPS | 1.5x | Regional anchors |
41
+ | **SENTINEL** | AES-NI ✅ | PTP (IEEE 1588) | 1.25x | Time-verified nodes |
42
+ | **PARTICIPANT** | AES-NI ✅ | NTP only | 1.0x | Standard nodes |
43
+ | **OBSERVER** | Unverified | Any | 0.25x | Minimal trust |
44
+
45
+ ### Network Topology
46
+
47
+ ```
48
+ ┌─────────────┐
49
+ │ ORACLE │ Atomic + AES-NI
50
+ │ (2.0x) │ Source of truth
51
+ └──────┬──────┘
52
+
53
+ ┌──────────────┼──────────────┐
54
+ ┌─────┴─────┐ ┌─────┴─────┐ ┌─────┴─────┐
55
+ │ ANCHOR │ │ ANCHOR │ │ ANCHOR │
56
+ │ (1.5x) │ │ (1.5x) │ │ (1.5x) │
57
+ └─────┬─────┘ └─────┬─────┘ └─────┬─────┘
58
+ │ │ │
59
+ ┌────┴────┐ ┌────┴────┐ ┌────┴────┐
60
+ │SENTINEL │ │SENTINEL │ │SENTINEL │
61
+ │ (1.25x) │ │ (1.25x) │ │ (1.25x) │
62
+ └────┬────┘ └────┬────┘ └────┬────┘
63
+ │ │ │
64
+ ┌───────┴───────┬──────┴──────┬───────┴───────┐
65
+ │ PARTICIPANT │ PARTICIPANT │ PARTICIPANT │
66
+ │ (1.0x) │ (1.0x) │ (1.0x) │
67
+ └───────────────┴─────────────┴───────────────┘
68
+ ```
69
+
70
+ ---
71
+
72
+ ## ✅ Implemented Features
73
+
74
+ ### 1. Mesh-Consensus Revocation
75
+
76
+ **File**: `security/mesh-revocation.js`
77
+ **Tests**: 41 passing
78
+
79
+ When 2/3 of nodes attest bad behavior, revocation is a mathematical fact.
80
+
81
+ ```javascript
82
+ import { MeshRevocation, REVOCATION_REASONS } from 'yakmesh/security/mesh-revocation';
83
+
84
+ // Create attestation when you observe bad behavior
85
+ const attestation = revocation.createAttestation(
86
+ badDokoId,
87
+ REVOCATION_REASONS.DOUBLE_SIGN
88
+ );
89
+
90
+ // Check revocation (pure math)
91
+ const status = revocation.isRevoked(someDokoId);
92
+ // { revoked: true/false, effectiveCount, threshold, confidence }
93
+ ```
94
+
95
+ ### 2. Hardware Attestation
96
+
97
+ **File**: `security/hardware-attestation.js`
98
+ **Tests**: 5 passing
99
+
100
+ Proves real AES-NI silicon through timing analysis.
101
+
102
+ ```javascript
103
+ import { HardwareAttestation } from 'yakmesh/security/hardware-attestation';
104
+
105
+ // Create local attestation
106
+ const attestation = await HardwareAttestation.createLocal();
107
+ // { hasAESNI: true/false, throughputMBps, timing... }
108
+
109
+ // Challenge another node
110
+ const challenge = HardwareAttestation.createChallenge();
111
+ const response = await HardwareAttestation.respondToChallenge(challenge, privateKey, dokoId);
112
+ const verification = HardwareAttestation.verifyResponse(response, challenge, publicKey);
113
+ ```
114
+
115
+ ### 3. Trust Tier System
116
+
117
+ **File**: `security/trust-tier.js`
118
+ **Tests**: 35 passing
119
+
120
+ Combines hardware + time source into trust levels.
121
+
122
+ ```javascript
123
+ import { TrustTierRegistry, TRUST_TIER } from 'yakmesh/security/trust-tier';
124
+
125
+ const registry = new TrustTierRegistry({
126
+ getTimeSource: (dokoId) => timeOracle.getSource(dokoId),
127
+ getHardwareAttestation: (dokoId) => hwStore.get(dokoId),
128
+ getNetworkAge: (dokoId) => sherpa.getAge(dokoId),
129
+ getEndorsementCount: (dokoId) => dokoStore.getEndorsements(dokoId).length,
130
+ });
131
+
132
+ // Get trust tier
133
+ const tier = await registry.getTier(dokoId); // 'oracle', 'anchor', etc.
134
+ const weight = await registry.getWeight(dokoId); // 2.0, 1.5, 1.25, 1.0, 0.25
135
+ ```
136
+
137
+ ### 4. Weighted Revocation
138
+
139
+ **Integrated with Trust Tiers**
140
+
141
+ ORACLE nodes have 2x weight in revocation consensus:
142
+
143
+ ```javascript
144
+ import { WeightedRevocationCalculator } from 'yakmesh/security/trust-tier';
145
+
146
+ const calculator = new WeightedRevocationCalculator(registry);
147
+
148
+ // 2 ORACLEs (4.0) + 6 PARTICIPANTs (6.0) = 10.0 effective
149
+ // vs. threshold of 9.33 (2/3 of 14.0 effective network size)
150
+ const result = await calculator.isRevoked(attestations);
151
+ ```
152
+
153
+ ---
154
+
155
+ ## 📊 Implementation Status
156
+
157
+ | Component | File | Tests | Status |
158
+ |-----------|------|-------|--------|
159
+ | Mesh Revocation | `mesh-revocation.js` | 41 | ✅ Complete |
160
+ | Hardware Attestation | `hardware-attestation.js` | 5 | ✅ Complete |
161
+ | **Extended HW Detection** | `hardware-attestation.js` | 29 | ✅ v2.4.1 |
162
+ | Trust Tiers | `trust-tier.js` | 35 | ✅ Complete |
163
+ | Silicon Parity | `silicon-parity.js` | 36 | ✅ Complete |
164
+ | Sybil Graph Analysis | `sybil-graph.js` | 44 | ✅ Complete |
165
+ | KHATA Trust Integration | `khata-trust-integration.js` | 22 | ✅ Complete |
166
+ | Strike System | `strike-system.js` | 31 | ✅ Complete |
167
+ | Weighted Calculator | (in trust-tier.js) | (included) | ✅ Complete |
168
+ | **Total v2.4 Tests** | | **243** | |
169
+
170
+ **Project Test Count**: 598 + 243 = **841 tests**
171
+
172
+ ---
173
+
174
+ ## 🛡️ Security Properties
175
+
176
+ ### Sybil Attack Defense
177
+
178
+ | Layer | Defense | Cost to Attack |
179
+ |-------|---------|----------------|
180
+ | SHERPA Presence | Must run real nodes | Infrastructure |
181
+ | AES-NI Timing | Must have real hardware | Real servers |
182
+ | Time Source | Must have precision time | Atomic/GPS hardware |
183
+ | Network Age | Must wait 7-30 days | Time |
184
+ | Endorsements | Must build reputation | Social proof |
185
+
186
+ ### Bot Farm Economics
187
+
188
+ To revoke an innocent node in a 100-node network:
189
+
190
+ ```
191
+ Required: 67 effective weight (2/3 of ~100)
192
+ With PARTICIPANTs only: 67 real servers
193
+ With ORACLEs (2.0x): 34 atomic clock nodes (!)
194
+ ```
195
+
196
+ **Bot farms become economically infeasible.**
197
+
198
+ ### Byzantine Fault Tolerance
199
+
200
+ - Tolerates up to 1/3 malicious nodes
201
+ - Attestations are post-quantum signed (ML-DSA-65)
202
+ - Threshold is 2/3 of **weighted** network
203
+
204
+ ---
205
+
206
+ ## 🛡️ Sybil Defense Layers
207
+
208
+ The v2.4 security model uses **layered defenses** to make Sybil attacks economically infeasible:
209
+
210
+ ```
211
+ ┌─────────────────────────────────────────────────────────────┐
212
+ │ SYBIL DEFENSE STACK │
213
+ ├─────────────────────────────────────────────────────────────┤
214
+ │ │
215
+ │ Layer 0: Crypto Acceleration Detection (v2.4.1) │
216
+ │ → AES-NI (128-bit): Baseline detection │
217
+ │ → VAES (256/512-bit): Enhanced fingerprinting │
218
+ │ → GFNI: Universal Galois Field acceleration │
219
+ │ → PQC-Ready: NTT + SHA-3 for post-quantum │
220
+ │ │
221
+ │ Layer 1: Silicon Parity (v2.4) │
222
+ │ → AES timing fingerprint = unique CPU identity │
223
+ │ → Weight division: tierMax / coreCount │
224
+ │ → 100 cores on 1 rig = same weight as 1 core │
225
+ │ │
226
+ │ Layer 2: Graph Analysis (v2.4) │
227
+ │ → Attestation clustering detection │
228
+ │ → Sybil clusters have coefficient > 0.7 │
229
+ │ → Honest networks have sparse, random graphs │
230
+ │ │
231
+ │ Layer 3: Behavioral Correlation (v2.4) │
232
+ │ → Uptime correlation analysis │
233
+ │ → Attestation pattern correlation │
234
+ │ → Synchronized activity = suspicious │
235
+ │ │
236
+ │ Layer 4: SHERPA Clock Correlation (existing) │
237
+ │ → Clock drift patterns reveal physical proximity │
238
+ │ → Same-room nodes have correlated drift │
239
+ │ │
240
+ │ Layer 5: Geographic Proof via SHERPA (v2.5) │
241
+ │ → Hardware timestamps enable RTT measurement │
242
+ │ → Nanosecond precision = ~2-20km resolution │
243
+ │ → Trilateration from global PTP/GPS landmarks │
244
+ │ → Physics can't be spoofed: speed of light! │
245
+ │ │
246
+ │ Layer 6: Economic Friction (future) │
247
+ │ → Registration queue (time cost) │
248
+ │ → Stake requirements (financial cost) │
249
+ │ → Makes mass registration expensive │
250
+ │ │
251
+ └─────────────────────────────────────────────────────────────┘
252
+ ```
253
+
254
+ ### Crypto Acceleration Tiers (v2.4.1)
255
+
256
+ ```javascript
257
+ // Extended hardware detection beyond AES-NI
258
+ CRYPTO_ACCELERATION_TIER = {
259
+ NONE: 0, // Software only - no acceleration
260
+ AES_NI: 1, // 128-bit AES-NI (baseline)
261
+ VAES_256: 2, // VAES 256-bit (AVX2) - 2x throughput
262
+ VAES_512: 3, // VAES 512-bit (AVX-512) - 4x throughput
263
+ GFNI: 4, // Galois Field - universal crypto
264
+ PQC_READY: 5, // NTT + SHA-3 accelerators
265
+ };
266
+
267
+ // Detection via timing heuristics:
268
+ // - Throughput > 2000 MB/s → likely VAES-256
269
+ // - Throughput > 4000 MB/s → likely VAES-512
270
+ // - CPU model string parsing for GFNI/PQC
271
+ ```
272
+
273
+ | CPU | Era | Typical Tier |
274
+ |-----|-----|--------------|
275
+ | Intel 10th Gen | 2019 | AES-NI |
276
+ | Intel 11th Gen+ | 2020+ | VAES-512 + GFNI |
277
+ | AMD Zen 3 | 2020 | VAES-256 + GFNI |
278
+ | AMD Zen 4+ | 2022+ | VAES-512 + GFNI |
279
+ | Apple M1+ | 2020+ | ~VAES-256 (equivalent) |
280
+
281
+ ### Silicon Parity: "One Silicon = One Vote"
282
+
283
+ ```javascript
284
+ // Weight division formula:
285
+ effectiveWeight = tierMaxWeight / max(1, detectedCores)
286
+
287
+ // Examples for PARTICIPANT tier (max 1.0x):
288
+ // 1 core → 1.0 / 1 = 1.0x ✅ Full weight
289
+ // 4 cores → 1.0 / 4 = 0.25x (per core, 1.0x total)
290
+ // 100 cores → 1.0 / 100 = 0.01x (per core, 1.0x total)
291
+
292
+ // Attack economics:
293
+ // 100-core rig cost: ~$50,000
294
+ // Benefit vs 1-core: $0 (identical total weight)
295
+ // ROI: Negative (electricity + hardware for nothing)
296
+ ```
297
+
298
+ ### Graph Analysis: Cluster Detection
299
+
300
+ ```javascript
301
+ // Honest network: Sparse, random attestation patterns
302
+ // Sybil cluster: Dense, everyone-attests-everyone pattern
303
+
304
+ // Detection metrics:
305
+ // - Clustering coefficient > 0.7 = suspicious
306
+ // - Low edge cut to outside = insular cluster
307
+ // - Eigenvalue gap reveals hidden structure
308
+
309
+ // Dr. Sybil's 1000 nodes:
310
+ // - All attest each other → clustering ~0.95
311
+ // - Few edges to honest nodes → edge cut ~0.05
312
+ // - Result: ENTIRE CLUSTER FLAGGED 🚨
313
+ ```
314
+
315
+ ### Geographic Proof via SHERPA Hardware Timestamps
316
+
317
+ ```javascript
318
+ // SHERPA already has hardware timestamping (PTP/GPS)
319
+ // We can measure RTT to landmarks with nanosecond precision!
320
+
321
+ // Physics:
322
+ // Light in fiber: ~5μs per km
323
+ // Hardware timestamp precision: 10-100ns
324
+ // Resolution: ~2-20km (city-level!)
325
+
326
+ // Trust Tier → Geographic Resolution:
327
+ // ORACLE (Atomic): ~1km (lab-grade)
328
+ // ANCHOR (GPS+PPS): ~5km (city-level)
329
+ // SENTINEL (PTP): ~20km (metro-level)
330
+ // PARTICIPANT (NTP): ~2000km (not useful)
331
+
332
+ // Dr. Sybil's 1000 "distributed" nodes:
333
+ // All triangulate to same datacenter → BUSTED
334
+ ```
335
+
336
+ ---
337
+
338
+ ## 🔧 Tier Requirements
339
+
340
+ ### ORACLE (2.0x weight)
341
+ - ✅ AES-NI hardware (verified by timing)
342
+ - ✅ Atomic clock time source
343
+ - ✅ 30+ days network age
344
+ - ✅ 3+ endorsements from established nodes
345
+
346
+ ### ANCHOR (1.5x weight)
347
+ - ✅ AES-NI hardware
348
+ - ✅ GPS + PPS time source
349
+ - ✅ 14+ days network age
350
+ - ✅ 2+ endorsements
351
+
352
+ ### SENTINEL (1.25x weight)
353
+ - ✅ AES-NI hardware
354
+ - ✅ PTP (IEEE 1588) time source
355
+ - ✅ 7+ days network age
356
+ - ✅ 1+ endorsement
357
+
358
+ ### PARTICIPANT (1.0x weight)
359
+ - ✅ AES-NI hardware
360
+ - ⚪ NTP time source (any)
361
+ - ✅ 1+ day network age
362
+ - ⚪ No endorsement required
363
+
364
+ ### OBSERVER (0.25x weight)
365
+ - ❌ No hardware verification
366
+ - ⚪ Any time source
367
+ - ⚪ No age requirement
368
+ - ⚪ No endorsement required
369
+
370
+ ---
371
+
372
+ ## 🚀 Remaining Work
373
+
374
+ ### Silicon Parity (Anti-Farm)
375
+
376
+ - [ ] Implement `security/silicon-parity.js`
377
+ - [ ] AES timing fingerprint collection (1000-op histogram)
378
+ - [ ] Bitslice sampling for epoch verification (~1ms)
379
+ - [ ] Full fingerprint refresh every 8 epochs (~10ms)
380
+ - [ ] Weight division: `tierMax / coreCount`
381
+ - [ ] VM detection via timing jitter analysis
382
+ - [ ] Platform UUID + fingerprint commitment binding
383
+
384
+ ### Graph Analysis (Sybil Detection)
385
+
386
+ - [ ] Implement `security/sybil-graph.js`
387
+ - [ ] Build attestation graph from KHATA messages
388
+ - [ ] Clustering coefficient calculation
389
+ - [ ] Edge cut analysis (insular clusters)
390
+ - [ ] Eigenvalue gap detection
391
+ - [ ] Automatic flagging when coefficient > 0.7
392
+
393
+ ### KHATA Integration
394
+
395
+ - [ ] Add `MESH_REVOCATION_MESSAGES` to KHATA protocol
396
+ - [ ] Attestation gossip via existing mesh
397
+ - [ ] Hardware challenge-response via KHATA
398
+
399
+ ### Strike System (Graduated Consequences)
400
+
401
+ - [ ] Track revocation lineage
402
+ - [ ] Strike 1: Fresh start allowed
403
+ - [ ] Strike 2: 7-day probation, reduced weight
404
+ - [ ] Strike 3: Permanent ban from linked lineage
405
+
406
+ ### Integration Testing
407
+
408
+ - [ ] Multi-node weighted revocation tests
409
+ - [ ] Hardware attestation challenge-response tests
410
+ - [ ] Cross-tier consensus scenarios
411
+ - [ ] Silicon parity weight division tests
412
+ - [ ] Graph analysis cluster detection tests
413
+
414
+ ---
415
+
416
+ ## 📝 API Reference
417
+
418
+ ### MeshRevocation
419
+ ```javascript
420
+ createAttestation(dokoId, reason, evidence?) // Create signed attestation
421
+ addAttestation(attestation) // Add from gossip
422
+ isRevoked(dokoId) // Check status (math)
423
+ createRevocationCertificate(dokoId) // Generate proof
424
+ MeshRevocation.verifyCertificate(cert, resolver) // Verify proof
425
+ ```
426
+
427
+ ### HardwareAttestation
428
+ ```javascript
429
+ HardwareAttestation.createLocal() // Attest local hardware
430
+ HardwareAttestation.createChallenge() // Challenge remote node
431
+ HardwareAttestation.respondToChallenge(...) // Respond to challenge
432
+ HardwareAttestation.verifyResponse(...) // Verify response
433
+ ```
434
+
435
+ ### TrustTierRegistry
436
+ ```javascript
437
+ getProfile(dokoId) // Get full trust profile
438
+ getTier(dokoId) // Get tier name
439
+ getWeight(dokoId) // Get attestation weight
440
+ calculateEffectiveCount(attestations) // Weighted count
441
+ getEffectiveNetworkSize() // Weighted network size
442
+ ```
443
+
444
+ ---
445
+
446
+ *Created: 2026-01-20*
447
+ *Philosophy: You can't fake physics*
@@ -0,0 +1,244 @@
1
+ # YAKMESH v2.5.0 Roadmap
2
+
3
+ ## Theme: "Geographic Exclusion — Physics Don't Lie"
4
+
5
+ **Target Release**: February 2026
6
+
7
+ This release adds geographic proof using speed-of-light physics:
8
+ - **RTT-based distance bounds** (minimum distance, not exact location)
9
+ - **Landmark trilateration** (exclusion zones from multiple reference points)
10
+ - **Time source integration** (precision timing = tighter bounds)
11
+
12
+ **"You can't be closer than light allows. Network latency only makes you appear farther."**
13
+
14
+ ---
15
+
16
+ ## 🎯 Core Principles
17
+
18
+ ### Physics-Based Proof
19
+ - Speed of light in fiber: ~200,000 km/s (0.67c)
20
+ - Minimum distance = (RTT / 2) × fiber_speed
21
+ - Network overhead only INFLATES RTT, never reduces it
22
+
23
+ ### What We CAN Prove
24
+ - ✅ "Node X is NOT within 500km of landmark Y" (exclusion)
25
+ - ✅ "Node X is consistent with being in region Z" (plausibility)
26
+ - ❌ "Node X is definitely at coordinates (lat, lon)" (NOT provable)
27
+
28
+ ### Honest Limitations
29
+ - We prove **exclusion zones**, not exact location
30
+ - Network delays make nodes appear farther, never closer
31
+ - This is NOT quantum entanglement - it's classical physics
32
+
33
+ ---
34
+
35
+ ## 📐 Distance Precision by Time Source
36
+
37
+ | Time Source | RTT Precision | Distance Precision |
38
+ |-------------|---------------|-------------------|
39
+ | QUANTUM | ±1ms | ±1km |
40
+ | ATOMIC | ±100μs | ±10km |
41
+ | GPS/PTP | ±1ms | ±100km |
42
+ | NTP | ±10ms | ±1000km |
43
+
44
+ Higher precision timing → smaller error bars → better exclusion.
45
+
46
+ ---
47
+
48
+ ## 🏔️ Architecture
49
+
50
+ ### Landmark Nodes
51
+ Well-known nodes with verified physical locations:
52
+ - ORACLE/ANCHOR tier nodes with GPS coordinates
53
+ - Distributed globally for coverage
54
+ - Operate SHERPA beacons for RTT measurement
55
+
56
+ ### RTT Measurement
57
+ ```javascript
58
+ import { measureRTT } from 'yakmesh/security/geo-proof';
59
+
60
+ const measurement = await measureRTT('https://landmark.yakmesh.dev/.well-known/yakmesh/beacon', {
61
+ samples: 5,
62
+ timeout: 10000,
63
+ });
64
+
65
+ console.log(`Min RTT: ${measurement.getMinRTT()}ms`);
66
+ console.log(`Reliable: ${measurement.isReliable()}`);
67
+ ```
68
+
69
+ ### Distance Calculation
70
+ ```javascript
71
+ import { calculateMinDistance, LIGHT_SPEED } from 'yakmesh/security/geo-proof';
72
+
73
+ // RTT of 40ms via fiber
74
+ const minDistance = calculateMinDistance(40, 'FIBER');
75
+ // Result: 3997 km (node cannot be closer than this)
76
+ ```
77
+
78
+ ### Exclusion Zones
79
+ ```javascript
80
+ import { ExclusionZone, GeographicProof } from 'yakmesh/security/geo-proof';
81
+
82
+ const zone = new ExclusionZone({
83
+ landmarkId: 'landmark-nyc',
84
+ landmarkName: 'NYC-ANCHOR-1',
85
+ minDistanceKm: 4000,
86
+ precisionKm: 100,
87
+ rttMs: 40,
88
+ });
89
+
90
+ // Check if claimed location is possible
91
+ const result = zone.isExcluded({ lat: 40.7128, lon: -74.0060 }); // NYC coords
92
+ // Result: true (excluded - node claims to be in NYC but RTT proves >4000km away)
93
+ ```
94
+
95
+ ### Trilateration
96
+ With 3+ landmarks, we can narrow down possible regions:
97
+
98
+ ```
99
+ Landmark A (NYC): RTT 20ms → max 2000km radius
100
+ Landmark B (London): RTT 80ms → max 8000km radius
101
+ Landmark C (Tokyo): RTT 120ms → max 12000km radius
102
+
103
+ Intersection = possible location region
104
+ ```
105
+
106
+ ---
107
+
108
+ ## ✅ Phase 1: Core Module (This Release)
109
+
110
+ ### Files
111
+ - `security/geo-proof.js` - Core module ✅
112
+
113
+ ### Features
114
+ 1. **LandmarkRegistry** - Register/manage landmark nodes
115
+ 2. **RTTMeasurement** - Measure RTT with statistical analysis
116
+ 3. **ExclusionZone** - Physics-based distance bounds
117
+ 4. **GeographicProof** - Aggregated proof from multiple landmarks
118
+ 5. **GeoProofService** - Service class for integration
119
+
120
+ ### Integration Points
121
+ - Uses `oracle/time-source.js` for precision timestamps
122
+ - Uses `security/trust-tier.js` for tier weights
123
+ - Exposes SHERPA-compatible beacon endpoints
124
+
125
+ ---
126
+
127
+ ## 🔜 Phase 2: KHATA Integration (v2.5.1)
128
+
129
+ ### Gossip Messages
130
+ Add geo-proof messages to KHATA protocol:
131
+ - `GEO_PROOF_REQUEST` - Request proof from peer
132
+ - `GEO_PROOF_RESPONSE` - Share proof with peer
133
+ - `LANDMARK_ANNOUNCE` - Announce landmark status
134
+ - `LANDMARK_VERIFY` - Cross-verify landmark
135
+
136
+ ### Trust Integration
137
+ - Geographic consistency as trust factor
138
+ - Peers with verified locations get trust bonus
139
+ - Inconsistent location claims trigger strikes
140
+
141
+ ---
142
+
143
+ ## 🔜 Phase 3: Dashboard & CLI (v2.5.2)
144
+
145
+ ### Dashboard
146
+ - World map visualization of exclusion zones
147
+ - Landmark status indicators
148
+ - RTT heatmap to landmarks
149
+
150
+ ### CLI Commands
151
+ ```bash
152
+ yakmesh geo status # Show current proof
153
+ yakmesh geo landmarks # List known landmarks
154
+ yakmesh geo measure # Trigger RTT measurement
155
+ yakmesh geo verify <coords> # Check if coords are possible
156
+ ```
157
+
158
+ ---
159
+
160
+ ## 📊 Test Plan
161
+
162
+ ### Unit Tests
163
+ - Distance calculation accuracy
164
+ - Haversine distance formula
165
+ - Exclusion zone logic
166
+ - RTT statistics (min, median, stddev)
167
+
168
+ ### Integration Tests
169
+ - RTT measurement with mock HTTP
170
+ - Landmark registry operations
171
+ - Proof generation and serialization
172
+
173
+ ### Physics Verification
174
+ - Speed of light constants
175
+ - Fiber vs vacuum propagation
176
+ - Edge cases (same location, antipodal)
177
+
178
+ ---
179
+
180
+ ## 🔗 Dependencies (All Existing)
181
+
182
+ | Module | Usage |
183
+ |--------|-------|
184
+ | `oracle/time-source.js` | Precision timestamps |
185
+ | `security/trust-tier.js` | Tier weights |
186
+ | `mesh/sherpa-discovery.js` | Beacon endpoints |
187
+ | `security/khata-trust-integration.js` | Gossip layer |
188
+
189
+ No new dependencies required.
190
+
191
+ ---
192
+
193
+ ## 📈 Success Metrics
194
+
195
+ | Metric | Target |
196
+ |--------|--------|
197
+ | RTT measurement reliability | >95% samples succeed |
198
+ | Exclusion zone accuracy | ±10% of physics limit |
199
+ | Trilateration coverage | 3+ landmarks per node |
200
+ | Test coverage | >90% statements |
201
+
202
+ ---
203
+
204
+ ## 🚀 Migration Path
205
+
206
+ ### From v2.4.0
207
+ 1. No breaking changes
208
+ 2. New `security/geo-proof.js` module
209
+ 3. Optional integration with trust system
210
+ 4. Landmarks can be added gradually
211
+
212
+ ### Configuration
213
+ ```javascript
214
+ // yakmesh.config.js
215
+ export default {
216
+ geoProof: {
217
+ enabled: true,
218
+ landmarks: [
219
+ {
220
+ name: 'NYC-ANCHOR-1',
221
+ endpoint: 'https://nyc.yakmesh.dev/.well-known/yakmesh/beacon',
222
+ coordinates: { lat: 40.7128, lon: -74.0060 },
223
+ region: 'NA-EAST',
224
+ },
225
+ // ... more landmarks
226
+ ],
227
+ },
228
+ };
229
+ ```
230
+
231
+ ---
232
+
233
+ ## 📚 References
234
+
235
+ - Speed of light in fiber: https://en.wikipedia.org/wiki/Fiber-optic_communication
236
+ - Haversine formula: https://en.wikipedia.org/wiki/Haversine_formula
237
+ - One-way delay measurement: RFC 7679
238
+ - v2.4.0 trust tiers: [ROADMAP-2.4.0.md](./ROADMAP-2.4.0.md)
239
+
240
+ ---
241
+
242
+ ## 🏷️ Tags
243
+
244
+ #yakmesh #v2.5.0 #geo-proof #physics #rtt #trilateration #exclusion-zones