Demo mode — every action is simulated in-browser against a self-contained mock. Set NEXT_PUBLIC_API_BASE to point the same client at the live SS-26 / SS-01 / SS-10 APIs.

Edge routes & WAF

The Envoy edge in front of the fabric: TLS, JWT validation, WAF, per-tenant rate limits and weighted canaries. The only public entrypoint (SS-07).

6Routes

4WAF on

1Canary

TrustMesh=falseEdge posture

The edge verifies the SS-01 JWT and strips inbound claim headers so a caller cannot forge identity; east-west is mTLS.