Nishi Family › Compare › Sovereign edge -- TLS 1.3 termination + SNI routing vs the field
Nishi Compare · full-field SOTA · measured, not asserted
Sovereign edge -- TLS 1.3 termination + SNI routing vs the field
Nishi vs the full field — every axis measured or researcher-sourced, grouped by category; each strip shows the whole field at a glance.
nishi sni_router + sites.elf (own TLS/HTTP stack, zero OpenSSL/nginx) vs the production edge stacks
TLS + SNI
peek ClientHello -> per-host backend (sni_extract)
own nishi_tls13, not OpenSSL/BoringSSL
sites.elf nx_sni_cert_select, proven both domains
sr_relay splices raw TCP; backend terminates
nx_acme_req Let's Encrypt live
not yet
not yet
personal-daemon path only
Routing + proxy
sd2_proxy_to + data-driven proxy_routes.conf
longest-prefix, boundary-safe (/site != /sitemap)
sd2_ws_pump TLS-terminating pump
sd2_proxy_stream 256KB window, TCP backpressure
sd2_fill_body 2MiB, landed 2026-07-10
add-a-row registry, zero recompile
guard-supervise liveness only, no active probe
single backend per host today
Sovereignty + safety
own TLS + HTTP + router; no OpenSSL/nginx/libc-TLS -- gate-measured 2026-08-23: x25519 (RFC 7748 5.2), ChaCha20 (RFC 8439 2.3.2), Ed25519 (RFC 8032 7.1), TLS1.2 PRF and P-384 ECDH (RFC 5903) known-answer gates GREEN over the sovereign primitives; libssl ABSENT-PROVEN in runtime/bin (nx_absent corpus_complete=1)
whole edge stack ours bits-up -- measured 2026-08-23: nx_absent libssl over buildroot/runtime/bin = 0 matches with corpus_complete=1; the only OpenSSL and nginx mentions in the edge sources are the wiki placeholder's own prose
crash-loop-guarded supervise + .prev rollback
no opaque C runtime in the request path -- witness: the sovereign builder emits single-PT_LOAD program-header-only ELFs (no .dynamic, no libc), and the five TLS known-answer gates above ran GREEN on 2026-08-23 against those exact binaries
DSM nginx LAN-shadow here (operator-gated fix)
Production scale (the field's turf)
single box on one WAN link
none built
single box
structured logs only, no metrics export
per-client sliding window in mgmt edge
Performance (measured / sourced)
nishi-hs MEASURED; certloop dominates -> optimize
nginx ~1-3msHAProxy ~1-3msCaddy ~2-5msTraefik ~2-5msEnvoy ~1-3msCloudflare <1msAWS-ALB ~1-3ms
ClientHello peek only
nginx <1msHAProxy <1msCaddy <1msTraefik <1msEnvoy <1msCloudflare <1msAWS-ALB <1ms
sd2_fill_body raised 8KB->1MiB 2026-07-10
nginx unboundedHAProxy unboundedCaddy unboundedTraefik unboundedEnvoy unboundedCloudflare ~100MBAWS-ALB ~100MB
sr fork-per-conn: simple + memory-isolated
nginx eventedHAProxy eventedCaddy eventedTraefik eventedEnvoy eventedCloudflare managedAWS-ALB managed
Person · product · place — not yet measured for this domain
knowledge/compare/edge.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain edge, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).Generated by nx_swcompare_sota from knowledge/compare/edge.sota — quantitative axes measured/sourced; researcher-fed (nx_swcompare_research). Zero JS, zero trackers.
Where we are. At parity on the core job and honestly nowhere near a CDN. The sovereign edge does SNI-routed TLS 1.3 termination with per-host certificate selection, raw-TCP SNI passthrough, HTTP reverse proxying with boundary-safe longest-prefix path routing, WebSocket passthrough, streaming with real TCP backpressure, full-body reassembly for large uploads, ACME auto-certificates and hot route reload with no restart -- all of it bits-up on our own TLS 1.3 and HTTP stack with zero OpenSSL and zero nginx, guard-supervised with crash-loop protection and .prev rollback. Three of its axes are graded as leads no mainstream edge makes: zero third-party dependency, no upstream CVE surface, and a deterministic auditable request path with no opaque C runtime in it -- and those are gate-measured rather than asserted, with x25519, ChaCha20, Ed25519, TLS1.2 PRF and P-384 ECDH known-answer gates GREEN on 2026-08-23 and libssl ABSENT-PROVEN in runtime/bin with corpus_complete=1. What it is NOT is a production CDN, and the board says so on the rows: no 0-RTT or session resumption, no HTTP/3, no WAF or DDoS mitigation, no global anycast, no autoscale, thin observability, one box on one WAN link -- and a TLS handshake at roughly 40 to 140ms against roughly 1 to 3ms for the field, which the verdict attributes to the certificate-validation loop.
Where we need to go. Make the edge fast enough and observable enough that its own numbers are checkable by someone outside this estate, then make it survive a bad backend, then put it on the modern wire. Latency comes first because it is the one axis where the gap is an order of magnitude and the cause is already diagnosed. THREE GAPS ON THAT BOARD ARE DELIBERATELY NOT RUNGS HERE, named so nobody re-derives why: global anycast PoPs need points of presence we do not have, autoscale needs more than one box, and retiring the DSM nginx that still squats the LAN 443 is an operator port change on the appliance rather than a scriptable one. A rung this lane cannot build is a rung that never closes. Throughout, the declared exceeds are shipping criteria no rung may trade away: no OpenSSL, no nginx, no third-party runtime in the request path, and nothing that puts an opaque dependency between a client and a certificate.
Research bar. Cloudflare is measured on the production CDN bar, and the column that holds Best on all five rows this ladder targets. Theirs: sub-1ms handshake, 0-RTT, HTTP/3, global anycast, full observability. Ours: E1 E2 E3 E4 and E5 each name a capability Cloudflare already has; it is the ceiling for this board and explicitly not a target on the axes needing PoPs we do not own.
Research bar. HAProxy is measured on the load-balancing and health-checking bar, and the single-box comparison that is actually fair to us. Theirs: active backend health checks with configurable rise and fall, and detailed stats export. Ours: E4 and E5 measure against it rather than against Cloudflare, because it is the closest thing in the field to what one sovereign box should look like.
Research bar. Envoy is measured on the modern proxy bar for observability and hot reconfiguration. Theirs: first-class metrics and distributed tracing, outlier detection, HTTP/3 support. Ours: E5 measures against its metrics and tracing model, which is the field's most complete published contract for what an edge should emit.
Research bar. AWS Application Load Balancer is measured on the managed bar, and the reminder that most of the field's health and scale story is bought rather than built. Theirs: managed health checks, target groups, HTTP/3 and automatic scaling. Ours: E4 measures against its health-check semantics; its anycast and autoscale rows are deliberately NOT rungs here.
| Rung | Closes with | Definition of done (pre-declared) | Executor | Est. |
|---|---|---|---|---|
| Metrics and traces export (E5) | sr_metrics_emit | The board grades observability Part for structured logs with no metrics export, while all four carried rivals hold Best. Emit connection counts, handshake durations, per-backend outcomes and error classes on a scrapeable surface, with a trace id carried across the proxy hop. ACCEPT: the handshake-duration series is exported with p50 p95 and p99 AND a request whose backend fails is attributable end to end from the exported data alone, with a NEG-CONTROL that a period in which the edge served nothing reports an explicit no-observations state rather than a zero -- an exporter that reports 0ms for an idle minute is indistinguishable from one that is broken. Sequenced FIRST because it is what makes every later latency claim checkable from outside. | Organ | 1.5 u |
| Handshake latency measured, bounded and cut (E1) after E5 | eh_handshake_budget | The domain's own stated headline: roughly 40 to 140ms against roughly 1 to 3ms for the field, with the verdict naming the certificate-validation loop as the dominant cost. Profile the handshake, attribute the time, and cut it. ACCEPT: a repeatable bench publishes p50 p95 and p99 for a full handshake BEFORE and AFTER, the after-p95 is under a bar pre-declared in this file before the work starts, the attribution names which stage the time actually moved from, AND the five TLS known-answer gates plus the Chrome-hello compatibility gate stay GREEN -- a faster handshake that changes a single byte on the wire is a protocol regression, not a win, so the equivalence result is the tooth and the speed number is the report. | Organ | 2 u |
| Session resumption and a considered 0-RTT decision (E2) after E1 | ts_psk_resume | The board grades this a plain No while every rival ships it, and it is the largest single latency win available for a returning client. Implement RFC 8446 PSK resumption in the key schedule: issue a session ticket, accept a PSK binder, and derive from the resumption secret. ACCEPT: a second connection from the same client completes with a measurably shorter handshake and the resumed session negotiates the same cipher suite and reaches the same application keys as a full handshake, with a NEG-CONTROL that a tampered or expired binder is REFUSED rather than silently falling back. 0-RTT IS A SEPARATE DECISION AND IS NOT AUTOMATIC HERE: RFC 8446 states early data is replayable, so if 0-RTT is enabled at all it must be restricted to idempotent requests and that restriction must be enforced by the edge rather than trusted to the backend -- and if the decision is to NOT ship 0-RTT, that is a legitimate outcome and the row says so instead of leaving it open forever. | Organ | 2 u |
| Active health probes and multi-backend routing (E4) after E5 | sr_backend_probe | The board grades health-checked failover Part because the guard supervises liveness but never actively probes, and grades multi-backend load balancing Part because there is one backend per host today. Those are one contract: an edge with a single backend has nothing to fail over TO. Add active probing with rise and fall thresholds and route across a backend set. ACCEPT: a backend killed mid-traffic is removed from rotation and in-flight requests complete against a surviving backend with zero client-visible 5xx, the recovered backend is returned to rotation only after the rise threshold, and a NEG-CONTROL where ALL backends are down returns an explicit edge-level error rather than hanging until the client times out. Probe the edge from OUTSIDE its own process: a health check that shares fate with the thing it checks proves nothing. | Organ | 2 u |
| HTTP/3 over QUIC on the edge (E3) after E1 | sr_h3_accept | The last of the four next-rungs the verdict names. CORRECTED 2026-08-25 AND THE CORRECTION CHANGES THE COST: the sota row reads "not yet" and reads as greenfield, but a QUIC substrate ALREADY EXISTS on disk -- nx_quic_udp, nx_quic_wire, nx_quic_hdr, nx_quic_pkt, nx_quic_frame, nx_quic_aead, nx_quic_keys, nx_quic_hs, nx_quic_handshake_sm, nx_quic_tls_schedule, nx_quic_transport_params, nx_quic_recovery, nx_quic_relay and nx_quic_fec, with fifteen test files beside them, found by find over buildroot/runtime with corpus_complete=1. This is a WIRING rung: compose what exists behind the router rather than re-implementing a transport. ACCEPT: a stock third-party HTTP/3 client completes a real request against a real host through the edge and the response is byte-identical to the same request over HTTP/2, the Alt-Svc advertisement is correct, and a NEG-CONTROL client that does NOT speak HTTP/3 is served over the existing path unchanged. The oracle is a third-party client, so this rung cannot be self-graded. | Organ | 3 u |
Milestones
| Milestone | Rungs | Cumulative |
|---|---|---|
| G0 · The handshake stops being the outlier | E1,E2 | 4 u |
| G1 · Survives a bad backend and reports why | E4,E5 | 7.5 u |
| G2 · On the modern wire | E3 | 10.5 u |
Risk register
| Risk | Likelihood x impact | Mitigation |
|---|---|---|
| A latency optimization silently changes bytes on the wire and breaks a real browser | possible x catastrophic | E1's accept rule requires the five TLS known-answer gates and the Chrome-hello compatibility gate to stay GREEN, and treats the equivalence result as the tooth rather than the speed number. This edge terminates every request to the live site, so a handshake regression is an outage rather than a slow page. |
| 0-RTT is shipped for the latency number and replay protection is left to the backend | possible x high | E2 states the constraint in the rung itself: RFC 8446 early data is replayable, so 0-RTT if enabled at all is restricted to idempotent requests AND the restriction is enforced at the edge. Declining to ship 0-RTT is an explicitly permitted outcome of that rung, so there is no pressure to ship it to close the row. |
| A health probe becomes part of the outage it exists to detect | possible x high | E4 requires probing from outside the serving process and a NEG-CONTROL for the all-backends-down case. The estate has already measured the two ways this fails: a probe that connects without accepting fills the backlog and manufactures the stall it reports, and a level-triggered check after a kill passes on the OUTGOING process. Both are named in the rung's done-rule rather than left to be rediscovered. |
| HTTP/3 is re-implemented from scratch because the sota row reads as greenfield | likely x high | This is why E3's rung text and its matrix row both enumerate the fourteen QUIC organs already on disk with the coverage of the search that found them. The failure this guards against is the estate's own most expensive recurring one: I did not know it existed is a retrieval failure, not a discovery. |
| Work starts on the CDN-scale rows that this lane cannot finish | possible x medium | Anycast, autoscale and the DSM port change are named in the goal row as explicitly NOT rungs, with the reason for each. They stay graded honestly on the sota page so the board never claims them, and no ladder version depends on them. |
Watch contracts (measured)
| Axis | Organ | Symbol | Status | Note |
|---|---|---|---|---|
| TLS handshake latency | runtime/_hdl_build/nx_sni_router.nx | eh_handshake_budget | WATCHING decl | OPEN -- rung E1, and this domain's own stated headline. edge.sota's verdict calls it out in its own words: handshake is "~40-140ms vs ~1-3ms" for the field and "our cert-validation loop dominates -- the clear next optimization". CELLS DERIVED, NOT COPIED, AND THE DERIVATION IS STATED: edge.sota carries this axis as a MEASURED num row rather than a graded one, so Cloudflare at under 1ms is graded Best and HAProxy, Envoy and AWS-ALB at roughly 1 to 3ms are graded Yes. The contract is a published percentile against a pre-declared bar, not a one-off timing |
| Session resumption and 0-RTT | runtime/nx_tls13_schedule.nx | ts_psk_resume | WATCHING decl | OPEN -- rung E2. Cells copied from the sota row 0-RTT and session resumption, where our own cell reads a plain No and every rival ships it. This is also the largest single latency win available for a returning client, which is why it is sequenced beside E1 rather than after the scale rungs. The organ named is the real key-schedule organ on disk, which is where a PSK binder has to live |
| HTTP/3 over QUIC | runtime/_hdl_build/nx_sni_router.nx | sr_h3_accept | WATCHING decl | OPEN -- rung E3. Cells copied from the sota row HTTP/3 QUIC. CORRECTED 2026-08-25 AND THIS CHANGES THE COST: the sota row reads "not yet" and reads as greenfield, but a QUIC substrate ALREADY EXISTS on disk -- nx_quic_udp, nx_quic_wire, nx_quic_hdr, nx_quic_pkt, nx_quic_frame, nx_quic_aead, nx_quic_keys, nx_quic_hs, nx_quic_handshake_sm, nx_quic_tls_schedule, nx_quic_transport_params, nx_quic_recovery, nx_quic_relay and nx_quic_fec, with fifteen test files beside them, found by find over buildroot/runtime with corpus_complete=1. So this is a WIRING rung and not a protocol build, and anyone who reads the sota row alone will re-implement fourteen organs that already exist |
| Health-checked backends and multi-backend routing | runtime/_hdl_build/nx_sni_router.nx | sr_backend_probe | WATCHING decl | OPEN -- rung E4. Cells copied from the sota row Health-checked backends and failover, where all four carried rivals hold Best and our own cell reads Part because the guard supervises liveness but never actively probes. The sibling row Load balancing multi-backend grades the same four the same way, so this one contract closes both: an edge with one backend per host has nothing to fail over TO |
| Metrics and traces export | runtime/_hdl_build/nx_sni_router.nx | sr_metrics_emit | WATCHING decl | OPEN -- rung E5. Cells copied from the sota row Observability metrics and traces, where all four carried rivals hold Best and our own cell reads Part for structured logs with no metrics export. This is the cheapest rung on the board and it is the one that makes E1 checkable at all: a latency claim with no exported percentile is a claim nobody outside this estate can verify |
watch rows=5 landed=0 watching=5 present=0 missing=0 absent=0 (partition sums)