← ENF Protocol — The Timestamp in the Wall·Architecture Spec

ENF Protocol · Technical Document · Specification Amendment · Draft

Amendment A2 — Resilient Transport Layer

The spec assumes a working open Internet between nodes. This amendment removes that assumption — and divides the contested network into three transports that carry one identical payload: the signed object.

Section A2.1Problem This Amendment Addresses

The v0.1 spec specifies a node down to the sensor, the correlation engine, the block structure, and a regional BFT cluster — and then, at the network boundary, defers: §13 lists "network peer discovery" as a "standard distributed systems problem. Use libp2p or equivalent. Not ENF-specific." That is correct for discovery. It quietly smuggles in a much larger assumption it does not state: that there is a working, open IP path between honest nodes in the first place.

For a protocol whose entire reason to exist is anchoring trust to physical reality when central authority is unavailable or adversarial, that assumption is the weakest link in the document. An adversary who cannot forge the ENF witness (A1) and cannot defeat correlation can still win cheaply by attacking the path: filter the protocol at a national firewall, fragment the network into islands, or — in the scenario the index page invokes — operate where the Internet is simply down. None of these require defeating any cryptography.

The network between honest nodes is therefore not a solved commodity to be hand-waved to libp2p. It is contested terrain with three distinct failure modes, each of which has a different answer:

Failure mode	Adversary / condition	Answer
Filtered	A path exists but the protocol is blocked, throttled, or proxied (DPI, national firewall, captive network).	SoftEther — route around control.
Absent	No IP path exists at all (outage, blackout, deliberate shutdown, air-gap).	Sneakernet — route around absence.
Centralized	A path exists but depends on a single controllable intermediary.	Distributed nodes — route around centralization.

Section A2.2The Three-Transport Division

The architectural move that makes this tractable is to insist that all three transports carry exactly the same payload: the signed object defined in §7 (a node's attested block — ENF witness, correlation result, BFT signature). The transport is a dumb pipe. The node verifies an arriving object the same way regardless of how it arrived.

SURVIVING IP PATH
      ↓
SoftEther: virtual Ethernet frames over an SSL-VPN that presents as HTTPS
      ↓
Encrypted virtual LAN between autonomous nodes
      ↓
Distributed services · local DNS · repositories · local LLM inference
      ↓
Signed synchronization of models, data, and messages   ←── the §7 object
      ↕
Sneakernet when no route exists                        ←── same §7 object

Because the payload is identical, sneakernet is not a degraded mode — it is a peer transport. A block that crossed the planet on a USB stick and a block that arrived over a SoftEther tunnel are indistinguishable to the verifier and equally admissible to the BFT layer (§8), subject only to the freshness/ordering rules already imposed by chain-binding (A1.4 / ENF-X-02). This is the single most important design property in the amendment: liveness is decoupled from any one path's availability.

Section A2.3Specified Mechanism — SoftEther as Ethernet-over-HTTPS Bridge

For the filtered failure mode, this amendment specifies SoftEther VPN as the inter-node link substrate. SoftEther's native protocol encapsulates virtual Ethernet frames inside an SSL-VPN session that, on the wire, presents as ordinary HTTPS on TCP 443. This buys four properties the regional BFT cluster (§8) needs but v0.1 never specified how to obtain:

Property	What it provides for the cluster
HTTPS-compatible tunnelling	Consensus traffic rides TCP 443 framed as TLS, traversing port/protocol blocking and most captive networks without a dedicated open port.
NAT & firewall traversal	Nodes behind consumer NAT or carrier-grade NAT join the cluster without inbound port-forwarding — essential for commodity, residentially-hosted nodes (the §11 cost model).
Layer-2 LAN-to-LAN bridging	Geographically separated nodes appear on one virtual Ethernet segment. The BFT cluster can treat remote peers as link-local, simplifying §8's peer addressing.
HTTP / SOCKS proxy traversal	In environments where direct egress is blocked but a proxy is mandated, the tunnel chains through it. (SoftEther NAT-traversal docs.)

Section A2.4Sneakernet as a First-Class Peer

For the absent failure mode — no IP path at all — the transport is physical media. The objects that move this way are exactly those too large or too infrequent to need a live link, plus anything queued during an outage:

Model weights	Local LLM inference (the diagram's services layer) needs the model present; weights are shipped once, signed, and verified on arrival.
Large datasets & software repositories	Bulk state that does not change per-block; ideal for physical transport.
Queued messages & signed network-state updates	§7 blocks accumulated while a node was partitioned, replayed into the BFT layer on reconnection.

The verification path is identical to the live path. There is no "sneakernet trust mode." An object carries its own §7 signature and its chain-binding; the medium it crossed is irrelevant to whether it is admitted. This is what lets a fully air-gapped node remain a genuine participant rather than a stale archive.

Section A2.5What This Closes, What It Does Not

The single most important section of this amendment. SoftEther is widely and somewhat loosely described as "undetectable" and "censorship-proof." It is neither, and the spec must not inherit that inflation.

Closed (or materially hardened)

Port / protocol blocking	Framing consensus traffic as HTTPS on 443 defeats naive blocking and traverses NAT and mandated proxies. The common case of a filtered path is handled.
Path-absence liveness	Sneakernet, carrying the identical signed object, decouples network liveness from any single live path. An outage degrades latency, not admissibility.

NOT closed — do not let these drift

"Presents as HTTPS" ≠ indistinguishable	SoftEther's TLS/handshake has a recognizable fingerprint. State-grade DPI has historically fingerprinted and throttled SoftEther (the GFW being the standing example). The honest claim is "traverses filtering and NAT," not "censorship-proof." Hostile-DPI environments require an obfuscation transport layered beneath SoftEther; SoftEther's own pluggable-transport story is weak. Flagged ENF-NET-01.
Layer-2 bridging has a scaling ceiling	Bridging nodes onto one flat virtual Ethernet segment is clean for a regional cluster (§8, single-digit to low-tens of nodes) but broadcast/ARP traffic and MTU fragmentation scale badly over lossy WAN links. A wide mesh wants L3 routing between bridged islands, not one global segment. Flagged ENF-NET-02.
Transport is not trust	SoftEther moves frames; it authenticates a tunnel, not a node, and says nothing about replica integrity. The trust root remains the §7 signature + A1 attestation + chain-binding, exactly as on the sneakernet path. SoftEther must never be mistaken for the security layer — it is the pipe, not the notary.
It does not resurrect a severed physical route	SoftEther needs a surviving HTTPS path. Against the absent failure mode it does nothing — that is sneakernet's job, by design. The two are complementary, not substitutable.
Dependency & maintenance surface	SoftEther is a large C codebase with its own CVE history and uneven release cadence; it becomes part of the node's trusted computing base and attack surface. A node depending on it inherits its security-update obligations. Flagged ENF-NET-04.

Section A2.6New Open Questions

Added to the §10 critical-path register. Each is a testnet measurement or governance target, consistent with the v0.1 convention.

Section A2.7Testnet Impact

This amendment is partially exercisable on the 7-node testnet and should not block the §11 critical-path correlation measurements. The base cluster can run its BFT traffic over a SoftEther virtual segment from day one — this is the cheapest of the three transports to validate and answers ENF-NET-02 (the L2 scaling question) directly at the testnet's actual node count.

Recommended sequencing: bring the cluster up on a SoftEther L2 segment and confirm consensus converges over it before introducing adversarial conditions. Then exercise the failure modes in order of cost — ENF-NET-02 (flat-segment overhead at 7 nodes, free), ENF-NET-03 (partition one node, replay its backlog by file copy to stand in for sneakernet, free), and only last ENF-NET-01 (DPI resistance), which requires an out-of-band adversarial network and is the only line item that may exceed the commodity testnet budget.

---

Spec Amendment A2 · amends Prototype Node Architecture Specification v0.1 · pre-prototype · not peer reviewed.
SoftEther answers a filtered path only; it does not defeat state-grade DPI, scale a flat L2 mesh, or move the trust boundary off the §7 signature.
Sneakernet carries the identical signed object — physical transport is a peer, not a degraded mode.
Prepared by flipkoin · GoComputerHelp · Regina, Saskatchewan · Treaty 4 territory — oskana kâ-asastêki · June 2026.