Cognis Weave Architecture

Architecture Overview: The Narrow Waist

Cognis Weave (CWP) is a narrow-waist protocol suite built on a seven-layer substrate: Lumen (bearers), Grain (narrow-waist cell), Weft (coding/repair), Strand (paths & privacy), Flow (transport semantics), Corpus (content & swarms), and Chorus (sessions & AI data plane).

The single wire unit is the Grain: a fixed-format, always-encrypted cell with a ~484-byte minimum, sized to survive the worst real bearer — Reticulum's operationally proven 500-byte / 5 bps floor — and budgeted up front to carry hybrid post-quantum handshake material without fragmentation (the lesson of Tor's 509-byte cell pain). Grains are identified by connection ID, not path 4-tuple, so identity survives network change. Critically, the cell format bakes in no timers, window sizes, or ACK-clocking assumptions: the same cell must be valid at 5 bps one-way broadcast and at 800 Gb/s per lambda — a span of roughly ten orders of magnitude in rate and nine in RTT, which forbids any such assumption at the waist.

Grains are carried by Bearer Functors: law-checked adapters that map the abstract protocol category onto a physical medium, exactly the way 802.11bb slots Li-Fi under an unchanged MAC and DTN slots LTP and TCP under one bundle format. Everything above the waist is built from a small set of generator primitives — coding endomorphisms, routing modes, transport lanes, crypto handshakes, swarm operations — composed with session-type combinators whose composites are mechanically projected to per-endpoint state machines and property-tested against the functor laws. Composition is a checked property, not a slogan.

A scope statement, stated plainly: CWP is a full-stack suite above a narrow waist. It rides on, not replaces, each medium's PHY/MAC (LoRa chirp modulation, BLE advertising, 802.11, coherent DSP), and it inherits each medium's non-negotiables — BLE's 11-byte unsegmented cliff, LoRa duty cycles, Part 97's encryption ban on amateur bands. Likewise, "photonic" means CWP controls and schedules photonic circuits; there is no optical RAM, so all buffering, coding, and cryptography execute at electronic edges. The honest headline is one control, identity, integrity, and content model from the acoustic edge to an OCS-scheduled lambda fabric — never uniform performance across that span.

The Seven-Layer Model

The Functor Algebra: Composition as a Certified Property

The algebra is concrete and law-checked, following the ocaml-mpst/Scribble and structured-cospans lineage.

The category Proto. Objects are session-typed protocol states — local types mechanically projected from global protocol terms built with the combinators seq, choice, rec, par over role-annotated actions. Morphisms are permitted message exchanges; composition is sequencing; identity is the empty exchange.

Bearer Functors. A Bearer Functor F_b : Proto → Bearer_b maps each abstract exchange to concrete operations on medium b: F.LoRa emits duty-cycle-budgeted 51-byte frames, F.Lambda pins a flexi-grid slot, F.Custody wraps exchanges in DTN bundles. The functor laws — F(id) = id and F(g ∘ f) = F(g) ∘ F(f), i.e. binding a composed protocol equals composing the bound pieces — are executable: the conformance suite property-tests random protocol compositions against every bearer. This is precisely what separates the algebra from buzzword soup. (NCCL's transport layer and NIXL's backend plugins already implicitly satisfy these laws; Cognis makes them the certification criterion.)

Natural transformations and endofunctors. Format adapters are natural transformations η : F ⇒ G — per-state converter families where encode-then-step must equal step-then-encode. Coding primitives are endofunctors on Grain streams (RaptorQ∘, RLNC∘) that compose because recoding relays re-mix coded symbols without decoding.

Concrete compositions.

• RaptorQ ∘ Mix ∘ F.LoRa — anonymous off-grid file drop: rateless-coded chunks through a Sphinx mixnet, bound to duty-cycled LoRa frames.
• Descriptor ∘ Spray ∘ F.Ether — KV-cache transfer: registered-memory scatter/gather descriptor lists, packet-sprayed across equal-cost paths, over encrypted UDP at NIC line rate.
• Systematic ∘ Governor ∘ F.Ether — the default fast path: verbatim source symbols with repair injected only at the measured loss rate.
• Fountain ∘ F.Carousel + F.LoRa return — one-way broadcast swarm source paired with a thin uplink (the SONIC pattern).
• F.Custody bridging a flow across a 9-order rate mismatch: full Flow semantics on either side of a store-and-forward segment, with RLNC recoding composing repair across the disruption.

Honest arithmetic on the primitive count. The registry holds ~40 orthogonal generators (9 bearer functors × 7 coding endos × 7 flow lanes/CC modules × 6 routing modes × 5 crypto patterns × swarm and AI ops). Every shipped composite is itself a registered, versioned, independently negotiable primitive that has passed projection (deadlock-freedom) and functor-law tests before it may be advertised in handshakes. The current registry enumerates ~350 certified composites; the number grows by composition. The certification gate is what keeps each composite a real primitive rather than a renamed pair — without it, the count would be a cross-product, not a claim.

Primitive Registry: The Generators

Bearer Functors (L0).

• F.Lambda — binds Grain flows to DWDM/flexi-grid lambda circuits and OCS paths via generalized labels (GMPLS RFC 3945/7698); data-rate and modulation agnostic so the photonic middle survives transceiver generations (the Google Apollo lesson).
• F.Ether — UDP encapsulation for fiber/Ethernet/Internet with fully encrypted, greased headers; middleboxes see nothing they can ossify (the QUIC lesson).
• F.Air — WiFi and Li-Fi under one binding (802.11bb PHY-swap discipline): identity, association, and security unchanged across radio and light.
• F.BLE — BLE mesh advertising bearer honoring the 11-byte unsegmented cliff; Grains fragment only when the envelope says the 2–3× segmentation latency penalty is acceptable.
• F.LoRa — LoRa/RNode binding with a per-node duty-cycle token bucket (EU868 1%, TTN 30 s/day) exposed in the API so applications schedule sends instead of failing at the radio; ADR trades SF7–SF12 rate against 25 dB of link budget.
• F.AX25 — AX.25/KISS TNC binding with a legal profile switch: authenticated-plaintext (signatures only, per Part 97) on amateur bands, full Grain crypto on ISM.
• F.Carousel — one-way broadcast binding for RDS (1187.5 bps subcarrier) and DRM datacasting: cyclic carousels of FEC-heavy Merkle chunks so receiver-only nodes reassemble objects with no uplink.
• F.Sonic — ggwave-class acoustic FSK (8–16 B/s, meters) as the zero-hardware bootstrap bearer: exchange identities/keys/network hints by sound, then hand off.
• F.Custody — DTN convergence adapter (RFC 9171 lineage): store-and-forward bundles with hop-by-hop custody transfer — the only sane bridge across a 9-order rate mismatch or an intermittent link.

Coding (L2). C.RaptorQ (RFC 6330 systematic block rateless: any ~K+2 symbols complete a block at 99.9999%, linear-time codec), C.SlideRLNC (RFC 8681-style sliding window over GF(2^8), ~13% less repair traffic than block RS at >10% loss), C.Recode (in-network RLNC re-mixing without decoding, <0.4% dependency waste per packet), C.HARQ-IR (retransmission never repeats bytes), C.Systematic (source symbols verbatim first, clean paths pay zero decode), C.ErasureGate (AEAD tags convert corruption into known-position erasure before the decoder — 2t erasures vs t errors halves required parity), C.Governor (online (p, RTT) estimator, redundancy at p+ε, FEC↔ARQ regime switching).

Transport (L4). T.Stream, T.Message (SCTP I-DATA lesson), T.Datagram (RFC 9221 pattern), T.PathSet (per-path packet-number spaces, coupled LIA/OLIA-style fairness, application-visible subflow scheduler), T.CCMod (negotiated CC module per BCP 133 discipline, with out-of-band capacity hints, e.g. Starlink's 15 s handover cadence), T.Resume (BDP cache, contract-bound 0-RTT), T.Spray (UEC 1.0 pattern, benchmarked at P99.9 not mean).

Routing (L3). R.Announce (Reticulum-style signed announce gossip — zero routing chatter on duty-cycled airtime), R.Label (the generalized forwarding resource: next-hop | timeslot | wavelength | fiber), R.Flood (TTL-bounded, dedup-cached, hop-capped because shared airtime is a commons), R.Onion and R.Mix (see Security), R.Mutate (graph reconfiguration as a costed operation: ms for MEMS OCS, ns for Sirius-class wavelength scheduling).

Crypto. K.Noise (XX first contact, IK reconnect, formally verified patterns, single-Grain variant for the 500-byte floor), K.Hybrid (X25519 + ML-KEM-768 into one HKDF — secure if either assumption holds), K.Ratchet (ephemeral hop keys plus Double-Ratchet-class message ratchet for mailboxes), K.Cell (one fixed padded size, PQ-budgeted).

Swarm (L5). S.CID, S.CDC (FastCDC), S.Merkle (16 KiB leaves, BT v2), S.Fountain, S.Introduce (Kraken-model coordinator, Kademlia O(log N)).

AI data plane (L6). A.Frame (safetensors/Arrow-pattern zero-copy frame: wire layout equals memory layout, mmap-able, range-fetchable), A.Descriptor (NIXL/RDMA-verbs shape: register once, async scatter/gather with out-of-order completion, pluggable backends), A.Collective (NCCL's factoring made protocol-level: fused steps × interchangeable algorithms × interchangeable bearer functors; ring stays bandwidth-optimal at the 2(N−1)/N lower bound — stated, not "beaten").

Composition. X.Combinators — seq / choice / rec / par over role-annotated actions; global protocol values project to per-endpoint state machines with deadlock-freedom checked before anything runs. This is the mechanism that certifies every composite in the registry.

Reliability & Coding Model: Rateless-First, Shannon-Honest

The Weft layer defines "near-lossless" precisely, and the spec refuses the word "lossless" without its epsilon: residual failure probability ≤ 10⁻⁶ per block (RaptorQ-grade, K+2 symbols). On a path with loss rate p, goodput ≤ (1−p) · raw_rate and required repair traffic is ≥ 1/(1−p) of source data. No code, feedback loop, or AI beats that floor; the design's Governor converges to it and never crosses it. The spec publishes this cost instead of hiding it.

Mechanism by traffic class:

• Bulk — systematic RaptorQ blocks. Source symbols ship verbatim first, so clean links pay zero decode cost; repair symbols interleave at the measured loss rate. Any ~K+2 received symbols, from any path or peer, complete the block at 99.9999% probability. ACK machinery collapses to one "done" signal.
• Real-time — sliding-window RLNC over GF(2⁸) with bounded FEC latency, plus SRT-style deadline ARQ: a tunable time budget after which a block is decoded, patched by late repair, or abandoned.
• Mesh/relay — RLNC recoding at relays: intermediate nodes re-mix coded Grains without decoding, so repair capacity composes across hops instead of resetting per hop (dependency waste <0.4% per packet).

ARQ and FEC are one mechanism via the HARQ-IR insight (the 5G lesson): a retransmission never repeats bytes. On NACK or timeout the sender emits further repair symbols of the same block — recovery and proactive FEC share one code.

The Governor adapts continuously: estimate (p, RTT), set proactive redundancy to p+ε, prefer selective retransmission when RTT is cheap (on clean short paths, static FEC is pure waste — QUIC-FEC's measured lesson), and shift toward proactive coding as RTT×loss grows (GEO at 600+ ms, deadline traffic).

Corruption becomes erasure before the decoder: AEAD tags and checksums convert bit corruption into known-position erasures, halving required parity (2t erasures vs t errors) and keeping the entire stack on cheap erasure-only codes.

Honest residual costs, stated in the spec itself:

1. FEC redundancy is always spent and competes with source traffic under one congestion controller.
2. Finite-blocklength physics (Polyanskiy) means small-block / low-latency traffic necessarily runs measurably below channel capacity.
3. "Lossless" at finite block length is always a stated epsilon, never a certainty. Any literal zero-loss claim would be false; CWP does not make one.
4. On feedback-free channels (broadcast carousels), reliability comes only from FEC plus repetition; delivery latency is quantized by carousel cycle time and the sender can never confirm delivery. "Fast and lossless over one-way FM" is a contradiction in terms — the honest statement is eventual, verified, ε-reliable delivery, latency measured in carousel cycles, not RTTs.

Swarm Model: Two Gears, Stated Conservation Laws

Every Corpus object is content-addressed: FastCDC chunking (Gear hash with normalized chunking, so edits and insertions dedup block-for-block; larger fixed blocks for cold bulk), a per-file binary Merkle tree over 16 KiB leaves with a SHA-256 root (the BT v2 pattern: per-block verification with compact proofs, per-block banning of malicious peers, identical-file dedup across swarms), and a self-certifying cognis:// link carrying root hash plus optional hints — sizes, introducer endpoints, HTTP fallback — with metadata itself fetched from the swarm and validated against the root (BEP 9 pattern).

Verbatim gear is classic and proven: rarest-first piece selection plus endgame duplicate-request-and-cancel. Tit-for-tat rechoke applies only in open swarms of strangers; closed/authenticated deployments run incentive-free ledgers (the Kraken / Delivery Optimization lesson).

Fountain gear is where rateless coding changes the game: seeds and peers emit distinct RaptorQ repair symbols of each block, so any ~K+2 symbols from any combination of peers, paths, or broadcast carousels complete it. Multi-source aggregation becomes trivial, the last-block problem largely dissolves, and one-way bearers (DRM/RDS carousels) become first-class swarm sources — a genuine improvement over BitTorrent's verbatim-block tail, with fallback to rarest-first + endgame for verbatim-block swarms.

Coordinator scope is Kraken-style: the tracker/DHT only builds the connection graph (Kademlia when decentralized — O(log N) lookups, and honestly seconds-scale to bootstrap). The data plane is fully peer-to-peer, running over LEDBAT-class scavenger congestion control so background swarms never degrade foreground traffic, with LAN-first → regional-cache → origin source tiering.

Physics stated plainly:

• Aggregate swarm throughput ≤ total peer upload capacity.
• First-copy distribution time ≥ filesize / seed upload rate.
• Content addressing gives immutability, not availability — someone must store and serve the bytes. Pinned always-on seeds are part of the architecture, not an apology: P2P is a bandwidth multiplier on guaranteed storage, never the storage layer itself.

Security & Privacy: Modes Priced Honestly

Identity is a self-certifying keypair, announce-signed Reticulum-style — no global addressing authority. Every Grain is encrypted; every handshake is Noise-based: XX for first contact (mutual auth with identity hiding), IK for reconnects, both formally verified patterns, with a single-Grain handshake variant sized for the 500-byte MTU floor because multi-RTT handshakes are unusable at seconds-per-packet.

Post-quantum from day one: X25519 + ML-KEM-768 secrets concatenated into one HKDF (the X25519MLKEM768/PQXDH pattern) — recorded traffic stays safe if either assumption holds, closing harvest-now-decrypt-later. The fixed Grain cell is budgeted up front for ML-KEM's ~2.3 KB round-trip so PQ material never forces fragmentation.

Forward secrecy runs at two layers: ephemeral hop keys destroyed on path teardown, plus a Double-Ratchet-class per-message ratchet for store-and-forward mailbox contexts.

Privacy is a choice of routing functor, and each mode is stated as an honest coordinate on the anonymity trilemma (Das et al. 2018 — strong anonymity, low latency, low bandwidth overhead: provably pick two):

1. Direct mode — no anonymity, lowest latency. Traffic is still uniform encrypted cells.
2. Veil mode (onion) — telescoped 3-hop circuits over fixed-size cells, months-pinned guards plus mesh vanguards, CGO-class non-malleable wide-block relay encryption so a tagging first hop cannot signal a colluding exit. Cost: roughly +300 ms–1 s. Threat model: resists local network adversaries; explicitly NOT a global passive adversary — DeepCorr-class end-to-end flow correlation wins if both ends are watched.
3. Fog mode (mixnet) — Sphinx uniform packets through stratified mixes with per-hop Poisson delays, unidirectional I2P-style send/receive paths for metadata-sensitive flows, and three tunable cover-traffic levers including self-addressed loops that double as drop-attack detectors (Loopix/Nym tuning levers exposed at runtime). GPA-resistant at a stated price: ~50–500 ms tunable latency plus continuous ~1 Mbps-class cover bandwidth per client.

What the spec does not claim to fix, because these are theorems and economics rather than bugs: the trilemma itself is unfixable; open relay membership means Sybil attacks can be made slower and costlier — via guards, vanguards, and stake — but never impossible; and anonymity-set size depends on concurrent user count, which a new network will not have at launch. The credible position is Tor-class threat models, selectable per flow, with costs published per mode, plus PQ-sized cells that Tor's 509-byte format currently cannot accommodate. CWP fixes the engineering mistakes (ossified headers, undersized cells, one-network-per-threat-model) and prices the theorem-bound costs explicitly.

One engineering tension is acknowledged rather than papered over: the uniform padded cell that defeats size fingerprinting on fast links is nearly pure overhead on tiny-MTU bearers (BLE's 11-byte cliff, 51-byte SF12 LoRa frames), where fragmentation multiplies latency 2–3× or worse. Privacy uniformity and constrained-link efficiency pull in opposite directions; the spec picks per bearer envelope.

Transport Adapters: Envelopes with Realistic Rates

Each bearer publishes an operating envelope. CWP never makes a medium faster than its physics — 730 bps RDS stays 730 bps, and a ~484-byte cell takes ~13 minutes to transmit at 5 bps. The claim is no protocol-imposed ceiling; performance tracks the bearer envelope.

At the 5 bps floor, "works" means exactly what Reticulum proved operationally: identity exchange, short messages, and store-and-forward custody. A handshake cell takes minutes; nothing interactive is possible. The spec's discipline is that the same cell, identity, and integrity model functions, with stated envelope, at the worst real bearer — not that the full experience exists everywhere.

AI Data Plane (Chorus)

The two-plane spine: compact schema'd control messages (µs-class encode cost, irrelevant at control frequency) are strictly separated from a zero-copy data plane whose wire layout equals memory layout. Tensors and KV-caches never pass through the control encoder — the ~65%-of-CPU protobuf tax stays out of the hot path, and HTTP/2-style control windows can never preempt tensor streams because flow control is per-semantic-stream and payload-class aware, with chunk size and concurrency as explicit negotiated parameters.

• A.Frame objects are offset-addressable by construction (name → dtype/shape/offset/length header + flat region, the safetensors/Arrow pattern): any consumer can range-fetch, parallelize, resume, and mmap — the serialization decision behind measured 76× model-load speedups and seconds-scale cold starts for 200+ GiB models, made a wire-format guarantee.
• Model/dataset distribution rides Corpus: weights are Merkle-verified, FastCDC-deduped, swarm-fetched LAN-first. A fleet pulling a checkpoint behaves like Kraken (20k × 1 GB blobs in under 30 s), and fine-tune deltas transfer only changed chunks.
• A.Descriptor gives disaggregated inference a stable transfer contract: register memory once, post async scatter/gather descriptor lists with out-of-order completion, over pluggable backends — RDMA/GPUDirect where NIC and GPU share a PCIe switch (topology is part of the stated correctness envelope), TCP, NVMe-oF, object storage. This is the NIXL shape vLLM already treats as a swappable connector.
• A.Collective factors collectives exactly as NCCL does — fused primitives × algorithms × transports — but the transport axis is a certified Bearer Functor, so a ring allreduce is provably the same protocol value over NVLink, IB, or an OCS-scheduled lambda fabric. Ring remains bandwidth-optimal at the 2(N−1)/N lower bound; the bound is stated, not "beaten."
• Tail latency is the design metric, not the mean (the UEC rationale: synchronous step time = max over workers). T.Spray provides spraying, out-of-order delivery with in-order completion, and selective retransmission, benchmarked at P99.9.

Two honest boundaries. First, cross-region training: ~5 µs/km propagation makes WAN synchronous collectives physics-bound, so the spec pushes WAN-scale learning to asynchronous/hierarchical patterns over F.Custody rather than pretending a protocol can shrink the speed of light. Second, competitive position: these primitives are patterned on shipped, measured systems (safetensors, Arrow Flight, NIXL, NCCL, UEC), and CWP must beat entrenched hand-tuned incumbents on P99.9 benchmarks, not category theory. The positioning is a certified, portable contract for the transfers AI systems already do — not a performance revolution. The same algebra does extend where incumbents do not: the Chorus choreography that moves KV-caches over RDMA also runs a 51-byte quantized-gradient exchange over F.LoRa.