One trusted fabric.Four members (OMEGA, Alpha, Iota, and Tarragon) use mutual TLS 1.3 with the Slipstream fabric owner. The owner's single runtime contains membership authority, local inventory, and Positronic's aggregated telemetry. A browser on OMEGA reads only OMEGA's loopback API with a separate browser token. nucleus ALPHA 0.2 / LOGICAL TOPOLOGY One trusted fabric. A shared view of your machines. IDENTITY, MEMBERSHIP & TELEMETRY Implemented prototype / November 01, 2026 01 / 03 OMEGA WSL / local member Alpha alpha.wphyperdrive.com Iota iota.parallaxws.com Tarragon tarragon.app Local read-only API Browser bearer token Local browser view / OMEGA The map reads its own node's loopback API. MUTUAL TLS 1.3 / TELEMETRY + FABRIC VIEW FABRIC OWNER Slipstream slipstream.host Membership authority Fabric CA + approved nodes Separate CA and node keys Positronic Heartbeats + shared view Includes owner inventory One Nucleus runtime on this host One runtime per node. The fabric shares membership, health and resource inventory.
Logical topology

One trusted fabric.

A shared view of your machines.

LOCAL BROWSER VIEW / OMEGAResource map

Reads OMEGA's loopback API using a separate browser bearer token.

Local read-only API
OMEGA

WSL / local member

Alpha

alpha.wphyperdrive.com

Iota

iota.parallaxws.com

Tarragon

tarragon.app

Mutual TLS 1.3Telemetry + fabric view
FABRIC OWNERSlipstream

slipstream.host

Membership authority

Fabric CA + approved nodes. Separate CA and node keys.

Positronic

Heartbeats + shared view, including the owner's inventory.

One Nucleus runtime on this host

One runtime per node. The fabric shares membership, health and resource inventory.

ALPHA 0.2 / IMPLEMENTED PROTOTYPE
November 01, 2026
Private reachability.Alpha, Iota, and Tarragon reach Slipstream using a reverse SSH forward into OMEGA, then a local SSH forward to Slipstream's loopback coordinator. OMEGA initiates both SSH connections. Nucleus mutual TLS remains end-to-end between member and owner, and no public Nucleus listener is exposed. nucleus ALPHA 0.2 / PROTOTYPE TRANSPORT Private reachability. End-to-end node identity. IDENTITY, MEMBERSHIP & TELEMETRY Implemented prototype / November 01, 2026 02 / 03 END-TO-END NUCLEUS mTLS 1.3 The forwarding bridge does not terminate this session. Remote members Alpha / Iota / Tarragon Nucleus member Loopback tunnel endpoint OMEGA Local forwarding bridge OpenSSH client Loopback forwarding path Slipstream Fabric owner Nucleus owner Loopback coordinator + API SSH -R SSH -L OMEGA initiates both SSH connections. Arrows show telemetry traffic; the fabric view returns over the same path. No public Nucleus listener.
Prototype transport

Private reachability.

End-to-end node identity.

End-to-end Nucleus mTLS 1.3
Remote member ↔ Slipstream
REMOTE MEMBERSAlpha / Iota / Tarragon

Nucleus member

Loopback tunnel endpoint

SSH -R
OMEGA

Local forwarding bridge

OpenSSH client

Forwards the inner TLS session without terminating it.

SSH -L
FABRIC OWNERSlipstream

Nucleus owner

Loopback coordinator + API

OMEGA initiates both SSH connections.
Arrows show telemetry traffic; the fabric view returns over the same path.

No public Nucleus listener.
ALPHA 0.2 / IMPLEMENTED PROTOTYPE
November 01, 2026
Explicit pairing.The owner sends a signed expiring one-use invitation. The joining node accepts it and returns a signed certificate request. The owner inspects and approves, then issues a signed grant and membership certificate. The joining node verifies and accepts membership before mutual TLS telemetry begins. Private keys remain on their originating machines. nucleus ALPHA 0.2 / SECURE ENROLLMENT Explicit pairing. Verified at both ends. IDENTITY, MEMBERSHIP & TELEMETRY Implemented prototype / November 01, 2026 03 / 03 Slipstream / fabric owner Node key + separate fabric CA key Joining node Own persistent identity key TRUSTED OUT-OF-BAND EXCHANGE Signed documents travel through an existing trusted channel. 01 Signed invitation Pinned authority + expiring, one-use secret Accept invitation 02 Signed certificate request Joining node proves possession of its key Owner inspects + approves 03 Signed grant + membership certificate Bound to the pending request and joining node Verify + accept membership 04 Mutual TLS telemetry begins Private keys stay on their originating nodes. Certificates establish membership.
Secure enrollment

Explicit pairing.

Verified at both ends.

OWNERSlipstream

Node key + separate fabric CA key

JOINING NODENew member

Own persistent identity key

Signed documents travel through an existing trusted out-of-band channel.

  1. 01
    Owner → joining node

    Signed invitation

    Pinned authority + expiring, one-use secret.

    Joining node accepts invitation
  2. 02
    Joining node → owner

    Signed certificate request

    Proves possession of the joining node's key.

    Owner inspects + approves
  3. 03
    Owner → joining node

    Signed grant + membership certificate

    Bound to the pending request and joining node.

    Joining node verifies + accepts membership
  4. 04

    Mutual TLS telemetry begins

    Both endpoints prove their identity.

Private keys stay on their originating nodes. Certificates establish membership.

ALPHA 0.2 / IMPLEMENTED PROTOTYPE
November 01, 2026
Nucleus Alpha 0.2 / Architecture collection