§15. Layer 1: Reachability

Jason St George. "§15. Layer 1: Reachability" in Next Generation Stores of Value: Privacy, Proofs, Compute. Version v2.0. /v/2.0/read/part-iii/15-layer-1/

Layer 1: Reachability

All of this math still travels as packets.

Every proof, every private swap, every verified FLOP ultimately crosses a handful of cables and radios that a small number of operators can see and shape. A store of value that survives yield-curve control but dies when a few IXPs collude is not a store of value; it is an overlay.

Comms resistance is the stack’s oxygen: the property that air still flows when someone leans on the hose.

Prior art this chapter stands on.

The layer’s components are deployments, not proposals, and the design borrows deliberately: BIP-324 encrypted P2P transport (shipped in Bitcoin Core 27.0) is the wire-format template for “encrypted and boring”; Tor, I2P, and the pluggable-transport lineage are the first-class transports and obfuscation shims; BOLT12 Offers are the receiver-private rendezvous pattern; and the VerifyReach measurement program of §15: Layer 1: Reachability follows the OONI methodology — volunteer vantage points, canary requests, ASN-stratified public aggregation — that has measured real-world censorship at scale since 2012. The thesis’s contribution is not any of these mechanisms; it is binding them into a monetary stack whose falsifiability depends on them, and treating their telemetry as monetary instruments. Full entries in Sources.

Threat Model: What We Must Survive

The comms threat model has four main faces:

Backbone controls.
IP and prefix blocking, BGP blackholing, DNS and SNI filtering, DPI-based resets, QoS throttles on known P2P handshakes.

Exposure and linkage.
Static addresses and reusable invoices let adversaries map who is getting paid; mempool and gossip surveillance reveal patterns.

Eclipse and routing capture.
A node that only talks to a small set of peers in the same ASN can be effectively isolated.

Platform risk at the edge.
App-store takedowns, CDN firewalls, corporate endpoint policies that classify P2P clients as malware.

Design Rules: Protocol Posture Under Pressure

1. Transports must be encrypted by default and boring on the wire. Clear-text, distinctive handshakes invite classification. BIP-324-class v2 encrypted transport is the template.

2. The stack must be transport-agile. No single path (TCP/TLS, Tor, I2P, QUIC) should be a single point of failure.

3. Receiver privacy must be the default. Payment rendezvous should be “addressless”—BOLT12 Offers, path-blinding, and shielded pools.

4. Settlement must be refund-safe under squeeze. Atomic, adaptor-signature flows with clear timeout and refund semantics.

5. Edge admission must remain open. No “special” relays or whitelisted entry points.

6. Comms health is part of the telemetry regime. If reachability silently degrades, neutrality degrades with it.

Mechanisms: What Needs to Ship

Encrypted, multi-path P2P transports.

Full nodes speak encrypted P2P by default, with Tor and I2P as first-class citizens. Camouflage layers (Noise-style patterns, obfs-class shims) allow relays in high-interdiction ASNs to keep moving traffic.

Receiver-private routing for payments.

BOLT12 Offers: receiver-private, reusable invoices. Path-blinding and rendezvous routing ensure intermediaries see only their hop. Federated ecash and shielded pools provide endpoint firebreaks.

Settlement survivability.

Adaptor-signature atomic swaps as the default for cross-asset payouts. “Abort & refund” as a first-class, well-signposted action.

Topology and anti-eclipse hardening.

Peer-set diversity and rotation; connections spread across geographies and ASNs; gossip protocols favor multiplicity of paths.

How Layer 1 Anchors the Triad

Communications resilience is not an orthogonal concern; it is the medium in which the triad either lives or suffocates.

For Privacy,

encrypted transports and receiver-private endpoints are what keep the network itself from nullifying ledger-level secrecy. Shielded pools and privacy coins are only as private as their membrane to the outside world. If every shielded payout can be traced to a stable IP graph and a static address, “lawful privacy” collapses into a thin veneer over a rich flow-of-funds analysis. Layer 1’s job is to ensure that settlement paths are as hard to pin down as the flows they carry: private not only in state, but in motion.

For Proofs,

communications resilience keeps verification a public act rather than a priestly privilege. A world where only a small set of well-positioned nodes can fetch and check proofs is a world where VerifyPrice has quietly become an internal KPI rather than a public commodity. If any honest machine with modest connectivity can still reach a verifier over at least one path, proof markets and receipt ledgers remain subject to universal scrutiny. When reachability fragments, the “public” in public verification becomes aspirational.

For Compute,

Layer 1 ensures that useful-work mining and verified inference do not devolve into “whoever still has a clear line to the router wins.” Proof-of-Useful-Work schemes depend on open admission: a wide, geographically and topologically diverse set of provers and miners competing to satisfy claims. If adversaries can choke ingress to a few ASNs or clouds, PoUW degenerates into a club good. Comms health metrics and open-admission design at the edge keep compute supply neutral and keep the token’s claim (“backed by globally demanded work”) from turning into “backed by whichever datacenter the regulator likes.”

All of this math still travels as packets. Layer 0 keeps the machines honest and powered; Layer 1 keeps them in conversation when it is no longer convenient for them to be. The triad’s monetary ambitions depend on both. Without verifiable machines, we do not know what happened. Without resilient communications, we do not know it in time, or at all.

Residual risks: Encrypted transport and obfuscated routing are ingredients, not complete answers to censorship. Residual threats include traffic analysis (pattern and timing correlation), active probing (protocol fingerprinting despite camouflage), endpoint seizure (physical confiscation of devices), long-term sustained shutdowns (where no transport can help), and legal coercion at the social layer. Layer 1 reduces these surfaces; it does not eliminate them. The honest claim is degradation resistance, not censorship immunity.

VerifyReach: Communications Telemetry

Layer 1 introduces VerifyReach as the communications analogue of VerifyPrice:

• Reachability metrics: fraction of vantage points from which key services are reachable.

• Degradation patterns: which networks experience blocking or throttling.

• Transport diversity: percentage of traffic over each transport class.

Target SLOs:

• Core infrastructure reachable from $\geq 95\%$ of sampled ASNs (uncensored regions).

• $\geq 70\%$ reachability for known-censored regions.

• p95 time-to-first-connection $< 10$s uncensored; $< 30$s censored.

• No country-level view sees more than $Y$% persistent reachability degradation without triggering incident handling.

VerifyReach feeds into Layer 6 governance: if reachability collapses in a region, incident response kicks in (alternative transports are promoted, routing is adjusted, and the degradation is visible on public dashboards).

VerifyReach Measurement Specification

Like VerifyPrice, VerifyReach requires a rigorous measurement methodology to prevent gaming and ensure credibility.

Sampling Frame:

VerifyReach sampling frame requirements.

Vantage Points:

• Community nodes: Volunteer-run measurement agents (similar to OONI probes). Incentivized via small WC rewards.

• Independent labs: At least 3 organizations (academic, NGO, commercial) run measurement infrastructure. No single operator controls $>30\%$ of vantage points.

• Diversity requirement: Vantage points must span $\geq 20$ countries and $\geq 100$ ASNs for measurements to be considered valid.

Metrics:

VerifyReach metrics and targets. Targets shown as uncensored / known-censored.

Adversarial Robustness:

VerifyReach adversarial robustness measures.

Publication:

• Raw measurement data (anonymized to protect vantage point operators) published daily.

• Aggregated dashboards updated hourly.

• Quarterly reports summarizing regional trends, incidents, and transport effectiveness.

• All measurement code is open-source and reproducible.

Monetary Consequences:

If VerifyReach for a region falls below thresholds:

• WC minted by operators in that region may face regional risk premiums (higher collateral requirements).

• Corridors primarily serving that region are flagged; users see warnings before transacting.

• Incident response is triggered: alternative transports promoted, routing adjusted.

This makes VerifyReach not just a dashboard metric, but an input to economic risk pricing.

Tip: hover a heading to reveal its permalink symbol for copying.