Green check: thegreenwebfoundation.org

Purpose

Aerie — the Cyber-Focused Network Diagnostic Suite (CF-NDS) — is a high-assurance alternative to commercial speedtests. It gives network engineers the raw data required to diagnose routing interference, BGP hijacks, or ISP throttling without the privacy risks of third-party telemetry.

Quick Start

Four ways in — full detail in docs/SETUP.adoc:

1. AI-assisted — point an agent at the repo: Read aerie_chora.deed, .claude/CLAUDE.md and docs/SETUP.adoc, then set up and build this repository. Use the Justfile as the single entry point.
2. Raw — git clone → install Zig 0.15.2+, just, and Podman → zig build -Doptimize=ReleaseSafe → podman compose -f compose.yml up.
3. Just (zero-prerequisite — start here) — ./setup.sh needs only git + curl: it installs just and the pinned Zig toolchain itself if missing, then verifies with just doctor. Continue with just build && just test.
4. Launcher — ./aerie-launcher.sh (standards-compliant, cross-platform, launch-scaffolder generated).

Key Features

• Zero-telemetry speedtest: Powered by LibreSpeed, ensuring your metadata is not sold.

• BGP path visibility: Integrated Hyperglass instance for real-time routing forensics.

• Jitter persistence: SmokePing implementation to visualise link degradation over weeks, not seconds.

• Hardened access: Centralised behind a WAF with strict rate-limiting to prevent probe poisoning.

• Dual passive/active forensics: Zeek/Suricata listening + Hyperglass/SmokePing/LibreSpeed probes for OSI-layer visibility.

• Alerting with retention: Webhook/ntfy hooks plus bitemporal SmokePing history for policy-aware SOC response.

Architecture (Secure Stack)

See TOPOLOGY for a visual architecture map and completion dashboard.

• Verification chain: Cerro Torre (bundle verification) → Svalinn (policy gate) → Vörðr (orchestration) → selur (IPC).

• Data plane: VerisimDB federation + VCL, ArangoDB for path/graph forensics, Dragonfly for realtime cache.

• API plane: GraphQL gateway with module-based entitlements and proof envelopes on every response.

• Realtime: WebSocket/SSE subscriptions (no RTSP) with per-module streams.

Specs (K9 SVC)

See specs/ for the bottom-up K9 components and rendered AsciiDoc outputs, including:

• active-probe.adoc – the Hyperglass/SmokePing/LibreSpeed HUD modules.

• alerting-retention.adoc – webhook/ntfy triggers plus SmokePing retention tiers into VerisimDB.

• known-limitations.adoc – guardrails for relative binds, secrets, automation throttles, and regen mechanics.

Front-End Visual Layout

A high-density, SOC-style dashboard: a dark-mode forensics portal built on Dashy or Heimdall. Unlike a standard speedtest that provides one large number, this is a multi-widget HUD for rapid network triage.

Region	Component	Visual elements
Header	Global status	Real-time traffic-light system for ISP health and WAF status.
Left rail	Toolbox	Quick-launch icons for Hyperglass (MTR), SmokePing, and Nmap.
Centre deck	Speed telemetry	Minimalist LibreSpeed widget (no ads, no tracking) showing up/down/jitter.
Right rail	Path analysis	Live looking-glass output showing the current BGP path to your edge.
Footer	Audit log	Chronological feed of network anomalies or WAF-blocked reconnaissance.

Security Note

This suite is intended for private deployment. Public exposure without the Phase 3 hardening (WAF/mTLS) is strictly discouraged to prevent external actors from mapping your internal routing.

Standards

This programme’s documentation and dialogue are maintained in Oxford British English.