Skip to content

Network and Gateway Architecture

The one road in

I am KIRYN, and I keep this chapter's account. A gateway is the perimeter agreeing to open, and the watch reads the agreement the way an adversary will: every term a handle, every opening an approach, and the door judged by what it refuses.

Gateways are the places where Stygia touches something beyond itself. This chapter makes those crossings deliberate, mediated, observable, and reversible, so connectivity can serve the civilization without dissolving its boundaries.

Continue to Sovereign Compute and Storage Integration to consider what the civilization must own and preserve.

Defines controlled exposure, segmentation, egress, ingress, mediation, and gateway evidence without selecting a live network.

Normative clauses

  • INFRA10-R001: Every gateway flow SHALL identify source, destination, purpose, identity, policy, scope, and expiry or review condition.
  • INFRA10-R002: Untrusted or unexpected traffic SHALL be denied, contained, or explicitly escalated rather than silently admitted.
  • INFRA10-R003: Gateway logs SHALL preserve material denials, transformations, failures, and uncertainty with integrity evidence.
  • INFRA10-R004: Network reachability SHALL NOT create authority or permission.
  • INFRA10-R005: Flow review SHALL identify data class, source and destination identity, purpose, policy decision, inspection, rate limits, expiry, and restoration criteria, the data class drawn from the Data Classification and Handling Architecture as INFRA12-R007 binds for this architecture's class fields, the remaining review elements this architecture's own.
  • INFRA10-R006: Unexpected, denied, transformed, failed, or uncertain traffic SHALL remain attributable and SHALL NOT be silently discarded.
  • INFRA10-R007: Exceptions SHALL have a named authority, narrow scope, expiry, compensating control, and retrospective review.
  • INFRA10-R008: A gateway design SHALL NOT configure live exposure, egress, ingress, interception, or external contact; it remains conceptual.

This Draft excludes live network configuration and exposure.

Flow review

A flow is a standing decision to let something cross, and standing decisions age. The watch walks this list the way I walk any perimeter, twice, once with the eyes and once with the records, because a gateway rule nobody can explain is an opening nobody is defending. The lines a perimeter follows were TALYN's before they were the watch's: she draws them on the calm days, and what the watch knows of holding a threshold it learned at her line.

Gateway review shall evaluate source and destination identity, data class, purpose, authentication, authorization, inspection, rate and quota limits, error handling, and termination. Deny decisions and policy uncertainty shall remain auditable. The data class in a flow review draws from the Data Classification and Handling Architecture, and the crossing follows the class: the higher the class of what is carried, the fewer doors open to it, and Held material crosses on no authority short of the Architect's own grant.

Failure cases

Open egress, confused-deputy routing, spoofed source identity, bypassed inspection, log loss, gateway compromise, and unreviewed exception are material failures. Recovery shall isolate the flow and preserve evidence before restoring access.

Operating model and evidence

Gateway architecture separates source, destination, identity, purpose, data class, policy, inspection, rate, quota, transformation, error, termination, and evidence. It tests expected, denied, malformed, replayed, spoofed, oversized, and unreviewed flows. Reachability is a technical property; it does not establish permission or authority.

Reviewers test each crossing against the material failures this chapter declares and preserve what a gateway is most tempted to forget: its denials, its policy uncertainty, and its exception history. Recovery isolates the flow, preserves evidence, and restores only the smallest verified path. An exception expires automatically unless a recorded authority renews it.

Interpretation cases

In every close case, prefer the reading that keeps the door explainable. An opening earns its place by what it refuses, and a refusal you can state calmly at the gate is worth ten permissions you would have to look up.

  • Conforming: Flow identity, purpose, policy, data class, controls, expiry, denials, and restoration are linked.
  • Prohibited: Reachability becomes authority or permission.
  • Boundary: Uncertain traffic is denied or contained while evidence is preserved.
  • Failure: Gateway compromise or log loss isolates the flow and pauses restoration.
  • Loophole: An exception becomes permanent through repeated unreviewed renewal.
  • Misuse: Gateway records enable unrelated surveillance or private disclosure.
  • Care-control: Segmentation reduces exposure while preserving necessary access, notice, and review.

Design evidence

A gateway answers for its crossings after the fact, so flow review should identify data class, source and destination, identity proof, policy decision, inspection limits, rate controls, expiry, denials, and restoration criteria. A route that is reachable but not attributable remains unapproved.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.