◇ Sovereign Internet Overlay
Encrypted routing plane above any physical carrier. WireGuard peers converge on an exit node with full-tunnel routing, NAT masquerade, and private DNS. Health is signed and measured, not asserted.
- ◦ A device still needs a physical carrier: Wi-Fi, Ethernet, cellular, satellite, LoRa, or a reachable peer.
- ◦ The sovereign layer is the encrypted routing/control plane above that carrier — not a replacement for it.
- ◦ Integrity target 99.4% is claimed ONLY after measured uptime, packet, DNS, and route telemetry prove it.
chmod +x setup-exit-node.sh sudo ./setup-exit-node.sh # installs wireguard + iptables # enables IPv4 forwarding # applies NAT masquerade on wg0 # starts wg-quick@wg0
# laptop wg-quick up ./wg0-laptop.conf # phone (QR) qrencode -t ansiutf8 < wg0-phone.conf
chmod +x health-check.sh ./health-check.sh # asserts: external IP == 204.168.210.161 # asserts: DNS resolves through tunnel # reports: handshake age + packet counters
External systems that claim to interoperate with this site. Reachability is probed server-side every 60 seconds. Reachable is not coupled: a peer is only trusted once it serves an ARCHANGEL/v0 signed payload whose re-derived CID matches.
- claim:
- Recovery frontend (12-step tracking, daily practices, sponsor matching).
- signed:
- —
- blocker to coupling:
- Externally hosted SPA. No signed /status payload, no verified Search Console property, robots.txt and sitemap.xml return the app shell.
- claim:
- 14 endpoints with Ed25519-signed responses and bidirectional webhook sync.
- signed:
- —
- blocker to coupling:
- Published on an ephemeral sandbox host. Needs a stable domain with TLS and a pinned Ed25519 public key before any webhook can be accepted here.
- claim:
- Public source for the Tesseract frontend.
- signed:
- —
- blocker to coupling:
- Not publicly readable. Auditors cannot reproduce the deployed build from source.
External gateways may POST signed events to /api/public/hooks/nexinus. The shared secret authenticates the sender, not the claim. Every accepted event is held QUARANTINED and never enters the ledger, the Golden Truth manifest, or any mint path.
loading…
This overlay does not create internet from nothing. To claim carrier-independent connectivity, add radio, satellite, or community mesh backhaul at the physical layer. Everything above assumes a reachable carrier underneath.