CEWP — feel the scale · per-server feasibility & 1-hop shaped slot supply

Pick a workload, tune trust depth or open Advanced to adjust population opt-ins (with CC 4.5.13 / 5.4.3 / 5.4.6 / 6.1.6 benefits & downsides), device tiers, phone Wi-Fi vs cellular, and reachable-home share. Watch per-server feasibility, 1-hop shaped slot supply, and shaped onion cover capacity update live.   ← Globe landing page · How it works · vs. other meshes · 6-peer kernel

Workload & Headline Knob

Operator-side local config: depth 0 = direct trust only; each hop multiplies the effective trust set (1× / 4× / 20× / 100× at depths 0/1/2/3).
Hard-NAT peers–
Shaped slots–
Onion cover–

PresetsCC 4.5.13 / 5.4.3 / 5.4.6

Fleet Defaults
High Privacy
CGNAT Stress (85%)
Unowned-Only (73rd Peer)

Device Tiers, Phone Wi-Fi vs Cellular & Hard NATscenario mix

use scenario tier mix
custom tier sliders
Reachable-home share = 100% − NAT% direct IPv6 / punched UDP path (leviculum#100 NAT-mix, leviculum#101 no PCP/NAT-PMP/UPnP). Per CC 5.4.3 ("A shaped link is one hop"), a shaped link is 1 direct hop; peers with no direct path carry on ordinary links.

Population Opt-In ChoicesBenefits (+) & Downsides (−)

+ Hides row timing & size in channel MDU frames (ρ=0.5, W=600 s); carries onion walks at +0 B extra wire cost. − Sends ~18.1 GB/mo/link continuous cover even when idle; adds ~1.16 s mean (~2.3 s @ 16 KB TCP MDU) Poisson wait.
+ Masks home message timing/size (W=600 s) on direct 1-hop links and expands the standing shaped cover pool for onion peers. − Costs ~7.2 GB/mo/link continuous cover bandwidth and adds ~2.9 s mean (~5.8 s @ 16 KB TCP MDU) wait.
+ Shapes direct 1-hop mobile links (W=600 s Wi-Fi, W=3,600 s cellular); adds mobile shaped cover hops. − 3.6 GB/mo/link Wi-Fi (0.9 GB/mo/link cell, ~7 GB/mo @ 8 links); keeps radio awake; 11.6–46.5 s TCP MDU delay.
+ Each directly reachable home/server adds L−1 = 7 shaped slots (Tiers.lean: each_home_adds_seven, reach ≠ capacity) & avoids stranding at the 73rd peer. − Carries strangers' sealed rows up to class budget; discloses signed route & locality to ≤3 referred strangers.
+ Reachable by short ciris:// name; can join public rooms (open:self_admit) & serve as announced relay/seat. − Lists device on public federation roster (lightnet); declining (self darknet) requires manual v3 contact codes.
+ Unlinkable federation publishing & private rooms via 3-hop X-Wing onion walks over shaped links from sticky guard. − Row plane only (≤64 KiB, no live A/V); ~1/3 home shaped share cover cost; never relays; uptime-correlation on sleeping phones.
+ Expands 3-layer relay deal & mixing pool so anonymous walks aren't narrowed by a small volunteer set. − Layer links must run shaped, reserving up to 4 of the node's L=8 shaped link slots at class rate.
+ Contributes 14 KiB/decision scrubbed reasoning traces to cohort accountability and RATCHET evaluation. − Widens trace visibility beyond self/family and adds signing, scrubbing, and chunk custody storage load.

Substrate Gates & Server Diskv1 targets

default
local-heavy
global-heavy
scenario default

Swarm & Onion Walk Knobs

cover-replaced ON
OFF
seat 33 KB/s (0.25s)
server 7 KB/s (1.16s)
home 2.8 KB/s (2.90s)

Per-server feasibility — L1 server tier vs the gates

What the server holds — steady-state, 92% utilization

effective trust sources (R × depth mult)
implied retention (admitted-trust pool)
custody store fraction (1/N)

Latency p50 (RTT) — CEWP vs today's internet

Federation rollup — the whole internet

total users
total substrate storage
aggregate CPU (full-util cores)
datacenters required0

Whole-chunk custody management — per content-hash

target holders H (custody)
whole-copy baseline
multiplicity ratio
fleet disk pool
distinct content — custody
distinct content — whole-copy

CC 5.4.3 Budget Classes, 1-Hop Shaped Slot Supply & CC 6.1.6 deterministic-alm — CC RC17 · Edge v44

no-direct-path peers vs k=2 reachable parent capacity
reachable-home share (IPv6 / punched direct path input)
1-hop shaped slots (Tiers.lean each_home_adds_seven, reach ≠ capacity)
direct 1-hop devices shaping traffic (standing cover pool)
shaping cover : anonymous onion peer ratio
answering onion relays / layer (CC 5.4.6 floor ≥ 3)
added hop-wait latency (one-way)
standing shaped links (L≤8, server 7 KB/s · seat 33 KB/s)
extra wire bytes for onion walks (replaces cover)
packet geometry (X-Wing KEM + wide-block AEAD)
large-N fan-out (CC 6.1.6 deterministic-alm member relay tree)
direct reachability (leviculum#100 NAT-mix, #101 no PCP/UPnP)
What this is / isn't — read before you trust a number

This is an analytic design-search toy, not a measurement. It ports the steady-state per-server model from examples/scale_model.rs verbatim. The numbers are "can the design close?" outputs, not telemetry from a running federation.

  • Steady-state, single-pool. One held-bytes pool per node scored by trust × demand × recency; no separate "archive vs cache" tiers, no warm-up transient. The eviction sweeper holds disk at 92% full.
  • Whole-chunk custody replication. A holder stores sealed whole chunks attested by custody:ack:v1 (while holds_bytes is retired and refused per CC §3.1.3.3); the swarm converges to H=30 consenting holders; governed by multiplicity and dominance gates ($n_{\text{eff}} \ge 3$, root durability floor $R_9 \ge 9$ per CC §6.1.2.1.2). Live A/V chunks are never fragmented into symbols (CC §5.3.3.2.3), and layered fidelity (CC §6.1.2) degrades gracefully across Full / Partial / EnvelopeOnly layers. Replication count is decoupled from trust radius.
  • The locality dividend is structural. self/family cohort content never emits a custody:ack:v1 attestation (while holds_bytes is retired and refused per CC §3.1.3.3), so no peer can request it — it's free inter-host. Only publishable() bytes (community + affiliations + species + planet + federation) cost anything to federate.
  • Empirical constants (sign/verify µs, scrub/canon rates, 14 KiB H3ERE trace) are baked in from CIRISVerify / CIRISEdge / CIRISPersist benchmarks — see FSD §2.
  • The cohort + depth knobs override the scenario. Changing them substitutes a different trust topology into the scenario's workload to let you feel sensitivity — they aren't the scenario's shipped defaults unless you pick "scenario default".
  • The gate sliders let you ask "what if the commodity box were beefier?" — the v1 bet is specifically the 1 TiB / 1 Gbps / 1 core column.

If a number looks wrong, the model is the source of truth — dispute the inputs, they're all visible.