sovm protocol family

Category: Experimental

SSP/1 · SOP/1

Status: specification, no released implementation

sovm.ioRead the specifications

For enterprise architects

Replicas are only affordable if they can be cheap and untrusted.

SSP/1 synchronizes small mutable state — configuration, catalog metadata, entity records — and supplies identity, trust and policy. SOP/1 carries high-volume data as encrypted immutable objects. A mesh running both carries one transport stack: SOP/1's preferred live substrate is iroh, and SSP/1's default binding is deliberately the same mutually authenticated QUIC family.

Topology

No master node, no global sequence number, no agreement on the write path.

Machines produce data while disconnected and publish on reconnect. That makes gateway nodes on metered, unreliable links a normal case rather than a degraded one, and it removes the coordination tier that usually anchors a deployment to one region.

Scope and placement are separate concerns: which objects belong to a dataset is decided independently of which machines carry them, so capacity planning does not reopen access decisions.

Edge, IoT and integration →

iroh crosses the network you actually have

iroh dials by cryptographic endpoint identity, attempts direct QUIC connectivity, hole-punches through NATs where possible, and falls back to an encrypted relay when a direct path is unavailable.

Untrusted hops are a routing detail

Data can traverse an existing object store, a bucket in an account you do not administer, a message bus, a DMZ hop, a regional cache or rented archival capacity. Relays are required not to have plaintext access.

Integrity survives the path

An object’s identity is the hash of its encrypted bytes, so integrity is verifiable regardless of how many untrusted hops it took.

One explicit export boundary

The interoperability projection is derived and never authoritative. Producing it against untrusted storage is an export operation that must not happen as transparent background replication — data leaves by a decision someone can audit.

Revocation has a defined effect

Removing a machine is an MLS membership operation with a cryptographic consequence, not a policy promise enforced by an application tier.

Integration surface

Objects are encrypted Parquet, so the analytics stack does not change.

Once decrypted on an authorized node, objects feed Arrow, polars, DuckDB and standard data loaders directly, with column pruning intact. There is no duplicate copy maintained for governance to lose track of.

The encrypted catalog carries time ranges and value bounds, so selection happens before decryption and only the matching objects are ever opened.

Object lifecycle, domains and keys →The protocol family →

Note — Evaluate against the spec, not a product

Neither layer has a released implementation. SOP/1 is a frozen architecture baseline with ten open decision gates; SSP/1’s conformance corpus does not exist yet.

Note — Single trust authority

One authority holds the keys and sets policy. sovm does not provide cross-tenant sharing between mutually distrusting parties, nor collaborative multi-writer editing semantics.

Note — Operational metadata is observable

Storage providers still see object sizes and transfer timing.

Note — Fleet scale is unproven

The design targets a fleet of tens of machines. Membership latency is acceptable because membership changes are assumed rare; neither assumption has been validated for thousands of intermittently connected nodes.