Self-Hosted Distributed Scientific Compute Mesh — Gate Topology

Overview

Status (Wave 155n): 10 operational gates (9 active + southGate validation). NUCLEUS confirmed on 3 gates (westGate, blueGate, strandGate). 10G MikroTik backbone. WireGuard overlay + Tower Atomic in shadow mode. bearDog crypto.sign LIVE on all Tower gates.

The ecoPrimals gate mesh is a sovereign, self-hosted network of compute gates connected via Tower Atomic transport (and legacy WireGuard overlay) coordinated through 🎵🐦 Songbird. Each gate runs a NUCLEUS composition and participates in capability-based routing — no centralized orchestrator, no exposed ports.

Tower Atomic runs alongside WireGuard in shadow mode. On LAN, Tower uses direct TCP (topology-aware path selection) while WireGuard routes through the overlay — so Tower avoids overhead that WireGuard was never designed to avoid. On degraded WAN paths, Tower sustains ~1.7× WireGuard throughput via adaptive retry. 360+ shadow benchmark files collected continuously across the mesh.

How Gates Connect

Peers discover each other through four path types, selected by songBird at runtime:

songBird discovers LAN peers via lan_addr and routes directly — bypassing the VPS entirely. This is the core advantage over WireGuard: same-switch gates communicate at 0.57ms instead of 153ms through the VPS hub.

Why Tower Exists Alongside WireGuard

WireGuard is an excellent VPN — but it’s a VPN, not a LAN-aware mesh. It has no concept of network topology: two gates on the same switch still route through the VPS hub (153ms round-trip). Tower discovers LAN peers via lan_addr and routes directly (0.57ms). This isn’t “faster than WireGuard” — it’s solving a different problem (topology-aware routing) that WireGuard doesn’t attempt.

Capability Routing

Services bind exclusively to localhost. songBird IS the port solver:

1. A gate registers capabilities via primal.announce
2. Callers invoke capability.call with a capability name
3. songBird routes to the best available provider (LAN-prefer, WAN-fallback)
4. Results flow back through the mesh transparently

This means adding a new compute node is zero-config: plug in hardware, cascade primals, primal.announce capabilities — the mesh absorbs.

Current Mesh State

The visualization above updates from songBird’s mesh.peers endpoint. Color indicates link health:

When songBird is unavailable, the visualization gracefully degrades to static topology data — showing known gates and their roles without live latency.

Enrolled Gates

Physical Topology

House 1 (CRS310 backbone — 1G MikroTik):
  sporeGate, eastGate, northGate, biomeGate(offline)
  Peptidoglycan anchor: sporeGate

House 2 (Omada SX3008F — 10G):
  ironGate, strandGate(COMPUTE LIVE), westGate(NEST ATOMIC LIVE),
  blueGate(ONLINE), swiftGate(ONLINE),
  southGate(HW ready), fieldGate(offline)
  Peptidoglycan anchor: blueGate

Link: 80m 10G AOC trunk between adjacent lots

Remote:
  golgiBody (VPS — sole depot)
  flockGate (WAN — Tower primal teams)
  grapheneGate (Android — mobile)

Key Invariants

• No single point of failure: unplugging any gate does not kill the network. The Flint edge router is the membrane; gates are ephemeral compute.
• songBird mesh consensus: each gate’s songBird maintains bilateral peer state. No central registry — peers discover each other via peer.connect and mesh.init.
• Security fail-closed: unknown peers are rejected. Trust flows through 🐻🐕 BearDog BTSP exchange and trusted issuer registry.
• Zero exposed ports: all inter-gate traffic flows through songBird mesh or WireGuard. Services never bind to public interfaces.

Topology Evolution

The mesh grows by autonomous enrollment (F10 fossilized):

New hardware arrives
  → gate-enroll.sh (Linux) or gate-enroll.ps1 (Windows)
  → WG peer registered, Forgejo SSH key, family seed delivered
  → Clone 43+ repos from Forgejo over mesh
  → membrane gate.bootstrap → fetch genomeBins from golgiBody depot
  → primalSpring scenarios pass → head published → ONLINE
  → Self-registration — gates declare name + composition

strandGate (64-core EPYC, 256GB, House 2) will follow this pattern once SSH access is established. fieldGate and future NUCs, Raspberry Pis, or cloud VMs join identically — the mesh absorbs any hardware that runs NUCLEUS.

USB Enrollment (Offline)

Gates can also be enrolled offline via USB:

gate-usb-bootstrap.sh   # Prepare USB with WG keys, primal binaries, MitoBeacon identity
stage_usb.sh --enroll    # Enroll the gate from USB

The USB carries WireGuard keys, RustDesk credentials, primal binaries, MitoBeacon identity, and peers.toml. Gates join the mesh without any network access to the hub.

Traffic Classes

🎵🐦 Songbird routes 6 traffic classes to specialized provider stacks:

WireGuard sends all 6 through the same undifferentiated tunnel. Tower Atomic routes each class to the correct provider via capability.call dispatch.

Shadow Metrics

Tower shadow deployment collects benchmark data every 60 minutes across all gate pairs. 360+ benchmark files have been collected, providing continuous parity evidence. Results are stored in benchScale/tower_shadow/ and consumed by 🧬♨️ primalSpring validation scenarios.

Limitations

• The mesh currently runs on 6 gates across 2 physical sites; multi-continent deployment is untested
• USB enrollment assumes a trusted physical carrier (no remote enrollment yet)
• LAN advantage over WireGuard is a topology difference, not a protocol speed difference — Tower routes locally, WireGuard routes through VPS
• No web dashboard; all monitoring is via CLI and JSON-RPC
• Tower Atomic source code: songBird is public, bearDog and skunkBat are public (AGPL-3.0)

Hardware: MikroTik 1G switches, consumer x86_64 Linux boxes, WireGuard baseline
Date: July 2026
Author: ecoPrimal (ORCID 0009-0004-2141-0321)