Prime Radiant receipts · All receipts

PR-10: The Seven Seas, and a closer machine serves

Built 2026-10-05T05:00Z by a W005 build helper (Claude, seat BM07) on M0. Live run 2026-10-05T04:51:11Z to 04:53:09Z (2026-10-04 23:51 Central). The Founder's words, relayed by W005: "we have the Seven Seas, so turn it on"; "a closer machine serves it instead"; no central database ("will cost me millions"); about $5 a month for a Cloudflare Worker as a bootstrap, on his existing account; M2 treated as if on a different network, joining voluntarily, reached by Socceri addressing. "MiB" means 1,048,576 bytes.

What was proven, in plain language

Two machines found each other with no central database, and the closer copy of a file was used, checked, and replaced when it was bad.

• Finding each other. Neither machine was told the other's address. Each one sent a signed "here I am" card on the home network, and each one also posted that card on a small notice board (the code for the Cloudflare Worker, run on M2 for the test). Each machine found the other both ways: on the network and on the notice board. Every card was checked against the key that signed it before it was used.
• Joining is voluntary. For the first 8 seconds M2 had not joined. In that time it sent nothing, posted nothing and ignored the 6 messages M0 sent it. M0 first saw M2 only after M2 joined.
• Who has this file? M2 asked, by address, who holds each of 50 public files. For all 50, two holders answered: M2 itself and M0.
  • (i) Closest first. M2 used its own copy every time (50 of 50), and every copy was byte-exact.
  • (ii) When M2's copy was not there, M0 served it instead: 10 of 10 byte-exact, including the 10.6 MB signed Windows launcher (0.64 s).
  • (iii) Bad copies were caught. When M2's own copy had one bit changed, the check caught it and M0's copy was used. When M0 was made to send one wrong bit on purpose, the check caught it and M2's own copy was used. Both times the right bytes arrived.
• Every connection between the machines started with the Thorax handshake (both keys checked) and was encrypted. 14 of 14 real connections passed it; 1 connection with a wrong key on purpose was refused.
• Everything outside the rules was refused, 6 of 6: a wrong key, a call-back address the requester had not signed, a stranger, a forged signature, and (asked two ways) a file M0 holds but did not offer.

The line that is safe to publish: two computers on one home network found each other with no central server, each picked the nearest holder of a file by its address, checked every byte against that address, and when a copy was wrong (on purpose, for the test) they caught it and used the other holder. The notice board for computers on different networks is written and tested, not deployed.

Condition (the caveat wins)

• Scale. One pair of machines, M0 (M0) and M2 (M2), on one home LAN, in one run of about 60 seconds, with 50 files totaling 18,690,102 bytes. M3 was off.
• "Different network" was by rule, not by wire. No shared drive, no WinRM in the data path, no address of M0 in M2's settings, and M2 joined by its own consent. Physically both are on the same LAN. Nothing crossed the internet.
• The Cloudflare Worker was NOT deployed. The notice board in this run was the unchanged worker.js running under plain Node on M2 (a temporary port), with a memory stand-in for Workers KV and the rate limiter. It has never run on Cloudflare.
• "Closest" here means "same machine first, then lowest measured round trip". With one remote holder there was no contest between two remote holders. M0's round trip was 1.3 to 2.3 ms (median 1.6 ms over 50 asks).
• Trust model. A node's key comes from its signed card (trust on first verified card), not from a list made ahead of time. A stranger with a valid card on the same topic would be accepted as a peer. What protects the person: content is checked by its address (SHA-512) and sha256, and each holder serves only its own signed consent list. There is no membership check in this test; the Conduit's real Seven Seas uses a signed membership attestation (see "The switch" below).
• Forward secrecy: none, same as PR-8 (Thorax relay v2 is static-to-static with a fresh salt per frame).
• This is not the Conduit app and not the Founder's Conduit (its port was not touched). It is test code built from the estate's own pieces.

The switch: why the Seven Seas is off in the Conduit, and what this test did instead

Read first: Conduit seven_seas.cjs, seven_seas_mount.cjs, conduit_public.cjs lines 235 to 253, net_reach.cjs, card_share.cjs line 887.

• In the Conduit, the Seven Seas starts only when both are true: (1) the Conduit holds a membership attestation signed by the production key pinned in the build (handed out by the seven-seas-attest function after a paste of a request code on the membership page), and (2) the meeting network (HyperDHT, reach) is allowed (settings.meetingNetwork !== false and CONDUIT_NO_MEETING_NETWORK not 1). CONDUIT_TEST_DHT_BOOTSTRAP points it at a loopback test network only.
• Turning that on for M2 would have needed a real member attestation from the live function. I did not do that, and I did not edit the frozen release candidate CONDUIT_WT_W005_034.
• Instead, this test proves the pieces the Conduit's Seven Seas does not have yet, with test keys: LAN discovery, a bootstrap list, "who has address X" with several holders, closest first, and fall back on a bad copy. The Conduit's own design says there is no relay and no server carrying cards; the Worker here keeps that rule: it carries signed cards about nodes, never content.
• Prior art reused or followed: Thorax relay v2 and the PR-8 handshake glue (unchanged, same hashes as PR-8); Conduit connector.cjs Socceri addressing (unchanged); the LAN beacon idea from mnemosyne constellation_discovery.ts (UDP beacon, signed frames). Searches for existing bootstrap, rendezvous, Kademlia, multicast and Cloudflare Worker code (disk grep and pheromone_query) found no rendezvous board; the only "Cloudflare Worker" yoke (BP085) is marked SUPERSEDED.

Nodes and keys

Where the 50 files came from

m0_build_stores.cjs took them from tonight's PR-8 signed consent manifest (its signature was verified first): the 20 largest records plus the 30 lowest-address records between 1 KB and 200 KB. Each file was re-hashed against the PR-8 manifest (Socceri, sha256, size) and scanned again for secret patterns (0 hits, 0 dropped). The copies went to M2 over the WinRM setup channel, not the data path. After the run, all 50 files in M2's store still matched the selection by sha256.

Test sets (picked by code before the run): W, 10 records whose local copy M2 moved aside (the 5 largest and 5 small ones); Y, 1 record whose M2 copy was corrupted; Z, 1 record M0 was told to corrupt when serving.

How it works (the protocol)

1. Node card. Each node signs a card: key, Socceri address, Thorax X25519 announcement, reach list (UDP address; for M2 also its TCP listener; M0 says "dial-out only"), the sha256 and seal of its own consent manifest, consent.joined: true, and a 5-minute expiry (seas_record.cjs). A card is used only if the Socceri address derives from the key, the signature holds, it has not expired, and joined is true.
2. Discovery (a): LAN. Every 2 s each joined node sends HELLO with its card to multicast a local multicast group on a temporary port and to the subnet broadcast. A node that hears a valid HELLO answers the sender with its own card (HELLO_ACK).
3. Discovery (b): bootstrap list. Every 2 s each joined node posts its card to each bootstrap address and reads the newest cards back (worker.js).
4. Who has X. The requester sends a signed WHO_HAS to every peer it knows; a holder answers with a signed HAVE (sha256, size) only if X is in its own consent manifest. The requester adds itself if it holds X, measures each remote holder's round trip (signed PING/PONG, median of 3), and tries holders in order: own copy first, then lowest round trip.
5. Transfer. The requester sends a signed CALL_ME naming a TCP listener from its own signed card. The holder dials back only to that address, and only if it is also the UDP source of the request. Then the Thorax handshake runs with both keys taken from the verified cards, and the file travels sealed.
6. Check on arrival. SHA-512 of the bytes must equal the address; sha256 and size must match; the holder's signature over {address, sha256, size, holder} must verify. Any failure: next holder.

Results

Discovery

• M2 joined at 04:51:30.836Z. Before that (04:51:22.807Z to 04:51:30.822Z) M2 sent 0 messages, saw 0 peers, and ignored 6 incoming messages. M0 first saw M2 after the join: true.
• M2's settings file (m2_config.json) contains no 192.168 address: checked by code. The only address in it is its own loopback notice board. M0's only configured address is the notice board's (the stand-in for the Worker's URL); every node-to-node address came from a signed card.
• Bootstrap only: M2 fetched one file from M0 using ONLY the card that came from the notice board (UDP address taken from that card): 5,354 bytes, byte-exact, holder signature verified, Thorax session bff447c2...89d2b4.

(i) Closest holder first: 50 of 50

(ii) Local copy withheld: M0 serves, 10 of 10

Each row: one holder answered (M0 only), the holder's signature verified, a fresh Thorax session (ids in checks.json). The "ms" counts the whole fetch: CALL_ME, dial back, handshake, sealed transfer and checks. For small files that set-up time (about 10 ms) is most of it, so MiB/s for small files is not a transfer rate.

(iii) Tamper tests: 2 of 2 caught, right bytes delivered both times

The corrupted and original copies of Y are kept on M2 in evidence (sha256 59e10ce3... and 511208d2...).

Refusals: 6 of 6 correct

What crossed the wire (checked by code, m0_check_results.cjs)

• M0 served 13 files and M2 received 13, in the same order, same sizes. 12 honest, 1 tampered on purpose (Z). Every served address is in M0's consent manifest. File payload 16,209,827 bytes.
• M0 dialed out 15 times, all to M2 (the address in M2's signed card): 14 Thorax handshakes passed, 1 refused (the wrong-key test). Plain TCP frame types from M0: only hello, ready and sealed; no file content in a plain frame. TCP bytes out 28,878,961, in 42,155.
• UDP from M0: 64 HELLO, 52 HELLO_ACK, 62 HAVE, 191 PONG, 3 CALL_REFUSED; 267,197 bytes. A HELLO with the full signed card is 1,622 bytes; a HAVE is 488 bytes.
• UDP into M0: 52 HELLO, 50 HELLO_ACK, 63 WHO_HAS, 191 PING, 18 CALL_ME.
• Notice board (stand-in on M2): 115 requests, all status 200: from M0 32 posts and 31 reads, from M2 (loopback) 26 posts and 26 reads.
• M2's listener accepted only the connections it was expecting; unexpected connections: 0.

Cloudflare Worker (written, tested, NOT deployed)

• worker.js: POST /v1/announce (signed card, at most 4,096 bytes, signature and Socceri checked with WebCrypto Ed25519 and SHA-512, stored in Workers KV with a 60 to 900 s expiry, an older card cannot replace a newer one), GET /v1/records?topic= (at most 16 newest), GET /v1/health. Per-IP rate limits: 10 posts and 60 reads per minute.
• wrangler.toml: KV namespace binding plus two Rate Limiting bindings.
• Workers KV, not Durable Objects, because it fits the $5 plan for the bootstrap phase (about 100 always-on nodes; numbers and the crossover in DEPLOY_FOR_FOUNDER.md).
• No wrangler or miniflare was installed (none found on M0; nothing was installed). The handler was unit-tested under plain Node 24: 20 of 20 pass (worker_unit_test.json), including: changed field refused, swapped address refused, wrong key refused, not-joined refused, expired refused, oversize refused, older card refused (409), rate limit at the 11th post (429) and per IP, at most 16 records, and the Worker's verifier agrees with the Node verifier on 30 of 30 good and broken cards.
• Then the same unchanged file served as the notice board in the live run (above).
• DEPLOY_FOR_FOUNDER.md: the clicks for Workers Paid and a Workers-only token, the one deploy command (npx wrangler deploy, after a one-time npx wrangler kv namespace create SEAS_KV), and the expected monthly cost from Cloudflare's public pricing page: $5.00 a month up to about 100 always-on nodes posting every 5 minutes, about $117 at 1,000 nodes unless the board moves to a Durable Object or nodes post less often.

Incidents and honest notes

1. Hook gates hit, all followed, none routed around. The inline-code blocker refused one node -e command; I wrote the code to a file as it instructs. The prior-work gate stopped 12 new files; each time I opened or named the candidates (membership attestation files, Electron workers, the site deploy button, generic names), found none that does this, and wrote the same path again as the gate allows. The Rule 66 gate required a sibling before I edited seas_node.cjs; the sibling seas_node.superseded.20261005T044648Z.cjs holds the earlier version. The bedrock and substrate gates ran in warn mode; I ran pheromone_query before the edit.
2. A dry run happened first, on M0 only (scratchpad, bootstrap channel only, different ports, fresh keys, topic pr10-dry-run): remote fetch of the 10.6 MB launcher, tamper fallback, local first and the wrong-key refusal all behaved. It briefly opened TCP on a temporary port on M0 for a few seconds. It is not counted here. seas_node.cjs was not changed after it; the driver, M0 main and orchestrator were first run live.
3. The secret re-scan used stricter patterns than PR-8's (for example AKIA followed by 16 characters instead of AKIA alone). The 50 files had already passed PR-8's broader scan, so this is a second check, not the only one.
4. The check script m0_check_results.cjs was written after the run and is not in the pre-run seal. It only reads the result files; every number in this receipt comes from it or from the result files directly.
5. Notice board count: the stand-in logged 32 posts from M0; M0's own log has 31. The last post was in flight while M0 was stopping, so M0 did not log its answer. Not a data-path issue.
6. M0 free RAM was 6,381 MB at the start, above the 6 GB floor but close. The test processes are small.
7. Existing M0 firewall rule, not changed: an older "Node.js JavaScript Runtime" inbound allow rule for Program node.exe on the Private profile lets M0 hear UDP on a temporary port. I made no firewall change on M0. M0 opened no TCP listener in the live run.
8. Canon conflict about Cloudflare: BP085 canon says the Founder does not use Cloudflare; tonight he says his Cloudflare account hosts mnemosynec.org, and the domain's name servers are Cloudflare's. Flagged in DEPLOY_FOR_FOUNDER.md for him to confirm.

Changes on M2 (and their removal)

• One folder, left in place: CROSS_NODE_TEST_PR10_20261005 with scripts (driver, keygen, 7 lib files), worker (worker.js, local_server.mjs, package.json), config.json, store (50 files, all matching the selection), evidence (Y original and corrupted), m2_pr10_ed25519_priv.pem (test key, never left M2), out (results.json 023fe262..., wire_log_m2.jsonl 8df1761b..., manifest_m2.json 1fe7a0ad..., bootstrap_log.jsonl 771e2f65...; copies in m2 with the same hashes).
• Three temporary firewall rules, all inbound, remote M0 only: CROSS_NODE_TEST_PR10_20261005_TCP47809, _UDP47810, _TCP47811. Opened 04:51:19Z, removed 04:52:24Z by the script's own cleanup.
• After cleanup: rules left 0; TCP listeners on 47809 and 47811: 0; UDP endpoints on 47810: 0; test processes: 0. A TCP probe from M0 afterwards to 47809 and 47811: False and False.
• Nothing was installed. Node v24.16.0 was already on M2.
• Not touched: the Founder's Conduit, his MnemosyneC keys, the frozen release candidate CONDUIT_WT_W005_034, his Cloudflare account.

Evidence (sha256)

Folder: D-BP223-W005-PR10-SEVEN-SEAS

Copyable. Node built-ins plus the estate files above, no npm installs. To run again on two other machines: copy scripts and worker; give each node a store folder of files named by their Socceri address; run keygen.cjs on each; run m0_node_main.cjs on one and m2_driver.cjs on the other (with config.json), or call createNode from seas_node.cjs directly.

What is next (not done)

• Deploy the Worker (his hands: DEPLOY_FOR_FOUNDER.md), then repeat this test with M2 on a phone hotspot so the two machines are truly on different networks. Across the internet the call-back needs a reachable listener or the meeting network's hole punch (net_reach.cjs); this test did not cover that.
• Fold LAN discovery and "closest holder" into the Conduit's real Seven Seas after the 0.3.4 audit, behind the membership attestation it already requires.
• Partial fetch from several holders at once (chunks with per-chunk hashes) and racing two remote holders: not built.

Filed. Not done. The Founder decides.