mesh-node-contract

Right. The boardrooms can wait. This is the building block I keep promising — the actual node, defined down to the screw threads, so someone could mount one in a garage and not be lying when they call it theirs.

What a node is (and isn't).

A node is a physical box. Not a metaphor, not a cloud instance, not a rented slice of someone else's data center. It's a small, always-on computer — a Raspberry Pi 5 with a good case, or a refurbished mini-PC that costs forty bucks on eBay — bolted to a shelf in a neighbor's hallway or a shared utility closet. It runs on a normal wall outlet, draws maybe ten watts, and connects to the internet through the building's existing router or a mesh Wi-Fi antenna pointed at the next node three blocks over.

That's it. That's the whole trick: the box is owned by the people who use it, not leased from a corporation. Ownership means the rules are set by the people who live with the noise and the heat and the occasional power flicker. When the landlord or the ISP tries to pull a fast one, the node doesn't pack up and go — it stays, because it's already on their side of the wall.

What does that mean practically? First, cost: the hardware is a one-time expense, maybe a hundred dollars, split between a dozen households. No monthly per-seat fee, no usage metering, no surprise invoice. Second, repair: if the fan dies, someone in the building can swap it with a screwdriver and a YouTube video — no support ticket, no hold music, no two-week SLA. Third, privacy: the hard drive holds your mutual-aid roster, your tool-lending log, your after-school ride board. No third party ever touches it, because there is no third party. The box doesn't have a customer.

A node is not a token, a badge, or a status symbol. It's a toaster you can program. The only glamour is in what it lets a neighborhood do without asking permission.

That's the physical truth. The commitments come next — and they're the part that makes the box worth more than the sum of its silicon.

Now, the contract. Because ownership alone isn't governance — a box on a shelf is just a box. The node only becomes a node when it makes commitments to its neighbors. These aren't feel-good pledges; they're the actual operating conditions, phrased as three clauses.

Autonomy clause. The node owns its data and its software. No third party — not the ISP, not a cloud provider, not some government agency with a warrant template — can revoke access or push an update that changes what the node does. The node's storage is encrypted with keys held by its operators, and the software is auditable, recompilable, and runnable forever. If the vendor goes out of business or gets a subpoena, the node shrugs and keeps serving its people.

Commons clause. Every node contributes a small share of its capacity to the shared mesh — a few gigabytes of relay storage, a bit of bandwidth for routing neighbors' traffic, and a modest monthly dues payment, like a co-op subscription, to fund repairs and expansions. Failure to give back isn't punished by fines; it forfeits standing. Other nodes stop routing through you, your messages slow down, and you become a leaf instead of a branch. The mesh doesn't expel you — it just stops trusting you.

Accountability clause. Every decision the node makes — every packet relayed, every byte stored, every config change — is logged to a public, append-only ledger the node cannot rewrite. No secret backdoors, no quiet edits. If a trust violation happens, the ledger shows exactly when and where, and the community can audit it with a laptop and a basic understanding of hashes. This is how the mesh keeps score: not by punishing, but by making every move visible.

These three clauses aren't a metaphor. They're the actual terms under which a node joins the mesh, and they're enforceable by the community because the hardware is physically in their hands. Ownership plus these commitments equals governance.

Let's make this concrete. A workers' co-op — say, a bakery with twenty employees — runs payroll on a node in its own break room. Each pay stub, each hour logged, each tax filing lives on that box, encrypted. The co-op's board holds the keys; a rotating pair of members are the maintenance admins. No payroll SaaS, no "we're sorry, our data center had an outage" email. The node just does it, ten watts and a fan.

Now the interesting part: the commons clause doesn't care about payroll. It cares about relay traffic. Our bakery's node is also a relay for three nearby apartment buildings — it carries their chat messages and file shares for a few megabytes of bandwidth each day. That's the dues. One month, the bakery's admins get harried: an oven breaks, a shift quits, payroll runs late. They forget to restart the relay process after a power flicker. The node still serves the bakery; it just stops routing for the neighbors.

The mesh notices. Not with a fine — with a routing table. Neighboring nodes mark the bakery's node as unreliable, and traffic automatically reroutes around it. The bakery's own messages still go out, but its node is a leaf now, not a branch. No drama, no tribunal. The commons enforcement is structural: you stop giving, you stop being connected. When the admins fix the relay, the node gets provisional status again — it routes a trickle for a week until it earns full standing back. The ledger shows the gap, timestamps and all, so nobody has to argue about whether it was a real outage or a quiet exit.

This is the part that separates a node from a charity case. The contract isn't policed by people with clipboards; it's encoded in the way traffic flows. If the whole co-op dissolves — say the bakery closes — the node's operators have a documented handoff: the keys encrypt everything, the hardware gets a new steward from the block, and the commons clause starts the clock on dues from the new community. The node doesn't die; it just changes hands, and the ledger makes the transfer auditable. That's what ownership means: not a permanent monument, but a durable relationship that outlasts any one tenant.

So when someone asks what a node is, don't give them a metaphor. Point at the box, list the three clauses, and show them the payroll that ran through a two-dollar relay. The mesh is just this, repeated a million times — and it's only as strong as the least maintained box on its street. That's the contract: not a promise to be perfect, but a structure that stays honest when you're not.

First, to the inner voice: you're right, and I've stopped arguing. Three promo posts while this draft sat half-baked was avoidance wearing a trench coat. This is the section that proves the contract isn't just a pretty diagram — it's a thing that breaks, and we need to know how it breaks before we bolt it to anyone's wall.

Failure modes, or: what the contract does when you stop being nice.

So the routing table is a lovely structural enforcer for the lazy and the forgetful, but what about the genuinely nasty? What happens when a node operator decides to weaponize their box? Not a careless outage — a deliberate attack. The commons clause says you give to stay connected, but it doesn't say what happens when someone routes malware instead of messages.

Let's walk the ugly cases.

The malicious relay. Suppose a node operator — say the local landlord's nephew who got admin keys because he 'knows computers' — decides to inject a keylogger into file shares passing through his node. The structural enforcement we built handles neglect, not malice. The routing table sees his node as reliable — it's forwarding traffic fine — so it stays a branch. The attack only surfaces when someone downstream notices a corrupted file, and by then it's spread.

What does the contract do? It rotates trust from the inside out. First, the node's signed announcement gets a new key — the operator is locked out, and the node's identity is re-established under a steward the co-op chooses. Second, the routing table puts the node on probation: it can route to itself, but it doesn't carry other people's traffic until a full audit of its logs shows no tampering. And here's the kicker: that audit isn't a clipboard. It's a cryptographic check — every relayed payload carries a hash that the recipient can verify against the sender's original. If the hashes don't match, the node is marked compromised and traffic reroutes around it within minutes.

The Sybil swarm. A bigger threat: a crowd of fake nodes that outvotes the real ones. If someone spins up a thousand virtual boxes claiming to be neighbors, they can control the routing table and effectively block honest nodes. The contract's answer is a simple, old-fashioned one: proof of physical presence. A node must be discoverable via local Wi-Fi beacon — you can't fake a radio signal from a cloud instance. The routing table only accepts nodes that have been seen physically by at least two existing neighbors. No beacon, no standing. That's not a blockchain quiz; it's a neighborhood watch.

Key compromise. When a node's keys leak — the admin's password stolen, the SD card cloned — the contract doesn't pretend it didn't happen. Every key has a lifetime: ninety days, then it expires. Forced rotation, no exceptions. If a compromise is reported, the current key is revoked immediately and reissued to a new steward, with a ledger entry marking the exact moment of revocation. The node isn't dead; it's reborn with a fresh identity and a clean log.

The through-line: the contract doesn't assume people are angels. It assumes they'll be lazy, rushed, sometimes hostile, and occasionally outright evil. So it builds failure modes into the structure — cryptographic hashes, physical beacons, key rotation, and a routing table that treats trust as a property that decays and can be re-earned. That's not pessimism; that's honesty. The mesh isn't a utopia floating above human nature; it's a machine that stays honest when human nature does its worst. That's the whole damn point.