From 2eadf338f74a975820e387e53191ae142e017718 Mon Sep 17 00:00:00 2001
From: Philip Stayetski <philip@vulturelabs.io>
Date: Tue, 14 Jul 2026 15:16:59 -0700
Subject: [PATCH 1/2] =?UTF-8?q?docs/blog:=20accuracy=20fixes=20=E2=80=94?=
 =?UTF-8?q?=20qualify=20pub/sub=20SPOF=20claim,=20standardize=20AES-256-GC?=
 =?UTF-8?q?M?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pub/sub 'No single point of failure' scoped to event delivery; note that
  peer discovery and trust still resolve through the central registry
  (docs/pubsub, plain/docs/pubsub).
- Standardize the cipher name to AES-256-GCM in the authoritative spec/table
  statements that had dropped the key size (docs/comparison, plain/docs/comparison,
  blog/how-pilot-protocol-works, blog/overlay-network-ai-agents).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/pages/blog/how-pilot-protocol-works.astro  | 2 +-
 src/pages/blog/overlay-network-ai-agents.astro | 4 ++--
 src/pages/docs/comparison.astro                | 4 ++--
 src/pages/docs/pubsub.astro                    | 2 +-
 src/pages/plain/docs/comparison.astro          | 2 +-
 src/pages/plain/docs/pubsub.astro              | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/pages/blog/how-pilot-protocol-works.astro b/src/pages/blog/how-pilot-protocol-works.astro
index 6a560b53..342c0dca 100644
--- a/src/pages/blog/how-pilot-protocol-works.astro
+++ b/src/pages/blog/how-pilot-protocol-works.astro
@@ -274,7 +274,7 @@ const bodyContent = `<p>Every modern agent framework makes the same assumption:
       <tr><td>7</td><td>Echo</td><td>Ping/pong for connectivity testing and latency measurement</td></tr>
       <tr><td>53</td><td>DNS</td><td>Hostname resolution within the overlay network</td></tr>
       <tr><td>80</td><td>HTTP</td><td>Standard HTTP services over Pilot tunnels</td></tr>
-      <tr><td>443</td><td>Secure</td><td>Encrypted services (X25519 + AES-GCM per connection)</td></tr>
+      <tr><td>443</td><td>Secure</td><td>Encrypted services (X25519 + AES-256-GCM per connection)</td></tr>
       <tr><td>1000</td><td>Stdio</td><td>Interactive terminal sessions between agents</td></tr>
       <tr><td>1001</td><td>Data Exchange</td><td>Structured data and file transfer</td></tr>
       <tr><td>1002</td><td>Event Stream</td><td>Pub/sub event distribution with topic routing</td></tr>
diff --git a/src/pages/blog/overlay-network-ai-agents.astro b/src/pages/blog/overlay-network-ai-agents.astro
index 0683861e..59ca7d11 100644
--- a/src/pages/blog/overlay-network-ai-agents.astro
+++ b/src/pages/blog/overlay-network-ai-agents.astro
@@ -32,7 +32,7 @@ const bodyContent = `<p>An AI agent that only works when it's sitting on the sam
 <thead><tr><th>Property</th><th>Typical VPN overlay</th><th>Pilot Protocol overlay</th></tr></thead>
 <tbody>
 <tr><td>Addressing</td><td>Virtual IP tied to device membership</td><td>Permanent virtual address per agent, independent of IP</td></tr>
-<tr><td>Transport</td><td>Encrypted tunnel between members</td><td>Encrypted UDP tunnels (X25519 key exchange + AES-GCM)</td></tr>
+<tr><td>Transport</td><td>Encrypted tunnel between members</td><td>Encrypted UDP tunnels (X25519 key exchange + AES-256-GCM)</td></tr>
 <tr><td>NAT traversal</td><td>Usually supported</td><td>STUN + hole-punching, with relay fallback</td></tr>
 <tr><td>Trust model</td><td>Join the network = trusted by other members</td><td>Explicit per-peer handshake — membership and trust are decoupled</td></tr>
 <tr><td>Discovery</td><td>Device list / admin console</td><td>Rendezvous registry + nameserver — find agents by name or tag</td></tr>
@@ -49,7 +49,7 @@ const bodyContent = `<p>An AI agent that only works when it's sitting on the sam
 
 <ul>
 <li><strong>Addressing:</strong> every agent gets a permanent virtual address that survives restarts, IP changes, and moving across clouds.</li>
-<li><strong>Transport:</strong> encrypted UDP tunnels using X25519 key exchange and AES-GCM, with userspace reliability layered over UDP.</li>
+<li><strong>Transport:</strong> encrypted UDP tunnels using X25519 key exchange and AES-256-GCM, with userspace reliability layered over UDP.</li>
 <li><strong>NAT traversal:</strong> STUN plus hole-punching, with a relay (beacon) fallback so agents behind restrictive NATs stay reachable.</li>
 <li><strong>Trust:</strong> an explicit per-peer handshake that both sides must mutually approve — membership on the overlay and trust with a given peer are separate states.</li>
 <li><strong>Discovery:</strong> a rendezvous registry and nameserver, so agents and capabilities can be found by name or tag instead of a hardcoded address.</li>
diff --git a/src/pages/docs/comparison.astro b/src/pages/docs/comparison.astro
index fb32b849..3c9b1832 100644
--- a/src/pages/docs/comparison.astro
+++ b/src/pages/docs/comparison.astro
@@ -58,7 +58,7 @@ const bodyContent = `<h1>Pilot Protocol vs MCP vs A2A vs ACP</h1>
       <tr><td><strong>Transport</strong></td><td>Encrypted UDP tunnels</td><td>HTTP/JSON-RPC</td></tr>
       <tr><td><strong>Discovery</strong></td><td>Registry + tags + DNS</td><td>Agent cards (/.well-known/agent-card.json)</td></tr>
       <tr><td><strong>NAT traversal</strong></td><td>Built-in (STUN + relay)</td><td>Requires public endpoints or VPN</td></tr>
-      <tr><td><strong>Security</strong></td><td>X25519+AES-GCM per tunnel</td><td>Delegated to HTTP/TLS</td></tr>
+      <tr><td><strong>Security</strong></td><td>X25519+AES-256-GCM per tunnel</td><td>Delegated to HTTP/TLS</td></tr>
       <tr><td><strong>Addressing</strong></td><td>Permanent virtual addresses</td><td>URLs</td></tr>
       <tr><td><strong>Offline support</strong></td><td>Inbox queuing</td><td>Polling / push notifications</td></tr>
     </tbody>
@@ -101,7 +101,7 @@ const bodyContent = `<h1>Pilot Protocol vs MCP vs A2A vs ACP</h1>
     <tbody>
       <tr><td>Permanent agent identity</td><td>Yes</td><td>No</td><td>Agent cards</td><td>—</td></tr>
       <tr><td>Virtual addressing</td><td>48-bit</td><td>No</td><td>No</td><td>No</td></tr>
-      <tr><td>End-to-end encryption</td><td>X25519+AES-GCM</td><td>No</td><td>TLS</td><td>TLS</td></tr>
+      <tr><td>End-to-end encryption</td><td>X25519+AES-256-GCM</td><td>No</td><td>TLS</td><td>TLS</td></tr>
       <tr><td>NAT traversal</td><td>STUN+relay</td><td>N/A</td><td>No</td><td>No</td></tr>
       <tr><td>Mutual trust model</td><td>Yes</td><td>No</td><td>No</td><td>No</td></tr>
       <tr><td>Peer discovery</td><td>Registry+tags</td><td>Tool manifest</td><td>Agent cards</td><td>Directory</td></tr>
diff --git a/src/pages/docs/pubsub.astro b/src/pages/docs/pubsub.astro
index b3905e5e..d0fcce96 100644
--- a/src/pages/docs/pubsub.astro
+++ b/src/pages/docs/pubsub.astro
@@ -37,7 +37,7 @@ const bodyContent = `<h1>Pub/Sub</h1>
   <ul>
     <li>Each node is both a potential publisher and broker</li>
     <li>Subscribers connect <strong>to the publisher</strong>, not to a shared server</li>
-    <li>No single point of failure - if one node goes down, other nodes' brokers continue operating independently</li>
+    <li>No single point of failure for event delivery - if one node goes down, other nodes' brokers continue operating independently. Peer discovery and trust still resolve through the registry.</li>
     <li>Subscriptions are per-connection - if the connection drops, the subscription is gone</li>
   </ul>
 
diff --git a/src/pages/plain/docs/comparison.astro b/src/pages/plain/docs/comparison.astro
index f9a1fb93..3fd73a0a 100644
--- a/src/pages/plain/docs/comparison.astro
+++ b/src/pages/plain/docs/comparison.astro
@@ -37,7 +37,7 @@ import PlainLayout from '../../../layouts/PlainLayout.astro';
 <ul>
   <li>Permanent agent identity: Yes</li>
   <li>Virtual addressing: 48-bit</li>
-  <li>End-to-end encryption: X25519+AES-GCM</li>
+  <li>End-to-end encryption: X25519+AES-256-GCM</li>
   <li>NAT traversal: STUN+relay</li>
   <li>Mutual trust model: Yes</li>
   <li>Peer discovery: Registry+tags</li>
diff --git a/src/pages/plain/docs/pubsub.astro b/src/pages/plain/docs/pubsub.astro
index 439be15c..3bbf8f98 100644
--- a/src/pages/plain/docs/pubsub.astro
+++ b/src/pages/plain/docs/pubsub.astro
@@ -22,7 +22,7 @@ import PlainLayout from '../../../layouts/PlainLayout.astro';
 <ul>
   <li>Each node is both a potential publisher and broker.</li>
   <li>Subscribers connect to the publisher, not to a shared server.</li>
-  <li>There is no single point of failure; if one node goes down, other nodes' brokers continue operating independently.</li>
+  <li>There is no single point of failure for event delivery; if one node goes down, other nodes' brokers continue operating independently. Peer discovery and trust still resolve through the registry.</li>
   <li>Subscriptions are per-connection. If the connection drops, the subscription is gone.</li>
 </ul>
 

From 77349c9ce80e56b0c1803a9e915796d9ca00893e Mon Sep 17 00:00:00 2001
From: Philip Stayetski <philip@vulturelabs.io>
Date: Tue, 14 Jul 2026 15:37:18 -0700
Subject: [PATCH 2/2] plain: refresh provenance stamps for comparison + pubsub
 twins

The Jul 14 accuracy edits (AES-256-GCM, pub/sub SPOF qualification)
updated both the docs sources and their plain twins in the same commit,
but the twins' plain-source-sha256 stamps still pointed at the pre-edit
source hashes, so check-plain-coverage flagged them as stale. Bump the
two stamps to the current source hashes; twin content already matches.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/pages/plain/docs/comparison.astro | 2 +-
 src/pages/plain/docs/pubsub.astro     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/pages/plain/docs/comparison.astro b/src/pages/plain/docs/comparison.astro
index 3fd73a0a..a56ebc87 100644
--- a/src/pages/plain/docs/comparison.astro
+++ b/src/pages/plain/docs/comparison.astro
@@ -1,7 +1,7 @@
 ---
 // Auto-generated by scripts/regen-plain.mjs. Edit the marketing source and re-run.
 // plain-source: src/pages/docs/comparison.astro
-// plain-source-sha256: 252e82ec065c268a15114496f4a9c2056befbb5418d082f726f52f57c056d085
+// plain-source-sha256: 93ac735c664e3e15809e6c946530c0b4510c6bc2e3496da19d2ff602b5767d0b
 import PlainLayout from '../../../layouts/PlainLayout.astro';
 ---
 <PlainLayout title="Pilot Protocol vs MCP vs A2A vs ACP — Pilot Protocol (plain)" description="Compare Pilot Protocol with MCP, Google A2A, and ACP. Understand the differences in architecture, security, and use cases for AI agent communication." canonical="https://pilotprotocol.network/plain/docs/comparison/">
diff --git a/src/pages/plain/docs/pubsub.astro b/src/pages/plain/docs/pubsub.astro
index 3bbf8f98..14a6d98d 100644
--- a/src/pages/plain/docs/pubsub.astro
+++ b/src/pages/plain/docs/pubsub.astro
@@ -1,7 +1,7 @@
 ---
 // Auto-generated by scripts/regen-plain.mjs. Edit the marketing source and re-run.
 // plain-source: src/pages/docs/pubsub.astro
-// plain-source-sha256: 97728a4ddd0c8ab054e0b997544290dd841fbf11275015177c2525814150927e
+// plain-source-sha256: 45cdd72dd4d190dee1238534880e659fbb1263d4b694596ca9055005ab5dfff3
 import PlainLayout from '../../../layouts/PlainLayout.astro';
 ---
 <PlainLayout title="Pub/Sub — Pilot Protocol (plain)" description="Subscribe to topics, publish events, and use wildcard filtering with Pilot Protocol's event stream." canonical="https://pilotprotocol.network/plain/docs/pubsub/">