Nishi Family › Compare › Sovereign Edge -- TLS 1.3 Termination and SNI Routing

Nishi Compare · capabilities, evidence and delivery

Sovereign Edge -- TLS 1.3 Termination and SNI Routing

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

The roadmap-binding board behind /compare/edge. Rival codes copied verbatim from the named edge.sota row; Nishi cells are MEASURED -- the ranker requires the implementing symbol as a top-level func in the real organ source on disk.

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. At parity on the core job and honestly nowhere near a CDN. The sovereign edge does SNI-routed TLS 1.3 termination with per-host certificate selection, raw-TCP SNI passthrough, HTTP reverse proxying with boundary-safe longest-prefix path routing, WebSocket passthrough, streaming with real TCP backpressure, full-body reassembly for large uploads, ACME auto-certificates and hot route reload with no restart -- all of it bits-up on our own TLS 1.3 and HTTP stack with zero OpenSSL and zero nginx, guard-supervised with crash-loop protection and .prev rollback. Three of its axes are graded as leads no mainstream edge makes: zero third-party dependency, no upstream CVE surface, and a deterministic auditable request path with no opaque C runtime in it -- and those are gate-measured rather than asserted, with x25519, ChaCha20, Ed25519, TLS1.2 PRF and P-384 ECDH known-answer gates GREEN on 2026-08-23 and libssl ABSENT-PROVEN in runtime/bin with corpus_complete=1. What it is NOT is a production CDN, and the board says so on the rows: no 0-RTT or session resumption, no HTTP/3, no WAF or DDoS mitigation, no global anycast, no autoscale, thin observability, one box on one WAN link -- and a TLS handshake at roughly 40 to 140ms against roughly 1 to 3ms for the field, which the verdict attributes to the certificate-validation loop.

Where we need to go. Make the edge fast enough and observable enough that its own numbers are checkable by someone outside this estate, then make it survive a bad backend, then put it on the modern wire. Latency comes first because it is the one axis where the gap is an order of magnitude and the cause is already diagnosed. THREE GAPS ON THAT BOARD ARE DELIBERATELY NOT RUNGS HERE, named so nobody re-derives why: global anycast PoPs need points of presence we do not have, autoscale needs more than one box, and retiring the DSM nginx that still squats the LAN 443 is an operator port change on the appliance rather than a scriptable one. A rung this lane cannot build is a rung that never closes. Throughout, the declared exceeds are shipping criteria no rung may trade away: no OpenSSL, no nginx, no third-party runtime in the request path, and nothing that puts an opaque dependency between a client and a certificate.

The unit. 1 u = one measured session-leg (organ plus gate plus a re-measured row), the calibration used across the estate. THESE ESTIMATES ARE A BOUND, NOT A MEASUREMENT: no rung has landed in this domain yet so there is no native calibration point, and the figures are carried from sibling lanes. They republish as actual-against-estimate on the first landed rung.

Cost to stop being the latency outlier: 4 u. E1 the measured handshake budget plus E2 session resumption. These two are sequenced together because resumption is the largest single latency win available for a returning client, so splitting them would report a partial result as the answer to the whole question.

Cost to survive a bad backend and say why: 3.5 u more. E5 metrics and traces plus E4 active health probing with multi-backend routing. E5 is deliberately cheap and early because it is what makes E1's claim checkable from outside at all.

Cost to reach the modern wire: 3 u more. E3 HTTP/3, which is a WIRING rung and not a protocol build -- the QUIC substrate already exists on disk. Program total 10.5 u and the three figures sum.

Research bar. Cloudflare is measured on the production CDN bar, and the column that holds Best on all five rows this ladder targets. Theirs: sub-1ms handshake, 0-RTT, HTTP/3, global anycast, full observability. Ours: E1 E2 E3 E4 and E5 each name a capability Cloudflare already has; it is the ceiling for this board and explicitly not a target on the axes needing PoPs we do not own.

Research bar. HAProxy is measured on the load-balancing and health-checking bar, and the single-box comparison that is actually fair to us. Theirs: active backend health checks with configurable rise and fall, and detailed stats export. Ours: E4 and E5 measure against it rather than against Cloudflare, because it is the closest thing in the field to what one sovereign box should look like.

Research bar. Envoy is measured on the modern proxy bar for observability and hot reconfiguration. Theirs: first-class metrics and distributed tracing, outlier detection, HTTP/3 support. Ours: E5 measures against its metrics and tracing model, which is the field's most complete published contract for what an edge should emit.

Research bar. AWS Application Load Balancer is measured on the managed bar, and the reminder that most of the field's health and scale story is bought rather than built. Theirs: managed health checks, target groups, HTTP/3 and automatic scaling. Ours: E4 measures against its health-check semantics; its anycast and autoscale rows are deliberately NOT rungs here.

Latest recorded release

No valid dated release entry is recorded for this domain.

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

6 of 12 capability source symbols found|0 of them authored stronger-claims|6 open|coverage 500/1000|adoption 4 full / 2 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 6 vs present 6 · named + unnamed + withheld = 5 vs open 5 · both reconcile

liar-kill conj=GPqN · first failing conjunct: quorum

graded document: BUILDROOT tree, 10317 bytes · gates map: NONE · stamped 37d 6h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_edge.verdict

Gap class	What it is, and the work it names
CLAIM-ONLY	No declared gate ran for this board, so every capability mark here rests on a symbol existing in source and on nothing executing. The remedy is to WRITE a `.gates` map naming gates that already run — authoring, not research.
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence edge itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: PLAN_MATRIX_BOUND_ONLY. Recorded priorities require current acceptance evidence and resource checks before execution.

Ranking matches the captured plan and matrix only. Latest execution outcome, research freshness, accepted delivery and investment return are unverified.

Recorded priority estimates

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: listed before new work by this heuristic. Priority is not measured delivery cost or execution readiness. Stamp: # asof=1790350961 domain=edge target_version=0.1 rungs=6 done=0 open=6 finish=0 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
#1	0.1	Metrics and traces export (E5) sr_metrics_emit dossier	2000	v=30 m=1 c=15
#2	0.1	Handshake latency measured, bounded and cut (E1) eh_handshake_budget dossier	1000	v=20 m=1 c=20
#3	0.1	Session resumption and a considered 0-RTT decision (E2) ts_psk_resume dossier	300	v=6 m=1 c=20
#4	later	Active health probes and multi-backend routing (E4) sr_backend_probe dossier	800	v=16 m=1 c=20
#5	later	HTTP/3 over QUIC on the edge (E3) sr_h3_accept dossier	133	v=4 m=1 c=30
#6	later	Directory indexes keep their trailing slash (E6) hr_dir_slash_canon dossier	0	v=0 m=1 c=10

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Metrics and traces export (E5)	sr_metrics_emit	The board grades observability Part for structured logs with no metrics export, while all four carried rivals hold Best. Emit connection counts, handshake durations, per-backend outcomes and error classes on a scrapeable surface, with a trace id carried across the proxy hop. ACCEPT: the handshake-duration series is exported with p50 p95 and p99 AND a request whose backend fails is attributable end to end from the exported data alone, with a NEG-CONTROL that a period in which the edge served nothing reports an explicit no-observations state rather than a zero -- an exporter that reports 0ms for an idle minute is indistinguishable from one that is broken. Sequenced FIRST because it is what makes every later latency claim checkable from outside.	Organ	1.5 u
Handshake latency measured, bounded and cut (E1) after E5	eh_handshake_budget	The domain's own stated headline: roughly 40 to 140ms against roughly 1 to 3ms for the field, with the verdict naming the certificate-validation loop as the dominant cost. Profile the handshake, attribute the time, and cut it. ACCEPT: a repeatable bench publishes p50 p95 and p99 for a full handshake BEFORE and AFTER, the after-p95 is under a bar pre-declared in this file before the work starts, the attribution names which stage the time actually moved from, AND the five TLS known-answer gates plus the Chrome-hello compatibility gate stay GREEN -- a faster handshake that changes a single byte on the wire is a protocol regression, not a win, so the equivalence result is the tooth and the speed number is the report.	Organ	2 u
Session resumption and a considered 0-RTT decision (E2) after E1	ts_psk_resume	The board grades this a plain No while every rival ships it, and it is the largest single latency win available for a returning client. Implement RFC 8446 PSK resumption in the key schedule: issue a session ticket, accept a PSK binder, and derive from the resumption secret. ACCEPT: a second connection from the same client completes with a measurably shorter handshake and the resumed session negotiates the same cipher suite and reaches the same application keys as a full handshake, with a NEG-CONTROL that a tampered or expired binder is REFUSED rather than silently falling back. 0-RTT IS A SEPARATE DECISION AND IS NOT AUTOMATIC HERE: RFC 8446 states early data is replayable, so if 0-RTT is enabled at all it must be restricted to idempotent requests and that restriction must be enforced by the edge rather than trusted to the backend -- and if the decision is to NOT ship 0-RTT, that is a legitimate outcome and the row says so instead of leaving it open forever.	Organ	2 u
Active health probes and multi-backend routing (E4) after E5	sr_backend_probe	The board grades health-checked failover Part because the guard supervises liveness but never actively probes, and grades multi-backend load balancing Part because there is one backend per host today. Those are one contract: an edge with a single backend has nothing to fail over TO. Add active probing with rise and fall thresholds and route across a backend set. ACCEPT: a backend killed mid-traffic is removed from rotation and in-flight requests complete against a surviving backend with zero client-visible 5xx, the recovered backend is returned to rotation only after the rise threshold, and a NEG-CONTROL where ALL backends are down returns an explicit edge-level error rather than hanging until the client times out. Probe the edge from OUTSIDE its own process: a health check that shares fate with the thing it checks proves nothing.	Organ	2 u
HTTP/3 over QUIC on the edge (E3) after E1	sr_h3_accept	The last of the four next-rungs the verdict names. CORRECTED 2026-08-25 AND THE CORRECTION CHANGES THE COST: the sota row reads "not yet" and reads as greenfield, but a QUIC substrate ALREADY EXISTS on disk -- nx_quic_udp, nx_quic_wire, nx_quic_hdr, nx_quic_pkt, nx_quic_frame, nx_quic_aead, nx_quic_keys, nx_quic_hs, nx_quic_handshake_sm, nx_quic_tls_schedule, nx_quic_transport_params, nx_quic_recovery, nx_quic_relay and nx_quic_fec, with fifteen test files beside them, found by find over buildroot/runtime with corpus_complete=1. This is a WIRING rung: compose what exists behind the router rather than re-implementing a transport. ACCEPT: a stock third-party HTTP/3 client completes a real request against a real host through the edge and the response is byte-identical to the same request over HTTP/2, the Alt-Svc advertisement is correct, and a NEG-CONTROL client that does NOT speak HTTP/3 is served over the existing path unchanged. The oracle is a third-party client, so this rung cannot be self-graded.	Organ	3 u
Directory indexes keep their trailing slash (E6)	hr_dir_slash_canon	MEASURED TWICE, A MONTH APART. hr_canon in nx_host_router (carried by the sites daemon) redirects a directory's slash forms -- /x/ and /x/index.html -- to /x and serves the index there. That is the reverse of the field default (Apache mod_dir's DirectorySlash, on by default, redirects /x to /x/), and it makes every relative reference on a directory index resolve against the PARENT directory. Witnesses: the koikatsu and vam compare pages shipped with every visual broken (debt 1785865143, still open), and on 2026-09-23 the cms scene alpha at /alpha/cms-scene fetched its module from /alpha/scene/orbit.wasm, a 404. The site emitter now builds a release for its mount with root-relative references (nx_site_build sb_mount, nx_site_mount_gate 20/20), which repairs only the pages that emitter builds; every hand-built or other-emitter page keeps the defect. Canonicalise a directory index to its slash form. ACCEPT: every URL in every served sitemap answers 200 or exactly one 301 hop to a 200, with no loop; a relative reference on a directory index resolves inside that directory; an extensionless file page that is not a directory is served unchanged; and a NEG-CONTROL that a path which is neither a file nor a directory still answers 404 rather than a redirect. DECLINING IS A PERMITTED OUTCOME: if the edge keeps the stripped form because every canonical directory URL would change, the rung closes with nx_page_verify's relative-asset law made a publish gate for every page (the remedy debt 1785865143 names), and this row says so.	Organ	1 u

Milestones

Milestone	Rungs	Cumulative
G0 · The handshake stops being the outlier	E1,E2	4 u
G1 · Survives a bad backend and reports why	E4,E5	7.5 u
G2 · On the modern wire	E3	10.5 u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 6. Rank input binding: PLAN_MATRIX_BOUND_ONLY. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 f763dd6164238f8bd6ae79d78a3d4ccef669dd05bf7a6c056680812ec9789678. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 6 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

E5 — Metrics and traces export
Prerequisites: None declared; this does not establish execution eligibility.
Contract: sr_metrics_emit
Acceptance: The board grades observability Part for structured logs with no metrics export, while all four carried rivals hold Best. Emit connection counts, handshake durations, per-backend outcomes and error classes on a scrapeable surface, with a trace id carried across the proxy hop. ACCEPT: the handshake-duration series is exported with p50 p95 and p99 AND a request whose backend fails is attributable end to end from the exported data alone, with a NEG-CONTROL that a period in which the edge served nothing reports an explicit no-observations state rather than a zero -- an exporter that reports 0ms for an idle minute is indistinguishable from one that is broken. Sequenced FIRST because it is what makes every later latency claim checkable from outside.
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
E1 — Handshake latency measured, bounded and cut
Prerequisites: E5 (acceptance unverified)
Contract: eh_handshake_budget
Acceptance: The domain's own stated headline: roughly 40 to 140ms against roughly 1 to 3ms for the field, with the verdict naming the certificate-validation loop as the dominant cost. Profile the handshake, attribute the time, and cut it. ACCEPT: a repeatable bench publishes p50 p95 and p99 for a full handshake BEFORE and AFTER, the after-p95 is under a bar pre-declared in this file before the work starts, the attribution names which stage the time actually moved from, AND the five TLS known-answer gates plus the Chrome-hello compatibility gate stay GREEN -- a faster handshake that changes a single byte on the wire is a protocol regression, not a win, so the equivalence result is the tooth and the speed number is the report.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
E2 — Session resumption and a considered 0-RTT decision
Prerequisites: E1 (acceptance unverified)
Contract: ts_psk_resume
Acceptance: The board grades this a plain No while every rival ships it, and it is the largest single latency win available for a returning client. Implement RFC 8446 PSK resumption in the key schedule: issue a session ticket, accept a PSK binder, and derive from the resumption secret. ACCEPT: a second connection from the same client completes with a measurably shorter handshake and the resumed session negotiates the same cipher suite and reaches the same application keys as a full handshake, with a NEG-CONTROL that a tampered or expired binder is REFUSED rather than silently falling back. 0-RTT IS A SEPARATE DECISION AND IS NOT AUTOMATIC HERE: RFC 8446 states early data is replayable, so if 0-RTT is enabled at all it must be restricted to idempotent requests and that restriction must be enforced by the edge rather than trusted to the backend -- and if the decision is to NOT ship 0-RTT, that is a legitimate outcome and the row says so instead of leaving it open forever.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
E4 — Active health probes and multi-backend routing
Prerequisites: E5 (acceptance unverified)
Contract: sr_backend_probe
Acceptance: The board grades health-checked failover Part because the guard supervises liveness but never actively probes, and grades multi-backend load balancing Part because there is one backend per host today. Those are one contract: an edge with a single backend has nothing to fail over TO. Add active probing with rise and fall thresholds and route across a backend set. ACCEPT: a backend killed mid-traffic is removed from rotation and in-flight requests complete against a surviving backend with zero client-visible 5xx, the recovered backend is returned to rotation only after the rise threshold, and a NEG-CONTROL where ALL backends are down returns an explicit edge-level error rather than hanging until the client times out. Probe the edge from OUTSIDE its own process: a health check that shares fate with the thing it checks proves nothing.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
E3 — HTTP/3 over QUIC on the edge
Prerequisites: E1 (acceptance unverified)
Contract: sr_h3_accept
Acceptance: The last of the four next-rungs the verdict names. CORRECTED 2026-08-25 AND THE CORRECTION CHANGES THE COST: the sota row reads "not yet" and reads as greenfield, but a QUIC substrate ALREADY EXISTS on disk -- nx_quic_udp, nx_quic_wire, nx_quic_hdr, nx_quic_pkt, nx_quic_frame, nx_quic_aead, nx_quic_keys, nx_quic_hs, nx_quic_handshake_sm, nx_quic_tls_schedule, nx_quic_transport_params, nx_quic_recovery, nx_quic_relay and nx_quic_fec, with fifteen test files beside them, found by find over buildroot/runtime with corpus_complete=1. This is a WIRING rung: compose what exists behind the router rather than re-implementing a transport. ACCEPT: a stock third-party HTTP/3 client completes a real request against a real host through the edge and the response is byte-identical to the same request over HTTP/2, the Alt-Svc advertisement is correct, and a NEG-CONTROL client that does NOT speak HTTP/3 is served over the existing path unchanged. The oracle is a third-party client, so this rung cannot be self-graded.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
E6 — Directory indexes keep their trailing slash
Prerequisites: None declared; this does not establish execution eligibility.
Contract: hr_dir_slash_canon
Acceptance: MEASURED TWICE, A MONTH APART. hr_canon in nx_host_router (carried by the sites daemon) redirects a directory's slash forms -- /x/ and /x/index.html -- to /x and serves the index there. That is the reverse of the field default (Apache mod_dir's DirectorySlash, on by default, redirects /x to /x/), and it makes every relative reference on a directory index resolve against the PARENT directory. Witnesses: the koikatsu and vam compare pages shipped with every visual broken (debt 1785865143, still open), and on 2026-09-23 the cms scene alpha at /alpha/cms-scene fetched its module from /alpha/scene/orbit.wasm, a 404. The site emitter now builds a release for its mount with root-relative references (nx_site_build sb_mount, nx_site_mount_gate 20/20), which repairs only the pages that emitter builds; every hand-built or other-emitter page keeps the defect. Canonicalise a directory index to its slash form. ACCEPT: every URL in every served sitemap answers 200 or exactly one 301 hop to a 200, with no loop; a relative reference on a directory index resolves inside that directory; an extensionless file page that is not a directory is served unchanged; and a NEG-CONTROL that a path which is neither a file nor a directory still answers 404 rather than a redirect. DECLINING IS A PERMITTED OUTCOME: if the edge keeps the stripped form because every canonical directory URL would change, the rung closes with nx_page_verify's relative-asset law made a publish gate for every page (the remedy debt 1785865143 names), and this row says so.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence edge writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

E5 Metrics and traces export · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sr_metrics_emit` · executor Organ · 1.5 u · stands on nothing
Definition of done	The board grades observability Part for structured logs with no metrics export, while all four carried rivals hold Best. Emit connection counts, handshake durations, per-backend outcomes and error classes on a scrapeable surface, with a trace id carried across the proxy hop. ACCEPT: the handshake-duration series is exported with p50 p95 and p99 AND a request whose backend fails is attributable end to end from the exported data alone, with a NEG-CONTROL that a period in which the edge served nothing reports an explicit no-observations state rather than a zero -- an exporter that reports 0ms for an idle minute is indistinguishable from one that is broken. Sequenced FIRST because it is what makes every later latency claim checkable from outside.
Matrix cell	Metrics and traces export · `runtime/_hdl_build/nx_sni_router.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sni_router`; declare `nx_sni_router TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

E1 Handshake latency measured, bounded and cut · cell WATCHING · gate NO-GATE-DECLARED

Contract	`eh_handshake_budget` · executor Organ · 2 u · stands on E5
Definition of done	The domain's own stated headline: roughly 40 to 140ms against roughly 1 to 3ms for the field, with the verdict naming the certificate-validation loop as the dominant cost. Profile the handshake, attribute the time, and cut it. ACCEPT: a repeatable bench publishes p50 p95 and p99 for a full handshake BEFORE and AFTER, the after-p95 is under a bar pre-declared in this file before the work starts, the attribution names which stage the time actually moved from, AND the five TLS known-answer gates plus the Chrome-hello compatibility gate stay GREEN -- a faster handshake that changes a single byte on the wire is a protocol regression, not a win, so the equivalence result is the tooth and the speed number is the report.
Matrix cell	TLS handshake latency · `runtime/_hdl_build/nx_sni_router.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sni_router`; declare `nx_sni_router TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

E2 Session resumption and a considered 0-RTT decision · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ts_psk_resume` · executor Organ · 2 u · stands on E1
Definition of done	The board grades this a plain No while every rival ships it, and it is the largest single latency win available for a returning client. Implement RFC 8446 PSK resumption in the key schedule: issue a session ticket, accept a PSK binder, and derive from the resumption secret. ACCEPT: a second connection from the same client completes with a measurably shorter handshake and the resumed session negotiates the same cipher suite and reaches the same application keys as a full handshake, with a NEG-CONTROL that a tampered or expired binder is REFUSED rather than silently falling back. 0-RTT IS A SEPARATE DECISION AND IS NOT AUTOMATIC HERE: RFC 8446 states early data is replayable, so if 0-RTT is enabled at all it must be restricted to idempotent requests and that restriction must be enforced by the edge rather than trusted to the backend -- and if the decision is to NOT ship 0-RTT, that is a legitimate outcome and the row says so instead of leaving it open forever.
Matrix cell	Session resumption and 0-RTT · `runtime/nx_tls13_schedule.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_tls13_schedule`; declare `nx_tls13_schedule TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

E4 Active health probes and multi-backend routing · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sr_backend_probe` · executor Organ · 2 u · stands on E5
Definition of done	The board grades health-checked failover Part because the guard supervises liveness but never actively probes, and grades multi-backend load balancing Part because there is one backend per host today. Those are one contract: an edge with a single backend has nothing to fail over TO. Add active probing with rise and fall thresholds and route across a backend set. ACCEPT: a backend killed mid-traffic is removed from rotation and in-flight requests complete against a surviving backend with zero client-visible 5xx, the recovered backend is returned to rotation only after the rise threshold, and a NEG-CONTROL where ALL backends are down returns an explicit edge-level error rather than hanging until the client times out. Probe the edge from OUTSIDE its own process: a health check that shares fate with the thing it checks proves nothing.
Matrix cell	Health-checked backends and multi-backend routing · `runtime/_hdl_build/nx_sni_router.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sni_router`; declare `nx_sni_router TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

E3 HTTP/3 over QUIC on the edge · cell WATCHING · gate NO-GATE-DECLARED

Contract	`sr_h3_accept` · executor Organ · 3 u · stands on E1
Definition of done	The last of the four next-rungs the verdict names. CORRECTED 2026-08-25 AND THE CORRECTION CHANGES THE COST: the sota row reads "not yet" and reads as greenfield, but a QUIC substrate ALREADY EXISTS on disk -- nx_quic_udp, nx_quic_wire, nx_quic_hdr, nx_quic_pkt, nx_quic_frame, nx_quic_aead, nx_quic_keys, nx_quic_hs, nx_quic_handshake_sm, nx_quic_tls_schedule, nx_quic_transport_params, nx_quic_recovery, nx_quic_relay and nx_quic_fec, with fifteen test files beside them, found by find over buildroot/runtime with corpus_complete=1. This is a WIRING rung: compose what exists behind the router rather than re-implementing a transport. ACCEPT: a stock third-party HTTP/3 client completes a real request against a real host through the edge and the response is byte-identical to the same request over HTTP/2, the Alt-Svc advertisement is correct, and a NEG-CONTROL client that does NOT speak HTTP/3 is served over the existing path unchanged. The oracle is a third-party client, so this rung cannot be self-graded.
Matrix cell	HTTP/3 over QUIC · `runtime/_hdl_build/nx_sni_router.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sni_router`; declare `nx_sni_router TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

E6 Directory indexes keep their trailing slash · cell WATCHING · gate NO-GATE-DECLARED

Contract	`hr_dir_slash_canon` · executor Organ · 1 u · stands on nothing
Definition of done	MEASURED TWICE, A MONTH APART. hr_canon in nx_host_router (carried by the sites daemon) redirects a directory's slash forms -- /x/ and /x/index.html -- to /x and serves the index there. That is the reverse of the field default (Apache mod_dir's DirectorySlash, on by default, redirects /x to /x/), and it makes every relative reference on a directory index resolve against the PARENT directory. Witnesses: the koikatsu and vam compare pages shipped with every visual broken (debt 1785865143, still open), and on 2026-09-23 the cms scene alpha at /alpha/cms-scene fetched its module from /alpha/scene/orbit.wasm, a 404. The site emitter now builds a release for its mount with root-relative references (nx_site_build sb_mount, nx_site_mount_gate 20/20), which repairs only the pages that emitter builds; every hand-built or other-emitter page keeps the defect. Canonicalise a directory index to its slash form. ACCEPT: every URL in every served sitemap answers 200 or exactly one 301 hop to a 200, with no loop; a relative reference on a directory index resolves inside that directory; an extensionless file page that is not a directory is served unchanged; and a NEG-CONTROL that a path which is neither a file nor a directory still answers 404 rather than a redirect. DECLINING IS A PERMITTED OUTCOME: if the edge keeps the stripped form because every canonical directory URL would change, the rung closes with nx_page_verify's relative-asset law made a publish gate for every page (the remedy debt 1785865143 names), and this row says so.
Matrix cell	Directory indexes keep their trailing slash · `runtime/_hdl_build/nx_host_router.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_host_router`; declare `nx_host_router TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

dossiers=6 cells_joined=6 no_matrix_row=0 (sum 6) gates_recorded=0 gates_unrecorded=0 no_gate_declared=6 (sum 6 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — unassessed

Comparative scores unavailable: 4 peer cells are unassessed. Establish cited assessments before comparing positions. Unknown cells are not absence; no zero scores or history observations were generated.

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 44, unassessed 4. Authored assessments are not verified outcomes.

Capability	Nishi	Cloudflare	HAProxy	Envoy	AWS-ALB
TLS handshake latency DARK — `runtime/_hdl_build/nx_sni_router.nx` EXISTS but does not declare `eh_handshake_budget`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung E1, and this domain's own stated headline. edge.sota's verdict calls it out in its own words: handshake is "~40-140ms vs ~1-3ms" for the field and "our cert-validation loop dominates -- the clear next optimization". CELLS DERIVED, NOT COPIED, AND THE DERIVATION IS STATED: edge.sota carries this axis as a MEASURED num row rather than a graded one, so Cloudflare at under 1ms is graded Best and HAProxy, Envoy and AWS-ALB at roughly 1 to 3ms are graded Yes. The contract is a published percentile against a pre-declared bar, not a one-off timing rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching eh_handshake_budget Pros none measured yetCons behind Cloudflare (leads), HAProxy, Envoy, AWS-ALB; open contract; expected source declaration not established	○	◉	●	●	●
Session resumption and 0-RTT DARK — `runtime/nx_tls13_schedule.nx` EXISTS but does not declare `ts_psk_resume`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung E2. Cells copied from the sota row 0-RTT and session resumption, where our own cell reads a plain No and every rival ships it. This is also the largest single latency win available for a returning client, which is why it is sequenced beside E1 rather than after the scale rungs. The organ named is the real key-schedule organ on disk, which is where a PSK binder has to live rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching ts_psk_resume Pros none measured yetCons behind Cloudflare (leads), HAProxy, Envoy, AWS-ALB; open contract; expected source declaration not established	○	◉	●	●	●
HTTP/3 over QUIC DARK — `runtime/_hdl_build/nx_sni_router.nx` EXISTS but does not declare `sr_h3_accept`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung E3. Cells copied from the sota row HTTP/3 QUIC. CORRECTED 2026-08-25 AND THIS CHANGES THE COST: the sota row reads "not yet" and reads as greenfield, but a QUIC substrate ALREADY EXISTS on disk -- nx_quic_udp, nx_quic_wire, nx_quic_hdr, nx_quic_pkt, nx_quic_frame, nx_quic_aead, nx_quic_keys, nx_quic_hs, nx_quic_handshake_sm, nx_quic_tls_schedule, nx_quic_transport_params, nx_quic_recovery, nx_quic_relay and nx_quic_fec, with fifteen test files beside them, found by find over buildroot/runtime with corpus_complete=1. So this is a WIRING rung and not a protocol build, and anyone who reads the sota row alone will re-implement fourteen organs that already exist rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching sr_h3_accept Pros none measured yetCons behind Cloudflare (leads), HAProxy, Envoy, AWS-ALB; open contract; expected source declaration not established	○	◉	◐	●	●
Health-checked backends and multi-backend routing DARK — `runtime/_hdl_build/nx_sni_router.nx` EXISTS but does not declare `sr_backend_probe`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung E4. Cells copied from the sota row Health-checked backends and failover, where all four carried rivals hold Best and our own cell reads Part because the guard supervises liveness but never actively probes. The sibling row Load balancing multi-backend grades the same four the same way, so this one contract closes both: an edge with one backend per host has nothing to fail over TO rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching sr_backend_probe Pros none measured yetCons behind Cloudflare (leads), HAProxy (leads), Envoy (leads), AWS-ALB (leads); open contract; expected source declaration not established	○	◉	◉	◉	◉
Metrics and traces export DARK — `runtime/_hdl_build/nx_sni_router.nx` EXISTS but does not declare `sr_metrics_emit`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung E5. Cells copied from the sota row Observability metrics and traces, where all four carried rivals hold Best and our own cell reads Part for structured logs with no metrics export. This is the cheapest rung on the board and it is the one that makes E1 checkable at all: a latency claim with no exported percentile is a claim nobody outside this estate can verify rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching sr_metrics_emit Pros none measured yetCons behind Cloudflare (leads), HAProxy (leads), Envoy (leads), AWS-ALB (leads); open contract; expected source declaration not established	○	◉	◉	◉	◉
SNI-based routing to a per-host backend Measured: `sni_extract` exists in `runtime/nx_sni_route.nx`, verified at emit. LANDED. Verified func sni_extract at nx_sni_route.nx line 14. Cells copied from the sota row SNI-based routing where Cloudflare holds Best and the other three carried rivals read Yes rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Cloudflare (leads)	●	◉	●	●	●
SNI passthrough without re-encryption Measured: `sr_relay` exists in `runtime/_hdl_build/nx_sni_router.nx`, verified at emit. LANDED. Verified func sr_relay at nx_sni_router.nx line 62 -- splices raw TCP so the backend terminates. Cells copied from the sota row SNI passthrough where Cloudflare and AWS-ALB read No: the managed edges do not hand you an unterminated stream, which is a capability the sovereign edge has BECAUSE it is not managed rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of Cloudflare, AWS-ALBCons not adopted yet: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	○	●	●	○
Streaming reverse proxy with TCP backpressure Measured: `sd2_proxy_stream` exists in `runtime/_hdl_build/nx_sites_daemon_v2.nx`, verified at emit. LANDED. Verified func sd2_proxy_stream at nx_sites_daemon_v2.nx line 1047, 256KB window. Cells copied from the sota row Streaming no-full-buffer where every carried rival reads Yes -- parity, stated as parity rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
WebSocket passthrough through the TLS terminator Measured: `sd2_ws_pump` exists in `runtime/_hdl_build/nx_sites_daemon_v2.nx`, verified at emit. LANDED. Verified func sd2_ws_pump at nx_sites_daemon_v2.nx line 616. Cells copied from the sota row WebSocket passthrough, all carried rivals Yes rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Large-POST full-body reassembly before forwarding Measured: `sd2_fill_body` exists in `runtime/_hdl_build/nx_sites_daemon_v2.nx`, verified at emit. LANDED. Verified func sd2_fill_body at nx_sites_daemon_v2.nx line 594, 2MiB, landed 2026-07-10 and load-bearing for every chunked upload since. Cells copied from the sota row Full-body reassembly, all carried rivals Yes rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
ACME certificate issuance over our own HTTP stack Measured: `nx_acme_req` exists in `runtime/nx_acme_http.nx`, verified at emit. LANDED. Verified func nx_acme_req at nx_acme_http.nx line 127, Let's Encrypt proven live. Cells copied from the sota row ACME auto-cert where Cloudflare holds Best as a managed service and HAProxy, Envoy and AWS-ALB read Part rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separate; ahead of HAProxy, Envoy, AWS-ALBCons behind Cloudflare (leads); not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	◉	◐	◐	◐
Directory indexes keep their trailing slash DARK — `runtime/_hdl_build/nx_host_router.nx` EXISTS but does not declare `hr_dir_slash_canon`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. OPEN -- rung E6, admitted 2026-09-25 from two measured witnesses named on edge.plan (debt 1785865143, and the cms scene alpha module 404 of 2026-09-23). The four rival cells are UNASSESSED (4), not copied and not graded: edge.sota carries no directory-canonicalisation row, and all four carried columns are proxies whose directory handling belongs to the origin behind them, so any grade here would be a claim nobody measured. dossierwatching hr_dir_slash_canon Pros none measured yetCons open contract; expected source declaration not established	○	?	?	?	?

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	11	rows carrying a Yes, Best or Part in a rival column
cited	0	a reference mark resolves to a pinned mirror
uncited	11	an observation read, badged until a reference lands
rows, summed	11	RECONCILED: the parts sum to the total 11

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
A latency optimization silently changes bytes on the wire and breaks a real browser	possible x catastrophic	E1's accept rule requires the five TLS known-answer gates and the Chrome-hello compatibility gate to stay GREEN, and treats the equivalence result as the tooth rather than the speed number. This edge terminates every request to the live site, so a handshake regression is an outage rather than a slow page.
0-RTT is shipped for the latency number and replay protection is left to the backend	possible x high	E2 states the constraint in the rung itself: RFC 8446 early data is replayable, so 0-RTT if enabled at all is restricted to idempotent requests AND the restriction is enforced at the edge. Declining to ship 0-RTT is an explicitly permitted outcome of that rung, so there is no pressure to ship it to close the row.
A health probe becomes part of the outage it exists to detect	possible x high	E4 requires probing from outside the serving process and a NEG-CONTROL for the all-backends-down case. The estate has already measured the two ways this fails: a probe that connects without accepting fills the backlog and manufactures the stall it reports, and a level-triggered check after a kill passes on the OUTGOING process. Both are named in the rung's done-rule rather than left to be rediscovered.
HTTP/3 is re-implemented from scratch because the sota row reads as greenfield	likely x high	This is why E3's rung text and its matrix row both enumerate the fourteen QUIC organs already on disk with the coverage of the search that found them. The failure this guards against is the estate's own most expensive recurring one: I did not know it existed is a retrieval failure, not a discovery.
Work starts on the CDN-scale rows that this lane cannot finish	possible x medium	Anycast, autoscale and the DSM port change are named in the goal row as explicitly NOT rungs, with the reason for each. They stay graded honestly on the sota page so the board never claims them, and no ladder version depends on them.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

SOTA field — 7 peers, 30 axes, measured bindings

nishi sni_router + sites.elf (own TLS/HTTP stack, zero OpenSSL/nginx) vs the production edge stacks

How the field is scored. A state-of-the-art comparison across the FULL competitor field: quantitative axes carry measured or published numbers (Nishi’s column is measured on this estate, competitor columns are researcher-sourced and cited in the note); grade axes carry Best / Yes / Part / No for every peer. A Nishi grade may be bound to an organ and a symbol and is then re-measured on every publish by the one symbol ruler the capability matrix above uses; an over-claim refuses to publish.

field, strip order:nginxHAProxyCaddyTraefikEnvoyCloudflareAWS-ALB·BestYesPartNo

TLS + SNI

SNI-based routing

peek ClientHello -> per-host backend (sni_extract) [rfc6066] [envoytls]

YES

TLS 1.3 termination

own nishi_tls13, not OpenSSL/BoringSSL [rfc8446] [nginxssl]

YES

Per-SNI certificate select

sites.elf nx_sni_cert_select, proven both domains

YES

SNI passthrough (no re-encrypt)

sr_relay splices raw TCP; backend terminates

YES

ACME / auto-cert

nx_acme_req Let's Encrypt live [rfc8555] [caddyhttps]

YES

0-RTT / session resumption

not yet

HTTP/3 (QUIC)

not yet [rfc9114]

mTLS to backend

personal-daemon path only

PART

Routing + proxy

HTTP reverse proxy

sd2_proxy_to + data-driven proxy_routes.conf

YES

Path + host routing

longest-prefix, boundary-safe (/site != /sitemap) [traefikrules]

YES

WebSocket passthrough

sd2_ws_pump TLS-terminating pump

YES

Streaming (no full-buffer)

sd2_proxy_stream 256KB window, TCP backpressure

YES

Full-body reassembly (large POST)

sd2_fill_body 2MiB, landed 2026-07-10

YES

Hot config reload (no restart)

add-a-row registry, zero recompile

YES

Health-checked backends / failover

guard-supervise liveness only, no active probe [haproxycfg] [awsalb]

PART

Load balancing (multi-backend)

single backend per host today

PART

Sovereignty + safety

Zero third-party dependency

own TLS + HTTP + router; no OpenSSL/nginx/libc-TLS -- gate-measured 2026-08-23: x25519 (RFC 7748 5.2), ChaCha20 (RFC 8439 2.3.2), Ed25519 (RFC 8032 7.1), TLS1.2 PRF and P-384 ECDH (RFC 5903) known-answer gates GREEN over the sovereign primitives; libssl ABSENT-PROVEN in runtime/bin (nx_absent corpus_complete=1)

BEST

Own source (no upstream CVE surface)

whole edge stack ours bits-up -- measured 2026-08-23: nx_absent libssl over buildroot/runtime/bin = 0 matches with corpus_complete=1; the only OpenSSL and nginx mentions in the edge sources are the wiki placeholder's own prose

BEST

Never-brick self-heal (guard respawn)

crash-loop-guarded supervise + .prev rollback

YES

Deterministic / auditable path

no opaque C runtime in the request path -- witness: the sovereign builder emits single-PT_LOAD program-header-only ELFs (no .dynamic, no libc), and the five TLS known-answer gates above ran GREEN on 2026-08-23 against those exact binaries

BEST

Single authoritative edge

DSM nginx LAN-shadow here (operator-gated fix)

PART

Production scale (the field's turf)

Global anycast / CDN PoPs

single box on one WAN link [cfworks]

WAF / DDoS mitigation

none built

Autoscale / multi-node

single box

Observability (metrics + traces)

structured logs only, no metrics export

PART

Edge rate limiting

per-client sliding window in mgmt edge

YES

Performance (measured / sourced)

TLS handshake, same-box

nishi-hs MEASURED; certloop dominates -> optimize

nginx ~1-3msHAProxy ~1-3msCaddy ~2-5msTraefik ~2-5msEnvoy ~1-3msCloudflare <1msAWS-ALB ~1-3ms

~40-140ms

Nishi, measured

SNI route decision

ClientHello peek only

nginx <1msHAProxy <1msCaddy <1msTraefik <1msEnvoy <1msCloudflare <1msAWS-ALB <1ms

<1ms

Nishi, measured

Max upload chunk (edge relay)

sd2_fill_body raised 8KB->1MiB 2026-07-10

nginx unboundedHAProxy unboundedCaddy unboundedTraefik unboundedEnvoy unboundedCloudflare ~100MBAWS-ALB ~100MB

1 MiB

Nishi, measured

Connection model

sr fork-per-conn: simple + memory-isolated

nginx eventedHAProxy eventedCaddy eventedTraefik eventedEnvoy eventedCloudflare managedAWS-ALB managed

fork/conn

Nishi, measured

7 competitors30 axes4 quantitativeNishi best 3 · absent 5

Honest verdict. On the CORE edge job -- SNI-routed TLS 1.3 termination with per-host certs, streaming + WebSocket passthrough, and hot-reloadable routes -- the sovereign edge is at parity with the field, built bits-up on our own TLS 1.3 + HTTP stack (zero OpenSSL, zero nginx), guard-supervised self-heal, deterministic/auditable. Those are structural wins no mainstream edge makes. It is NOT a production CDN: no HTTP/3, no 0-RTT, no WAF/DDoS, no global anycast, no autoscale, thin observability, one box; and TLS handshake is ~40-140ms vs ~1-3ms for the field (our cert-validation loop dominates -- the clear next optimization). One deployment gap remains, diagnosed 2026-07-10: the Synology DSM nginx still squats the LAN :443 as a shadow edge (external traffic already routes to our sovereign edge) -- the durable fix is an operator DSM-port change, not a scriptable one. Next rungs: cut handshake latency, HTTP/3, health-checked LB, metrics/traces.

Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/edge.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain edge, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from edge.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	4
scanned	4
fetched	4
reused	0
failed	0
named	4
candidates	4
mentions	4
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Cloudflare	1	1	col0-cloudflare	named	https://developers.cloudflare.com/fundamentals/concepts/how-cloudflare-works/
2	HAProxy	1	1	col1-haproxy	named	https://docs.haproxy.org/3.0/configuration.html
3	Envoy	1	1	col2-envoy	named	https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/listener_filters/tls_inspector
4	AWS-ALB	1	1	col3-aws	named	https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 12 capabilities: 12 exclusive to it and 0 shared with other boards. Shared rows on this page: 0 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 0 + refused 0 (partition 0); undecided = unmapped 0 + unproven 0 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6790.

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395895 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[rfc8446] IETF RFC 8446 (August 2018). The Transport Layer Security (TLS) Protocol Version 1.3 -- the published wire specification our own nishi_tls13 implements and every rival terminates. publisher · read in our library knowledge/fetched/cmp_edge_rfc8446.txt · pin h47871bc8820a2c3b6ea89f061055577058862cf543686b82d10131239702b3bd · accessed 2026-08-28 · published-standardGrounds: The TLS and SNI category: the TLS 1.3 termination row and the 0-RTT session-resumption row whose Nishi cell is honestly No.
[rfc6066] IETF RFC 6066 (January 2011). TLS Extensions: Extension Definitions -- section 3 defines Server Name Indication, the ClientHello extension every row in the TLS and SNI category is routed by. publisher · read in our library knowledge/fetched/cmp_edge_rfc6066.txt · pin h6a33cceaa5e1b6518923d9d04ffaa738bad0417806b3c94a995484e140f5cbc0 · accessed 2026-08-28 · published-standardGrounds: The SNI-based routing row, the per-SNI certificate select row and the SNI passthrough row: SNI is a published extension, not a vendor feature.
[rfc9114] IETF RFC 9114 (June 2022). HTTP/3 -- the published specification behind the HTTP/3 QUIC row the sovereign edge answers No on. publisher · read in our library knowledge/fetched/cmp_edge_rfc9114.txt · pin h6b84555c88eeebcf5d2b2e1d9d7b58630abc97ab877b2cf62dee4cd635db34e4 · accessed 2026-08-28 · published-standardGrounds: The HTTP/3 QUIC row: the gap is measured against a published standard, so the rung has a definition and not an aspiration.
[rfc8555] IETF RFC 8555 (March 2019). Automatic Certificate Management Environment (ACME) -- the protocol nx_acme_req speaks to Let's Encrypt and that Caddy and Traefik automate. publisher · read in our library knowledge/fetched/cmp_edge_rfc8555.txt · pin ha40983bbf91f2bd3a976d1c16520aa4418c02ba6d6f1ddcaf772881f823b2497 · accessed 2026-08-28 · published-standardGrounds: The ACME auto-cert row: our Yes and every rival cell beside it are claims about one published protocol.
[nginxssl] F5 NGINX Plus Admin Guide. SSL Termination for TCP Upstream Servers (docs.nginx.com, read 2026-08-28). States that NGINX Plus acts as the server-side SSL endpoint, decrypting requests and encrypting responses that backend servers would otherwise have to do, and that since release R6 it performs SSL termination for TCP connections as well as HTTP. The same page tells the reader to obtain certificates using an SSL library such as OpenSSL. publisher · read in our library knowledge/fetched/cmp_edge_nginxssltcp.html · pin h4d391e4655746bc9a56be9a1fcc2d4902ebeb26ae4ecdc6a139ef456ccf85023 · accessed 2026-08-28 · vendor-docGrounds: The nginx column on TLS 1.3 termination and HTTP reverse proxy, and the counterpart to our zero-third-party-dependency row: the incumbent's own guide points at OpenSSL where ours points at nothing.
[haproxycfg] HAProxy 3.0 Configuration Manual (docs.haproxy.org, read 2026-08-28). The vendor's complete configuration reference, including the alphabetical keyword index and the health-check and load-balancing directives. publisher · read in our library knowledge/fetched/cmp_edge_haproxycfg.html · pin h543c095ef7e1658d321a1477422ee714c3d3e691be7f4d9f39a79b401ba0a851 · accessed 2026-08-28 · vendor-docGrounds: The HAProxy column, in particular the Best cells on health-checked backends and load balancing that our guard-supervise liveness-only row is honestly measured against.
[caddyhttps] Caddy documentation. Automatic HTTPS (read 2026-08-28). Caddy's own statement that automatic HTTPS provisions TLS certificates for all your sites and keeps them renewed, redirects HTTP to HTTPS, and needs no downtime, extra configuration or separate tooling. publisher · read in our library knowledge/fetched/cmp_edge_caddyhttps.html · pin h70e8e2e6e5ca7f1614f48d99373d6ad6977c9a0a0d8c59c5cdd566ab4ae973d2 · accessed 2026-08-28 · vendor-docGrounds: The ACME auto-cert row where Caddy scores Best: that cell is the vendor's documented default, read rather than assumed.
[traefikrules] Traefik v3 reference. HTTP routing rules and priority (read 2026-08-28). Documents the Host, Path, ClientIP and query matchers and the v3 rule syntax that composes them per router. publisher · read in our library knowledge/fetched/cmp_edge_traefikrules.html · pin hc11c11c9d8a992f9617c986463d492a5cb42bf4ebfca644dc0ee563114f6d8ab · accessed 2026-08-28 · vendor-docGrounds: The Traefik column on path and host routing and on hot config reload. The first fetch of the older routing/routers URL returned a 662-byte redirect stub and was NOT cited.
[envoytls] Envoy proxy documentation. TLS Inspector listener filter (read 2026-08-28). Detects whether a transport is TLS and extracts the server name (SNI) and ALPN from the ClientHello, exposing sni_found, tls_found and alpn_found counters. publisher · read in our library knowledge/fetched/cmp_edge_envoytls.html · pin h11a44dd5591098a4f284f1a02dd6d650339bd2eb8d28310ed8a8a93c61d2ce1d · accessed 2026-08-28 · vendor-docGrounds: The Envoy column on SNI-based routing and SNI passthrough: the rival does exactly what sni_extract does, named in its own documentation.
[cfworks] Cloudflare developer documentation. How Cloudflare works (last updated 2026-04-20, read 2026-08-28). Describes proxied DNS records routing all HTTP and HTTPS traffic through Cloudflare as a reverse proxy, and names the benefits as load balancing, hiding the origin IP against DDoS, caching at a location near the visitor, and decrypting and re-encrypting SSL or TLS on behalf of the origin. publisher · read in our library knowledge/fetched/cmp_edge_cfworks.html · pin h518fc9b4059ebf109addac18c3175fc2b599b69bbcf5a6582e3bb7f4bd3cbdf2 · accessed 2026-08-28 · vendor-docGrounds: The Cloudflare column across the production-scale category: global anycast and CDN PoPs, WAF and DDoS mitigation, and the caching and TLS-offload cells that make it Best there and irrelevant to sovereignty.
[awsalb] AWS Elastic Load Balancing documentation. Create an HTTPS listener for your Application Load Balancer (read 2026-08-28). Documents adding an HTTPS listener with a certificate, optional pre-routing authentication, and forwarding to weighted target groups. publisher · read in our library knowledge/fetched/cmp_edge_awsalb.html · pin h913f8a99f6f9aa7abcf2def869c964ab88be5a611bc7ee3c9edaa056ce9b82e5 · accessed 2026-08-28 · vendor-docGrounds: The AWS-ALB column on TLS termination, health-checked backends, load balancing and autoscale: a managed listener with weighted target groups is what our single-backend-per-host row is measured against.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/edge.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls