▸ Core

Node Operators

Overview

Node operators are the foundational infrastructure providers of the INCOG Mesh Network. By contributing relay routing capacity through dedicated hardware or virtual infrastructure, node operators enable the decentralized routing architecture that underpins the network's privacy guarantees. In exchange for this contribution, node operators receive monthly $INCOG token issuance proportional to their verified participation.

The node operator model is designed to achieve three properties simultaneously:

Sufficient routing capacity to support the browser's privacy routing needs without degraded performance
Sufficient geographic distribution to provide meaningful jurisdictional diversity in relay path construction
Sufficient economic incentive to sustain long-term operator participation without requiring altruistic contribution

Operator Classes

The INCOG Mesh Network supports three operator classes, differentiated by hardware capability, network bandwidth contribution, and participation tier:

Tier 1: Home Router Nodes

Home router nodes are INCOG-certified consumer hardware devices installed in residential or small-office networks. These devices:

Connect to an existing broadband connection
Contribute a configurable portion of available upstream bandwidth to relay routing
Operate primarily as middle relay nodes (not entry or exit nodes)
Require minimal configuration via the INCOG node management interface
Are optimized for continuous operation (low power draw, passive cooling)

Home router nodes represent the long tail of the network's geographic distribution. A dense deployment of home router nodes across diverse jurisdictions significantly improves the relay path diversity available for routing.

Tier 2: Dedicated Relay Hardware

Dedicated relay hardware is purpose-built or repurposed server hardware operated by technically sophisticated participants. These nodes:

Operate on dedicated network connections with committed bandwidth
Can serve as entry nodes (if the operator meets guard node eligibility requirements) or exit nodes
Operate with higher uptime expectations (99.5% or greater)
Can contribute substantially higher throughput than home router nodes

Tier 3: Data Center / Cloud Nodes

Cloud-hosted or colocation nodes operated by participants with professional infrastructure expertise. These nodes:

Provide high-availability relay capacity with SLA-backed uptime
Are particularly valuable as exit nodes due to stable IP address ranges and professional abuse handling
Contribute the bulk of raw routing throughput
Are subject to enhanced verification requirements to prevent Sybil-type concentration

Hardware Layer

INCOG-Certified Router Hardware

The INCOG protocol specifies a certification profile for router hardware that defines minimum hardware requirements for protocol compliance:

Minimum hardware specification (Tier 1)

Dual-core ARM or x86 processor at 1.0GHz or greater
512MB RAM minimum, 1GB recommended
WAN port with 100Mbps minimum throughput
Hardware random number generator for cryptographic operations
Persistent storage for relay state and cryptographic key material
Secure boot capability (recommended)

Network requirements

Static or DDNS-stable IP address for directory listing
NAT traversal capability (UPnP or manual port mapping) for non-DMZ deployments
Minimum 10Mbps dedicated upstream capacity for relay participation

Software Architecture

INCOG relay node software runs as a hardened daemon on certified hardware. The software stack:

Operates in a constrained execution environment with minimal OS footprint
Does not log traffic content — only metadata required for reward verification (connection counts, throughput bytes, uptime)
Generates cryptographic attestations of relay activity for the reward verification system
Updates automatically via a signed OTA mechanism
Exposes a local management interface for configuration and monitoring

Key Management

Each relay node generates a unique long-term identity keypair at initialization. This keypair:

Identifies the node in the relay directory
Signs relay capability announcements
Is used in the authenticated key exchange protocol with browser clients
Is stored in hardware-isolated key storage where supported by the device

The long-term identity key is distinct from session keys used in per-connection encryption, maintaining forward secrecy for relay sessions.

Operator Registration

On-Chain Registration

Node operators register their nodes on-chain through the INCOG relay registry contract. Registration involves:

Identity commitment: The operator submits the node's long-term public key and a cryptographic commitment to the node's network address
Holder verification: The operator demonstrates $INCOG token holding above the minimum threshold (exact threshold determined by governance)
Capability attestation: The node software generates a signed capability attestation confirming hardware and network specifications
Registry inclusion: Following verification, the node is included in the relay directory and becomes eligible for relay path selection and reward issuance

Operator Identity

The INCOG protocol does not require operators to disclose personal identity. Operator registration is pseudonymous — linked to an on-chain address and node keypair, not to real-world identity. This design reflects a recognition that node operators themselves have privacy interests that the protocol should protect.

However, the pseudonymous registration does create on-chain accountability: malicious or defective operator behavior can be attributed to the registered on-chain identity and penalized within the protocol's reward mechanism.

Uptime and Performance Requirements

Uptime Expectations

Node participation in reward calculation requires sustained availability. The protocol calculates a rolling uptime score based on:

Successful response to periodic liveness probes from the relay directory system
Peer-reported availability from adjacent relay nodes that have routed through the node
Self-reported operational metrics from the node's cryptographic attestation

Minimum uptime thresholds for reward eligibility:

Tier 1 home nodes: 95% monthly uptime (allows for ISP outages and maintenance)
Tier 2 dedicated nodes: 99% monthly uptime
Tier 3 data center nodes: 99.5% monthly uptime

Nodes falling below tier-appropriate minimums are excluded from reward calculations for the period of degraded availability. Extended underperformance triggers directory de-listing until the operator restores compliance.

Throughput Verification

Reward calculation incorporates verified throughput contribution. Throughput is measured through:

Cryptographic attestations from the node's relay software reporting bytes relayed per time period
Cross-validation against adjacent node attestations (entry and exit nodes in paths that traversed the node)
Statistical sampling by the relay directory's verification infrastructure

Throughput attestations are signed with the node's long-term identity key, making them attributable and verifiable. Forged throughput attestations would require compromise of the node's keypair, which would also compromise the node's relay security — creating a strong disincentive against manipulation.

Reward Distribution

Reward Calculation

Monthly $INCOG rewards are calculated from a reward pool allocated to relay network participation. The distribution algorithm weights:

Throughput contribution (primary factor)
Bytes relayed per period, cross-validated against adjacent node attestations. Higher throughput earns proportionally higher rewards.

Uptime score
A multiplier applied to the throughput contribution, capped at 1.0 for nodes meeting tier-appropriate uptime requirements and declining below 1.0 for nodes failing to meet thresholds.

Geographic diversity bonus
Nodes operating in underrepresented geographic regions or jurisdictions receive a diversity multiplier. This incentivizes global distribution of routing capacity rather than concentration in high-bandwidth regions.

Node class weighting
Different node tiers carry different base multipliers reflecting their contribution to network resilience and relay path quality. Exit nodes carry additional weighting reflecting their operational overhead.

Distribution Mechanism

Rewards are distributed on a monthly cycle. The calculation:

node_reward = (node_throughput / total_network_throughput)
            × uptime_multiplier
            × geographic_multiplier
            × class_weight
            × monthly_reward_pool

Rewards are distributed programmatically from the protocol's reward contract, which is funded from the allocated relay incentive pool in the $INCOG token supply. Operators claim rewards by submitting signed attestation bundles to the reward contract, which verifies the attestations and releases the appropriate allocation.

Operator Obligations and Protocol Rules

Operator Obligations

By registering as a node operator, participants commit to:

Maintaining hardware and software in a state compliant with the node software specification
Not modifying node software in ways that degrade relay privacy properties
Not using the relay node to log or inspect the content of relay traffic
Not operating multiple nodes under a single registration to artificially inflate throughput metrics
Maintaining the on-chain registration in good standing, including minimum token holding

Protocol Violations

The protocol defines penalties for demonstrable violations of operator obligations:

Forged attestations: De-listing from relay directory and forfeiture of pending rewards
Sybil registration (multiple nodes under a single identity): Reduction in reward eligibility proportional to detected duplication
Traffic interference: Immediate de-listing and referral to protocol governance for further action

The enforcement mechanism relies on cryptographic attestation cross-validation — forged or manipulated attestations produce inconsistencies detectable by the verification system.

Voluntary Exit

Node operators may voluntarily exit the network at any time by:

Removing the node from active relay path eligibility (setting availability to zero in the capability announcement)
Waiting for existing relay circuits through the node to expire
Submitting a de-registration transaction to the relay registry

Voluntarily exited nodes receive prorated rewards for the period they were active in the final month.

View original documentation