FIPS Network Overlay and Fleetmesh Federation

Architecture & Scope

Overlay Routing and Relay Federation

FIPS and fleetmesh operate at distinct architectural layers: FIPS provides encrypted multi-hop IPv6 packet routing, while fleetmesh provides application-layer accounting and rate enforcement between sovereign relays.

Topology differs across both designs: FIPS constructs multi-hop routing graphs where intermediaries re-encrypt and forward raw datagrams; fleetmesh establishes bilateral peering graphs where relays enforce rate budgets directly, restricting transit paths to three hops for clear accounting attribution.

Same keys, different layers

Where they would sit in one stack

Side by side

Fourteen axes, none of them a tie

Signaling and Primitives

Shared Nostr Rendezvous and Protocol Overlap

Both protocols utilize Nostr relays for connection discovery and session establishment. Each node publishes signed, expiring connection descriptors with NIP-40 expiration. Private handshakes circulate as NIP-44 payloads encased in ephemeral kind 21059 gift wraps, routed using recipient kind 10050 inbox relay lists. All events are signed with the primary node identity key.

Kind 21059 serves as an open container under NIP-59 for ephemeral messaging. Nodes ignore unrecognized inner rumor payloads silently. A FIPS daemon ignores DIDComm payloads addressed to its key, and a fleetmesh node ignores traversal offers, preventing parse errors.

Descriptor Structuring

FIPS publishes network endpoints within JSON payloads under kind 37195, indexed by author npub. Fleetmesh indexes endpoints using structured tags in kind 11801 alongside node class, protocol digests, and subordinate agreement and transport keys, resolving into a standard DID document. FIPS uses npub routing directly, requiring a single key pair where fleetmesh binds three.

Transport Capabilities

Multi-Carrier Routing in FIPS

FIPS implements unified routing across Tor, Nym, Bluetooth Low Energy (BLE), raw Ethernet, and 802.11s mesh links. Integrating a FIPS transport adapter in fleetmesh provides direct access to these physical and overlay carriers through a single daemon.

• Measured link telemetry: In-band measurement tracks per-link round-trip time, packet loss, jitter, goodput, and MTU dynamically. Fleetmesh kind 21802 telemetry provides higher-level window accounting via meshwatch.py.
• Multi-layer encryption: FIPS applies Noise IK per link and Noise XK end-to-end. Fleetmesh secures control traffic via DIDComm v2 while delegating data stream encryption to negotiated transport rungs.
• Operational tooling: FIPS provides fipsctl, interactive status monitors, and packaging across eight platforms. Fleetmesh provides the meshnode CLI, declarative manifests, systemd service units, and the meshwatch watcher.
• Direct home relay routing: FIPS establishes direct IPv6 connectivity behind NAT routers through STUN hole punching and Tor fallbacks.
• Formal adversary models: FIPS documents threat models, mitigations, and implementation status across all network layers.

Economic Accounting

Resource Authorization and Rate Budgets

FIPS authenticates source packet keys without determining resource authorizations. Fleetmesh provides explicit bilateral capacity allocation: nodes establish rate limits under signed grants, verify consumption using chained receipts, and apply deterministic remedies upon breach.

Interconnectivity

Integration Architecture

A fleetmesh node operates as a standard Nostr relay and can deploy within a FIPS overlay container reachable at ws://<npub>.fips:80. FIPS mesh clients connect using author public keys without DNS dependencies or TLS certificate management, since the underlying FIPS transport provides mutual authentication and encryption.

Adding a fips transport scheme allows fleetmesh nodes to address peers directly via public key:

["endpoint", "fips", "npub1…", "1"]        // Peer addressed directly by Nostr identity
["endpoint", "iroh", "<ed25519>", "2"]
["endpoint", "wss",  "wss://relay.example.org", "9"]

• Key alignment: Nodes can reuse their Nostr identity keypair for FIPS Noise authentication, or bind an optional fourth key specifically for overlay transport.
• Identity-linked addresses: FIPS IPv6 addresses derive directly from public keys. Peer telemetry must preserve local confidentiality when logging connection events.
• Reputation export to link ACLs: Fleetmesh dispute findings export directly to FIPS peers.deny lists, allowing application-layer rate accounting to enforce link-level blocks.

Project Details

Timelines and Licences

• Timeline: FIPS development began in March 2026; fleetmesh specifications were published in September 2026 as contemporary, complementary protocols.
• Licensing: FIPS is published under the MIT license; the fleetmesh specification is CC0 1.0 Universal open access.
• Topological models: FIPS routes packets across a multi-hop physical overlay; fleetmesh coordinates contractual replication boundaries across bilateral relay agreements.
• Protocol versioning: FIPS follows semantic software versioning; fleetmesh versioning represents a cryptographic digest computed over machine-readable schemas.

Implementation Plan

Potential Specification Extensions