Foundation

The Living Network

FrogNet derives the network from what is actually reachable. Nodes discover, route, elect services, split and heal without asking applications to understand the topology.

Current implementation: FD&F and the network path

Local operation.

A LAN-only FrogNet uses its local discovery and merge path. It can discover members, establish routes and select eligible service hosts without Internet access. Ordinary Ethernet, Wi-Fi and radio bearers supply connectivity; the same application state model sits above them.

A local lillypad is not necessarily the whole pond. It may become part of several scoped networks. Preserve the distinction between a local served LAN and the scopes in which that LAN participates.

Region operation.

In region mode, fdf-facts and fdf-client publish the node’s own state. FD&F owns discovery. The graph and daemon own route decisions and application; the old recursive crawl does not run for region membership.

The published state includes addresses, lease pairs, uplink observations, region tunnel facts, capabilities and generation. A generation changes only for a change that matters to the network plan. Others read it through the region.

Change is an input, not a reason to restart the world.

The region watch delivers membership, facts and mapping changes. One world read and one kernel WireGuard snapshot feed each event. The daemon replans and applies locally. It does not launch runMerge for each region event; runMerge remains on boot and interface changes.

r19-a15 makes both hosts-file writers use the same leaf-naming facts. Before that correction, a later runMerge could erase the PC or phone’s name even though the device remained a member.

Loss and reconstruction.

A clean session close is observed quickly. Silent death depends on TCP liveness settings and the path. The newer five-second keepalive configuration measured roughly four seconds in a namespace experiment, with more false deaths under higher packet loss. That tradeoff is not a universal convergence bound.

Transient application RAM and FD&F’s membership manager are different services. A new application RAM host means an application-world change and reconstruction. A restarted region manager ends and recreates member sessions. Read the failure contracts.

The broker transition.

The October 11 tree still contains broker-era code and installer dependencies. FD&F already drives region membership and hub routing. The October 12 cleanup proposes removing the broker and fixing fresh-install, key-generation and packaging dependencies; it is not a completed release in the evidence reviewed here.

Use the implemented baseline when deciding which commands or operational promises apply.

Discovery

Nodes learn reachable FrogNet hosts recursively. Reachability and measured RTT feed route construction.

Specification: §4 Discovery and membership · §4a Triggering and the merge controller

Routing

Routes are per destination. A lower-latency indirect path can beat a direct one. Healthy incumbents are held to prevent needless churn.

Specification: §5 Addressing and routing

Split and heal

A partition becomes independent ponds using what each side can still reach. Restored connectivity triggers discovery; discovery converges on the newly reachable topology.

Specification: §6 Pond formation, split and heal · §13 Failure and recovery

Seattle pond Internet brokerWireGuard transit · not network authority New York pond 900 MHz bearer
A pond continues locally when the WAN path disappears. When connectivity returns, discovery runs again and converges on what is reachable.

The Internet extension is part of the path, not the authority.

Specification: §7 Internet extension and broker · §12 Security and trust boundaries

The current broker publishes channel information and provides WireGuard transit between sites. Nodes pull the published channel list and update their local broker state from it. The broker does not push commands into the pond and does not own application Memory.

Security boundary: every cross-site packet using the broker path transits the broker, and a live broker compromise can expose traffic at the forwarding seam. FrogNet limits the consequence by keeping authority and valuable persistent state out of the broker: it is not the Memory store, application database, naming authority or service-election authority. Loss of the broker leaves each surviving pond able to operate locally. See the complete boundary and mitigation.

Linux is visible.

FrogNet uses the operating system instead of pretending it is an appliance abstraction.

Specification: §3 Node, identity and installation · §18 Implementation considerations

Interfaces, routing tables, dnsmasq, WireGuard, processes, systemd services, filesystem state and kernel networking remain inspectable by the operator. The simulator models the same mechanisms so topology and discovery-convergence work can be exercised before physical deployment.

Persistent node identity is separate from mutable address and route state. Ponds, choruses, nodes and tunnels are distinct scopes in the current implementation.

Recorded field evidence

Multi-city network

Qualified

Ten-node development network spanning multiple cities and heterogeneous paths.

900 MHz

Qualified

A FrogNet radio node remained on the mesh while moving through Queens.

Physical actuation

Qualified

A value changed in New York travelled through the Seattle state path and caused a lamp in New York to change state.