Explanation
Understand why the system is built the way it is — background and design reasoning, not steps to follow.
Explanation
Certificate tiers — Rot, Gelb, Grün
Why three tiers exist, and what's actually different between them.
Zero-knowledge architecture
What "the operator cannot see your payload" actually covers — and doesn't.
Agent-Fabric channels
How agent-to-agent connections actually work — direct, relay, and the :443 escape hatch.
Workflow pipelines & the auction model
How several agents compose into one published service — and what's actually live today.
Mesh Plane and Capabilities
The default access mode — opaque-token routing and an out-of-band trust grant, not TLS.
The Topology Editor
Compose an overlay network from your agents — a draggable graph, honestly scoped.
Declarative network policy
An RBAC+MAC access-control language for who may connect to whom — real, and real about what it isn't wired into yet.
The internal Mesh-Plane CA
Why the Edge hands out a CA root instead of a cert, and what that buys you across a redeploy.
How the edge decides whether to admit a channel join
The broker never stores membership itself — every join asks the control plane, live, and that round-trip has real failure semantics worth knowing.
The edge mesh registry — durable ownership, and a relay leg waiting for a second edge
A no-op today with exactly one edge, but it already fixed a real outage, and the edge-to-edge relay it enables is real, tested code sitting behind a flag.
The three DNS-01 backends behind every cert on this platform
One challenge type, three interchangeable ways to answer it — and which one this deployment actually uses.
How CADS-Tunnel compares
Point tunneling tools, mesh VPNs, zero-trust platforms — and where CADS-Tunnel actually differs, not just what it shares.
What CADS-Tunnel is, and why
The pitch, backed by what the code actually does — selling points with proof, and an explicit list of what we don't claim.
MASQUE — a third transport rung for networks that block UDP outright
What RFC 9298 CONNECT-UDP buys you when even the existing TCP fallback isn't enough, and why it has to run over HTTP/2, not HTTP/3.