A better internet, without big tech and massive datacenters.

The dark sphere is Earth, drawn ocean-first with continent outlines in cyan from the public-domain Natural Earth 110m land dataset. The faint blue grid is latitude and longitude. Above the surface sit two kinds of node dots and one kind of arc, and which ones are drawn depends on the mode you picked.

Orange dots are the roughly fourteen hyperscale metros that host most of today’s internet substrate (AWS, Azure, GCP, Meta, Apple). Pale yellow dots are the top hundred-plus population metros, sized by how many people live there. Cyan halos around each metro suggest the CEWP server density (one server per ten humans, peppered across where the humans actually are).

Yellow particles flowing along orange arcs are bytes in the centralized topology: every metro funnels its traffic toward its nearest hyperscale facility, which is exactly what today’s internet does. Cyan particles on shorter edges are bytes in CEWP: they travel along the trust graph (small-world, with metro locality bias) rather than through any central party. The same submarine cables run underneath both modes, drawn faintly. Same fiber. Different middle.

The numbers panel reads a steady-state model of the federation. For each tier (client, proxy/L0 server, L1 server) the model computes how much storage that tier holds, how much bandwidth it moves per day, and how much CPU it burns. Then it multiplies by how many of that tier exist at the user count you picked.

The load-bearing formula is the same one the Rust toy uses:

effective_R       = trust_radius * trust_multiplier(depth)
daily_admitted    = effective_R * daily_bytes * publishable_cohort
trust_budget      = 0.85 * (disk_budget - own - traces)
retention_days    = trust_budget / daily_admitted
admitted_held     = daily_admitted * retention_days   (capped)
inbound_bw        = daily_admitted + daily_fetch * (1 - cache_hit)
fanout            = 1 + narrow_cohort*4 + wide_cohort*64
outbound_bw       = daily_bytes * fanout

Each server only holds bytes from its effective trust set (direct trust R, expanded by the recursion depth knob via small-world overlap), and only for as long as the disk budget allows. There’s no archive-vs-cache distinction in v0.3; both push and pull terminate at the same gate, and bytes that earn demand stay while everything else gets evicted when newer or more popular content arrives.

Per-server feasibility is checked against three hard gates: one terabyte of disk, one gigabit per second of bandwidth (which is ten point eight terabytes per day), and one full CPU core. The ✓ or ⚠ next to each per-server stat tells you whether the scenario fits.

• Users sets how many people are on the federation. Log scale from a thousand to five billion. Federation rollups multiply per-server numbers by this.
• Daily bytes per user is what each person produces in a day across all their content. Text scenarios are kilobytes; video scenarios are tens of megabytes.
• Daily fetch bytes per user is what each person consumes — reading, watching, scrolling. Drives bandwidth and cache pressure.
• Trust radius (direct R) is how many other people each person directly trusts. Around 150 is the Dunbar number.
• Trust depth (server) is how far past direct trust the server walks before admitting content. 0 is strict (direct only); 1 means friend-of-friends; 3 starts to feel like the open internet. Each hop expands the admittable source set by roughly 4x at depth 1, 20x at depth 2, 100x at depth 3.
• Cache hit rate is the fraction of fetches served from local cache. Tight communities give you 85% easily; loose global content with long tails sits closer to 30%.
• Cohort locality moves the cohort_scope distribution between local-heavy (mostly self/family/community traffic) and global-heavy (most traffic species/planet/federation scope). Local-heavy is the CEG locality dividend at work.
• Server disk budget is the disk each L1 server brings to the federation. The retention number falls out of this: more disk means content sits longer before eviction.

The single most surprising number in the model is that something like sixty-five percent of typical activity never leaves the metro. That is not a routing optimization. It falls out of the wire format itself.

In CEG, content that’s scoped self or family never emits the holds_bytes:sha256:* attestation that would tell the rest of the federation it exists. So no peer can request it. So the trust gate is never reached. So the bytes never flow.

Local content is local because the wire format will not carry it. You don’t need a privacy policy to keep your family photos off Facebook; you can’t accidentally publish them in the first place. That is what “structural” means in the README’s claim that CEWP makes the centralized internet’s failure modes structurally unavailable.

This page is a thin scaffold. It runs the same analytic formulas as the Rust toy at CIRISNodeCore / examples / scale_model.rs and draws a hand-picked dataset on the globe. The real CEWP simulation engine is a separate Rust workspace specified in CEWP / FSD / SIMULATION_ENGINE.md.

That engine runs both topologies at the same time over the same real-world data: PeeringDB for facilities and IXPs, CAIDA for AS-level peering, TeleGeography for submarine cables, GeoNames for metro populations. It scales from one thousand agents in the browser to five billion at 1:1 on a GPU cluster, and emits a snapshot stream in the format the rendering layer here already consumes.

When that engine lands, the hand-picked dataset gets swapped for snapshot frames produced by the engine. The globe stays the same; the math gets the full topology underneath.

The model is honest about its inputs. Every per-operation cost is a measured benchmark from the substrate sister repos, not a guess.

• hybrid_sign 466 microseconds — Ed25519 + ML-DSA-65, from CIRISVerify v2.8.0 BENCHMARKS
• hybrid_verify 276 microseconds — same source
• AES-GCM at 64 KiB blocks: 5.45 GiB/s encrypt, 5.91 GiB/s decrypt
• dispatch_inbound under 400 microseconds from CIRISEdge v0.10.0 BENCHMARKS
• Persist row write around 1.5 milliseconds from CIRISPersist v3.3.0
• H3ERE trace per agent decision around 14 kilobytes from CIRISPersist INTEGRATION_LENS

If you build a version of the substrate that is faster or slower, the math here moves with it. Nothing is hard-coded as a claim about “CEWP can do this” — it is always “at these measured costs, the federation looks like this.”

CEWP is the platform identity for the seven repos of CIRIS Agent 3.0. Each has a specific role; the platform is what they become together.

Substrate sisters handle bytes, crypto, and transport: CIRISVerify, CIRISPersist, CIRISEdge.

Fabric sisters handle federation semantics, detection, and spec: CIRISNodeCore, CIRISLensCore, CIRISRegistry.

Agent runtime + unified client: CIRISAgent (the H3ERE reasoning pipeline plus the UI users interact with).

All seven cohabit in one process at CIRIS 3.0 deployments. The substrate runs on commodity hardware down to a Jetson Orin home box and scales to the full internet on roughly one server per ten humans. No datacenters required.