Trust by design.

Every driver fetched from the online registry carries an ed25519 signature over its full 248-byte descriptor. The firmware verifies that signature against a public key pinned in NVS before the descriptor touches the bus.

Tampered, replayed, or unsigned drivers are silently rejected. Verified descriptors are cached in the on-chip /drvcache SPIFFS partition so the next boot is offline.

The TOSS Wire Protocol (TWP v2) puts a CRC-16 in every frame. Frames that fail CRC are dropped before they ever reach a handler.

A 32-entry origin-based dedup ring keyed on origin_mac + seq blocks replay attempts across the relay graph. TTL decrements on every hop, so nothing bounces forever.

Sensor nodes only speak ESP-NOW. They have no IP stack, no DHCP, no port to scan. Only the elected gateway has a WiFi STA connection, and it serves a local-only MCP server.

The setup portal is CSRF-protected, rate-limited with exponential backoff, and idle-times-out after 10 minutes. Holding BOOT for 5 seconds wipes WiFi creds and the auth key from NVS.

WiFi credentials, the mesh auth key, and the driver public key sit in the ESP32 NVS partition. With NVS encryption enabled at provisioning, they're hardware-encrypted at rest.

No identifiers leave the device. No accounts. No analytics. Outbound HTTPS only to a configurable driver registry that serves signed blobs and asks for nothing in return.

An LLM talks to the mesh through MCP tool calls — read a sensor, write an actuator, list capabilities. The gateway dispatches each call through the local driver manager.

No raw frame injection. No driver swaps from a tool call. In a real install you pick which actuators the agent is allowed to write to, and the scope is enforced every call.