Encrypted, datacenter-free presence at scale.

What this is

CIRIS is the CIRIS Epistemic Web Platform (CEWP) — a complete replacement for the internet's extractive middle. Streaming, video calls, gaming, files, messages, and signed claims route directly between the devices people already own, over a post-quantum-encrypted mesh: no giant data centers in the middle, no handful of companies owning the pipes or deciding what you see. The network governs itself through signed, weighted votes (no platform owner), never advertises your local content to the rest of the network, and runs on hardware you already have — it removes the centralized control plane rather than renting it back to you.

This page measures one capability of that substrate — presence at scale: encrypted realtime A/V for thousands, forwarded by participants' own uplinks. The fabric node (CIRISServer) is the transport + storage tier — the same primitives that carry a live blob also store the durable corpus. Full framing: ciris.ai/cewp.

Can a room of N do video? MODEL

Layered encoding makes it a bandwidth question, not a tile cap: you pull each person's lowest layer (a ~50 kbps presence blob) and focus-pull full quality only for whoever you're looking at. Two sides of the ledger — what you receive (demand), and what the room's peers must donate to forward it (supply, = N²·b by conservation):

Demand is the easy half — even 2,000 blobs is ~100 Mbps to your device. Supply is the real question. Everyone-sees-everyone is N×N delivery, so the room must source ~200.0 Gbps of forwarding at N=2,000 — and leaves forward nothing (a constrained mobile peer just publishes its own blob), so that load lands on the fat interior: peers with real donated uplink, in an O(log N)-deep ALM tree (per-node fan-out bounded by measured uplink). Feasibility is Σ(donated interior uplink) ≥ N²·b — not crypto. It's the one open empirical variable, gated honestly in the edge capacity benches (alm_tree_depth_vs_n, cold_join_burst_latency, CIRISEdge PR#147).

And what a "blob" costs dominates the supply side. 50 kbps is edge's BLINKING_DOT — a low-res video thumbnail; a literal presence dot is far cheaper, which decides whether the room needs prosumer fat interior or rides ordinary asymmetric home uplinks:

At a true presence dot (~5 kbps) the room needs ~20 Gbps total — ordinary asymmetric homes (~10 Mbps up each) sum to it with no datacenter. At a 50 kbps video thumbnail it needs ~200 Gbps — real prosumer/home-server fat interior, or it collapses back toward centralization. The "presence at scale" claim is strongest precisely because presence is cheap.

vs the state of the art

Sources: Meet 49-tile cap, mediasoup ~500 consumers/core, SFU cascading, SFrame (E2E media). The honest framing: this isn't a bigger gallery — it's a different mode. An SFU can't show you the ambient presence of a 2,000-person room at all; the fabric makes that the primitive, end-to-end encrypted, scaling by peers instead of servers. Whether a given room sustains it is the donated-uplink question (MODEL) above, not a crypto one.

Where this sits among decentralized projects

Against the centralized incumbents the contrast is the 49-tile cap (above). Against the decentralized field, the distinction is scope: the others are mature, excellent, single-purpose layers; CEWP is the (pre-1.0) attempt at the whole stack — transport + durable storage + realtime-at-scale + self-governance — and 100% post-quantum.

Composes, not only competes. CEWP runs on Reticulum transport today, and can piggyback IPFS / Veilid / Iroh as blob-bootstrap & cache substrates (CIRISPersist#147). The distinctive claim isn't beating any one layer — it's the whole stack in one post-quantum substrate, with realtime presence-at-scale and self-governance that none of the others attempt together. (Honest caveat: those projects are production-deployed at scale; CEWP is RC-grade.) Sources: Reticulum vs IPFS/Nostr/SSB (HN), Iroh vs libp2p, decentralized-apps guide.

How

Guaranteed mesh characteristics — build the UX against these

The envelope the substrate guarantees, with provenance. A UX can rely on these directly — what a device renders at a given downlink, how presence degrades, what survives node churn — without re-deriving the physics.

Is the crypto in the way? No — here's the measurement. MEASURED

Per-frame the post-quantum cost is structurally zero (bulk is AES-256-GCM); the PQ cost is a one-time handshake per peer-link. The numbers, single-core, in-memory:

A 50-person 30 fps room is ~0.49% of one core to receive (open-only) and ~0.27% to publish. Fan-out (inner-once/outer-N):

Membership-rekey PROJECTED · CIRISEdge#129 flat O(N) vs tree O(log N) per join/leave:

Store spine: hybrid trace ingest 194.36 µs (~5,145 traces/s/core); re-delivery saves only ~9.3% (verify runs before dedup — replay is verify-bound by design, the AV-9-safe choice). Levers: pre-verified relay path + batch verify (CIRISPersist#225).

Live mesh (bridge) — A↔B federation bring-up ATTESTED

Provenance: real two-node bridge mesh — Node A ciris-canonical-trio-1-3v2kb7tbvs (lens/seed) ↔ Node B ciris-status-1 (status). Substrate floor: edge v7.0.0 / persist v10.0.0 / verify v7.2.0. Measured: 2026-06-22. These numbers are not reproducible on a CI runner (no two-node mesh in CI); they are attested with source node identity and date. CI criterion numbers (MEASURED badge) are separate and always runner-local.

Capacity scoring — capacity:sustained_coherence:v1

Node A derives per-agent n_eff from ingested agent traces: builds the 11-dimensional lens constraint feature matrix → Jacobi eigendecomposition → participation ratio n_eff_pr → capacity(n_eff_pr, gate=20, target=8) → [0,1] score → emits a hybrid-signed scores CEG attestation (capacity:sustained_coherence:v1). Node B receives the attestation via consent:replication:v1. The per-agent per-cadence-tick CPU cost of this pipeline is CI-measured in the N_eff scoring bench (n_eff_e2e/500) — see the substrate metrics above.

The capacity score VALUE depends on the corpus (agent traces ingested). With a thin corpus (<20 traces) the gate returns 0.0 honestly — a zero-row means "observed but not yet scored", not "missing". A corpus that clears the gate yields a score in [0,1].

Cohort propagation — FountainSwarmRuntime ATTESTED

Each node runs the SAME ciris_edge::swarm::FountainSwarmRuntime that src/holonomic.rs wires into production. The publisher's cohort closure is derived from replication_peers_from_consent(…) — ONLY consented peers. Propagation and group-B isolation numbers below come from the examples/mesh_propagation/main.rs in-process driver on bridge-mesh hardware (in-memory bus = swarm LOGIC + cohort gate, not wire transport):

Group-B isolation = 0 is structural, not statistical. Structural — the publisher's cohort closure is derived from replication_peers_from_consent(...), which returns ONLY consented peers. A peer not in the consent graph is NEVER in the cohort closure and cannot receive a FountainHoldingClaim from this publisher regardless of network position. Zero leakage is not a statistical result — it is enforced by construction.

Replication A↔B — consent:replication:v1

Bidirectional mutual-key-registered replication; each node owns its own corpus. Node A's imported agent traces replicate to Node B; Node A's capacity:sustained_coherence:v1 scores are served via Node B. CPU cost per replicated trace: replication_ingest criterion bench (CI-MEASURED): ~4,336 traces/s/core (fresh), ~4,859/s/core (dedup path).

Holonomic storage — survival of the replicated corpus MODEL

The same holographic property runs the "store" half: content is fountain-split into symbols, any sufficient subset reconstructs. Policy N=20 K=6 H=30; overhead 1.5× (vs ~5× whole-copy). Survival P(Binomial(H,q) ≥ N) — computed, reproducing scale_model v0.7. The reconstruction itself is no longer assumed: tests/chaos_mesh.rs drives edge v4.2.0's own fountain codec (codec-fountain) — really encoding content into H=30 holders, killing a third, and rebuilding it byte-identical — MEASURED at 99.6% from any 20/30 (33% loss) and 100% from 21/30 (RaptorQ's small reception overhead at the exact floor). The q-curve below stays MODEL — it's the swarm-availability assumption, not the codec:

A live node recomputes survival from measured q + observed holders and alarms under the 99% floor.

Substrate — MEASURED (through the fabric) MEASURED

Promoted from this run's criterion benches — each value traces to a real bench result (group/id), not a modeled target:

The remaining substrate metrics and the holonomic tier are explicit gated stubs (not fabricated — no bench grounds them yet):

• substrate (remainder) — gated on no MLS-commit / cold-join-latency bench yet (the five throughput/scoring metrics above are measured through the fabric when criterion results are supplied): mls_commit_barrier, cold_join_burst_latency
• holonomic — gated on fountain/holonomic API wiring (CIRISServer#11) + CIRISRegistry#88 composite model: wholeness_witness_reconciliation, alm_topology_compute, recursive_trust_bootstrap_walk, swarm_rarity_convergence

Benchmarked against the field — per layer

No single "PQC streaming" suite exists, so each layer is held next to its recognized reference.

Provenance & honesty

• MEASURED rows are single-core in-memory criterion microbenches (AEAD-bound); over-the-wire deployment is NIC/kernel/Reticulum-bound. Absolute µs are host-relative; ratios travel.
• MODEL rows are bandwidth arithmetic over edge FEDERATION_SCALING_MODEL.md bitrate anchors (720p30≈2.5 Mbps, blinking-dot≈50 kbps, relay egress≈150 Mbps/core) — not a live N-node test.
• The blob path ships today via AV1 SVC base layers. Full symmetric M>2 MDC video is FRONTIER — the wire/substrate ships; the production codec (NeuralMDC-class) does not exist yet. M=2 is the production default.
• 100% hybrid PQC, hard cut — Ed25519+ML-DSA-65 sigs, X25519+ML-KEM-768 KEM, no classical-only path.
• Membership-change rekey is PROJECTED from the real hybrid-KEM primitive (CIRISEdge#129 not yet implemented); steady-state video is unaffected.