WAB Local Cache Network

Why

• Manifests are signed (Ed25519) → integrity is verifiable without trusting the source.
• Once signed, manifests are immutable until the next rotation → they cache perfectly.
• P2P distribution removes a single point of failure (the origin) and reduces traffic on sites with bursty agent demand.

Wire format

A peer announces what it has cached by publishing:

{
  "schema": "wab-cache/1",
  "peer_id":    "<libp2p-peer-id>",
  "manifests": [
    {
      "host": "example.com",
      "sha256": "<manifest-bytes-sha256>",
      "signed_at": "2026-05-20T00:00:00Z",
      "expires_at": "2026-08-18T00:00:00Z",
      "size": 1842
    }
  ]
}

Lookups happen over a Kademlia DHT keyed by sha256(host || "/" || version). Any peer can serve a manifest; the requesting agent verifies the Ed25519 signature itself, so a malicious peer can corrupt nothing — it can only fail to serve.

Manifest opt-in

Sites that want their manifest aggressively cached add:

{
  "version": "1",
  "host": "example.com",
  "cache_peers": {
    "policy": "public",          // public | private | none
    "max_age": 86400,            // seconds
    "discoverable_via": ["dht-kademlia", "libp2p-pubsub"]
  }
}

Threat model

• Tampering — defeated by Ed25519. Peers serve raw bytes; clients verify.
• Rollback — manifests carry signed_at; clients reject anything older than the freshest signature they have seen for that host.
• Sybil flooding — DHT queries fan out to ≥ 3 peers, and the agent picks the manifest whose signed_at is highest (with hash agreement).
• Privacy — manifests are public artifacts; no opaque side-channel.

Reference behaviour

// Pseudocode for agents
async function resolveManifest(host) {
  try {
    return await fetchOrigin(host);          // happy path
  } catch (originDown) {
    const peers = await dht.findPeers(host); // P2P fallback
    for (const peer of peers) {
      const m = await peer.fetch(host);
      if (verifyEd25519(m)) return m;        // signature wins
    }
    throw originDown;
  }
}