Standards reference
Every standard Nexus Atlas implements, follows, borrows an idea from or deliberately departs from, keyed to the configuration key or API surface it touches. The relationship words mean the same as on the engineering site’s standards page, which keeps the full descriptions; the reasons behind each departure are on its design decisions page.
The four relationships. Implements: Atlas speaks it on the wire or produces its format. Follows: Atlas uses its classification or vocabulary. Borrows the idea: the mechanism is Atlas’s, the insight is the document’s. Departs from: Atlas does it differently, by decision.
The list
| Standard | Relationship | In Atlas | Config / API | Explained |
|---|---|---|---|---|
| Noise Protocol Framework | Implements | Every session is a Noise IK handshake; the primitive set behind it is a build-time choice. | [crypto] · atlasd keygen | Cryptography |
| RFC 7748 | Implements | Key agreement in every handshake. | [interface] private_key · [[peer]] public_key | Cryptography |
| RFC 8439 | Implements | Authenticated encryption of every datagram and of the end-to-end seal. | [crypto] e2e, e2e_require | Cryptography |
| RFC 7693 | Implements | The hash in the handshake and in key derivation. | [crypto] | Cryptography |
| RFC 8489 | Implements | Netcheck classifies every link by STUN against the relay's two addresses. | [traversal] stun_servers · GET /api/netcheck | Netcheck |
| RFC 4787 | Follows | Per-link NAT classification is reported in these terms. | GET /api/netcheck | Netcheck |
| RFC 8445 | Departs from | Candidates and checks are exchanged through the mesh's own rendezvous; endpoint-dependent NAT pairs stay relayed instead of attempting port prediction. | [traversal] punch, punch_links | Hard NAT pairs · Hole punching |
| RFC 2474 | Follows | Classification reads CS6/CS7, EF, AF41 and CS1 first. | QoS classifier rules (DSCP first) · GET /api/qos | The six classes |
| RFC 3758 | Borrows the idea | Deadline delivery is timed reliability per packet, with the budget set per class or derived from the bond's own round trips. | [qos] deadline_k, deadline_floor_ms, deadline_ceil_ms · dropped_late | Lineage · Tempo |
| RFC 7496 | Borrows the idea | Backlog shedding admits the newcomer and abandons lower-priority backlog, counted per class. | [qos] backlog_bytes · dropped_aqm | Lineage · Triage |
| RFC 8655 | Borrows the idea | Replication, elimination and explicit routes are borrowed; per-flow reservation is deliberately not. | [routing] path_redundancy, [[routing.static_path]] | Lineage · No reservation |
| IEEE 802.1 TSN | Departs from | Atlas works above the bearers and does not schedule the medium; diversity across bearers is its mechanism. | — | No reservation |
| RFC 2328 | Borrows the idea | The mesh floods link-state adverts and runs Dijkstra on every node; the flood is paced per bearer and carries positions and names. | [mesh] · [link_monitor] · GET /api/stats topology | Control plane |
| RFC 1624 | Implements | The interconnect seam repairs IPv4, TCP and UDP checksums this way when it maps addresses. | [peer.interconnect] | Interconnect |
| RFC 8446 | Departs from | No negotiation on the wire: one suite and one protocol version across a fleet, by decision. | [crypto] | No negotiation |
| RFC 5424 | Implements | Link, session and configuration events are exported as syslog or CEF. | [syslog] | Telemetry |
| RFC 9116 | Implements | Every Nexus Atlas website serves one, pointing at the same disclosure policy. | /.well-known/security.txt | Disclosure |
| CycloneDX | Implements | Every release ships one, and the binaries embed their own dependency manifest. | release bom.json | Supply chain |
| SLSA v1.0 | Implements | Releases carry Level 3 provenance beside keyless signatures. | release provenance attestation | Supply chain |
| FIPS 140-3 | Departs from | The default build runs the Noise suite above; a validated-module build mode is a labelled certification track. | — | Certification tracks · No negotiation |
| STANAG 4609 / MISB ST 0601 | Follows | Carried unchanged; the design page states why frame-to-record alignment belongs in the stream, not in the transport. | — | Alignment |