NeXuS Boot Protocol¶
The sequence that governs every packet, every session, every connection.
No personally identifiable packet leaves this machine until the user's threat model has been met.
The Principle¶
NeXuS is offline-first by necessity, not by limitation.
Conditions required to safely reach out may not always be achievable — bridge nodes unavailable, Tor bootstrapping blocked, I2P tunnels failing to establish. The system must function completely in their absence. The node is never broken by the absence of a network — it is simply an Island waiting for the right conditions to become a Constellation.
The user alone decides when those conditions are sufficient. The system verifies. No automation overrides that decision.
The Five Phases¶
Phase 0 — Island¶
The machine boots. Everything local starts. Nothing external moves.
Local AI ✓ operational
nb notes ✓ operational
MkDocs wiki ✓ operational
Security stack ✓ active
Firewall ✓ kill-switch engaged — zero outbound
POINT score 0
The node is a fully functional offline PowerStation. This is not a degraded state. This is the baseline. Every NeXuS capability that does not require a network is available immediately.
No packet leaves. Not one.
Phase 1 — User Decision¶
The user opens the NeXuS Network Orchestrator.
This is a deliberate act. The system does not attempt to reach out automatically. The Orchestrator does not open itself.
The user selects their threat model for this session:
| Threat Model | Max POINT2POINT Score | What It Means |
|---|---|---|
| APEX | 0 | Full signals intelligence — zero tolerance |
| PURSUIT | 2 | Active targeted deanonymization |
| HARVEST | 10 | Bulk behavioral profiling |
| OBSERVE | 20 | Network-level visibility |
| SCAN | 40 | Opportunistic automated attacks |
The threat model is not a permanent setting. It is a session decision. The user assesses their current situation and chooses accordingly.
System acknowledges:
Phase 2 — Dark Stack Bootstrap¶
The system attempts to establish the conditions required to meet the selected threat model. No traffic flows during this phase — the stack is building internally.
[ ] Snowflake bridge → connecting...
[ ] Tor circuits → bootstrapping...
[ ] I2P tunnels → establishing...
[ ] Medusa routing → configuring...
[ ] DNS privacy stack → verifying...
[ ] POINT2POINT audit → scoring...
Each component is verified independently. A partial stack is not sufficient. The system does not open a degraded connection and hope for the best.
Snowflake is the entry point for censored or hostile network environments. If standard Tor bootstrap is blocked, Snowflake bridges provide the path. If Snowflake cannot connect — the system reports the condition honestly and remains in Island mode.
Phase 3 — Conditions Assessment¶
The dark stack reports its current capability. The POINT2POINT framework scores the current state against the user's threat model ceiling.
Conditions met:
✓ Snowflake bridge connected
✓ Tor circuits 3/3 established
✓ I2P tunnels bootstrapped (12 min)
✓ Medusa routing 5-circuit load balance active
✓ DNS privacy stack Unbound → DNSCrypt → Tor → DoH
✓ POINT2POINT score 0 [APEX ceiling: 0]
CONDITIONS MET — awaiting user confirmation
Conditions not met:
✓ Snowflake bridge connected
✗ Tor circuits 0/3 — bootstrap timeout
✗ Medusa routing depends on Tor — not available
✓ DNS privacy stack partial
✗ POINT2POINT score 14 [APEX ceiling: 0 — NOT MET]
CONDITIONS NOT MET
Your threat model (APEX) cannot be satisfied at this time.
Remaining in Island mode.
Options:
[R] Retry bootstrap
[D] Downgrade threat model
[I] Stay in Island mode
The system does not proceed without the user. It does not silently downgrade. It does not open a partial connection. It presents the honest state and waits.
Phase 4 — Visual Verification¶
When conditions are met, the system presents a full verification screen before any network traffic flows.
╔══════════════════════════════════════════════════════════╗
║ NeXuS Network Orchestrator ║
║ All Systems Operational ║
╠══════════════════════════════════════════════════════════╣
║ Threat Model APEX ║
║ POINT Score 0 / 0 ✓ ║
║ ║
║ Snowflake ✓ connected ║
║ Tor ✓ 3 circuits ║
║ I2P ✓ tunnels established ║
║ Medusa ✓ 5-circuit active ║
║ DNS ✓ routed through Tor ║
║ Kill-switch ✓ engaged ║
║ ║
║ Ready to initiate full NeXuS networking. ║
║ ║
║ [ OPEN NETWORK ] [ STAY ISLAND ] ║
╚══════════════════════════════════════════════════════════╝
The user makes the final call. [ OPEN NETWORK ] is not a default. It is a choice.
Phase 5 — Network Live¶
The user confirms. The network opens.
NeXuS Network Orchestrator — ACTIVE
Scanning for peers...
Syncthing ✓ running
AutoDoc ✓ watching
Mesh layer ✓ listening
The node is now a Constellation node — actively looking to join or create a network. All traffic routes through the verified dark stack. The POINT2POINT score is continuously monitored.
Continuous Health Monitoring¶
The system does not verify once and trust forever. The dark stack is monitored continuously. Any degradation is surfaced immediately.
[!] Tor circuit 2 dropped — rerouting to 4-circuit load balance
[!] POINT score drift: 0 → 2 — APEX ceiling approached
[!] I2P tunnel timeout — attempting reconnect
If the POINT2POINT score rises above the user's threat model ceiling at any point during a session — the system alerts immediately and suspends outbound traffic until the condition is resolved or the user acknowledges the risk.
The user is never in the dark about the state of their stack.
Why Offline First Is Not Optional¶
Conditions may fail to be met for reasons outside the user's control:
- Tor bootstrap blocked by ISP or hostile network
- Snowflake bridges temporarily unavailable
- I2P needing extended bootstrap time (10–30 min on new nodes)
- Hardware failure in part of the stack
In any of these scenarios the node must remain fully functional. If the system required a network to operate, every one of these failure modes would leave the user with a broken machine at the moment they need it most.
NeXuS is a PowerStation first. The network is a force multiplier — never a requirement.
Summary¶
Phase 0 — Island Boot. Local services up. Zero outbound. Full function.
Phase 1 — Decision User opens Orchestrator. Selects threat model.
Phase 2 — Bootstrap Dark stack builds. No traffic flows.
Phase 3 — Assessment POINT2POINT scores the stack. Conditions met or not.
Phase 4 — Verification Visual confirmation. User makes final call.
Phase 5 — Live Network opens. Continuous monitoring begins.
At every phase, the user is in control. At every phase, the POINT2POINT protocol is the arbiter. No packet moves without both.
Conditions may not be able to be met. The system must be self-sufficient. When conditions are met — the user confirms. Then NeXuS reaches out.
NeXuS — Sane • Simple • Secure • Stealthy • Beautiful